Training Material For

ZXC10 CDMA Cellular Mobile

Communication System

ZTE Corporation
February 2003
 Preface

The global mobile communications market is booming. There are about 250 million users
worldwide and should be nearly l billion by early next century. Code Division Multiple Access
(CDMA) is the fastest-growing digital wireless technology, tripling its worldwide subscriber base
between 1997 and 1998. There are already 30 million CDMA customers and, at the current growth
rate, there will be 50 million by the millennium. The major markets for CDMA are North America,
Latin America, and Asia (particularly China, Japan and Korea). In total, CDMA has been adopted
by almost 50 countries around the world.

It is not hard to see the reasons for the success of CDMA. CDMA is m advanced digital
technology that can offer about 7 to 10 times the capacity of analog technologies and up to 6 times
the capacity of digita1 technologies such as Time Division Multiple Access (TDMA). The speech
quality provided by CDMA systems is far superior to any other digital cellular technology,
particularly in difficult radio environments such as dense urban areas and mountainous regions. In
both initial deployment and long-term operation, CDMA provides the most cost-effective solution
for cellular operators. After an 18-month of market rollout, Personal Communications Services
(PCS) providers have adequately demonstrated the power of CDMA technology to support a
marketing strategy based on low prices and superior performance in key areas such as voice
quality, system reliability, and handset battery life.

CDMA service providers have a strong advantage when pursuing the market to the minutes-
of-use model, given the longevity of CDMA handset battery life and the higher quality of the
voice signal. A recent analysis of wireless platform performance by the Telecommunications
Research and Action Center (TRAC) found that CDMA outperformed other digital and analog
technologies on every front, including signal quality, security, power consumption, and reliabi1ity.
Although analog technology came out ahead in availability, all three digital services (GSM, IS-136
TDMA, and IS-95 CDMA) were rated equally over analog with respect to availability of enhanced
service features. The TRAC study found CDMA to be superior in signal security and voice quality
over the other digital air interface standards. According to TRAC, CDMA has several advantages
for consumers. Lower power consumption enables CDMA handsets to support up to 4 hours of
talk time or 48 hours of standby time on a single battery charge. It has also been found that the
soft-handoff characteristics of CDMA lead to fewer dropped calls than with GSM and IS- 136
TDMA. One possible drawback for some CDMA customers is that there are some limitations on
roaming capabilities. Some PCS operators with cellular affiliates are supporting dual-mode
handsets to allow roaming between CDMA and analog platforms.

The CDMA technology is constantly evolving to offer customers new, advanced services.
The mobile data speeds offered through CDMA phones are increasing, and new voice codecs
provide speech quality close to wireline. Internet access is now available through CDMA
terminals. The time will soon be at hand when CDMA service providers can further exploit the
enhanced service potential of their platforms. There has ken much talk of so-called third
generation (3G) data capabilities, where PCS providers will be able to compete with wireline
service providers at high access speeds. PCS providers are looking ahead toward providing a range
of service categories such as Internet and intranet access, multimedia applications, high-speed
business transactions, and telemetry. The CDMA network offers operators a smooth evolutionary
path to 3G mobile systems.

The opportunity to use the CDMA platform to add a fixed wireless service feature represents
an added advantage for operators. Because CDMA has ample spectrum to provide a fixed service
on top of mobile, several operators are exploring using terminals that would be able to shift the
handset between fixed and mobile service, depending on where the user is. The universal handset
would serve as a cordless phone in the home and as a mobile handset outside the home. The
evolution to 3G will open the wireless local loop (WLL) with Public Switched Telephone Network
(PSTN) and Public Data Network (PDN) access, while providing more convenient control of
applications and network resources. It will also open the door to convenient global roaming,
service portability, zone-based ID and billing, and global directory access. The 3G technology is
even expected to support seamless satellite interworking.

CDMA is the selected approach for the 3G system, as evidenced by the proposals submitted
by the European Telecommunications Standards Institute (ETSI). The Association Radio Industry
Business (ARIB), and the Telecommunications Industry Association (TIA). The 3G cdma200O
uses a CDMA air interface based on the existing IS-95B standard to provide wireline-quality voice
service and high-speed data services, ranging from 144 kbps for mobile users to 2 megabits per
second (Mbps) for stationary users. It is important to note that cdma2000 is a core proposal of the
TIA for International Mobile Telecommunications-2000 (IMT-2000).

This book can be divided into three parts: Chapters 1 through 7 provide a foundation for
understanding the material in subsequent chapters. Chapters 8 through 21 deal with mainly the
products and solutions of ZTE CDMA, including the products at the radio side, at the switching
side, and the layered network management center ZXCOMC. It also introduces the services,
network planning and network optimization of ZTE cdma2000 1x. Chapters 22 and 23 mainly
describe the typical configuration and networking modes of BTS system on the basis of ZTE
products. It finally analyzes the typical cases of the application of ZTE products in WLL and
cdma2000 1x, including deep coverage and wide coverage.

Chapter 1. A comprehensive knowledge concerning the development of the wireless

communications, the development trend of mobile communication systems, and ZTE’s research
and development.

Chapter 2. Basic working principles of CDMA, including basic principle of Spread spectrum
communication and some basic concepts of CDMA, and the characteristics of mobile channels.

Chapter 3. A general idea of IS-95 System, including a general description of the forward /
reserve channels and air interface standards.

Chapter 4. The working principle of the wireless part of cdma2000 1xRTT and its circuit
domain and packet domain.

Chapter 5. Some basic principles and development about 3G, centering on cdma2000 1x EV-
DO.

Chapter 6. The smooth evolution scheme from ZTE cdma2000 BSS side to the all-IP, the
hardware composition and typical configurations of the all-IP cdma2000 BS and the performance
features of ZTE all-IP scheme.

Chapter 7. The key techniques and advantages of the CDMA system.

Chapter 8. The network structure and its interfaces of the CDMA cellular mobile
communication system, and the corresponding technical standards of the system, the technical
indexes, software and hardware system structures he networking and configuration modes of ZTE
ZXC10−MSC/VLR/SSP, and its services and functions.

Chapter 9. ZXC10-HLR/AUC (V3.0)

Chapter 10. CDMA Short Message Center (ZXSC100)

Chapter 11. The software and hardware structure and function of the ZXC10-BSS, including
the external interfaces of the system, the overall structure and technical indices of the system, the
software structure of the system, and the networking mode and system configuration.

Chapter 12. The technical indexes, hardware architecture, product characteristics and
networking modes & configuration of ZXCBTS M800 and ZXCBTS M190 systems.

Chapter 13. The technical indexes, hardware architecture, product characteristics and
networking modes & configuration of ZXCBTS R800 and ZXCBTS R190 systems.

Chapter 14. Technical indexes, hardware architecture, product characteristics and networking
modes and configuration of ZXRPT-C800 system.

Chapter 15. The technical indexes, hardware architecture, product characteristics and
networking configuration mode of ZXICS C800 and ZXICS C801 systems.

Chapter 16. The wide and deep coverage solutions of ZTE’s CDMA system.

Chapter 17. A description of the ZTE CDMA-WLL solution.

Chapter 18. ZXPDSS Packet Switching System

Chapter 19. A description of the protocols, the standards, the technical specifications, the
system architecture and the networking configuration modes of the ZTE hierarchic centralized
network management center (ZXCOMC).

Chapter 20. ZTE cdma2000 1x Services.

 Chapter 21. ZTE Network Planning and Optimization Solution.

Chapter 22. Typical WLL networking and configuration with reference to ZXC10-BSS
(V5.0) and then gives typical examples.

Chapter 23. Networking Configuration Analysis with typical cdma2000 1x Cases.

Appendix A comprises a list of abbreviations.

Appendix B FAQ.
 Contents

CONTENTS

CHAPTER 1 WHY CDMA?..................................................................................................................1

INTRODUCTION......................................................................................................................................1

1.1 DEVELOPMENT OF MOBILE COMMUNICATIONS AND BRIEF HISTORY OF CDMA ..........................1

1.2 EVOLUTION OF CDMA STANDARDS AND THE THIRD GENERATION (3G) MOBILE
COMMUNICATIONS............................................................................................................5

1.3 ANALYSIS AND PROSPECT OF CDMA MARKET.............................................................................10

EXERCISE 14

CHAPTER 2 PRINCIPLES OF THE CDMA SYSTEM .................................................................15

INTRODUCTION....................................................................................................................................15

2.1 OVERVIEW......................................................................................................................................15

2.2 BASIC CONCEPTS OF THE CDMA SYSTEM....................................................................................16

2.3 FEATURES OF THE CDMA CELLULAR MOBILE COMMUNICATION NETWORK...............................18

2.4 PRINCIPLES OF SPREAD SPECTRUM COMMUNICATION...................................................................19

2.5 WALSH CODE, M SEQUENCE AND M SEQUENCE...........................................................................22

2.6 PROPERTIES OF MOBILE CHANNELS..............................................................................................24

2.7 BRIEF INTRODUCTION TO SPEECH CODING TECHNIQUE................................................................28

EXERCISE 30

CHAPTER 3 IS-95 SYSTEM PRINCIPLES.....................................................................................31

INTRODUCTION....................................................................................................................................31

3.1 IS-95 SYSTEM OVERVIEW..............................................................................................................31

3.2 AIR INTERFACE STANDARDS OF IS-95 SYSTEM.............................................................................33

i
Contents

3.3 SIGNAL DESIGN OF FORWARD LINKS.............................................................................................34

3.4 SIGNAL DESIGN OF THE REVERSE LINK.........................................................................................37

EXERCISE 39

CHAPTER 4 PRINCIPLES OF CDMA2000 1X RTT......................................................................41

INTRODUCTION....................................................................................................................................41

4.1 ENHANCEMENT OF CDMA2000 1XRTT PERFORMANCE.................................................................41

4.2 SPREADING RATE AND RADIO CONFIGURATION............................................................................43

4.3 TYPES AND STRUCTURES OF THE CHANNELS................................................................................44

4.4 WORKING PRINCIPLE OF THE CDMA2000 1XRTT CIRCUIT-SWITCHING DOMAIN.........................63

4.5 OPERATION MECHANISM OF THE CDMA2000 1X PACKET DOMAIN...............................................79

EXERCISE 99

CHAPTER 5 EVOLUTION OF CDMA2000 1X EV AND ZTE HRPD SOLUTION.................100

INTRODUCTION..................................................................................................................................100

5.1 EVOLUTION OF CDMA2000 RADIO-SIDE STANDARDS..................................................................100

5.2 EVOLUTION FROM ZTE CDMA TO 1X EV..................................................................................115

EXERCISE 116

CHAPTER 6 EVOLUTION OF CDMA2000 BS-SIDE AND ZTE ALL-IP SOLUTION............118

INTRODUCTION..................................................................................................................................118

6.1 SMOOTH EVOLUTION OF ZTE CDMA2000 ALL-IP BSS SIDE......................................................120

6.2 NETWORK FRAMEWORK AND HARDWARE COMPOSITION OF ZTE ALL-IP CDMA2000...............122

EXERCISES 145

CHAPTER 7 KEY TECHNIQUES AND ADVANTAGES OF CDMA.........................................147

INTRODUCTION..................................................................................................................................147

ii
 Contents

7.1 OVERVIEW OF THE KEY TECHNIQUES..........................................................................................147

7.2 ADVANTAGES OF THE CDMA SYSTEM........................................................................................159

EXERCISES 164

CHAPTER 8 ZXC10-MSC/VLR/SSP (V3.0)...................................................................................168

INTRODUCTION..................................................................................................................................168

8.1 OVERVIEW....................................................................................................................................168

8.2 TECHNICAL INDICES OF ZXC10-MSC/VLR/SSP AND SOFTWARE STRUCTURE AND HARDWARE

STRUCTURE OF ZXC10-MSC/VLR..............................................................................176

8.3 ZXC10-SSP SYSTEM STRUCTURE...............................................................................................240

8.4 ZXC10-MSC/VLR/SSP FUNCTION.............................................................................................250

8.5 ZXC10-MSC/VLR/SSP NETWORKING AND CONFIGURATION....................................................269

EXERCISE 278

CHAPTER 9 ZXC10-HLR/AUC (V3.0)...........................................................................................279

9.1 OVERVIEW....................................................................................................................................279

9.2 ZXC10-HLR/AUC INDICES........................................................................................................287

9.3 ZXC10-HLR/AUC SYSTEM HARDWARE STRUCTURE................................................................291

9.4 SOFTWARE STRUCTURE OF THE ZXC10-HLR/AUC....................................................................318

9.5 ZXC10-HLR/AUC SERVICE FUNCTION......................................................................................366

9.6 ZXC10-HLR/AUC NETWORKING AND CONFIGURATION ............................................................386

EXERCISE 391

CDMA SHORT MESSAGE CENTER (ZXSC100)........................................................................392

9.7 OVERVIEW...................................................................................................................................392

9.8 ZXSC100 PERFORMANCE INDICES.............................................................................................395

9.9 HARDWARE ARCHITECTURE OF ZXSC100.................................................................................398

iii
Contents

9.10 ZXSC100 SOFTWARE STRUCTURE............................................................................................422

9.11 ZXSC100 SERVICE FUNCTIONS................................................................................................481

9.12 ZXSC100-GW CDMA-GSM INTERWORKING SHARED GATEWAY AND INDEPENDENT SHORT

MESSAGE SYSTEM.........................................................................................................525

9.13 ZXSC100 NETWORKING AND CONFIGURATION.......................................................................532

EXERCISE 537

CHAPTER 10 ZXC10-BSS................................................................................................................539

OBJECTIVES 539

INTRODUCTION..................................................................................................................................539

10.1 OVERVIEW OF THE BASE STATION SYSTEM .............................................................................539

10.2 TECHNICAL INDICES OF BSS......................................................................................................559

10.3 HARDWARE STRUCTURE OF BSS...............................................................................................562

10.4 ARCHITECTURE OF BSS SOFTWARE...........................................................................................608

10.5 NETWORKING MODE AND TYPICAL CONFIGURATION...............................................................632

EXERCISES 640

CHAPTER 11 MICRO BTS.............................................................................................................642

OBJECTIVES 642

INTRODUCTION..................................................................................................................................642

11.1 OVERVIEW.................................................................................................................................642

11.2 ZXCBTS M800 TECHNICAL SPECIFICATIONS...........................................................................643

11.3 ZXCBTS M190 TECHNICAL SPECIFICATIONS...........................................................................648

11.4 HARDWARE ARCHITECTURE OF ZXCBTS CDMA MICRO BTS ...............................................652

11.5 ZXCBTS CDMA MICRO BTS PRODUCT CHARACTERISTICS....................................................653

11.6 NETWORKING MODE AND SYSTEM CONFIGURATION................................................................655

iv
 Contents

EXERCISES 662

CHAPTER 12 REMOTE RF UNIT..................................................................................................663

OBJECTIVES 663

INTRODUCTION..................................................................................................................................663

12.1 OVERVIEW..................................................................................................................................663

12.2 ZXCBTS R800 TECHNICAL SPECIFICATIONS............................................................................665

12.3 ZXCBTS R190 TECHNICAL SPECIFICATIONS............................................................................669

12.4 HARDWARE STRUCTURE OF THE REMOTE RF UNIT....................................................................673

12.5 PRODUCT FEATURES OF THE REMOTE RF UNIT..........................................................................676

12.6 NETWORKING MODE AND SYSTEM CONFIGURATION................................................................676

EXERCISES 681

CHAPTER 13 ZXRPT-C800.............................................................................................................683

OBJECTIVES 683

INTRODUCTION..................................................................................................................................683

13.1 ZXRPT-C800 CHARACTERISTICS..............................................................................................683

13.2 ZXRPT-C800 TECHNICAL SPECIFICATIONS...............................................................................684

13.3 HARDWARE STRUCTURE OF ZXRPT-C800................................................................................685

13.4 ZXRPT-C800 NETWORKING MODE..........................................................................................687

EXERCISES 687

CHAPTER 14 ZTE CDMA INDOOR DISTRIBUTION SYSTEM..............................................689

OBJECTIVES 689

INTRODUCTION..................................................................................................................................689

14.1 OVERVIEW..................................................................................................................................689

v
Contents

14.2 HARDWARE STRUCTURE OF THE INDOOR DISTRIBUTION SYSTEM.............................................689

14.3 NETWORKING MODES AND SYSTEM CONFIGURATION..............................................................700

EXERCISES 709

CHAPTER 15 ZTE CDMA WIDE AND DEEP COVERAGE SOLUTIONS..............................710

OBJECTIVES 710

INTRODUCTION..................................................................................................................................710

15.1 ZTE CDMA WIDE COVERAGE SOLUTION.................................................................................710

15.2 ZTE CDMA DEEP COVERAGE SOLUTION.................................................................................716

EXERCISES 725

CHAPTER 16 ZTE CDMA-WLL SOLUTION..............................................................................727

INTRODUCTION..................................................................................................................................727

16.1 CDMA-WLL CHARACTERISTICS...............................................................................................727

16.2 ZTE CDMA-WLL SOLUTION....................................................................................................728

EXERCISES 730

CHAPTER 17 ZXPDSS PACKET SWITCHING SYSTEM.........................................................731

17.1 SYSTEM OVERVIEW...................................................................................................................731

17.2 CDMA2000-1X PACKET DATA SWITCHING NODE (ZXPDSS-P100)..........................................741

17.3 CDMA2000-1X PACKET DATA HOME AGENT (ZXPDSS-H100)...............................................749

17.4 CDMA2000-1X PACKET DATA AUTHENTICATION, AUTHORIZATION AND ACCOUNTING SERVER

(ZXPDSS-A100)..........................................................................................................752

17.5 NETWORKING MODE..................................................................................................................757

17.6 SYSTEM CONFIGURATION PRINCIPLES.......................................................................................760

EXERCISES 761

CHAPTER 18 HIERARCHICAL CENTRALIZED NETWORK MANAGEMENT CENTER

vi
 Contents

(ZXCOMC)...........................................................................................................................762

INTRODUCTION..................................................................................................................................762

18.1 OVERVIEW..................................................................................................................................762

18.2 PROTOCOLS AND STANDARDS...................................................................................................764

18.3 TECHNICAL SPECIFICATIONS......................................................................................................767

18.4 ZXCOMC SYSTEM ARCHITECTURE..........................................................................................769

18.5 SERVICE FUNCTIONS..................................................................................................................774

18.6 NETWORKING MODES AND SYSTEM CONFIGURATION...............................................................777

EXERCISES 780

CHAPTER 19 INTRODUCTION TO ZTE CDMA2000 1X SERVICES....................................782

19.1 INTRODUCTION TO ZTE CDMA2000 1X SERVICES.....................................................................782

EXERCISES 823

CHAPTER 20 ZTE NETWORK PLANNING AND OPTIMIZATION SOLUTION................825

20.1 PURPOSE, PRINCIPLE AND WORKFLOW OF NETWORK PLANNING.............................................825

20.2 TYPICAL CASES ANALYSIS OF ZTE NETWORK OPTIMIZATION AND PLANNING SOLUTIONS.....828

CHAPTER 21 NETWORKING CONFIGURATION ANALYSIS WITH TYPICAL WLL

CASES 850

INTRODUCTION..................................................................................................................................850

21.1 ZXC10-BSS (V5.0) NETWORKING MODE.................................................................................850

21.2 ANALYSIS ON ZTE CDMA WLL APPLICATION EXAMPLE.........................................................852

CHAPTER 22 NETWORKING CONFIGURATION ANALYSIS WITH TYPICAL CDMA2000

1X CASES.............................................................................................................................857

22.1 PHASE II CDMA2000 1X NETWORK CONSTRUCTION SCHEME OF HAINAN UNICOM.................857

22.2 ZTE “C++” ELABORATE NETWORK SOLUTION.........................................................................871

vii
Contents

22.3 CHONGQING (WANZHOU, FULING AND QIANJIANG) RADIO NETWORK COVERAGE SOLUTION 874

REFERENCE 881

APPENDIX A ABBREVIATIONS..................................................................................................883

APPENDIX B FAQ............................................................................................................................896

viii
 Part 1
CDMA Principles and Techniques

ZTE Corporation
February 2003
 Preface

This part mainly introduces the principles, development and features of the CDMA
technologies, including the overview of cdma2000 and PDSN working principles, as well as the
overall and latest development of 3G.

The contents of this part are organized as follows: Chapter 1 introduces the development,
main features and current market situations of CDMA. Chapter 2 introduces some basic working
principles of CDMA. Chapter 3 introduces the working principles of IS-95 system. Chapter 4
introduces the working principles of cdma2000 on the wireless and the core network sides,
including the introduction to PDSN. Chapters 5 and 6 take the technical evolution of ZTE as an
example to introduce the evolution policy of the 3G technologies. Chapter 7 introduces the
advantages and disadvantages of CDMA.

After reading this part, the reader should be able to get a general understanding concerning
the basic working principles and key technologies of CDMA; basically master the working
principles of cdma2000 at the core network and wireless sides; acquire a deep understanding of
advantages and disadvantages of CDMA; and be familiar with the development of CDMA and
some basic concepts of 3G.
 Chapter 1 Why CDMA?

Chapter 1 Why CDMA?

Objectives
After learning this chapter, you shall be able to:

♦ Know the history of wireless communications;

♦ Be familiar with the basic concepts, standards and the evolution of CDMA;

♦ Know the general situations in respect of research and development, products and
marketing of ZTE.

Introduction

All our customers have been engaged in the wireless communication industry for decades, and are well
experienced. To serve them, you must gain some knowledge about the development of the wireless
communications. Through learning this chapter, you will get a comprehensive knowledge concerning
the development of the wireless communications, and know about the development trend, the
company’s research and development as well as the market situations to some extent, which may lay a
foundation for learning latter chapters. This is the goal of learning this chapter.

1.1 Development of Mobile Communications and Brief History of

CDMA

1.1.1 The First-generation Mobile Communication System

At the early 1970s, when Bell Laboratory put forward the concept and relevant theory in respect of the
cellular system to cover a small area, some scientists first thought of the cell structure: In the
architecture, cell is a kind of economical and efficient structure. The mobile network adopts the same
mode. Different frequencies are used between adjacent cells, and same frequencies are used in the cells
which are apart sufficiently far from each other. Then the co-channel interference can be effectively

1
Chapter 1 Why CDMA?

avoided, the same frequency can be used for many times, hence saving the frequency resources. Later,
the cellular system developed rapidly, and quickly entered a practical stage. In the cellular network,
each geographical area (usually a large and medium-sized cities and their suburb areas) is provided
with many base stations, and is controlled by one mobile switch. At any place of this area, a mobile
vehicle-mounted station and a portable phone can connect to PSTN via a radio channel and a switch,
which can really achieve the communications with any place of the world at any time and any place.
Meanwhile, as long as the adopted system is the same, the automatic roaming can be conducted, hence
enlarging the movable range of the mobile station. The first-generation cellular mobile phone system is
an analog cellular mobile system, characterized mainly by the use of analog mode to transmit the
analog signal. AMPS (1983) of the U.S.A., TACS + ETACS (1985) of the U.K. and NAMTS (1978) of
Japan have all developed their own systems.

In 1975, the Federal Communication Committee of the U.S.A. opened the mobile phone market,
and decided the frequency spectrum of land mobile communications and large-capacity cellular mobile
communications, which made preparations for the mobile phone to be put into the commercial use. In
1979, Japan put the first cellular mobile phone of the world into use, i.e., NAMTS. In 1979, the AMPS
analog mobile cellular system was tested in Chicago of the U.S.A., and was finally put into commercial
use in the U.S.A. in December 1983.

In 1977, China began to adopt the analog cellular phone for communications. The first mobile
phone communication office of China was deployed in Guangzhou in November 1987.

1.1.2 The Second-generation (2G) Mobile Communications System

The rapid development of the first-generation analog cellular system also constantly exposed
disadvantages, especially in the large cities with dense populations. As the frequency resources become
more and more insufficient due to the frequency-division multiple access technology adopted by the
analog cellular phone, and the analog cellular system is vulnerable to eavesdropping and disclosure, the
user’s benefits may be harmed.

After the mid of 1980s, wide applications of the large-scale integrated circuits, microcomputer,
microprocessor and digital signal processing technologies, provided technical support for the
development of the digital mobile communication system.

In 1982, the GSM organization was established in Europe to develop the Pan-European mobile
communication roaming standards. They discussed and tested 8 different laboratory plans, and finally
formulated the Pan-European Global System for Mobile Communications (GSM). For the GSM mobile
system, the frequency spectrum usage rate is high and the capacity is increased, and the automatic
roaming and handover function can be achieved. With the adoption of Enhanced Full Rate (EFR)
coding technique, the communication quality is satisfactory. In addition, thanks to such advantages as

2
 Chapter 1 Why CDMA?

rich service types, easy encryption, strong interference immunity, small user device and low cost, the
mobile communication is enabled to enter a new milestone.

On September 18, 1993, the first GSM digital mobile communication network in China was
deployed in Jiaxing, Zhejiang Province. In October 1994, the first provincial GSM mobile
communication network was deployed in Guangdong Province with the capacity reaching up to 50,000
subscribers.

Another mode of the 2G mobile communication system is Code Division Multiple Access
(CDMA), which is a kind of advanced wireless spread spectrum communication technique adopted in
the digital mobile communication during recent years. The original intention of developing the CDMA
technology is to prevent the communication interference from enemies. During World War II, CDMA
technology was developed and widely adopted in the military communications of anti-interference and
privacy. Later it was developed and put into use of the commercial communications by Qualcomm
Corp. of the U.S.A. As CDMA is originally adopted in the military communication, its security is very
powerful and its technical implementation is very difficult. In 1989, Qualcomm sent the CDMA digital
mobile communication system to Pacific Bell Company for small-scale test. In 1995, Hongkong
Hutchison Telecomm deployed the first CDMA commercial system of the world. Many theoretical
advantages of CDMA technology were verified in the practice, and they were rapidly promoted and
applied in the Northern and Southern America, and Asia, etc. Many countries and regions in the world,
including Hongkong of China, South Korea, Japan and the U.S.A., set up the CDMA commercial
network. In the U.S.A., of 10 mobile communication operators, 7 operators adopted CDMA network.
In South Korea, 60% populations are the CDMA mobile users. At the 28 th Olympic Game held in
Australia, CDMA technology played a significant role. In 1995, the Headquarters of the General Staff
of Chinese Army and the Ministry of Post & Telecommunications of China decided to adopt the
dedicated 800M-frequency in the army to set up the CDMA pilot networks in four cities, i.e., Beijing,
Shanghai, Xi’an and Guangzhou.

To a great extent, the 2G mobile communication technology eliminated many defects of the FM
technique adopted in the 1G mobile communications, thus significantly meeting various
communication requirements at the time. Moreover, it had acquired wide application all over the world.
As the mobile communication demands constantly increase, the people in the developed countries and
regions soon found that the 2G communication technology could not meet the increasing requirements
any more. The first problem lies in the network capacity. More and more mobile subscribers were too
heavy for the network to bear. Although the network optimization became better and better, the users
felt more and more unsatisfactory in their communications use. Such problems as call drop, connection
unable and network busy annoyed the operators. The constant emergence of new technologies such as
DCS1800, dual coverage and Micro Cell could still not satisfy the requirements of people.
Furthermore, at the time when the 2G network technology is put forward, the standard development
organizations made a serious mistake in estimating the demands for the mobile data service. Therefore,
it becomes a hard potato for the 2G network technology to meet the increasing demands for the

3
Chapter 1 Why CDMA?

wireless data service.

The CDMA technology is a rising star in the mobile communication field. Compared with the
traditional GSM technology based on time division multiplexing mechanism, it has obvious
advantages. First, the capacity is larger and the usage rate of the frequency spectrum is higher in the
CDMA system. With the same frequency segment as that of GSM, more users are allowed to use the
system. According to estimation, with the same frequency resources, the CDMA network has a system
capacity as large as 8~10 times of that in FM analog network, and 3~4 times of that in the GSM
network. Second, the planning and construction of the CDMA system network are simpler than the
GSM network. Finally, with the combination of CDMA, Time Division Multiple Access (TDMA) and
Frequency Division Multiple Access (FDMA) technologies, greater data bandwidth can be provided on
the basis of limited frequency spectrum. The High Data Rate (HDR) technique currently shown in the
cdma2000 system can provide 2.4 Mbps data bandwidth based on the frequency spectrum of 1.25
MHz, and the usage rate of the frequency spectrum reaches 1.92 bps/Hz, which is much higher
compared with the traditional wireless communication technology. The usage rate of the frequency
spectrum of 1x TREME can reach 3.84 bps/Hz in the future. With integration of the current developing
WLAN technology, the users can easily enjoy the broadband mobile data service at any place in the
near future.

1.1.3 Basic Concept of CDMA

The CDMA system is a self-interfering system, in which all the mobile users occupy the same
bandwidth and frequency. This system allocates each user a unique code sequence (spread spectrum
code), which is used to encode the signals of the bearer information. The receiver that knows the code
sequence decodes the received signals and restores them to the original data because the
crosscorrelation between the code sequences of one user and another user is very slight. Let’s draw an
analogy. Image the bandwidth as a large room. All the people will enter the only large room. If
speaking in completely different languages, they can clearly hear the voice of their fellows, and can
only be interfered by the conversations of other people. The air in the room can be imaged as the carrier
of the bandwidth, and different languages are regarded as the codes. We can constantly add the users
until we are blocked by the background noise. If the user’s signal intensity can be controlled, we can
accommodate more users while keeping high-quality communication.

As the bandwidth of the code sequence is much wider than the bandwidth of signal bearing
information, and the frequency spectrum of the signal has been spread in the encoding process, so this
is called as spread spectrum modulation, and the generated signals are called as spread spectrum
signals. CDMA is often indicated by Spectrum Spreading Multiple Access (SSMA). The spread
spectrum of the transmitted signals is to provide the CDMA with multiple access capability. The spread
spectrum modulation technique must cater to two basic requirements:

4
 Chapter 1 Why CDMA?

1. The bandwidth of the transmitted signals must be much greater than the information
bandwidth.

2. The bandwidth of the generated RF signals is independent of the transmitted information.

In the spread spectrum system, the ratio of the bandwidth (Bt) of the transmitted signals to the
information bandwidth (Bi) is called as the processing gain of the spread spectrum system, i.e., Gp =
Bt/Bi. It can be seen that the processing gain of the CDMA system is very high.

The receiver adopts the same spread spectrum code and the received signals to conduct the
correlation operation to restore the carried original information.

As the spread spectrum signal is a spectrum-spread signal, it has many advantages that are
different from those of the narrowband signal.

♦ Multiple access capability

♦ Multi-path interference resistance capability

♦ Privacy

♦ Man-made interference resistance

♦ Low interception probability

♦ Narrowband interference resistance capability

According to different spread spectrum modulation modes, CDMA can be divided into Direct
Sequence Spread Spectrum (DS-SS), Frequency Hopping Spread Spectrum (FH-SS), Time Hopping
Spread Spectrum (TH-SS) and hybrid spread spectrum.

1.2 Evolution of CDMA Standards and the Third Generation (3G)

Mobile Communications

1.2.1 Evolution of the CDMA Standards

The development process of the CDMA standards at the wireless side can be represented by the chart
below. The evolution process of the CDMA standards is roughly divided into the following stages:

cdmaOne, namely, IS-95A and IS-95B: It mainly supports the voice service, belonging to G2
communication.

5
Chapter 1 Why CDMA?

cdma2000 1X: It can support both voice and data services. The max. data rate can reach 153 kbps,
belonging to 3G mobile communications.

cdma2000 1xEV-DO: As the enhanced version of cdma2000 1X at stage 1, it supports data

services, with max. forward rate being up to 2.4 Mbps.

cdma2000 1xEV-DV: As the enhanced version of cdma2000 1X at stage 2, it supports both voice
and data services, with max. data rate being up to 4 Mbps, and even higher.

ZTE CDMA Roadmap

CDMA
CDMA
CDMA
CDMA 1x
1x EV-DV
EV-DV
CDMA
CDMA 1x
1x EV-DO
EV-DO
CDMA
CDMA 1x
1x
Architecture IS ALL IP
Evolution
IS 95
95
HIRS

95 1xRTT 1xRTT EV DO 1xRTT EV DV

Wireless Technology

2000 2001 2002 2003 2004

800MHz, 1900MHz,450MHz
Spectrum IMT2000
2.5G, 3.5G

Cellular systems and wireless access

Products Wireless data network: PDSN, FA, HA, AAA

Indoor antennae, repeaters, intelligent antennae

Coverage
Improvement Macro/Micro base stations, indoor/outdoor compact base
stations, distributed base stations (remote RF)

Fig. 1-1 ZTE CDMA Roadmap

IS-95 is the first-released standard of the cdmaOne series standards. But the first CDMA standards
really and widely applied in the world are IS-95A which supports the 8K code voice service and the
STD-008 standard of the 1.9 GHz CDMA PCS system. The 13K code voice service quality is already
very close to the voice service quality of the wireline phone. With the increasing demands of the mobile
communication for the data service, Qualcomm of the U.S.A. declared in February 1998 to apply the
IS-95B standard to the basic platform of CDMA. With IS-95B standard, the CDMA system
performance could be enhanced, the data flow of the user’s mobile communication equipment could be

6
 Chapter 1 Why CDMA?

increased, and the 64 kbps data service could be supported. Later, cdma2000 became the transitional
standard from the narrowband CDMA system to the 3G system.

1.2.2 Why the 3G Demanded

With the social progress, people have raised higher requirements for the mobile communication.
Although 2G technology can well provide the mobile voice communication, it seems to be incapable to
satisfy the ever-increasing requirements of the people who expect to enjoy the data and multimedia
mobile communication. Furthermore, in the highly populated developed areas, the 2G system also is
facing the technical bottleneck, which cannot meet the requirements of the increasing user’s capacity.

We are earnestly expecting the 3G technology, i.e., the third-generation mobile multimedia
service. The 3G technology features the use of the enhanced broadband data and multimedia over the IP
and ATM networks. The data transmission rate of the current 3G system can reach 144 kbps on the
vehicle, 384kbps while walking outdoor, and 2 Mbps inside a building, which can be further increased
in future. The 3G service involves video stream, audio stream, mobile interconnection, mobile
commerce and e-mail, and it can be ultimately developed for the video mail and file transfer. Till now,
the 3G standards have been developed in the world, and put into commercial use in many countries.
They are cdma2000 technology, UMTS technology and TD-SCDMA technology developed in China.
Here we take emphasis on the cdma2000 technology.

In the aspect of the mobile user:

2G (2.5G) and 3G networks will coexist for a long time. Like other new technologies, it also takes
time for the 3G network to become popular. When necessary, most users will use the products based on
the 3G network. Home computer is just in a similar case. For example, if a 386 computer is unable to
support some game and software programs, it will upgrade to 486 or Pentium series. Although many
mobile users are satisfied with the existing 2G products, the commercial and high-end users expect to
enjoy the broadband wireless data products resulted from the 3G network. Therefore, a mobile operator
must concurrently provide the services of both 2G and 3G.

The mobile operators intend to ensure the smooth evolution for the users. To keep their current
users, an operator will gradually introduce new services to achieve the smooth evolution. This is why
2G and 3G services will coexist in the coming years. For most existing users, the 2G service can satisfy
their requirements within a certain time. For the users who only use the cellular phone voice service,
they possibly need not change to use the 3G network temporarily. For this reason, the smooth evolution
from 2G to 3G network is very important for the mobile service operators.

In respect of the technical aspect:

IS-95 is the first-released standard of the cdmaOne series standards. But the first CDMA standard

7
Chapter 1 Why CDMA?

really and widely applied in the world is IS-95A. Later, such standards as TSB74 supporting 13K voice
encoder, STD-008 supporting 1.9 GHz CDMA PCS system, and IS-95B supporting 64 kbps data
service were developed.

The major difference between IS-95B and IS-95A is that the former allows many channels bound
together. If the auxiliary traffic channel is not used, IS-95B is basically the same as IS-95A, and they
can coexist in the same carrier.

The cdma2000 1X, the first stage of the 3G cdma2000 wireless communication system, is evolved
from cdmaOne, with the main features of backward compatibility with the existing TIA/EIA-95-B
standard and sharing or overlapping the frequency band with the IS-95A/B system. The cdma2000 1X
differentiates from IS-95 via different radio configurations (RC). Through setting of RC, 1X and IS-
95A/B terminals can be supported at the same time. Therefore, IS-95A/B and cdma2000 1X can coexist
in the same carrier.

The cdma2000, a 3G RTT scenario put forward by TIA TR45.5 of the U.S.A. to ITU, can
effectively support the existing IS-634A standard, with the core network based on ANSI-41. With
network expansion mode, it can provide the running capability in the core network based on GSM-
MAP.

The evolution roadmap of our products is: IS--95A → cdma2000 1xRTT → HDR → ALL IP BSS
products.

In recent years, the mobile communication market in the world continue to show the rapid
development. According to the estimation of EMC (www.emc-database.com), the number of mobile
users in the world will reach 1.6 billion in 2005. By the end of 2001, the number of mobile users in the
world had reached about 950 million, with an increase of about 230 million from 720 million at the end
of 2000, basically the same increase as that in 2000. Compared with that in 2000, the average traffic of
each user in the world almost kept the same. However, in some countries where the service is highly
popular, such as Northern European countries, the traffic of each user appears to be developing.
Therefore, the traffic in the world was increased by more than 30% in 2001. In addition, the mobile
data service is surprisingly increased. The number of short messages sent in the world reached 30
billion in December 2001, with an increase of about 10 times that of the previous year. In Japan, the
number of Internet mobile service users (I-mode and similar services) reached about 50 million. The
data service income was increased by 30% or so, with an average percentage of 4% ~ 5% of the total
revenue of the operators in the world. For some operators, the data service income already counted for
15% ~ 20% of the total revenue of the operators in the world.

Currently, between the latest two outstanding 3G scenarios in the world, in the UMTS
specifications, the WCDMA standards are constantly developed with new versions, diversified and fast
changes, hence causing its less stability. Under this situation, it is very difficult for a manufacturer to
adopt one of the versions to manufacture the equipment and the terminal device. For example, more

8
 Chapter 1 Why CDMA?

than 500 items are pending in the version of R99 released in March 2001. Compared with the version
of June 2001, the new R99 version passed at the 3GPP conference held in Beijing at the end of
September 2001, 266 newly revised items passed. Obviously contrasted with the above, it is smoother
for cdma2000 to evolve from 1x to 1x EV-DV. In the forward extending process of cdma2000 1x, the
wireless subsystem only needs to be partially changed in the hardware and software aspects, and it is
relatively more stable. Therefore, cdma20001x actually put in the commercial operation enjoys a lion’s
share in the market currently. As cdma2000 is directly evolved from the previous CDMA system, it can
provide a quickest, simplest approach at lowest cost for the 3G services. All the 3G technologies
(cdma2000, WCDMA and TD-SCDMA) may be practical, while cdma2000 is the most advanced in the
aspects such as product development, commercial use and market acceptance.

With increasing demands for information, the data service is developing based on diversity, large-
capacity and asymmetry. To cater for the increasing data service, ZTE keeps up with the
communication industry in the world, being the first company to deploy the cdma2000-1x mobile
communication system in China and to develop the cdma2000-1x EV-DO mobile communication
system successfully.

1.2.3 Key Technical Features of cdma2000 1X

The cdma2000 1X has a capacity twice as much as that of the IS-95A system, and can support the data
transmission of 144 kbps. Compared with IS-95A, the cdma2000 1X is greatly enhanced in the aspects
including wireless channel type, physical channel modulation and wireless packet interface functions.
The packet switching mode is introduced in the network; and the mobile IP service is supported. All
these technical features are to satisfy more 3G services with greater complexity.

The cdma2000 1X provides a reverse pilot channel, which enables the reverse channel to conduct
the coherent demodulation. Compared with the incoherent demodulation technique adopted in the
reverse channel of the IS-95 system, the gain can be increased by 3 dB, and the capacity of the
corresponding reverse link is doubled.

The cdma2000 1X adopts the forward fast power control technique, which can control the power
of the forward fast –closed-loop. Compared with the slow power control technique only adopted in the
forward channel of the IS-95 system, the capacity of the forward channel is greatly increased and the
power consumption of the base station is decreased.

The cdma2000 1X adopts the fast paging channel, hence greatly decreasing the power
consumption and increasing the standby duration of the mobile station. The standby duration of the
cdma2000 1X mobile station is over 5 times that of the IS-95 mobile station.

The Orthogonal Transmit Diversity (OTD) and Space Time Spreading (STS) technologies is

9
Chapter 1 Why CDMA?

adopted in cdma2000 1X forward channel, hence improving the fading-resistant capability of the
channel as well as the signal quality of the forward channel. With the orthogonal transmit diversity and
forward fast power control technologies; the capacity of the cdma2000 1X forward channel is twice as
much as that of the IS-95A system.

The Turbo code can be used over the cdma2000 1X traffic channel because the gain of 2 dB can
be obtained if the Turbo code other than the convolutional code is used in the channel code. Therefore,
the capacity of the cdma2000 1X system can be increased by 1.6 times that when the Turbo code is not
used.

New access mode is also defined in the cdma2000 1X, which can shorten the call setup time, and
lighten the interferences caused to other users in access process of the mobile station.

For the packet service of the cdma2000 1X, besides the forward and reverse basic traffic channels,
the system also needs to set up the corresponding auxiliary code-division channel. If the forward link
needs to transmit a large quantity of packet data, the base station will send the auxiliary channel
allocation message to set up the corresponding forward auxiliary code-division channel, which
transmits the data to the mobile station via the forward auxiliary code-division channel within the time
specified in the message. If the reverse link needs to transmit a large amount of packet data, the mobile
station will send the auxiliary channel request message to set up a corresponding reverse auxiliary
code-division channel with the base station, so that the data can be transmitted to the base station via
the reverse auxiliary code-division channel within the time specified in the message. From the above,
we can see that the setup of the auxiliary channel enables cdma2000 1X to support the packet service
more flexibly.

In cdma2000 1X, the data service of 144 kbps can be provided, and the auxiliary code-division
channel is added. Several data flow and multiple services can be carried simultaneously for one user.
Therefore, the services provided in cdma2000 1X are much more increased than those provided in IS-
95, thus laying a foundation for supporting various multimedia packet services.

1.3 Analysis and Prospect of CDMA Market

1.3.1 Overview

At the end of 1980s, thanks to the abrupt change from analog to digit cellular technology in the world,
the GSM technology developed in Europe was tremendously benefited, rapidly promoted in about 100
countries, and unquestionably taking the leading position in the market. However, the breakthrough in
term of technical and economical performances is the application of CDMA technology in the mobile
communications. During recent years, through the wide discussion and argumentation in the

10
 Chapter 1 Why CDMA?

telecommunication industry, a new industry with great potentiality has been formed for CDMA;
especially the actual operation of the commercial CDMA system in the world proves the maturity of the
CDMA technology. Furthermore, the CDMA mode has been recognized as the air interface standard in
the industry of the 3G mobile communications.

Compared with other existing cellular systems, significant advantages are available in CDMA: For
operators, the CDMA system can increase the usage rate of the frequency spectrum, greatly save the
frequency resources, decrease the number of base stations, and low down the project implementation
cost; for users, the CDMA system can provide high-quality voice, better privacy, low call drop rate and
low mobile transmitting power which save the battery power.

The narrowband CDMA based on IS-95 can be more smoothly transited to the 3G mobile
communication.

Currently, there are more than 10 CDMA system vendors and the number of mobile phone
manufacturers has reached over 40 in the world. ZTE already successfully developed the CDMA-IS95
and cdma2000 systems, and put them into commercial use in a large scale.

According to the development trend of CDMA in the world, the evolution from CDMA
technology to the 3G mobile communication system will be greatly sped up. Currently, CDMA network
in the world has been developed in 44 countries, with more than 120 networks, of which, 41% of them
are in the Asia-Pacific regions, 38% in Northern America, 19% in Latin America and 2% in other
regions. It is estimated that the total number of CDMA users will reach 280 million in 2006, of which,
80% are the cdma2000 mobile communication network users. The monthly mobile data volume of each
user will exceed 200 MB, which reaches the application level of the data volume in the existing wired
Internet. In the countries such as South Korea, India, New Zealand and Australia, the CDMA market is
developed at an extremely fast speed. The cdma2000 technology will be developed in three stages:
cdma2000-1x, 1x EV-DO and 1x EV-DV. Its downstream data transfer rate will be increased to 2.4
Mbps, even 4.8 Mbps from 153.6 kbps in the frequency width of 1.25 MHz, which directly leads the
higher usage rate of the frequency spectrum. The cdma2000-1x is most successfully applied in South
Korea, and the total number of users has already reached more than 28 million. The three big operators
in South Korea, i.e., SK, KTF and LG, have developed cdma2000-1x services. For the network
construction, SK and KTF adopt the overlap mode, and LG telecom has upgraded the previous IS-95
network.

South Korea is the first country in the world to provide the synchronized cdma2000 1 XEV – DO
commercial service. SK Telecom deployed the pilot service on November 17, 2001. SK Telecom
deployed the synchronized IMT – 2000 (cdma2000 1 XEV – DO) commercial service in Inchon city on
January 28, 2002, which started the new era of the synchronized mobile communication. The
synchronized IMT – 2000 (cdma2000 1 XEV – DO) commercial service was deployed in Soeul in the
mid of February 2002, in 26 cities including Pusan, Daegu, Gwangju and other cities where the World
Cup Football Match was held at the end of April 2002. And it was planned to deploy the commercial

11
Chapter 1 Why CDMA?

service in 81 cities of the country. This service is achieved via a PCMCIA mobile phone, which is a
dedicated mobile phone connected to a PDA or a notebook for wireless data communication. In April
2002, ordinary mobile phones were employed. VOD and mobile Videophone debuted in May 2002.
During the World Cup Football Match, the football fans from all over the world had experienced the
IMT - 2000 mobile communication service represented by the videophones, with the max. transmission
rate of 2.4 Mbps, being over 16 times faster than the current rate of 144 kbps of the cdma2000 1X
network. The service can be retrieved during travel, and can provide wireless multimedia services such
as VOD, cartoon and photograph mail.

According to the prediction conducted by Datacomm Company, the number of CDMA users in the
world will count for over 35% of the total number of mobile users in the world within the coming five
years. In many developing countries where mobile communication is undeveloped, the CDMA mode
will be much more adopted in the mobile communication network construction than the GSM mode.
With the rapid development of the mobile communication market in the developing countries, the
CDMA network will be greatly popularized in the world.

Currently, the CDMA network is being employed in more than 40 countries in the world, and it is
employed as the main mobile communication network in such countries as the U.S.A., South Korea,
Japan and Australia, and in some regions of South America. CDMA Development Group (CDG)
released in its investigation report: In the third quarter of 2001, the number of CDMA mobile
communication service users in the world reached 95 million, with an increase of 10% from the same
period in 2000. And it is estimated that the number of CDMA users will exceed 100 million by the end
of this year. In September 1997, the number of CDMA users in the world is about 5 million. Four years
later, the number of CDMA users is increased by about 20 times, what a surprising development speed.
Especially in Asia, the CDMA service is tremendously developed during recent years. The number of
CDMA users in Asia is increased by 88% to 28 million. In the Asia-Pacific area, the CDMA
commercial networks are constructed in many countries and regions including Hong Kong of China,
Japan, South Korea, Australia, Thailand, Philippines, New Zealand and Bengal. And the number of
CDMA users has exceeded 21 million.

In the international market, the CDMA products developed by ZTE have strong capability to
compete with the products manufactured by any other manufacturers.

1.3.2 General Introduction to the ZTE Products

Current situations of research and development:

In the CDMA development process, ZTE has had altogether about 1,500 persons devoted in the
research, development and test field, and about 400 persons in the project deployment. Among them,
those with the academic education of master degree or higher count for more than 80%, which forms a

12
 Chapter 1 Why CDMA?

strong technical force.

Currently, ZTE can provide a complete set of networking scheme of the IS-95 and cdma2000 1X
mobile phone systems and the CDMA wireless Local Loop (WLL) systems at three frequency bands,
i.e. 450M, 800M and 1.9G.

The cdma2000 1x EV-DO (HDR) system was shown at the 3G Annual Fair held in Hong Kong of
China in 2002, and was also exhibited in Guizhou Province and Guangxi Chuang Autonomous Region
of China.

Currently, ZTE is developing the products based on ALL-IP platform, i.e. Super BSC and Super
BTS. The ALL-IP network is the development trend of the future communication technology, and the
voice and data services are provided over the IP network.

The 1XEV-DO and ALL-IP products will be provided simultaneously. According to the plan, the
sample system should have been manufactured and debugged by May 2003. From then on, the data
service with higher rate (2.4 Mbps) and all functions of the existing 1X system should be provided.
And the pilot office will be deployed in November 2003 (the product will also be put into production at
the same time).

Working frequency of the system:

The working frequency band of the 800M CDMA system should be within the ranges shown
below:

(RX of the BS and TX of the MS) (TX of the BS and RX of the MS)
824 ~ 849 (MHz) 869 ~ 894 (MHz)

The working frequency band of the 1900M CDMA system should be within the ranges shown
below:

(RX of the BS, transmitted by MS) (TX of the BS, RX of the MS)
1850 ~ 1910 (MHz) 1930 ~ 1990 (MHz)

The working frequency band of the 450M CDMA system should be within the ranges shown
below:

(RX of the BS, TX of the MS) (TX of the BS, RX of the MS)
453 ~ 457.475 (MHz) 463 ~ 467.475 (MHz)

13
Chapter 1 Why CDMA?

Exercise

1. Briefly describe the history of the wireless communication.

2. What are the features of the CDMA technology?

3. Briefly describe the evolution scenario of the CDMA technology.

14
 Chapter 2 Working Principles of the CDMA System

Chapter 2 Principles of the CDMA System

Objectives
After learning this chapter, you shall be able to:

♦ Learn some basic concepts of the CDMA system.

♦ Learn the features of the CDMA cellular mobile communication network.

♦ Grasp the principle of the spread spectrum communication.

♦ Understand the features of the mobile channels, so as to make good preparation for
learning the next chapter of cdma2000 1xRTT system principles.

Introduction

This chapter mainly introduces the basic working principles of CDMA, including some basic concepts
of CDMA, and basic principle of Spread spectrum communication. At the end of this chapter, the
features of channels are introduced.

2.1 Overview
CDMA is a kind of advanced multi-access mode, with a broad application perspective. Currently, it is
the development hotspot in many countries around the world. The multi-access mode means that many
user addresses use the same band for communicating with one another. Normally, these users scatter in
different places and may be in the moving state. Here are two examples for the multi-access
communication mode: multiple satellite communication earth stations communicate with one another
via the same satellite transponder and many mobile user stations communicate with one another via the
same base station. As the same transmission band is used, mutual interference may be generated among
users, which is called multi-access interference. To reduce or eliminate the multi-access interference,
different user signals must have certain features so that the receiver can differentiate them one another.
This procedure is called signal division. Major signal division modes are: frequency division, time
division, code division and space division. Frequency division: different users use different bands to
implement the signal division. Time division: different users use different time slots to implement the
signal division. Code division: all the users use the same band to transmit their signals at the same time

15
Chapter 2 Working Principles of the CDMA System

and the signal division is implemented through the orthogonality or quasi-orthogonality among address
code waveforms of different users. This mode is called the code division multi-access mode.

The code division multi-access system adopts the spread spectrum modulation signals. Its
bandwidth is much greater than the bandwidth of the information signals, and the ratio of them may be
tens, hundreds, or thousands. The power spectrum density of spread spectrum signals is extremely low,
with very good concealment property and quite strong anti-interferences capability, e.g. anti-aiming
interference, anti-multipath interference, etc. Back in 1960s, the spread spectrum technique is applied
to the military and anti-interference communication. Since 1980s, with the fast development of the
integrated circuit and computer technologies, the CDMA spread spectrum technique has been more and
more applied to the civil communication systems. One typical application is the CDMA IS-95 digital
mobile communication system developed by Qualcomm Corp. of the USA in 1990s.

The early mobile communication system is the information analog Frequency Modulation
Frequency Division Multi-Access mode (FM-FDMA). This kind of system is being used till now. The
digital modulation Time Division Multi-Access (GMSK-TDMA) communication system GSM
developed at the early 1990s, is deemed as the representative of the new generation communication
system. Meanwhile, the CDMA technology of Qualcomm Corp. is accepted as the major technique for
the 3rd generation mobile communication. Currently, besides the mobile communication, the CDMA
technology is being widely applied to many other fields, like the data transmission, satellite
communication, and remote control and telecontrol and telemetry space communication.

As the spread spectrum signals are used, this kind of system has the capabilities against multiple
kinds of interferences, especially the capability against the multi-path interference. The power spectrum
density of the spread spectrum signals is very small. That is, the power of unit bandwidth is very small,
nearly without interference for common non-spread spectrum communication systems. So, the same
band can be shared with it, thus improving the spectrum availability. As all the users use the same
carrier frequency and there is no cross-modulation, the frequency resources can be fully used. The
multipath separation technique can be adopted to enhance the capability against the multi-path
interference.

2.2 Basic Concepts of the CDMA System

In the CDMA system, each user is allocated with one unique code sequence (spread spectrum code,
normally a PN code), which is also used to encode the signals bearing information. The receiver of the
user who knows this code sequence decodes the received signals and restores the original data. This is
because that the correlation between this user code sequence and other user code sequences is very
weak. As the bandwidth of the code sequence is far bigger than that of the signal bearing information,
the coding process spreads the spectrum of signals. So, it is also called spread spectrum modulation and
the signal accordingly generated is called spread spectrum signals. Spreading the spectrum of signals

16
 Chapter 2 Working Principles of the CDMA System

transmitted provides CDMA with the multi-access capability.

The major difference between CDMA and GSM lies in the multi-access technique. That is, GSM
uses different time slots to differentiate different users while CDMA uses different PN codes. For
CDMA, first the user data (speech or data) is sent to the spread spectrum unit after being coded via
channels. The spread spectrum unit generates one PN code which is unique for each user and multiplies
it by the user data to generate a new spread spectrum sequence, which will be then sent to the radio
frequency unit for transmission. At the receiving side, the process is just the reverse. First, the signal is
received by the radio frequency unit. Then, the convolution despreading is conducted for received data
on the despreading unit by using the same quasi-orthogonality PN code, thus obtaining the user data.
Fig. 2-1 shows the process.

PN code

Channel Radio
coding frequency

Radio Channel
frequency coding

PN code

Fig. 2-1 Transmitting and receiving processes of CDMA

CDMA communication is also known as the spread spectrum multi-access communication. This is
because the orthogonal code band is usually far greater than the user data’s and the data is spread to a
rather big spread spectrum for transmission after the operation between the PN code and the user data.
The advantage of doing this is that during transmission, the signal energy is distributed across the entire
bandwidth. The signal power per unit spectrum can be quite low, even lower than the background noise
power. However, a relatively high receiver output signal to noise ratio and security can still be ensured.

The spread spectrum modulation technique must meet two basic requirements:

1. The bandwidth of the transmitted signal must be greater than that of the information.

17
Chapter 2 Working Principles of the CDMA System

2. The bandwidth of the radio frequency signal is irrelevant to the information to be transmitted.

The receiver uses the same spread spectrum code to conduct the correlation operation with the
received signal to restore the original information carried. As the spread spectrum signal spreads the
spectrum of signals, it has a series of performances different from the narrowband signals: multi-access
capability, anti-multi-path interference capability, privacy, anti man-made interference capability,
smaller interception probability and anti-narrowband interference capability.

2.3 Features of the CDMA Cellular Mobile Communication Network

Compared with FDMA and TDMA, CDMA has many special features. Part of them is inherent in the
spread spectrum communication system and the rest is brought about by the soft handoff and power
control technologies. The CDMA mobile communication network adopts multiple technologies, such as
spread spectrum, multi-access, cellular networking, frequency reuse, etc., and is a kind of cooperative
operation of 3-D signal processing of frequency domain, time domain and code (energy) domain. So, it
has good anti-interference performance, capability against multi-path fading, and high security. The
same frequency can be used in multiple cells repeatedly. The required carrier-to-interference ratio (C/I)
is smaller than 1. Choices related to quality and capacity can be made based on requirements. These
attributes provide the CDMA system following very important advantages compared with other
systems:

High system capacity: In theory, the CDMA mobile network is 20 times greater than the analog
network. In fact, it is 10 times greater than the analog network and 4~5 times greater than GSM.

Flexible system capacity configuration: This is related to the mechanism of CDMA. CDMA is a
self-interfering system. All the mobile users occupy the same bandwidth and frequency. If we can
control the signal strength of users, we can accommodate more users based on high conversation
quality.

Good conversation quality: The voice quality of the CDMA system is very good. The voice
encoder can adjust the data transmission rate dynamically. Meanwhile, it can select different level for
transmission according to proper threshold values. At the same time, the threshold value varies with the
changes of the background noise. Thus, even though the background noise is considerable, good
conversation quality can be ensured.

In addition, the CDMA system adopts the soft handoff technique. During the handoff, the principle
of “first connect and then disconnect” is adopted. Thus, the defect of the call drop in hard handoff can
be overcome fully. The frequency planning is simple. Users are divided by sequence codes. So, the
same CDMA carrier can be used in adjacent cells. The network planning is flexible and the expansion
is simple. The battery life of the mobile station is lengthened. By adopting the power control and
adjustable rate voice encoder, the service life of the mobile station battery is lengthened.

18
 Chapter 2 Working Principles of the CDMA System

2.4 Principles of Spread Spectrum Communication

2.4.1 Brief Introduction

With the fast development of the computer network, the spread spectrum communication is being
widely used because it provides computer networks with physical interface channels .

The spread spectrum communication, fiber communication and satellite communication together
are named three major high-tech communication transmission modes in the information time. The
spread spectrum communication technology is a kind of information transmission mode. It adopts the
spread spectrum code for modulation at the transmitting end, thus making the bandwidth occupied by
the signal much greater than the necessary bandwidth the information needs. At the receiving end, the
same spread spectrum code is used for the correlation demodulation to despread so as to restore the
information transmitted.

The spread spectrum technique includes following methods: Direct sequence Spread spectrum (DS
for short), Frequency Hopping (FH), Time Hopping (TH), and linear FM (Chirp). Besides,
combinations of these spreading methods are also available, e.g. FH/DS, TH/DS, FH/TH, etc. In
communication, DS, FH and FH/DS are widely used.

The spread spectrum communication technology has following features:

1) Strong anti-interference capability. As signals are spread to a quite wide band, it is necessary to
conduct processing at the receiving end, i.e. compressing the bandwidth to restore the narrowband
signals. As to the interference signals, they are spread to a very wide band as they are irrelevant to the
spread spectrum PN code, thus reducing the interference power entering the signal band. Accordingly,
the output signal/interference ratio of the correlator is increased and thus the anti-interference capability
is very strong. Its anti-interference capability is in directly proportional to the times that its band is
spread. The greater the spectrum is spread, the stronger the anti-interference capability will be.

2) Multi-access communication. Although the CDMA spread spectrum system occupies a quite
wide band, its spectrum utilization ratio is even higher than that of the single-frequency single-carrier
system because respective networks can use the same band at the time. In the future, CDMA will be a
major multi-access communication mode for personal communication.

3) Good security. As the spread spectrum system spreads the information to be transmitted onto a
quite wide band, its power density is reduced with the spreading of the spectrum, even fading in the
noise. So, it has a good security. It will be very difficult to intercept or detect such signals, or it is
impossible to do such actions for spread spectrum signals unless the same spread spectrum code as
used by the transmitting end is used and the signals are synchronized, and correlation detection is also
made. As the power spectrum density of the spread spectrum signal is quite low, in many countries (e.g.

19
Chapter 2 Working Principles of the CDMA System

the USA, Japan, and some European countries), once the power spectrum density of a special band (e.g.
ISM band) meets certain requirements, such a band can be used without approval.

4) Anti-multipath interference. In some communication environments, like the mobile

communication, indoor communication, etc., the multi-path interference is very considerable. So, to
guarantee smooth communication in such environments, a system must have very strong anti-
interference capability. The spread spectrum has very strong anti-multipath interference capability. It
provides the anti-multipath interference capability through the correlation property of the spread
spectrum code used by the spread spectrum or even can improve the system performance with the
multi-path energy.

Certainly, the spread spectrum communication has many other advantages, such as precious
timing and ranging, arbitrary addressing, etc.

2.4.2 Basic Principles of the Spread Spectrum Technique

The basic feature of spread spectrum communication is that the spectrum of the baseband signals
bearing the information data is spread by using the PN code with a rate many times higher than that of
the information data to be transmitted, and accordingly the signal of low power spectrum density of
broad band is formed for transmission. Shannon worked out the formula for calculating the channel
capacity during the research of the information theory:

C = B × log 2 (1 + S N )

Where: C—channel capacity, in bps; B—signal bandwidth, in Hz; S—signal mean power, in W; N—
noise mean power, in W.

This formula shows that if the information transmission rate C does not change, the bandwidth and
the signal-to-noise ratio P/N can be exchanged. That is, increasing the bandwidth can transmit
information reliably at the same information rate with a smaller signal-to-noise ratio. Besides, reliable
communication can be kept by increasing the signal bandwidth accordingly even when the signals are
submerged in noise, i.e., the advantage of a high signal-to-noise ratio can be obtained by transmitting
information with a broadband signal through spreading spectrum. This is just the basic thought and
theoretical basis of the spread spectrum communication.

The figure blow shows the structure of the direct sequence spread spectrum communication.

20
 Chapter 2 Working Principles of the CDMA System

Source coding
Channel

decoding
Channel Channel

Source
Carrier Carrier
coding Decoding
modulation demodulation
(spreading) (despreading)

Transmitting Receiving

Fig. 2-2 The structure of the direct sequence spread spectrum communication

The figure below illustrates the entire spreading and despreading processes.

Transmitting end

S(f) S(f)

Signal

Signal

f0 f f0 f
Signal spectrum before spreading Signal spectrum after spreading

Receiving end
S(f) S(f)

Signal
Interference noise
Interference noise
Signal

f0 f f0 f
Signal spectrum before despreading Signal spectrum after despreading

Fig. 2-3 The processes of spreading and despreading

The spread system has one important concept, i.e. spread spectrum gain. As the spread spectrum
communication system spreads the signal spectrum at the transmitting end and restores the information

21
Chapter 2 Working Principles of the CDMA System

at the receiving end, it brings an advantage that the anti-interference tolerance is improved greatly.
Theoretical analysis shows that the anti-interference performance of a spread spectrum system is
related to the bandwidth proportion of the spreading signal after the information spectrum is spread.
Normally, the ratio of the spread spectrum signal bandwidth W to the information bandwidth F is called
Gain Processing (GP), i.e. GP=W/△F.

The processing gain indicates how the signal-to-noise ratio of the spread spectrum system is
improved. Besides, other performances of the spread spectrum system are usually related to GP. So,
GP is an important performance index. The greater it is, the better the performance will be.

Information data D becomes the baseband (narrow band) signals with bandwidth B1 after regular
data modulation. The spread spectrum modulation is made for the baseband signals with the Pseudo
Noise Code (PN Code) generated by the spread spectrum code generator, forming the spreading signals
with a bandwidth of B2 (far greater than B1) and extremely low power spectrum density. This is
equivalent to distributing the signal energy of narrow band B1 onto broadband B2 for transmission by
adopting the PN code. The receiving end uses the same PN code as that used during the transmitting for
spread spectrum demodulation and restoring the broadband signals to regular baseband signals. That is,
the components corresponding to those of the transmitting are extracted from the broadband according
to the regulation of the PN code and are integrated, thus forming the common baseband signals. Then,
information data D can be demodulated with regular communication processing.

2.5 Walsh Code, m Sequence and M Sequence

In the CDMA system, some orthogonal and quasi-orthogonal codes are needed. Mathematically, there
are many types of orthogonal functions, e.g. the Handmard function family, Walsh function family,
Haar function family, etc. In CDMA system, the Walsh orthogonal code is adopted.

The Walsh function is a kind of binary orthogonal function system, with the value range of 1 and –
1.It has multiple equivalent definition methods. The commonest one is the Handmard numbering
method. The Walsh function in IS-95 just adopts this definition method.

The Walsh function set is a complete non-sine type orthogonal function set, usually used as the
address codes of users.

In the IS-95 standard, the specific construction table of the Walsh function (r=6, n=2 6=64-bit
64×64) is given.

The most important feature of the Walsh function is that it is orthogonal in the interval [0, 1]

By multiplying two Walsh functions, we can obtain another Walsh function, i.e. closeness for the
multiplication. Besides, the Walsh function is fully orthogonal in the case of complete synchronization.

22
 Chapter 2 Working Principles of the CDMA System

However, in the case of asynchronization, its self-correlation and cross-correlation is neither ideal.
Meanwhile, these two indices degrade remarkably with the increase in the value of the synchronization
error.

The following will discuss the features of the Walsh-PN compound code.

♦ When meeting the strict synchronization, the Walsh function can implement the strict
orthogonality. As the mobile channels are parameter-variable multi-path channels, it is very
difficult to ensure strict synchronization.

♦ When the synchronization error is produced, Walsh correlation will degrade quickly.

♦ The m sequence self-correlation functions are not fully orthogonal. Its cross-correlation
value is -1/p (p is the cycle of the m sequence).

♦ Respective advantages of the Walsh code and the PN code are combined. That is, the
features of the compound code can be used to overcome the defects of both.

In the CDMA system, three sequences are the long code, short code and Walsh code. The
following conducts a comparison among them.

The short code is used for the orthogonal modulation of the forward/reverse channels. In the
forward channel, different base stations use different short codes to mark themselves. The length of the
short code is 215.

The long code is obtained by outputting the result of adding one PN code generated by a 42-bit
shift register, one 42-bit long code mask, and modulo 2. The long code mask of each channel is
different. Also, the long code mask is generated via a 42-bit shift register. The length is 2 42-1. In the
CDMA system, the long code is used for scramble in the forward link and for spreading spectrum in the
reverse link.

The Walsh code is used for the forward spreading spectrum of the CDMA system, by means of its
orthogonality.

The table below gives a comparison among three codes of the CDMA system.

Table 2-1 The comparison among three codes of the CDMA system

23
Chapter 2 Working Principles of the CDMA System

Code sequence Length Application position Application purpose Code rate

m sequence (the 242 – 1 Reverse access channel Direct sequence spread 1.2288 M
maximal length Reverse traffic channel spectrum
linear feedback Identifying the mobile
shift register, i.e. station
the long code) Forward paging channel Used for data scramble 19.2 K
Forward traffic channel
M sequence (the 215 All the reverse channels Orthogonal spreading 1.2288 M
Maximal length helpful to modulation
feedback non-
All the forward Orthogonal spreading is
linear shift
channels helpful to modulation and
register, i.e. the
identify the base station.
short code)
Walsh function 64 All the reverse channels Orthogonal modulation 307.2 K

All the forward Orthogonal spreading, 1.2288 M

channels identifying respective
forward channels

2.6 Properties of Mobile Channels

2.6.1 Properties of Mobile Communication

Radio signals suffer various interferences during the propagation. People may say mobile channels are
the most complicated communication channels. This is because that the radio signals will encounter
various obstacles that make signals suffer fading caused by multi-path effect, shadow effect, scattering
and diffraction, besides the interferences usually encountered in the cable channel. Moreover, signals
can be affected by terrain. In addition, changes of the weather will also cause slow fading of radios
signals. When a mobile station moves at a high speed, the situation may be worse. In this case, the
Doppler frequency shift effect will happen to signals. Meanwhile, all these factors vary with the
moving of the mobile station.

Multi-path propagation

The multi-path interference caused by multi-path propagation means mutual interference between
the code elements at the receiving end caused by different arrival time of radio waves due to different
transmission paths. It can cause the attenuation in the amplitude of the data signals transmitted. Also,
the waveform broadening can be caused and thus the data transmission rate will be restricted. The

24
 Chapter 2 Working Principles of the CDMA System

multi-path interference occurring in the mobile channels are mainly caused by the signal reflection of
huge buildings. From the angle of the mobile station, this means that the same signal arrives at the
mobile station at different time and from different directions, which is shown in Fig. 2-4.

Fig. 2-4 Multi-path propagation of radio signal

Multi-path signals not only scatter the energy of signals but also make only a part of the signal
energy transmitted received by the mobile station. Besides, as the multi-path signals reach the mobile
station via different paths and at different time, their phases thereby are different from each other as
well. Thus, multi-path signals received by the receiver may cause extremely serious fading. In this way,
the signal-to-noise ratio of signals is decreased greatly, and the communication effect is influenced.
Besides, in the case of broadband communication, the spectrum of signals is comparatively wide, so the
frequency-selective fading may also occur. This is mainly because some frequency components are
fully cancelled out due to multi-paths as the fading depths generated on different frequencies are
different in different multi-path cases. Fig. 2-5 shows the details.

Fig. 2-5 The real frequency-selective Rayleigh fading channel

25
Chapter 2 Working Principles of the CDMA System

In the figure, the vertical axis stands for the gain (in dB) and the horizontal axes stand for the
frequency and time respectively. In this figure, we can see many “deep valleys”, where serious fading
occurs. The so-called Rayleigh fading refers to the multi-path fading that the probability distribution
function of the electric-field intensity of signals is subject to the Rayleigh probability distribution. And
another major factor contributing to the Rayleigh fading is the Doppler effect, which will be discussed
below. In the mobile communication, multi-path is unavoidable. Although it has serious interfere on
communication, people can make use of it as well. For example, when a mobile station moves to the
back of a big building and enters the shadow area, the radio signals can reach the mobile station by
reflected signals only. People can use this reflected wave and/or diffracted wave to keep the continuity
of the speech. In the GSM and CDMA mobile communication systems, the technical measures against
the multi-path interference are time domain equalization and diversity reception.

Doppler frequency shift

In general knowledge, we all have such an experience: When a police car is bearing up to us, we
may feel the alarm whistle become sharper and harsher while softer when it is bearing off us . This is
just the frequency variation caused by the Doppler frequency shift. The Doppler frequency shift means
that the multi-path effect not only can cause changes in the amplitude of the transmitted signals, but
also can cause changes in the frequency structure of the transmitted signals. Thus, the phase fluctuates,
which causes incorrect receiving of data signals. The Doppler frequency shift’s value can be calculated
with the formula below:

Doppler frequency shift = (movement speed/wavelength) × COS (the included angle between the
incidence wave and the movement direction)

When people make calls with a mobile station in a state of moving slowly, the Doppler frequency
shift can be ignored. However, when people do that in a car moving fast, this factor must be considered.

Signal shadow and transmission loss

As mentioned above, as most of the signal energy is blocked by the building, fading will occur as
well when a mobile station enters the shadow area of a building. In this case, the mobile station can
receive the signals reflected or diffracted from other bodies only. However, this kind of fading is quite
slower than that caused by the multi-path interference. So it is called slow fading. It is not so hard to
deal with as the fast fading.

Fading means that the amplitude of the signals at the receiving end often changes randomly. That
is, sometimes it is very heavy while sometimes it is very slight, without a regular pattern. According to
fading period, fading is divided into the slow one and the fast one. The fast fading is normally caused
by multi-path propagation. It causes serious distortion of signals. The slow fading is caused by such

26
 Chapter 2 Working Principles of the CDMA System

factors as different types of atmospheric refraction, terrain along the route or influences of other
obstacles. With the increase of the frequency, the distribution curve that the signal level varies with the
time is closer and closer to the Rayleigh distribution. So, we also can consider Rayleigh distribution as
the worst estimation of the fast fading.

2.6.2 Convolutional Coding

The convolutional code can effectively overcome the single random error. The convolutional code
concept was brought forward by Elias in 1955. As this coding method can be expressed in the form of
convolutional operation, hence named.

The convolutional encoding is a kind of memory coding. That is, for any time period specified
arbitrarily, the n output code symbols encoded in this way is related to not only the k input bits of that
time period, but also the m input bits saved in that encoder.

Its encoding constraint length is l=m+1. Here m refers to the number of the register elements in the
encoder (memory length).

For convolutional coding encoding constraint length and code rate needs to select. The encoding
constraint length shall be as long as possible, so as to obtain good performance. However, with the
increase of the encoding constraint length, the complexity of decoding is increased accordingly. The
modern super-large integrated circuit can implement the convolutional coding with the encoding
constraint length of 9.The code rate depends on the coherence time of channels and the interleave depth
that will be discussed below.

2.6.3 Block Interleaving Technique

The block interleaving is used to deal with burst data errors in series, making the amount of errors
falling into each receiving character after they are deinterleaved at the receiving end no greater than
that of errors the error-correcting code can correct. In a parameter-variable channel of the land mobile
telecommunication, bit errors usually occur in series. This is because many lasting deep fading valleys
will affect a successive bit string. However, the common channel coding is valid only when finite
random errors and not long error string. To solve this problem, it is hoped to find a method to separate
successive bits in a message. That is, successive bits in a message are transmitted in the discrete mode.
Thus, even though a string of errors occurs during transmission, one or more errors will appear in a
codeword after a message with a successive bit string is restored through deinterleaving. This is just the
interleave technique. The deinterleaved received character that comprises random error(s) can be
restored to the original message bits after errors are corrected.

27
Chapter 2 Working Principles of the CDMA System

As we all know, burst errors may happen to the radio channels. As the interleaving can randomize
these burst errors, and the convolutional coding is quite valid for correcting random errors, so they are
used at the same time. The interleave plan can be either block interleaving or convolutional
interleaving. In the cellular system the block interleaving mode is normally adopted.

The interleaving length is determined by the delay requirement of service. The delay for voice
service is shorter than that of data service. So, it is necessary to match the interleaving depths with
different services.

2.7 Brief Introduction to Speech Coding Technique

For a long time, to solve the information transmission rate has been a key problem in the development
of the communication network. It is quite important. Currently, scientific researchers are studying this
subject in two ways. One of them is to develop new modulation methods and technologies, thus
improving the bit rate of the information transmitted along the channel. In this case, the index is the bit
rate (bit/s) per unit bandwidth (Hz). The other is to compress the bit rate of the source coding. For
example, the standard PCM coding of analog signal with the 3.4 kHz bandwidth shall be transmitted at
the coding bit rate of 64 kbps and compressing this bit rate can obviously improve the number of voice
circuits transmitted over the channel. This is undoubtedly important for any transmission environment
with limited spectrum resources. Especially, it becomes extremely important today when the radio
communication technology determines the future of the communication development. In fact,
compressing the speech bit rate is directly related to such technologies as the voice storage, voice
identification voice synthesis.

The progress of the speech coding technique has quite remarkable influence on the new
communication services, e.g. the IP phone service, real-time long-distance translation service, artificial
intelligence interfaces of switches, etc. So, to drive the development of the communication network,
Group 15 of the former International Telegraph and Telephone Consultative Committee (CCITT) put
forward many proposals about the speech coding standards that need to be formulated urgently. With
the development of VLSI, this technique is being used not only in expensive channels, but also used in
ordinary channels. Therefore, people are more focusing on the coding technique. Currently, the digital
mobile communication network and the Personal Communication Network (PCN) are the
communication means which people put much regards to. For such networks, one of the important
subjects is to compress the speech coding rate to form the object-oriented speech coding technique.

Since PCM was brought forward in 1938, the coding method of the digital speech coding
technique has gained noticeable progress. For example, the Linear Prediction Coding technique (LPC)
was brought forward in 1968 and the HMM technique and Vector Quantization (VQ) technique
appeared in 1970s.

28
 Chapter 2 Working Principles of the CDMA System

The speech coding is source coding. It aims to convert the analog voice into the digital signals for
transmission in channels. The speech coding technique, together with the modulation technique,
directly determines the spectrum utilization of a system in the mobile communication system. In the
mobile communication, it is vital to save spectrum. The research of the speech coding technique in the
mobile communication is to reduce the bit rate of the voice code as low as possible on the premise of
ensuring certain conversation quality.

The speech coding technique is normally divided into three types: Waveform coding, parameter
coding and hybrid coding.

So, what kind of speech coding technique is suitable for the mobile communication? It is mainly
determined by the conditions of mobile channels. As the frequency resource is quite limited, it is
required the rate of coding signals be low. Considering the broadcasting conditions of mobile channels
are tough, the coding algorithm shall have better anti-bit-error capability. In addition, from the angle of
users, better voice quality and shorter delay shall be provided. Generally, mobile communication has
following requirements for the digital speech coding technique:

♦ The rate is low. The pure coding rate shall be less than 16 kbps.

♦ The voice quality shall be as high as possible at a certain coding rate.

♦ The coding delay shall be short, within tens of ms.

♦ In a strong noise environment, the algorithm shall have comparatively good anti-bit-error
capability, thus keeping comparatively good voice quality.

♦ The algorithm shall not be too complex, easy for large-scale integrity.

The CDMA system mainly has two types of speech coding, i.e. Code Excited Linear Prediction
(CELP) of 8 kbps and 13 kbps. The speech coding of 8 kbps can reach or exceed the speech coding
quality of 13 kbps of the GSM system. The speech coding of 13 kbps has reached the wired toll voice
level. CELP adopts the same principle as the pulse excited linear prediction coding. The only difference
is that the pulse position and amplitude are replaced by one vector code table.

With the fast development of the cellular system across the world, the capacity of the CDMA
cellular system now is 4 to 5 times the capacity of other cellular mobile communication systems.
Besides, the quality of service, and coverage is better than that of previous systems. To adapt to this
development trend, the current CDMA system adopts a kind of very effective speech coding technique,
i.e. Qualcomm Code Excited Linear Prediction (QCELP) coding. It is the patent of the US Qualcomm,
used as the speech coding standard (IS95) of the second-generation digital mobile communication of
the north America (CDMA). This algorithm can work not only at a fixed rate like 4/4.8/8/9.6 kbps, but
also at a variable rate between 800 bps~9600 bps. This technique can reduce the mean data rate. The
reduction in the mean data rate can enlarge the capacity of the CDMA system based on the digital

29
Chapter 2 Working Principles of the CDMA System

telephone system by twice or so.

The algorithm of QECLP is now considered most effective. One of major features is to use a
proper threshold value to determine the rate to be used. The threshold value varies with the background
noise level. In this way, the background noise is constrained and good voice quality can be ensured
even in a noise environment. The voice quality of 8 kbps CDMA system is close to that of GSM 13
kbps.

Exercise

1. Introduce the principle of the spread spectrum communication briefly.

2. Describe the features of the mobile communication.

3. Introduce the requirements of the mobile communications for the digital speech coding.

30
 Chapter 3 IS-95 System Principles

Chapter 3 IS-95 System Principles

Objectives
After learning this chapter, you shall be able to:

♦ Master the forward/reverse channel of IS-95 system

♦ Understand air interface standards of IS-95 system

♦ Understand the application of Spreading Technique, CDMA Technique and

Channel Coding Technique in the IS-95 forward/reverse link

♦ Understand data proceeding process of IS-95 System at stages from initial data
information to CDMA RF Signal.

♦ Explain the differences between forward and reserve links in the IS-95 system.

♦ Obtain a basis for the follow-up study of cdma2000 1xRTT system principles.

Introduction

This chapter gives a general idea of IS-95 System, including a general description of the forward /
reserve channel and air interface standards. In the follow-up description, more information is provided
for the design process of the forward/reserve CDMA link signal of the IS-95 system by focusing on the
differences between the forward and reserve links. Included within the chapter, there is a general
description of the radio side of IS-95 System, which provides a basis for the follow-up study of CDMA
2000 1xRTT system principles. With respect to the core network side of CDMA, detailed information is
arranged in the next chapter.

3.1 IS-95 System Overview

In the latest of 1970s, the newly developed Analog Cellular Mobile Communications System is
generally regarded as the first generation of the Cellular Mobile Communications System. However,
with the rapid development of the mobile communications, the disadvantages of the first generation
cellular system are more evident: limited capacity, monotonous service operation and inferior voice

31
Chapter 3 IS-95 System Principles

quality. The second generation of Mobile Communications System thus came into being and kept
developing since then. It is a digital cellular mobile communication system based on the TDMA and
GMSK technologies. Thus, compared to the first generation of mobile system, there is considerable
increase in the system capacity, service operations and voice quality. With the consistent effort made in
this regard over decades, the technique is proven to be reliable and has been widely applied. Today, at a
glance countrywide, the system is used widely in China. At the end of 1980s, research into the GSM
digital system was just at its beginning and CDMA Digital Mobile Communications System was
proposed by the USA in the meanwhile. Today, the CDMA System has been the major topic of
international resource in this respect. In American, Qualcomm, which is one of the world leaders in the
field of CDMA technique, has been carrying out considerable theoretical researches and on-site
experiments to verify the suitability of CDMA technique. The evidence shows that the CDMA system
has many advantages such as increased capacity. In 1993, American Telecommunication Industrial
Association established the TIA CDMA IS-95 as the temporary standard for the American Digital
Cellular System using Qualcomm’s air interface standard. Thanks to its large capacity, strong anti-
interference capabilities and high security, the CDMA system has been showing its big advantages and
a broad prospect of market applications since its emergence. Thus, many domestic and foreign
companies poured great efforts on its development, research and production. The technique is
introduced into many countries for networking and production. Today, the CDMA Digital Cellular
Communications System has been deployed in many cities all over the world.

Included within the forward CDMA channels transmitted by the base station of IS-95 system are:
Pilot Channel: A channel over which pilot signal is transmitted to allow the base station to be identified
by mobile stations and provide MS access to the network.

Synchronization Channel: a channel over which synchronous signal is transmitted to establish

timing and synchronization between the mobile station and the system.

Paging Channel: a channel over which the paging, command and traffic channel assignment
signals are transmitted by the base station to the mobile station.

Traffic Channel: a channel over which the forward communication data and signaling are
transmitted.

Included within the reverse CDMA channels transmitted by the mobile station of IS-95 system
are:

Access Channel: A channel which is seized by mobile stations randomly. By combining the access
channel with paging channel, each paging channel can be used with 32 access channels. It is over these
channels that the MS originates a call and transmits the acknowledgement messages

Traffic Channel: a channel over which the reverse communication data and signaling are
transmitted.

32
 Chapter 3 IS-95 System Principles

3.2 Air Interface Standards of IS-95 System

The IS-95 system is a dual-mode system compatible with the current analog system. Its frequency is set
as being staggered with that of the AMPS system, so as to reduce interference. Inside a cell, the
Frequency Division Duplex (FDD) mode is adopted between the base station and mobile stations. The
base station also can divide the cell into several sectors by using the polarization antenna. Normally, a
base station has two receiving antennas for enhancing the diversity effect of signals. A base station is
connected with the Mobile Telephone Switching Office (MTSO) via the microwave LAN in the mode
of Time Division Duplex (TDD). Finally, it is connected with local public telephone network via the
SS7. Generally, the IS-95 system mainly has following features:

♦ Band

Downlink: 869 ~ 894 MHz for transmitter; 824 ~ 849 MHz for receiver

Uplink: 824 ~ 849 MHz for transmitter; 869 ~ 894 MHz for receiver

♦ Number of channels

64 code division channels/1.25 MHz RF

Each cell can be divided into three sectors, sharing one RF.

Each network has nine RFs, among them, 12.5 MHz is occupied by receiver and transmitter
respectively, with a total of 25 MHz occupied.

♦ RF bandwidth

Channel NO.1 2 × 1.77 MHz

Other channels 2 × 1.23 MHz

♦ Spreading modulation

QPSK for base station

OQPSK for mobile station

♦ Spreading Mode

DS-PN

Digital filter bandwidth of 1.25 MHz

♦ Speech coding

33
Chapter 3 IS-95 System Principles

Variable rate CELP. The maximum rate is 8 kbps, the maximum data rate is 9.6 kbps, and the
frame length is 20 ms.

♦ Channel coding

Convolutional coding and Viterbi decoding

Downlink code rate R = 1/2; constraint length K = 9

Uplink R = 1 / 3, K = 9

♦ Pseudo-random Noise (PN) code

Chip rate is 1.2288 Mchip/s; the base station identifier is the m sequence of 2 15 –1 bits, and
the user identifier the m sequence of 242 - 1 bits.

64 orthogonal Walsh functions are 64 channel address codes.

♦ Interleave coding

Adopt interleave coding for time diversity, with an interval of 20 ms.

♦ Pilot Frequency (PF)

Forward links use the PF signals for synchronous tracing.

♦ Receiving mode

Adopting RAKE for receiving: Mobile station 3-path RAKE; base station 4-path RAKE.

3.3 Signal Design of Forward Links

In a forward link (From a base station to a mobile station), to enable the communication between a base
station and mobile stations, the Q-CDMA system signal is designed with the combination of multiple
techniques, like the frequency division, pseudo code division, and orthogonal signal multi-access.
Frequency division is to divide available cellular spectrum into channels with a bandwidth of 1.25. The
base station uses the PN sequence with a certain time bias as the identifier, which is used for the mobile
stations to differentiate signals transmitted from different base stations. PN is generated by the linear
feedback shift register, at the cycle of 32768 chip/s and the chip rate of 1.2288M. Two PN sequences,
PN1 and PN2, are used to modulate two orthogonal carriers respectively.

These logical channels use different codes to implement the code division multi-access, so as to
transmit messages to mobile stations. The receiver of a mobile station uses the corresponding Walsh

34
 Chapter 3 IS-95 System Principles

code to conduct correlation receiving, obtaining the information codes. The Walsh code is 64 long and
has 64 chips in total. Different Walsh codes are orthogonal with one other. Through orthogonal
correlation processing, multiple transmitted signals of the base station can be separated in an ideal way.
Fig. 3-1 shows the forward link logical channels of a base station.

Forward CDMA channel

(the 1.23MHz channel
sent by the BS)

Synchro-
Pilot Paging Paging Traffic Traffic Traffic Traffic Traffic
Traffic
nization
channel channel 1 channel 7 channel 1 channel N channel 24 channel 25 channel 55
channel 25
channel to
to to

Traffic data MS power

W=Code channel
control subchannel

Fig. 3-1 CDMA logical channels in respective directions sent by the base station

The example in above figure includes one pilot channel, a synchronization channel, seven paging
channels and fifty-five traffic channels. Using the pilot channel is one important feature of the forward
link. The pilot channel uses the zero function Walsh 64 0. It is not modulated by information but just
consists of a pair of orthogonal PNs. Each base station uses such a pair of PN sequences with time
offset as the identifier of the forward link. The synchronous channel transmits a signal that is encoded,
interleaved, spread and modulated. It is used for the mobile stations of the base station to capture the
initial time. The synchronous paging channel also transmits a signal that is encoded, interleaved, spread
and modulated. It is used to transmit the system overhead information and mobile station special
messages. The traffic channel is used to transmit user information and signaling information. In each
traffic channel, the service data and power control information, which will be sent to the mobile
stations, in contained.

A base station can transmit signals in different ways at multiple rates. Among them, the
synchronous channel transmits signals at a fixed rate of 1.2 kbps. The paging channel provides two
rates, i.e. 9.6 kbps and 4.8 kbps. The traffic channel can work at multiple rates, i.e. 9.6, 4.8 and 2.4
kbps. When digital signals are transmitted in frame, the frame is 20 ms. Their rate can be changed

35
Chapter 3 IS-95 System Principles

frame by frame. However, after repeated by the code word, the rate of modulating symbols will remain
19200 symbols/second in any case. In the forward link, the digital signals are processed with channel
coding, interleaving, scrambling, orthogonal modulation and quadrature spreading. Channel coder
outputs the codewords through convolutional coding with the bit rate of 1/2 and constraint length of 9,
and after its coded symbols are interleaved, forming codewords with 20 ms long. Then, scrambling will
be made with the subscriber PN with a length of 42-bit. As its chip rate is 1.2288 Mchip/s, this long
code shall be changed into 19.2 kbps before scrambling. That is, extract the first one from the 64 PNs’
chips for scrambling. The scrambled data stream will be modulated by the Walsh function in an
orthogonal way, which is actually an orthogonal spreading. As the channels in a base station use
different Walsh functions which are orthogonal with one another, the channels are also of orthogonality
during spreading. After the orthogonal spreading, each channel is sent to quadrature phase for
spreading, and it is spread again with 1.2288 Mchip/s code in I tributary and Q tributary respectively.
The identifier of the BS is added to the signal. The PN offset of the PN code used by each BS is
different from one another. Finally the signals processed with the quadrature phase spreading are
modulated to form the QPSK transmitting signals of the forward link.

From the above description the data streams of the signals of the forward links can be depicted in
Fig. 3-2.

36
 Chapter 3 IS-95 System Principles

Fig. 3-2 Data streams of the channels forward links

3.4 Signal Design of the Reverse Link

The reverse link (MS-BS) is composed of several traffic channels and access channels. Fig. 3-3 depicts
all the signal channels to the BS.

Reverse CDMA channel

(1.23MHz channel received
by base station)

Access Access Traffic Traffic

channel 1 channel n channel 1 channel m

Fig. 3-3 All the signal channels received by the BS and the data streams of the reverse channels

The traffic channels are used to transfer signals from the user to the BS and the access channels
are used by the MS to initiate the communication with the BS and to respond to the message in the
paging channels. They are random access channels. There is a maximum of 62 traffic channels in one
CDMA path and each paging channel supports a maximum of 32 access channels. Like forward links,
the reverse link also uses PN for spreading modulation and the length of this PN is the same as that of
the forward link. However, a fixed phase difference is used here. The digital signals from the MS are
also applied with convolutional coding, codeword interleaving, Walsh 64-system orthogonal
modulation, long code spread spectrum, and quadrature phase PN spreading modulation. Compared
with the forward links, there are the following differences:

♦ The digital information uses convolutional coding with bit rate 1/3 and constraint length
9. Therefore the coded symbol rate is 28.8 kbps.

♦ The convolutional coded information is interleaved in an interval of 20 ms. After the

interleaving is finished, every 6 binary symbols form a codeword used to select one of the 64
different Walsh orthogonal functions for transmitting. Obviously the Walsh function is used
here differently from the forward link case. In the forward link, the Walsh function is
determined by the channel assigned to the MS; whereas in the reverse link the Walsh

37
Chapter 3 IS-95 System Principles

function is determined by the information sent, that is, the function in the reverse link is used
for 64-system orthogonal modulation. The symbol rate after the modulation changes to 307.2
kchip/s and the chip rate is 1.2288 Mchip/s.

♦ The long PN in the reverse link is used directly for spreading other than scrambling. It is
used to differentiate different MSs. As each possible phase offset of this PN long code may
correspond to an effective address, a large address space is provided along with high privacy.

♦ When a short PN is used for quadrature-phase modulation, all the MSs use the 0-offset
PN uniformly. This is because in the reverse channel there is no need to identify the BS.

Fig. 3-4 shows the data streams of the reverse traffic channels.

Inphase pilot PN, 1.2288Mcps

Convolutional
coding
Voice Symbol Interleav- Orthogonal
encoder repetition ing modulation

Quadrature-phase pilot PN,

1.2288Mcps

Fig. 3-4 Data stream of the reverse traffic channels

38
 Chapter 3 IS-95 System Principles

Exercise

1. Explain the functions of the forward/reverse channels of the IS-95 system.

2. Describe briefly the forming of the forward channels of the IS-95 system.

3. Describe the forming of the reverse channels of the IS-95 system.

4. Describe the differences between the forward and reverse links of the IS-95 system.

39
40
 Chapter 4 Principles of cdma 2000 1x RTT

Chapter 4 Principles of cdma2000 1x RTT

Objective:
After learning this chapter, you should be able to:

♦ Master the types and functions of the forward/backward channels of the cdma2000
1xRTT system.

♦ Understand the enhancement of cdma2000 1xRTT’s performance over IS-95

system.

♦ Master new technologies involved in the creation of the forward/backward channels

of the cdma2000 1xRTT system and the similarities and differences between
cdma2000 1xRTT and IS-95 system.

♦ Master the principles of switching domain of cdma2000 1xRTT.

♦ Master the principles of the packet domain of cdma2000 1xRTT.

Introduction

This chapter introduces the principles of cdma2000 1xRTT from three perspectives. Before the
introduction of these 3 major parts begins, let’s see the description of the enhancement of cdma2000
1xRTT over IS-95 system. The first part discusses the working principle of the wireless part of
cdma2000 1xRTT including Sections 4.2 and 4.3. The second part discusses the working principle of
the cdma2000 1xRTT circuit domain. And the third part discusses the working principle of cdma2000
1xRTT packet domain.

4.1 Enhancement of cdma2000 1xRTT Performance

The cdma2000 1xRTT system is backward compatible with the IS-95 system. Compared with IS-95,
there are some substantial technical features in cdma2000 1xRTT, which are listed briefly as follows:

Wireless part:

41
Chapter 4 Principles of cdma 2000 1x RTT

♦ Unlike the 64 bits of the Walsh code of the IS-95 system, the cdma2000 1xRTT system
uses a maximum of 128-bit Walsh code, hence increasing the system capacity.

♦ Fast forward power control – increasing the forward capacity.

♦ Forward transmit diversity – increasing the forward capacity.

♦ Supplemental channel (SCH) – supporting high-speed packet data service.

♦ Introduction of the Turbo code – increasing the system throughput.

♦ Reverse supplemental pilot channel – the reverse link uses coherence demodulation to
increase the reverse capacity.

♦ Flexible frame length – meeting requirements for different packet data services.

♦ Optional longer interleaver.

♦ Enhanced Media Access Control (MAC) – supporting QoS/packet state transition.

Network part:

♦ Enhanced A1 interface – supporting concurrent services and emergency call.

♦ Introducing subscriber area – providing different services for subscribers in different

geographical areas.

♦ A3/A7 interface – supporting inter-BSC soft handoff.

♦ A10/A11 interface – supporting packet data.

♦ Security alliance between PCF and PDSN – supporting secure and reliable transmission.

♦ Supports Mobile IP – supporting macro mobility of packet data (between PDSN and FA).

With these new features added, the cdma2000 1xRTT system is able to be backward compatible
with IS-95. Its baseband system uses Radio Configuration (RC) to implement compatibility. The
coding, interleaving, and error correction vary for different radio configurations.

♦ RC1 and RC2 are totally the same as the IS-95 system; other radio configurations, i.e.,
above RC2, are the newly added contents of the 1x system.

♦ During the call establishment, the corresponding service negotiation program determines
the usage of RC.

42
 Chapter 4 Principles of cdma 2000 1x RTT

♦ With regard to the voice service, the IS-95 mobile station can work in the carrier
frequency of 1x and the 1x mobile station can work in the carrier frequency of IS-95.

4.2 Spreading Rate and Radio Configuration

Spreading Rate is shortened to “SR”. It means the chip rate of the spectrum waveform of the extended
CDMA signals, which determines the width and processing gain of the spectrum. SR1 is 1,228,800
chip/s. It is the same as that of current IS-95. It forms 1.25 MHz signals, each sector of which can bear
a certain amount of data.

Radio Configuration is shortened to “RC”. RC refers to the work mode of a series of forward and
reverse traffic channels. Each type of RC supports a set of data rates. The difference lies in the
parameters of the physical channels, including modulation features and spreading rates.

The RCs that SR1 corresponds to are categorized into two types: one is compatible with IS-95 and
the other uses new channel modulation and coding technique. In order for BS and MS to support SR1,
they work either at the first type of RC or at the second type of RC but not in both at the same time.

When cdma2000 1xRTT works at SR1, it has several RF configurations, each of which has its
own features.

Fig. 4-1 Spreading Rates & Radio Configurations

43
Chapter 4 Principles of cdma 2000 1x RTT

In the above figure, RC1 is compatible with RS1 of the IS-95 system. RS1 refers to the rates of
9600, 4800, 2400, or 1200 bps. RC2 is compatible with RS2 of the IS-95 system. RS2 refers to the
rates of 14400, 7200, 3600, or 1800 bps.

“Quarter-rate convolutional or Turbo Coding” or “1/4 rate convolutional or Turbo coding” refers
to the convolutional encoder or Turbo encoder of rate R=1/4. Convolutional coders are illustrated in the
following figure.

Figure 4-2 Convolutional encoder

4.3 Types and Structures of the Channels

This section will first introduce all the forward/reverse physical channels that cdma2000 1xRTT
provides, then the framework of the physical layer of each channel. For more detailed description of the
system channels and principles of the cdma2000 1xRTT system, see the references of this section.

44
 Chapter 4 Principles of cdma 2000 1x RTT

Physical Layer encodes/decodes and modulates/demodulates the forward/reverse physical

channels. Recall that there are forward channels and reverse channels in the IS-95 system.

Forward channels:

♦ Pilot channel

♦ SYNC channel

♦ Paging channel

♦ Traffic channel

Reverse channels:

♦ Access channel

♦ Traffic channel

See the principles of the IS-95 System in Chapter 3 of Part II for the functions of these channels.

Fig. 4-3 Forward/reverse channels of IS-95

The forward/reverse channels of the cdma2000 1xRTT system are illustrated in Fig. 4-4.

Forward channels:

♦ F-Pilot (Walsh Code0): Forward pilot channel, whose function is the same as that of the
forward pilot channel of IS-95A. It is used by the mobile station for synchronous coherence
demodulation. The base station sends pilot signals in this channel for the mobile station to

45
Chapter 4 Principles of cdma 2000 1x RTT

identify the base station and introduces the mobile station to access the network.

♦ F-Sync (Walsh Code 32): Forward Sync channel, whose function is the same as that of
the forward Sync channel of IS-95A. It is used to provide system time and frame
synchronization to the mobile station. The base station sends the synchronization information
in this channel for the mobile station to establish the synchronization and timing with the
system.

♦ PAGING (Walsh Code 1~Walsh Code 7): Forward paging channel, whose function is the
same as that of the forward paging channel of IS-95A. The base station sends paging,
instructions, and traffic channel assignment information to the mobile station.

♦ F-BCCH: The abbreviation of forward broadcast control channel. It only works above
RC3, and serves to transmit the overhead message to MS.

♦ F-QPCH: The abbreviation of forward quick paging channel. It only works above RC3,
and serves to indicate on which timeslot the MS is to receive the control message on F-
PCH/F-CCCH. Since it is not necessary for MS to monitor the PCH/F-CCCH timeslot all the
time, it can cutdown the power consumption of the MS drastically.

♦ F-CPCCH: The abbreviation of forward common power control channel. When the MS
sends data on R-CCCH, the inverse control bit is transmitted to the MS.

♦ F-CACH: The abbreviation of forward common assignment channel. It only works above
RC3 together with F-CPCH, R-EACH and R-CCCH. When the BS demodulates an R-EACH
header, it indicates on which R-CCCH the MS is to send the access message and from which
F-CPCH to receive the power control bit.

♦ F-CCCH: The abbreviation of forward common control channel. It serves to transfer the
control messages and burst short data between the BS and the MS when no TCH is
established in the MS.

♦ F-FCH: It is the abbreviation of forward fundamental channel, a kind of TCHs. It carries

the signaling/voice/low-speed packet data service, circuit data service or auxiliary service
when the MS gets in the TCH status.

♦ F-DCCH: The abbreviation of forward dedicated control channel, a kind of TCH. It only
works above RC3, and serves to transfer messages or low-speed packet data service or circuit
data service when the MS is in TCH status.

♦ F-SCH: Forward supplemental channel, which belongs to one of the traffic channels.
Working above RC3, it bears the high-speed packet data traffic (14.4 kbps or above) after the
mobile station enters the traffic channel.

46
 Chapter 4 Principles of cdma 2000 1x RTT

Reverse channels:

♦ R-Pilot: Reverse pilot channel: works above RC3; used to assist the base station in
detecting the data transmitted by the mobile station.

♦ R-ACH: The abbreviation of reverse access channel: Its functions are the same as the R-
ACH of IS-95A.

♦ R-EACH: The abbreviation of reverse enhanced access channel. It only works above
RC3, and can send the control information to the BS via this channel when no TCH is
established in the MS, thus improving the access capability of the MS.

♦ R-CCCH: The abbreviation of reverse common control channel. It serves to transfer the
control messages and short burst data between the BS and the MS when no TCH is
established by the MS.

♦ R-FCH: It is the abbreviation of reverse fundamental channel, a kind of TCHs. It carries

the signaling/voice/low-speed packet data service, circuit data service or auxiliary service
when the MS gets in the TCH status.

♦ R-DCCH: The abbreviation of reverse dedicated control channel, a kind of TCH. It only
works above RC3, and serves to transfer messages or low-speed packet data service or circuit
data service when the MS is in TCH status.

♦ R-SCH: Reverse supplemental channel, which belongs to one of the traffic channels.
Working above RC3, it bears the high-speed packet data traffic (14.4 kbps or above) after the
MS enters the traffic channel.

47
Chapter 4 Principles of cdma 2000 1x RTT

Fig. 4-4 Forward/reverse physical channels of the cdma2000 1xRTT system

At the initial start of 1xRTT, there are still many IS-95 mobile stations. The IS-95 mobile station
can still obtain the configuration information from the existing channels. In the 1xRTT phase, the
channels used do not include F-BCH, F-CPCCH, F-CACH, F-CCCH, and F-DCCH, which are
available later and which are dedicated to the 1xRTT mobile stations.

4.3.1 Cdma2000 Turbo Encoder

In CDMA system, to guard against error transmission, the bits are first transformed into symbols with
the channel encoder then are transmitted. After the symbols are received, the decoder processing to
recover the bits has a very high tolerance for error symbols. Even there are error symbols in codeword
stream; the correct bits can still be recovered. There are several channel coding methods to transform
the bits into symbols. The traditional CDMA system voice uses convolutional coding, whereas
cdma2000 introduces Turbo coding.

Either from the point of view of information theory or from the point of view of coding theory, to
increase the coding performance, the coding constraint length must be increased. However, directly
increasing either the packet coding length or the convolutional coding constraint length also increases
the system complexity dramatically. For such circumstances, Forney presented the concept of
concatenated code, that is, several short codes are used to construct a long code. This reduces the

48
 Chapter 4 Principles of cdma 2000 1x RTT

complexity of the decoder and has the effect of equivalent a long code. One widely used concatenated
structure uses the RS code as the outer code and the convolutional coding as the inner code.

Extensive research on the concatenated code finally resulted in Turbo coding. Turbo coding uses
relatively simple Recursive Systematic Convolution (RSC) and interleaver to reach the error correction
performance close to Shannon limit. Turbo coding is a very attractive, new technique in recent years.
Though its complexity and decoding delay may be unfit for some applications, it is still regarded as a
good coding method available now.

Turbo code has excellent error correction performance, suitable for data transmission service that
does not have high requirement for decoding delay. It is used to lower the requirement for transmitting
power and to increase the system capacity. In cdma2000-1X, Turbo code is only used in the forward
supplemental channel and reverse supplemental channel.

Turbo code has better effect when applied in large symbol group, such as the long frames of the
cdma2000 high-speed data rate.

Fig. 4-5 Common Turbo encoder

The Turbo encoder of cdma2000 is illustrated in Fig. 4-5. The turbo encoder creates 5 output
streams – the original data stream plus four data streams created by the four feedback shift registers
combined with the interleaving technique. Then the data streams are punctured to lower the output rate

49
Chapter 4 Principles of cdma 2000 1x RTT

to 3 times that of the original data stream.

4.3.2 Quasi Orthogonal Function

The resource of the Walsh codes is limited. There are 128 Walsh codes available in 1xRTT. However,
so many channels of new types and length-variable codes may use up the Walsh codes of some sectors.
What then? Quasi-Orthogonal Functions (QOF) extends the resource of the Walsh codes. The quasi-
orthogonal function of the Walsh codes is illustrated in Fig. 4-6.

QOF is obtained by a nonzero sign QOF mask (QOF sign) multiplying a nonzero rotation enabled
Walsh function (Walshrot). The procedure that uses QOF for orthogonal spreading is: first, a suitable
Walsh function is multiplied by the mask of bipolar sign (This mask is derived by the sign mapping of
QOFsign from 0+1, 1-1); the resulted sequence is multiplied by the data streams of the I and Q
tributaries, respectively; then the data streams of these two tributaries are multiplied with the sequence
derived from complex-mapping the Walsh rot.. The complex mapping maps 0 to 1 and 1 to j (j means a
complex value with 90 degree phase shift).

Fig. 4-6 Implementation of the Walsh code/quasi-orthogonal

The parameters in the above figure are described as follows:

Walsh function =±1 (mapping: ‘0’ → +1, ‘1’ →-1)

50
 Chapter 4 Principles of cdma 2000 1x RTT

QOFsign=±1 bipolar QOF mask (mapping: ‘0’ → +1, ‘1’ → -1).

Walshrot = ‘0’ or ‘1’, the Walsh function that rotates by 90 degree when
enabled.

Walshrot=’0’ means no rotation.

Walshrot=’1’ means 90 degree rotation.

Null QOF means QOFsign=+1 and Walshrot=’0’.

PNI and PNQ=±1, PN sequence of the I and Q tributaries.

The null QOF is used in RC1 and RC2.

The following are features of the QOF code:

♦ QOFs are derived by the Walsh code multiplied by a quasi-orthogonal mask.

♦ The members of the QOFs set are orthogonal of one another. The members in different
QOFs sets, including the original Walsh codes, are slightly away from orthogonality, but this
will not cause any problem.

The equipment manufacturers do not provide the QOFs functions in their initial cdma2000
products. But all of them are expected to support QOFs.

4.3.3 Orthogonal Transmit Diversity

To increase the capacity, cdma2000 uses several diversity transmissions, as illustrated in Fig. 4-7.

At SR1, BS supports Orthogonal Transmit Diversity (OTD) or Space Time Spreading (STS) in the
Forward Link (FL) channel. Of course it is possible not to use them. At SR3, the BS provides FL
diversity by transmitting different carrier frequencies with different antennas. This, however, is not
compulsory either. Specifically speaking, with orthogonal transmit diversity, the data are applied with
the serial/parallel conversion and are assigned to two antennas that use different Walsh codes.
Compared with a single antenna, the length of the Walsh codes is doubled but the total resource of the
Walsh codes occupied remains unchanged. This is an open loop transmitting mode.

51
Chapter 4 Principles of cdma 2000 1x RTT

f1

Mapping and
f1
scrambling
Mapping and
映射和扰码
普通模式
Common mode D scrambling
f2
f1 E
M Mapping and
映射和扰码
Mapping scrambling
D Mapping and
映射和扰码 and U
scrambling
scrambling f3
E X
f2 Mapping and
映射和扰码
M scrambling
U Mapping and 3x MC mode
X 映射和扰码
scrambling

OTD or STS mode

Fig. 4-7 cdma2000 forward transmit mode

4.3.4 HPSK Modulation

HPSK modulation includes BPSK modulation and QPSK modulation.

Using HPSK in the system provides the following advantages:

♦ Lowers the peak-to-average ratio (peak factor) of the reverse link waveforms transmitted
by the mobile station.

♦ This lowers the requirement for the performance of the mobile station’s power amplifier,
making it simpler and cheaper and using precise battery power effectively.

This lowers the outband radiation of the CDMA signal edge by 4 dB (recommended in the
standard procedure by the Korean manufacturers).

4.3.5 Creation of the 1xRTT Forward Channel

This and the following sections describe the framework of the creation of the cdma2000 RTT
forward/reverse channels. For details, see the reference.

The Pilot, Sync, and Paging channels are compatible with the IS-95 system. BPSK is applied to

52
 Chapter 4 Principles of cdma 2000 1x RTT

these channels, just as in IS-95. Our description will not go beyond that.

SR1 forward traffic (F-Traffic) channel

In IS-95 (RC1 or 2), the F-Traffic channels include 1 F-FCH fundamental channel that uses IS-95
coding with active rate of 9600 or 14400 bps.

In cdma2000 (RC3, 4, or 5), the F-Traffic channels include 1 F-FCH fundamental channel and 1
or 2 F-SCH supplemental channels. In cdma2000, F-DCCH is associated with the F-Traffic channel for
bearing the signaling and power control data.

SR1 RC1 and RC2 forward traffic channels are compatible with the reverse channels of IS-95 and
are actually the same as the forward traffic channels of IS-95. The difference between the structure of
the RC1~2 and RC3~5 forward traffic channels lies in the different baseband data scrambling created
by the long pseudo-random data sequence. This is because in the traffic channels of RC1~2, the
information bits are encoded and modulated to symbols of fixed rate of 19.2 ksymbps; whereas in the
traffic channels of RC3~5, the rates of the symbols modulated from the information bits vary from 19.2
ksymbps to 614.4 ksymbps. Therefore the creation of the baseband data scrambling is complex. There
is one more difference between these two types of RC, that is, the data output with RC1~2 is in BPSK,
whereas the data output with RC3~5 is in QPSK.

SR1, RC1 9600 bps F-FCH ( IS-95 compatible)

Fig. 4-8 F-Traffic channel at SR1

53
Chapter 4 Principles of cdma 2000 1x RTT

SR1 RC2 14,400 bps F-FCH (IS-95 compatible)

Fig. 4-9 SR1 RC2 14,400 bps F-FCH

SR1 RC3 F-FCH (9600 bps)

The power control information

can be carried either in graphic
or in F-DCCN
The sign stream is divided into
two parts: one enters the logical
The complex number scrambling
I tributary and the other enters
guarantees that at any time the physical I
the logical Q tributary.
and Q phase plane includes the same
multitude. This will minimize the
peak-to-average ratio.

54
 Chapter 4 Principles of cdma 2000 1x RTT

Fig. 4-10 SR1 RC3 F-FCH (9600 bps)

SR1 RC4 F-FCH (9600 bps)

The power control information

can be carried either in graphic
or in F-DCCN
The sign stream is divided into
two parts: one enters the
logical I tributary and the other
The complex number scrambling guarantees
enters the logical Q tributary.
that at any time the physical I and Q
phase plane includes the same multitude.
This will minimize the peak-to-average ratio.

Fig. 4-11 SR1 RC4 F-FCH (9600 bps)

The structures of the forward traffic channels in RC3~5 are similar; and the difference lies in the
framing parameters.

4.3.6 Cdma2000 1xRTT Reverse Channels

The following figure shows all the reverse channels of cdma20001xRTT.

55
Chapter 4 Principles of cdma 2000 1x RTT

Fig. 4-12 cdma2000 SR1 CDMA reverse channels

The structures of the reverse access channel and the reverse fundamental channel of RC1~2 are
the same as those of the access channel and reverse traffic channels of the IS-95 system. They are not
described here. As an example, the forming of the RC3 reverse fundamental channel is illustrated in
Fig. 4-13.

Fig. 4-13 Forming of the RC3 reverse fundamental channel

Fig. 4-14 shows the I-Q mapping structure of the reverse pilot channel, enhanced access channel,
reverse common control channel, and the reverse T-channel of RC3~4. As can be seen from the figure,

56
 Chapter 4 Principles of cdma 2000 1x RTT

the reverse pilot channel is not coded because what it bears is only the TDM power control signals plus
some constants. The reverse link in Fig. 4-14 uses Hybrid Phase Shift Keying (HPSK), a new spreading
mode. The light blue frames in the figure are the ones that are related to it. This mode provides the
delay of one chip at the Q tributary of the long code and decimates by 2, thus lowering the
peak/average value of the reverse link signals by 1dB. The dynamic decrease of the signals reduces the
redundancy in the dynamic range required by the power amplifier, allowing more effective use of the
PA and smaller design. Thus the mobile station is able to launch several code division channels in
different power levels and to minimize the peak-to-average value of the signal power.

W416 means #4 code of the 16-chip long Walsh code

Fig. 4-14 I-Q mapping structure of the reverse pilot channel, enhanced access channel, reverse common control
channel, and the reverse T-channel of RC3~4.

4.3.7 Structure of the CDMA Cellular Mobile Communications System at the

Radio Side

The schematic diagram of the switching domain of the CDMA cellular mobile communication system
is shown in Fig. 4-15.

57
Chapter 4 Principles of cdma 2000 1x RTT

Router Router

Fig. 4-15 Structure of the CDMA cellular mobile communications system at the radio side

The abbreviations are illustrated in Table 4-1.

Table 4-1 Abbreviations descriptions

Abbreviations English means
BTS Base Transmitter Station
BSC Base Station Controller
BS Base Station
MS Mobile Station
MSC Mobile Switching Center
HLR Home Location Register
AUC Authorization Center
PSTN Public Switched Telephone Network
PLMN Public Local Mobile Network
PDSN Packet Data Service Node

The Base Station System (BSS) at the radio side comprises two parts: base station controller
(BSC) and base station transceiver (BTS).

BSC is the controlling part of the BSS. BSC is mainly in charge of wireless NM, wireless
resources management, maintenance and management of BSS, call processing, control of MS handoff

58
 Chapter 4 Principles of cdma 2000 1x RTT

and speech coding, together with the support for the high-speed packet data service.

BTS is the radio part of the BSS and is controlled by BSC. BTS provides radio transmission and
the corresponding control function. An MS accesses the CDMA cellular mobile communications
system through radio link by way of BTS.

4.3.8 Basic Call Procedure

This section describes the call establishment procedure when a mobile station originates a call or
terminates a call, for the reader to have basic understanding of the CDMA mobile communication
system. For more procedures involved in the communications, see Sections 4.4.3 and 4.5.5.

1. A mobile station originates a call

Steps:

1) The MS sends an origination message to the BS.

2) The BS returns an acknowledgement to the MS.

3) The BS sends a complete layer-3 message, which is a CM service request, to the Mobile
Switching Center (MSC). The BS also sets the timer T303, waiting for the MSC’s assignment request
message.

4) The MSC sends an assignment request to the BS and the BS closes T303.

5) The BS sends channel assignment message to the MS.

6) Then the BS sends the Null frame to the MS and catches pilot synchronization signal of the
mobile station’s basic traffic channel (TCH).

7) The BS sends to the MS an acknowledgement showing that it has caught the synchronization
signal of the reverse traffic channel pilot.

8) The MS returns the acknowledgement.

9) The MS sends the service connection message and the current FCH configuration information
to the MS

10) The MS accepts the current configuration, and sends the service connection completion

59
Chapter 4 Principles of cdma 2000 1x RTT

message to the BS.

11) The BS returns the assignment complete message to the MSC.

12) The MSC sends the ringback tone to the MS and the MS hooks off, entering the talk status.

Origination message

BS acknowledgement instruction

Complete layer-3 message : CM service request

Assignment request message

Channel assignment message

Tch forward synchronization

BS acknowledgement instruction

MS acknowledgement instruction

Service connection message

Service connection complete

Assignment complete

Ringback tone

Figure 4-16 Procedure of a MS initiating a call

2. MS terminates a call

60
 Chapter 4 Principles of cdma 2000 1x RTT

Steps:

1) The MSC sends a paging request message to the BS and starts timer T3113.

2) The BS forwards the paging request message to the MS.

3) The MS returns the paging response message to the BS.

4) The BS forwards the paging response message to the MSC and starts the timer T303. The MSC
closes T3113 after it receives the paging response message.

5) The BS sends a BS acknowledgement to the MS.

The succeeding steps 6~13 are the same as steps 4~11 in the above procedure of an MS
originating a call.

14) The BS sends a ringing message with specific information to the MS.

15) The MS sends acknowledgement to the BS, acknowledging the ringing message.

16) The MS sends connection command to the BS.

17) After the BS establishes the connection between the mobile stations, it returns
acknowledgement to the MS, acknowledging the connection.

18) The BS establishes connection with the MSC and both parties enter talk status.

61
Chapter 4 Principles of cdma 2000 1x RTT

Paging request

Paging message

Paging response message

Paging response
BS acknowledgement
command
Assignment request

Channel assignment message

Tch forward synchronization

BS acknowledgement
command
MS response instruction

Service connection message

Service connection complete

Assignment complete
Ringing message with
specific information
MS acknowledgement
instruction
Connection instruction

BS acknowledgement
command
Connection

Fig. 4-17 Procedure of an MS being called

62
 Chapter 4 Principles of cdma 2000 1x RTT

4.4 Working Principle of the cdma2000 1xRTT Circuit-Switching

Domain

4.4.1 Architecture of the Circuit-Switching Domain of the CDMA Cellular

Mobile Communications System

The schematic diagram of the CDMA cellular mobile communication system is shown in Fig. 4-18.

MS MSC SCP PSTN

ISDN
Um E PSPDN

Abis A B
BTS BSC MSC/SSP VLR

Q C D G

M N
SC SC HLR VLR

M N
M
SME SME
AUC

Fig. 4-18 Architecture of the circuit-switching domain of the CDMA cellular mobile communications system

The description is given is Table 4-2.

Table 4-2 Abbreviations descriptions

Abbreviation Full name
MSC Mobile Switching Center
VLR Visitor Location Register
HLR Home Location Register
SC Short Message center
SSP Service switching point

63
Chapter 4 Principles of cdma 2000 1x RTT

AUC Authorization Center

PSTN Public Switched Telephone Network
ISDN Integrated Service Digital Network
PSPDN Packet Service Public Digital Network
SME Short Message Entity
BTS Base Transceiver Station
BSC Base Station Controller
BS Base Station
MS Mobile Station

4.4.2 Descriptions of Network Entities

4.4.2.1 Base Station Sub-system

BSS is a general term for wireless equipment and wireless channels control equipment serving one or
several cells. Generally, a BSS contains one more BSCs and BTS. For details, please refer to ZXC10-
BSS Technical Manual.

4.4.2.2 MSC
MSC is a functional entity fulfilling control and switching over the mobile stations in other service
areas, and is also automatic connection equipment between CDMA networks and other public
switching networks or between subscribers of other MSCs. MSC is the center of the CDMA cellular
mobile communication system. It is different from the wired switch in that it must take into account the
allocation of the radio resource and the user’s mobility and should at least do the following things:

1. Location registration processing;

2. Handoff processing.

4.4.2.3 GMSC
When a non-CDMA subscriber calls a CDMA subscriber, the call will first be routed to an MSC, which
will inquires the corresponding HLR and further route the call to the called party’s MSC. This kind of
MSC is called Gateway MSC (GMSC). It is up to the network operator to select which MSCs as
GMSCs.

4.4.2.4 VLR
VLR is responsible for storage and updating of the subscriber data roaming to the mobile station within

64
 Chapter 4 Principles of cdma 2000 1x RTT

the VLR service area, and VLR and MSC are generally joined together. When a mobile station roams to
a new location area, the MSC will notify the VLR, and VLR will originate registration processing to
update subscriber location information. VLR also stores the needed information for call establishment
in the database for MSC search. One VLR can take charge of one or more MSC region (s). Specifically,
the following information is included:

Service item information (PROFILE)

Mobile Identification Number/International Mobile Station Identification (MIN/IMSI)

Shared Secret Data (SSD)

Network (Network)

Electronic Sequence Number (ESN)

Mobile Station Authentication Data (AUTHEN)

Mobile Station Authorization Data (AUTHOR)

Temporary Local Directory Number (TLDN) for the mobile station

Location Area Information (LAI) for the mobile station

4.4.2.5 HLR
HLR provides information storage and management for mobile network subscribers, including
subscription, unsubscription, service authorization and cancellation, etc, and assists subscribers in
completing call and service operations at the same time. One or more HLRs can be set for a CDMA
network according to the subscriber quantity, equipment capacity and networking mode, and the virtual
mode will be employed for multiple HLRs. The subscriber information stored in the HLR includes the
following two types in information:

1. Subscriber subscription information

Some location information that enables the realization of call routing and accounting, such as VLR
address, MSC address and local mobile station identity.

2. Subscriber-related information stored in the HLR

It comprises:

Service item information (PROFILE)

65
Chapter 4 Principles of cdma 2000 1x RTT

Mobile Identification Number/International Mobile Station Identification (MIN/IMSI)

Shared Secret Data (SSD)

Network (Network)

Electronic Sequence Number (ESN)

Mobile Directory Number (MDN)

IMSI/MIN and MDN are often used to access the key assignments of mobile subscriber
database.

The HLR also contains the following mobile subscriber information:

Telecom services

Data services

Intelligent service

Short message service data

Service restriction (such as roaming restriction)

Supplementary service parameters

4.4.2.6 Authentication Center (AUC)

The AUC is a function entity for the management of authentication information related to the mobile
station. It implements mobile subscriber authentication, stores the mobile subscriber authentication
parameters, and is able to generate and transmit the corresponding authentication parameters based on
the request from MSC/VLR. The authentication parameters in the AUC can be stored in the encrypted
form. Generally, AUC and HLR are combined together. The subscriber authentication parameters
stored in AUC include the following:

1. Authentication key (A_KEY);

2. Share Secret Data (SSD);

3. Mobile Identification Number/International Mobile Subscriber Identity (MIN/IMSI);

4. Authentication Algorithm Verification (AAV);

66
 Chapter 4 Principles of cdma 2000 1x RTT

Accounting (COUNT).

4.4.2.7 Short Message Center (MC or SC)

As an independent entity in the CDMA cellular mobile communication system, the short message
center works in coordination with other entities such as MSC and HLR to implement the reception,
storing and transfer of the short messages from CDMA cellular mobile communication system
subscribers, and store subscriber-related short message data.

4.4.2.8 Short Message Entity (SME)

SME is a function entity for composing and decomposing short messages.

4.4.2.9 Operation and Maintenance Center (OMC)

The OMC provides the network operator with network operation and maintenance services,
manages the subscriber information and implements network planning, to enhance the overall working
efficiency and service quality of the system. As the maintenance functions have their respective
emphases, the OMC is divided into OMC-S and OMC-R. OMC-S is mainly responsible for
maintaining the MSS, and OMC-R is responsible for maintaining the BSS. As far as an operation and
maintenance system is concerned, the two parts are not strictly separated. In fact, from the approach of
the whole system, the entire CDMA mobile communication system (including MSC/VLR, HLR/AUC,
SC, BSC, BTS, etc.) should be controlled by a highly efficient operation and maintenance system.

4.4.3 Workflow

The workflow of the CDMA system is divided into mobility management, basic call service, and
handoff.

4.4.3.1 Mobility Management Service

4.4.3.1.1 Registering/De-registering services

Due to the mobility of mobile subscribers, the locations of mobile subscriber are in constant changing
status. In order to obtain easily the mobile subscribers’ location information during processing of call
service, short message service and supplementary services, and in order to enhance the effective
utilization of radio resources, it is required that the mobile subscribers’ locations in the network are
registered and the mobile subscribers’ activation statuses are reported, that is, location registration is
required.

67
Chapter 4 Principles of cdma 2000 1x RTT

The CDMA system supports the following nine registration types:

1. Power-on registration: when an MS is switched on or switched from an analog system to the

CDMA system, the MS initiates a registration.

2. Power-off registration: if the MS has already been registered in the current service system, the
MS initiates registration when it is switched off.

3. Periodic registration: When the timer expires, the MS initiates a registration.

4. Distance-based registration: When the distance between the current MS and the MS of last
registration exceeds the threshold, the MS initiates a registration.

5. Area-based registration: When the MS enters a new registration area, it initiates a registration.

6. Parameter change-based registration: when the MS enters a new system or when the parameters
stored in the MS are changed, the MS initiates a registration.

7. Instructed registration: the MS initiates a registration as required by the BS.

8. Implicit registration: When the MS sends a call initiation message or a paging response message
successfully, the network can determine the location of the MS. This can be regarded as implicit
registration.

9. Traffic channel registration: when the network obtains the registration information of the MS
that has been assigned traffic channel, the network can so inform the MS that it has registered.

A typical registration processing flow is shown in Fig. 4-19.

68
 Chapter 4 Principles of cdma 2000 1x RTT

Fig. 4-19 Registration flow

♦ When the BS receives the registration request from the mobile station, it sends a
Location Update Request message to the current service system (MSC/VLR2) to start the
registration flow;

♦ The current service system sends the registration notification message REGNOT to the
MS’s HLR.

♦ If the MS has previously registered elsewhere, the HLR will send the registration
cancellation notification message REGCANC to the previous system MSC/VLR1, and
MSC/VLR1 will delete all the records of this MS from the database.

♦ MSC/VLR1 returns the registration cancellation result to the HLR.

♦ The HLR returns the registration notification result to MSC/VLR2.

♦ If the registration is successful, MSC/VLR2 will send the Location Update Accept
message to the BS to indicate the successful registration of MS.

Note: in addition to location alteration, the reasons for registration also include periodic
registration, parameter alteration, etc.

A typical de-registration flow is illustrated in Fig. 4-20.

69
Chapter 4 Principles of cdma 2000 1x RTT

Fig. 4-20 De-registration flow

♦ The serving MSC/VLR determines to perform de-registration based on the MS’s power
off indication or other deactivation reasons.

♦ The serving MSC/VLR deletes all the records of this MS and sends the MSINACT
message containing the cancelled registration type parameters to the HLR.

♦ The HLR deletes the pointer that points to the MSC/VLR from the MS data and sends a
null msinact acknowledgement operation to the MSC/VLR.

4.4.3.1.2 MS Deactivation
When a registered roaming MS is confirmed to be inactive, the MSC/VLR will initiate an MS
deactivation operation. A typical flow is shown in Fig. 4-21.

♦ When a registered roaming MS is confirmed to be no longer active, the MSC/VLR marks

the MS as deactivated, and sends the MSINACT message to the HLR.

♦ The HLR sets the MS as deactivated, deletes the pointer of the MSC/VLR, and then
sends the msinact acknowledgement operation to the MSC/VLR.

In addition, MS deactivation can also be reported during registration or in the routreq message.

70
 Chapter 4 Principles of cdma 2000 1x RTT

Fig. 4-21 MS deactivation flow

4.4.3.1.3 Authentication
Authentication is to protect legal subscribers and prevent “intrusion” of fake, illegal subscribers. Each
registered user has been given a subscriber directory number, a mobile identification number (MIN)
and an authentication key (A-KEY). The MIN and A-KEY are written into the subscriber’s mobile
phone by means of air activation service or special equipment. By means of SSD updating, a Shared
Secret Data (SSD) parameter is generated in both the AUC and the subscriber’s mobile phone to be
used for future authentication and encryption algorithm calculation. If the VLR visited supports SSD
sharing, this SSD is also saved in the VLR. The 128-bit SSD is divided into two parts, which are
respectively used for 64-bit SSD_A for authentication calculation and the 64-bit SSD_B for the
encryption calculation.

The SSD generation algorithm and the authentication algorithm are sketched in Fig. 4-22

71
Chapter 4 Principles of cdma 2000 1x RTT

RANDSS D ES N

RANDS SD E SN A-key
56 32 64

S S D_Gener a tion
Pr oce du re

S S D A NEW S SD_B _NEW

64 64

SSD Illustration of SSD generation algorithm

RAND_CHALLENGE ESN AUTH_DATA S

SSD_AUTH

RAND E SN MIN1 SSD_A

32 32 24 64

Au th_Sign a tu r e
Pr oce du re

AUTH_SIGNATURE

AUTHR
18

Fig. 4-22 Schematic diagram of SSD generation and authentication algorithm

The authentication procedure includes the following types:

72
 Chapter 4 Principles of cdma 2000 1x RTT

1. System authentication at the time of registration, call originating and call terminating (Global
Challenge);

2. Unique challenge with MS being idle or on traffic channel;

3. SSD updating.

4.4.3.1.3.1 System Authentication

With registration as example, a typical flow of system authentication is shown in Fig. 4-23.

Fig. 4-23 System authentication at the time of registration

1. If AUTH=1 in the air interface OMT message, it indicates that authentication is necessary at
system access, The RAND for the authentication is also provided by the BS; the MS uses
RAND and the SSD-A and MIN/ESN data that it has stored to execute the CAVE algorithm to
obtain an authentication result AUTHR.

2. The MS registers in the new serving MSC/VLR, and provides authentication parameters such as
MIN/ESN, AUTHR, RANDC, COUNT in the Location Update Request message.

73
Chapter 4 Principles of cdma 2000 1x RTT

3. MSC/VLR sends the authentication request message AUTHREQ to the HLR/AC, and the
HLR/AC executes the CAVE algorithm using the MIN/ESN, RAND and currently stored SSD-
A to calculate the authentication result AUTHR, and compares the result with the MS-sent
AUTHR.

4. HLR/AC returns the authentication result “authreq” to the MSC/VLR.

5. If the authentication is successful, the MSC/VLR will initiate the registration service.

6. HLR returns the registration result.

Unique Challenge
When MS is idle or on the traffic channel, the AC can initiate unique challenge. If the SSD is shared,
the unique challenge can also be initiated by the VLR. A typical flow is shown in Fig. 4-24.

Fig. 4-24 Flow of unique challenge

SSD Update
When the SSD values of the MS do not match with those in the AC, or if required by security reasons,
it is necessary to perform SSD update to the MS.

A typical SSD update flow is shown in. Fig. 4-25.

74
 Chapter 4 Principles of cdma 2000 1x RTT

Fig. 4-25 SSD update flow diagram

4.4.3.2 Basic Call Services

Basic service call includes local call, outgoing call, in-coming call and tandem call. The last three must
be supported by inter-office signaling systems , which are divided into channel associated signaling and
common channel signaling depending on the types. Common channel signaling is suitable for signaling
transfer between SPC exchanges, while channel associated signaling is suitable for communication
between DT, ABT, SFT, etc. and other offices.

The mobile call of the CDMA wireless access system ZXC10-MSC/VLR/SSP is controlled by a
procedure, as illustrated in Fig. 4-26. This procedure can either be in the position of calling or being
called. It can also perform the corresponding calls by cooperating with ISUP, TUP and CAS.

75
Chapter 4 Principles of cdma 2000 1x RTT

Mobile call procedure

ISUP procedure
TUP procedure
Common associated
signaling procedure

Fig. 4-26 Mobile call procedure

4.4.3.2.1 Mobile Originated Call

With a mobile-fixed call as an example, the typical flow is shown in Fig. 4-27:

Fig. 4-27 Mobile originated call

76
 Chapter 4 Principles of cdma 2000 1x RTT

The BS sends the CM Service Request message to the MSC, carrying the called number and other
parameters needed to establish the call.

If the subscriber is legal, the MSC sends the Assignment Request message to the BS, to start to
assign terrestrial circuit s and instruct the BS to assign traffic channels for the MS.

The BS implements channel assignment and then sends the Assignment Complete message to the
MSC.

Note: d, e, f.: connection to the called party through TUP or ISUP signaling is maintained until the
commencement of the conversation.

4.4.3.2.2 Mobile Terminated Call

With a fixed-mobile call as an example, the typical flow is shown Fig. 4-28.

1. GMSC sends the IAM message to the called party, carrying the called address.

2. MSC sends the paging request message to the BS where the called MS is located.

3. The BS sends the paging response message to the MSC.

4. d and e perform assignment of terrestrial circuits and air channels.

5. The BS sends the ACM message to the caller, and the caller hears the ring-back tone.

6. Called party hooks off

77
Chapter 4 Principles of cdma 2000 1x RTT

Fig. 4-28 Mobile terminated call

4.4.3.3 Handoff
During a call, if the MS needs to change the traffic channel for any reason, a handoff will occur. In the
CDMA system, handoffs can be divided into soft handoff and hard handoff. Soft handoff requires that
the channel frequency and Selection Distribution Unit (SDU) are not changed during the handoff, thus
to avoid interruption during the call. By the entities involved, the handoff procedure can be divided into
intra-BS handoff, inter-BS handoff, and inter-MSC handoff. The following introduces some typical
handoff procedures.

Soft handoff

A soft handoff is usually implemented within the BS, and it will be notified to the MSC in a
Handoff Performed message, as shown in Fig. 4-29.

Fig. 4-29 Soft handoff

Hard handoff

With an inter-MSC forward handoff as example, the typical hard handoff flow is shown in Fig. 4-
30.

78
 Chapter 4 Principles of cdma 2000 1x RTT

Fig. 4-30 Hard handoff

1. The source BS sends the Handoff Required message to the serving MSC to initiate a handoff.

2. The serving MSC sends the FACDIR2 message to the destination MSC to order the destination
MSC to start the forward handoff program.

3. The destination MSC sends the Handoff Request message to the destination BS to request the
destination BS to assign the corresponding resources to the MS.

4. The destination BS acknowledges the handoff request with the Handoff Request ACK message.

5. The destination MSC acknowledges the forward handoff command with facdir2.

6. The serving MSC sends the Handoff Command message to the source BS to order the MS to
start the handoff.

7. The MS starts the handoff.

8. The MS reports handoff completion to the destination MSC.

9. The destination MSC notifies the original serving MSC about the handoff completion with the
MSONCH message.

4.5 Operation Mechanism of the cdma2000 1x Packet Domain

4.5.1 Position of PDSS in the Network

As an access gateway, the Packet Data Serving Node (PDSN) provides Simple IP and Mobile IP access
modes for the cdma2000 mobile station to access Internet or Intranet. Cdma2000 1X provides

79
Chapter 4 Principles of cdma 2000 1x RTT

maximum access rate of 144 kbps to each user and cdma2000 EV-DO provides maximum access rate
of 2M to each user.

Compared with IS-95, in order for the cdma2000 user data service to access, the cdma2000-1X
core network should be added with PDSN, HA (providing Mobile IP service) and AAA; these three
functional entities are generally referred to as the ZXPDSS system; the cdma2000-1X access network
should be added with PCF functional entity. These new devices are required by the packet data service
transmission to provide high-speed access to the Internet, videophone, and e-commerce to the users in
the 3G mobile communication system.

The structure of cdma2000-1X network is illustrated in Fig. 4-31.

Fig. 4-31 Structure of the CDMA1X network

The position of the ZXPDSS system is illustrated in the figure. MS, BTS, PCF, PDSN, AAA, and
HA work together to carry out the cdma20001X packet data service. The functional entities of the
packet switched core network include: Packet Data Serving Node (PDSN), Home Agent (HA),
Authentication, Authorization, and Accounting (AAA) server.

80
 Chapter 4 Principles of cdma 2000 1x RTT

4.5.2 Major Functions of the Network Entities of the PDSS System

4.5.2.1 PDSN
PDSN provides the Internet or Intranet access service to the cdma2000 mobile stations.

PDSN is the interface connecting the Radio Network (RN) and the Packet Data Network (PDN).
Its major function is to provide Simple IP access or Mobile IP access services to the mobile stations, so
that the users can access the public data network or private data network. In case of Simple IP access,
PDSN works like a network access server (NAS); for Mobile IP access, PDSN acts as a foreign agent
(FA) of the MS. It is also involved in the authentication and accounting for users.

When providing Mobile IP access service, PDSN works as an FA. FA is a router located in the
mobile station visit network. It provides IP care-of-address and IP routing service to the MS. (The
precondition is that the MS must be registered in the HA). For the data sent to the MS, the FA fetches
the IP data packets from the tunnels of the HA and forwards them to the MS; for the data sent from the
MS, the FA works as a default router or uses the reverse tunnel to forward them to the HA.

4.5.2.2 HA
HA is a router in the MS home network. It is responsible for maintaining the current location
information of the MS and establishing the correspondence between the MS’s IP address and the MS’s
forwarded-to-address. When the MS leaves the registration network, it needs to register to the HA.
After the HA receives the data packets destined to the MS, it forwards them to the forwarded-to-address
of the MS through the tunnel between HA and FA. The forwarded-to-address decapsulates the packets
and sends them to the MS, hence implementing the Mobile IP function.

Simple IP does not need HA, but Mobile IP needs.

4.5.2.3 AAA Server

AAA refers to Authentication, Accounting, and Authorization Server. This function is carried out by the
Radius server. It authenticates the user’s script file information, authorizes the data services, and
performs accounting accordingly.

AAA is divided into service AAA, intermediate AAA and home AAA.

The service AAA is located in the service network (also known as the visit access provision
network), and is connected with the PDSN in the service network. The home AAA is located in the
home network and is connected with the HA in the home network in case of Mobile IP access. If the
MS is not roaming, then the service AAA and the home AAA are combined into one. The intermediate
AAA is in the intermediate network (optional, contingent upon the actual circumstances). It has

81
Chapter 4 Principles of cdma 2000 1x RTT

security relationships with the service AAA and the home AAA and is used to transmit AAA message
securely between the service AAA and the home AAA. Sometimes there are more than one
intermediate AAA servers between the service AAA and the home AAA.

4.5.3 Protocol Requirements

4.5.3.1 Simple IP Protocol

Fig. 4-32 Model of the simple IP protocol

The processing of Simple IP is easy. In the R-P interface side, A11 adopts UDP; the PPP data
packets are encapsulated with GRE and then A10 adopts UDP. Thus the original IP packets are first
encapsulated then routed. The WAN interfaces are first PPP processed, GRE encapsulated, and then
routed to the R-P interface. If the PPP is directly terminated at the access server, then the packets are
only GRE encapsulated and then directly routed.

R-P Interface WAN Interface

IP GRE PPP IP

IP GRE PPP IP

82
 Chapter 4 Principles of cdma 2000 1x RTT

Fig. 4-33 Processing of the simple IP data

4.5.3.2 Mobile IP Protocol

Fig. 4-34 Control model of the Mobile IP protocol

83
Chapter 4 Principles of cdma 2000 1x RTT

Fig. 4-35 Data model of the Mobile IP protocol

Compared with Simple IP in terms of data processing, the Mobile IP establishes reverse tunnel and
is added with reverse tunnel processing.

R-P Interface WAN Interface

IP GRE PPP IP

IP GRE PPP IP Tunnel

Fig. 4-36 Processing procedure of the Mobile IP data

Another difference from Simple IP is that it has the HA; the authentication needs the involvement
of the HA. The PPP link is established differently; the registration, authentication, and authorization
should be performed as required by Mobile IP. There is also an interaction with the HA to establish a
reverse tunnel.

PDSN needs to support both Mobile IP and Simple IP and needs to do so in one PPP link. When
the mobile terminal is having Simple IP service and wants to apply for Mobile IP service, then the
PDSN can support both Mobile IP and Simple IP in one PPP link. If the mobile terminal is having
Mobile IP service and wants to apply for Simple IP service, then it needs to re-negotiate the PPP. This
is because the PPP of Mobile IP does not perform CHAP or PAP authentication, whereas that of Simple
IP does.

4.5.3.3 A10/A11 Interface Protocol

R (Radio)-P (Packet) interface refers to the interface between the radio access network and the packet
core network, in particular the interface between PCF and PDSN.

4.5.3.3.1 Protocol Sublayer of the R-P Interface

The protocol stacks of the A10 and A11 interfaces are as follows:

84
 Chapter 4 Principles of cdma 2000 1x RTT

A10 interface:

GRE
IP
Link layer
Physical layer

A11 interface:

IOS application
UDP
IP
Link layer
Physical layer

The UDP application in the A11 interface follows the corresponding definitions of RFC2002 –
Application of UDP in Mobile IP.

4.5.3.3.2 Application of the Mobile IP Protocol

The “IOS application” layer in the A11 interface uses Mobile IP-based message transport control
signaling and accounting. The A11 interface uses the well-known port (699) of the Mobile IP. Each
control message is transmitted in the UDP data packets. The startup program (PCF) connected to A10
chooses an appropriate source UDP port and sends the connection request message to the selected UDP
port 699 of the PDSN. The receiving side (PDSN) sends a response message to the UDP port of the
startup program (PCF).

1) Registration request

In the cdma2000 network, an MS establishes a connection by sending origination message to

BS/PCF through the radio network. After the BS/PCF receives the call establishment command, it
sends a registration request message to PDSN to create a new A10 connection.

BS/PCF sends the registration request message that is encapsulated in GRE frame and that has the
reverse tunnel bits. The Home Address field is set as 0. The Home Agent field is set as the IP address of
the PDSN. The forwarded-to-address field is set as the IP address of the BS/PCF.

85
Chapter 4 Principles of cdma 2000 1x RTT

After the PDSN receives a registration request message, the information in the Session Specific
Extension is used to identify a packet data session. When the registration is accepted, it is used to create
the GRE tunnel used by the MS.

2) Registration answer

According to the processing procedure depicted in RFC2002, PDSN sends a registration response
message. The local address field is the same as that of the corresponding registration request message.
The message should contain the session specific extension.

3) Registration update/acknowledgement

RFC2002 defines two new messages to support PDSN initiating the disconnection of the A10/A11
connection and accelerating the recovery of the BS/PCF side resources.

When the information related to a call changes, the registration update message is used to notify
the concerned parties. When the handoff between BS/PCF happens, PDSN will notify the source
BS/PCF.

The registration update message uses the well-known port number 699 of the Mobile IP. The
registration response message is sent to the corresponding source port. Each control message is
transported in the UDP data packet.

4.5.3.3.3 Application of the General Routing Encapsulation (GRE) Protocol

The upper layer of the A10 interface is the General Routing Encapsulation (GRE) protocol defined in
RFC1701.

GRE encapsulates the user service in the following form:

GRE header User service

Fig. 4-37 GRE encapsulates user service

86
 Chapter 4 Principles of cdma 2000 1x RTT

0 1 2 3 Bit number

1 2 3 4 5 6 7 8 9 1 2 3 4 5 6 7 8 9 1 2 3 4 5 6 7 8 9 1
0 0 0 0

C R K S s Recur Flag Version Protocol type Octet: 1-4

No.
Key value Octet: 5-8
Sequence number (optional) Octet: 9-12

Fig. 4-38 GRE header

The flag bit and other fields of the GRE header are coded as follows:

C (checksum flag (Present)) ‘0’

R (Routing flag) ‘0’

K (Key value flag) ‘1’

S (Sequence number flag) ‘0/1’

s (Strict source route flag) ‘0’

Recur (Recursion control) ‘0s’

Flags: ‘0s’

Version No. ‘0s’

Protocol type Hex‘88 0B’ (PPP type)

(Note: the current

TIA/EIA/IS-835 does not
support this value; it is
reserved for pure PPP).

Hex ‘88 81’ is used in

87
Chapter 4 Principles of cdma 2000 1x RTT

Unstructured byte stream.

BS/PCF and PDSN set the key-value field of the GRE header as PCF Session Identifier (PSI)
related to a call. If the link layer/network layers require the packet data to be transmitted in sequence,
then the sequence number field is used. The sequence number refers to the sequence number of each
packet data packet. At the start of the packet session, BS/PCF and PDSN set the sequence number as 0.
For a specific session, the packet data packets have continuous sequence numbers. The sequence
number has the Roll-overs function. For PPP and async PPP that require sequential reception of the
packet data, if the packet data reaching BS/PCF or PDSN loses the correct sequence, then the receiving
entity will attempt to recover the correct packet sequence before it transmits the packet data to the PPP
layer.

4.5.4 Service Requirements

The cdma2000 packet data service is totally based on the IP technique. In order for the user to use the
packet data service, the mobile terminal establishes an IP connection with the network; all the services
go through that IP connection. On the basis of this IP connection, the cdma2000 packet core network
provides multiple basic services to the mobile user.

4.5.4.1 Public Network Access Service

The various services, including E-mail, FTP, WWW, and e-commerce provided by the Internet are all
available in the mobile terminal via such IP connection. The public network access services are divided
into two types by the mobile user’s access modes:

1) Public network access service based on the Simple IP

When a user uses Simple IP to access, he will be allocated a dynamic IP address from the service
access provider. The user can maintain such IP address in the network within certain geographical area.
But when the user moves out of the above geographical area, such IP address is no longer valid.

2) Public access service based on the Mobil IP

When a user uses Mobile IP to access, he can use either the static IP address or dynamic IP
address, depending on his home IP network. The user can maintain his IP address while moving in the
area of the cdma2000 network or other networks.

88
 Chapter 4 Principles of cdma 2000 1x RTT

4.5.4.2 Private Network Access Service

Virtual Private Network (VPN) refers to the enterprise network built on the public network platform. It
is not confined by geographical limitations but is controlled and managed uniformly by the enterprise.
The cdma2000 packet core network provides private radio data network for the enterprise users and
private access service to the mobile users.

The private network access services are divided into two types by the mobile user’s access modes:

1) Private network access service based on the Simple IP

2) Private access service based on the Mobil IP

4.5.4.3 WAP/Brew and Other Bearer Services

As a packet bearer platform, the cdma2000 packet core network provides WAP and/or Brew bearer
service and on such basis provides multiple applications based on WAP and/or Brew.

4.5.5 Flow of Communication

4.5.5.1 The Initiation and Termination of the Simple IP Service that Needs AAA
Fig. 4-39 shows the communication flow of the initiation and termination of the Simple IP service that
needs AAA.

89
Chapter 4 Principles of cdma 2000 1x RTT

MS RN PDSN AAAf AAAh

Access Network Procedure

1）
Start Packet Service
2）
Begin PPP Establishment
3）
Auth/profile reuest
4）
Auth/profile reuest
5）
Auth/profile response
6）
Auth/profile response
7）
Complete PPP Establishment AAA accounting start
8）
User Data (over PPP) AAA interim accounting
9）
Access Network Procedure
10）
End Packet Service
11）
AAA accounting stop
12）

Fig. 4-39 Initiation of the Simple IP with AAA

1) The terminal MS uses the network access procedure to register in the radio access network.

2) The terminal MS initiates the establishment of the Packet Data Session. RN sends to PDSN an
instruction message of establishing a new Packet Data Session.

3) PDSN establishes a PPP session with the terminal MS.

4) If CHAP or PAP is used to establish PPP, then the PDSN sends authentication request that
includes User Service Profile to the visit AAA server.

5) The visit AAA server forwards the authentication request to the MS’s home AAA server.

6) The home AAA server sends the authentication response to the visit AAA server.

90
 Chapter 4 Principles of cdma 2000 1x RTT

7) The home AAA server forwards the authentication response to the PDSN.

8) PPP session is established. The PDSN sends the authentication start message to the visit AAA
server which forwards the message to the home AAA server.

9) The terminal MS and the PDSN uses PPP session to transmit data. During the transmission,
alternatively, PDSN sends interim accounting message to the visit AAA which forwards the
message to the home AAA.

10) The terminal MS sends the logout service request to the radio access network and uses the
network access procedure to terminate the Packet Data Session.

11) RN sends the PDS termination message to PDSN.

12) PDSN sends the accounting termination message to the visit AAA server which forwards the
message to the home AAA server.

4.5.5.2 Mobile IP Service Initiation

Fig. 4-40 shows the communication flow of the Mobile IP service initiation.

1) The terminal MS uses network access procedure to register in the radio access network.

2) The terminal MS initiates establishment of the Packet Data Session. RN sends to PDSN an
instruction message of establishing a new Packet Data Session.

3) PDSN establishes a PPP session with the terminal MS.

4) After the PPP session is established, PDSN sends to the terminal MS agent broadcast; or the MS
sends to PDSN agent request message.

5) MS sends to PDSN MIP registration request message that includes NAI and FAC response
message.

6) By AAA protocol, PDSN sends to the visit AAA server the authentication request.

7) The visit AAA server decides to forward to the authentication request message to the
appropriate home AAA server according to NAI. The forward can be via the Broker AAA.
(Broker AAA is not shown in Fig. 4-40)

8) The home AAA server sends to the visit AAA server the authorization response message that
can be transferred between the visit and home network via the security alliance.

9) The visit AAA server forwards the authorization response message to the PDSN.

91
Chapter 4 Principles of cdma 2000 1x RTT

10) If there is no IP secure connection between the visit and home networks, alternatively, the
PDSN can establish IP secure connection with HA via IKE. The establishment of the secure
connection requires the AAA authorization response message to transfer the IKE pre-shared
key or the certificate exchange in the IKE. If the AAA server returns the home-visit
authentication extension key and SPI, then PDSN does not need the IKE to establish IP secure
connection with HA.

MS RN PDSN AAAf AAAh HA

Access Network Procedure

1）
Start Packet Service(R-P)
2）

3） Establish PPP

4） Agent Advertisement

MIP Reg Req

5）

6） Auth reuest

Auth reuest
7）

8） Auth response

Auth response
9）
IKE or Securitu Relationship (Optional)
10）
MIP Reg Req
11）
MIP Reg Reply
12）
MIP Reg Reply AAA Start Acct
13）
User Data (over PPP) AAA Interim Acct (Optional)
14）

Fig. 4-40 Mobile IP service initiation

92
 Chapter 4 Principles of cdma 2000 1x RTT

11) PDSN sends MIP registration request message (RRQ) to HA.

12) HA sends MIP registration response message (RRQ) to PDSN.

13) PDSN records the response in the List of Visitors and forwards the registration response
message to the MS. PDSN sends the accounting start message to the visit AAA. Alternatively,
this message can be forwarded by the Broker AAA server.

14) MS and PDSN use PPP session to transmit data to each other. Alternatively, PDSN can send
interim accounting message to the visit AAA server; this message can be forwarded by the
Broker AAA server.

4.5.5.3 Handoff Between RNs in Areas Managed by One PDSN

Fig. 4-41 shows handoff between RNs in the areas managed by one PDSN

1) PDSN and the terminal MS use PPP session to transmit data to each other.

2) When the radio system determines that hard handoff is required between RNs, the serving RN
sends the handoff request to the target RN. According to the current handoff procedure, VLR is
responsible for forwarding the handoff request.

3) The target RN allows the handoff request from the serving RN and sends the response message
to the serving RN via the handoff procedure in the VLR.

MS RN RNt PDSN

User Data Dorrmant

1）
Origination Request Message (Data Ready Indicator)
2）
R-P Setup
3）
Close old R-P
4）
Traffic Channel Transfer
5）
Establish Packet Service
6）

Fig. 4-41 Handoff between RNs in areas managed by the same PDSN

93
Chapter 4 Principles of cdma 2000 1x RTT

4) PDSN initiates a process to clear the R-P session with the source RN. The serving RN notifies
the terminal MS to execute the hard handoff to the target RN.

5) The traffic channel is handed off from the serving RN to the target RN.

6) The target RN notifies the PDSN to establish Packet Data Session and sends the IMSI or
terminal ID to PDSN. PDSN uses IMSI or the terminal ID to know which current R-P session
is handed off to the target RN.

4.5.5.4 Hard Handoff Between PDSNs When Mobile IP Access

Fig. 4-42 shows the hard handoff between PDSNs in the case of Mobile IP access.

MS RNs RNt PDSNs PDSNt AAA

User Data
1）
Hard Handoff Request (packet parameters, Session ID)
2）
Hard Handoff Response
3）
Close old R-P
Hard Handoff Directive
4）
Transfer of Traffic Control
5）
Start Packet Service (Session ID)
6）
Close Packet end point AAA interim Record(Optional)
7）

Reminder of Flow same as Flow 11-2 setp (3)-(13)

Fig. 4-42 Hard handoff between PDSNs in the case of mobile IP access

1) The terminal and the serving PDSN transmit data to each other via the PPP session.

2) When the radio system determines that hard handoff is required between the RRCs, the serving
RN sends handoff request to the target RN. Such request includes the packet parameters (such

94
 Chapter 4 Principles of cdma 2000 1x RTT

as connection ID) for fast handoff of the packet data. This message is forwarded between the
RNs according to the current handoff procedure.

3) The target RN allows the handoff request from the serving RN and sends response message to
the serving RN via the current handoff procedure in the VLR.

4) The serving RN notifies the terminal MS to execute the hard handoff to the target RN.

5) The traffic channel is handed off from the serving RN to the target RN.

6) The target RN notifies the target PDSN to establish the Packet Data Session and sends the
connection ID to the target PDSN. The target PDSN uses the connection ID to establish a new
R-P session.

7) After the handoff is finished, the serving RN notifies the serving PDSN that the tunnel
termination point is closed; this tunnel termination point is MS’s and is in the serving RN
before the handoff. Alternatively, the serving PDSN can send the AAA interim accounting
record to the AAA server.

8) Other steps of the procedure (including establishment of the PPP session and registration of the
Mobile IP) are the same as steps 3~13 in Section 4.5.5.2 Flow of the initiation of the mobile IP
Service.

4.5.5.5 Flow of the Network Terminating Simple IP Service

Fig. 4-43 shows the flow of the network terminating Simple IP service.

MS RN PDSN AAAf AAAh

Idle PPP or LCP Terminaion

1）
End Packet Service
2）
AAA acct stop
3）

Fig. 4-43 The network terminated simple IP service

95
Chapter 4 Principles of cdma 2000 1x RTT

1) When the dormant PPP session in PDSN expires, the PDSN sends LCP termination message to
the MS or the MS sends LCP termination message to the PDSN to terminate the data session
between PDSN and MS.

2) PDSN sends the instruction message of data session termination to RN.

3) PDSN sends the accounting termination message to the visit AAA server which forwards the
message to the home AAA server.

4.5.5.6 Flow of MS Terminating Mobile IP Service

Fig. 4-44 shows the flow of MS terminating Mobile IP service.

1）

2）

3）

4）

5）

6）

Fig. 4-44 MS terminated mobile IP service flow

1) MS and PDSN transmit data to each other via the PPP session.

2) MS sends the mobile IP de-registration message to PDSN (the lifetime in the Mobile IP
registration request RRQ is 0) which forwards the message to the HA.

3) The HA sends the Mobile IP de-registration response message to the PDSN, instructing that the

96
 Chapter 4 Principles of cdma 2000 1x RTT

Mobile IP service is terminated; the PDSN forwards the message to the MS.

4) If there are no other data sessions between PDSN and MS, then PDSN sends the LCP
termination message to the MS. The MS can also send the LCP termination message to the
PDSN according to the Mobile IP de-registration response message.

5) PDSN sends the instruction message of data session termination to RN.

6) PDSN sends the accounting termination message to the visit AAA server which forwards the
message to the home AAA server.

4.5.5.7 Flow of the Network Terminated Mobile IP Service

Fig. 4-45 shows the flow of the network terminated mobile IP service.

1）

2）

3）

4）

5）

Fig. 4-45 The network terminated mobile IP service

1) MS and PDSN transmit data to each other via the PPP session.

2) Due to the fact that the MS is powered off, dormant, or not in the network serving coverage, the
Mobile IP registration time expires.

3) If there are no other data sessions between PDSN and MS, then PDSN sends LCP termination
message to the MS.

4) PDSN sends the instruction message of data session termination to RN.

97
Chapter 4 Principles of cdma 2000 1x RTT

5) PDSN sends the accounting termination message to the visit AAA server which forwards the
message to the home AAA server.

4.5.5.8 Dormant Handoff Under the Control of One PDSN

Fig. 4-46 shows the dormant handoff under the control of one PDSN.

1）

2）

3）

4）

Fig. 4-46 Dormant handoff under the control of one PDSN

1) The data session in the MS and RN is in the dormant state.

2) The MS roams into an area whose packet field ID changes, the MS sends the start request
message to the target RN to indicate if the data is in the ready-to-send state.

3) The target RN selects and establishes the session with the serving PDSN.

4) The serving PDSN sends to the serving RN the message that the session has been handed off to
the target RN.

98
 Chapter 4 Principles of cdma 2000 1x RTT

Exercise

1. Describe briefly the features of the Turbo code. What channel is it used in cdma2000 1x?

2. What does radio configuration mean?

3. What is orthogonal transmit diversity? Is there any other diversity transmitting modes?

4. What is HPSK modulation?

5. Describe briefly the enhancement of cdma2000 1xRTT’s performance over IS-95.

6. Describe the basic structure of the cdma2000 1x network.

7. Describe briefly the basic functions of MSC VLR and HLR.

8. Describe briefly the basic flow of the registration.

9. Describe the working principles of PDSS.

10. Describe the major functions of PDSN and AAA.

11. Describe the basic working principles of Mobile IP.

12. Please depict the procedure of the hard handoff between the PDSNs when the mobile terminal
accesses the network with the Mobile IP protocol.

99
Chapter 5 Evolution of cdma2000 1x EV and ZTE HRPD Solution

Chapter 5 Evolution of cdma2000 1x EV and ZTE HRPD

Solution

Objectives
After learning this chapter, you shall be able to:

♦ Get acquainted with the history of cdma2000 radio-side standards

♦ Learn the basic features of cdma2000 1xEV-Do scheme and cdma2000 1xEV-DV
scheme

♦ Master the evolution scheme from ZTE to cdma2000 1xEV.

Introduction

This chapter introduces some basic principles and development about 3G.It covers some stages of 3G
development, centering on cdma2000 1x EV-DO. At present, the prospect of cdma2000 3x RTT is not
clear yet. So, only brief introduction is given about it.

5.1 Evolution of cdma2000 Radio-Side Standards

5.1.1 3G Mobile Communications

5.1.1.1 General
The aims of the 3G mobile communication system include: highly consistent design around the world;
compatibility with the services of fixed network; high service quality; small terminal usable around the
world; global roaming capability; terminal supporting the multi-media function and extensive services.
To achieve the above aims, the 3G Radio Transmission Technology (RTT) is required to support the
high-speed multi-media service (high-speed mobile environment: 144 kbps; Outdoors walking

100
 Chapter 5 Evolution of cdma2000 1x EV and ZTE HRPD Solution

environment: 384 kbps; Indoor environment: 2 Mbps), acquire higher frequency spectrum than the
current system and meet some other basic requirements.

In the 18th session of ITU TG8/1 held in Helsinki, Finland, the IMT-2000 recommendations’ radio
interface technical specification, IMT.RSPC, was passed. It finally established the radio interface
technical specifications contained in IMT-2000.

As the most important conclusion of the conference, on the radio interface technical specification,
IMT.RSPC, clearly classifies the radio interface technical specifications as the following 5 standards:

CDMA technique:

♦ IMT-2000 CDMA DS corresponds to WCDMA

♦ IMT-2000 CDMA MC corresponds to cdma2000.

♦ IMT-2000 CDMA TDD corresponds to TD-SCDMA and UTRA TDD.

TDMA technique:

♦ IMT-2000 TDMA SC corresponds to UWC-136.

♦ IMT-2000 FDMA/TDMA corresponds to DECT.

The above 5 names was shortened by ITU as IMT-DS, IMT-MC, IMT-TD, IMT-SC and IMT-FT.
See Fig. 5-1. We can say that the IMT-2000 land radio interface specifications consist of five standards.

Fig. 5-1 IMT-2000 ground radio interface specifications

101
Chapter 5 Evolution of cdma2000 1x EV and ZTE HRPD Solution

5.1.1.2 Technical Features and Market Prospect of 3G

In the 3G mobile communication system, the intelligent signal processing technique is adopted to
implement the multimedia data communication primarily based on the voice services. With more
powerful capability to provide the multimedia services and extremely huge communication capacity,
the 3G mobile communication system will bring to the human being tremendous changes and become
the multimedia mobile communication system covering the whole world. Generally speaking, the 3G
has three major features:

♦ Implement the global roaming of the same mobile phone, making it possible to fulfill the
communication between any people at any time and any place;

♦ High transmission rate. In the static or walking conditions, the data transmission rate is
up to 2.4 Mbps; In the vehicle conditions, the data transmission rate is up to 384 kbps;

♦ Capable of providing the communication services of different standards.

The UMTS forum, which is composed of the global telecom industry and the telecom supervisory
institutions, believes that 3G can provide 7 kinds of services, pure voice service, the multi-purpose
voice (like the internet voice service), the positioning service, the mobile Internet access, the
multimedia information service, the mobile intranet/internet access and the customized information and
entertainment service.

It is estimated by the UMTS that the 3G service providers around the world hope to make a total
income of USD 300 billion by 2010. From 2001 till 2010, the global 3G service market will amount to
USD1 trillion, with the 3G service subscribers amounting to 700 million.

As for the geographic distribution of the 3G development, it is estimated by the UMTS that Asia
and the Pacific Area will lead in the world. In 2010, the total amount of the 3G service market in that
area will amount to USD120 billion, occupying over 37% of the global market, higher than any other
areas.

According to the estimation of the UMTS, at that time, the information and entertainment services
will generate the most income for Asia and the Pacific area (36%) and the next is the voice only service
(28%); It is the same case with Europe: The top two income sources are the information &
entertainment service (28%) and the pure voice service (27%). In the North America, the case is
different. Most of the income will come from the Intranet/Internet access service (31%) and the next to
it is the voice only service (26%), with the information & entertainment service only accounting for
9%.

102
 Chapter 5 Evolution of cdma2000 1x EV and ZTE HRPD Solution

5.1.2 General Description about the Development of cdma2000 Radio-Side

Standards

The development of the CDMA radio side standards can be illustrated by Fig. 5-2.

According to Fig. 5-2, the evolution of the CDMA radio-side standards primarily consist of the
following phases:

♦ cdmaOne: The voice service takes the dominating position, belonging to the 2G mobile
communications.

♦ cdma2000 1x: Support both the voice service and the data service. Its highest data rate
can be 153 kbps.

♦ cdma2000 1xEV-DO: The enhanced version of the 1x Phase 1, supporting the data
service, with the highest forward rate amounting to 2.4 Mbps.

♦ cdma2000 1xEV-DV: The enhanced version of the 1x Phase 2, supporting the voice and
data service, with the highest data rate amounting to 4 Mbps or higher.

Voice service153K Voice and 4M or higher

Mainly voice service 2.4M data service
data service data service

cdma200
0
HRPD
cdma200
0
cdmaOne
cdmaOne 1X
cdma2000
1XEV-DV
2G

3G
New mobile terminals can roam to the original network

Original mobile terminals can roam to the new network

ZTE cdma2000 ALL IP BSS

Fig. 5-2 Evolution of the radio side standards

103
Chapter 5 Evolution of cdma2000 1x EV and ZTE HRPD Solution

IS-95 is the first released standard among the cdmaOne series. IS-95A is the first CDMA standard
that is widely applied around the world. It supports the 8K coding voice service and the STD-008
standard of the 1.9 GHz CDMA PCS system. The 13 kbps encoding voice service is very close to the
wireline telephone in the voice quality. As the mobile communications have an increased demand for
the data service, Qualcomm Corp., U.S.A announced in Feb. 1998 the application of the IS-95B
standard in the CDMA fundamental platform. IS-95B can enhance the performance of the CDMA
system, increase the data throughput of the user mobile communication equipment, and provide the
support for the 64 kbps data service. Later, cdma2000 became the standard for the transition of the
CDMA system to the 3G system.

At present, with the rapid development of mobile communications, the successful operation of
China Unicom’s IS-95A enhanced CDMA cellular mobile communication system and the construction
of the cdma2000-1x mobile communication network system, the cdma2000-1x has come into the
commercial application stage. At the same time, the enhanced technologies in the cdma2000-1x system
tend to substitute the cdma2000-3x technology and become the 3G technology standards under the
future CDMA evolution system.

With the adventure of the information age, the data services are developing toward diversification,
large capacity and asymmetry. The limited 1x data service capability cannot meet the demands of future
service development. In order to meet the fast growing data services, ZTE is always trying to grasp the
spirit of the age and keep pace with the latest development of the world telecom industry based on its
concept of Maximizing Users’ Benefits and its corporate culture of Providing Quality Service and
Gathering Faithful Customers. It is the first in China to put the cdma2000-1x mobile communication
system into operation and the first in China to successfully develop the cdma2000-1x EV-DO mobile
communication system. Soon, its development of the cdma2000-1x EV-DV mobile communication
system will bear fruit.

cdma2000 HRPD, also called HDR and 1xEV-DO, is a kind of radio transmission technique that
has been optimized specially for the mobile data applications. It is high in the utilization of the
frequency spectrum, capable of providing the peak rate up to 2.4 Mbps within the 1.25 MHz
bandwidth. Meanwhile, it is compatible backward with the cdma2000 1x, with the radio frequency
system and link budget completely consistent with the 1x system. Consequently, the operators can
easily fulfill the upgrading from the current 1x network. The technique passed the 3GPP2
standardization in 2002 and is officially recognized as a 3G technology.

The cdma2000 1xEV-DV is another extension of the cdma2000. It can simultaneously support the
voice and high-speed packet data services in one carrier. It has higher voice and data capacity than both
1x and 1xEV DO. Current, among all the 3G standards, it supports the highest data rate in the unit
bandwidth.

The CDMA standard is a standard series with the forward/backward compatibility:

104
 Chapter 5 Evolution of cdma2000 1x EV and ZTE HRPD Solution

♦ The next generation mobile terminal can roam to the last generation network, only
unable to access the new features defined under the new standards.

♦ The last generation mobile terminal can roam to the next generation network, only
unable to access the new features defined under the new standards.

5.1.3 cdma2000 1xEV-DO Standard

As the data services are developing toward diversification, large capacity and asymmetry in these
years, it turns out that the cdma2000 1x is unable to meet the demands of future service development
due to its limited data service capability. So, the 3GPP2 TSG-C established the 1xEV work group at the
beginning of 2000, aiming to prepare and provide the solution for the high-speed asymmetric packet
data service: 1xEV-DO technique. All the major technical specifications of 1xEV-DO were prepared in
2001. Now is already the version maintenance stage.

5.1.3.1 General Description about the cdma2000 1xEV-DO Scheme

cdma2000 1xEV-DO, also called HDR and HRPD, is a kind of radio transmission technique that has
been optimized specially for the mobile data applications. Since the 3GPP2 has established the 1x EV
standard work group in March 2000, significant progress has been made in the standardization of 1xEV
DO. In the ITU-R WP8F conference held by ITU in August 2001, 1xEV DO was accepted as part of
the 3G IMT-2000 standard. Compared with the 1x technology featuring the optimized voice and the
medium-rate data transmission, the 1xEV-DO technology has made optimization and improvement in
the capacity, data transmission and radio Internet access. The 1xEV-DO can support in the 1.25 MHz
standard carrier the high-speed data service at the average rate of 650 kbps and the peak rate of 2.4
Mbps. Meanwhile, it is compatible backward with the cdma2000 1x, with the radio frequency system
and link budget completely consistent with the 1x system. Consequently, the operators can easily fulfill
the upgrading from the current 1x network. It has the following features:

♦ Compared with the voice service, the data service has some completely different features.
For example: The voice service has low time delay, low rate, symmetric
upstream/downstream and low requirements for the bit error rate, while the data service
features with frequent sudden changes, high rate, asymmetric upstream/downstream and
insensitivity to the time delay. According to those features of the data service, a series of
characteristic techniques and methods are adopted in the 1xEV-DO.

♦ One carrier is used separately to provide the data service. In this way, it is not necessary
to consider the compromise made when the data and voice are transmitted in the same carrier
(cdma2000 1x is the product of such compromise). All the data optimization methods can be
used for such carrier.

105
Chapter 5 Evolution of cdma2000 1x EV and ZTE HRPD Solution

♦ In the forward link, the Time Division Multiplexing (TDM) mode is applied in the users,
with one 1.666 ms time slot as the minimal allocation unit; The AT makes quick feedback
(600 Hz) about the quality of the forward channel, so that the AN can determine the user and
rate of the next time slot (variable from 38.4K to 2.4576M); The Hybrid ARQ is used to
adjust the deviation that may occur to the AT’s rate estimate; The self-adaptive coding &
modulation (R=1/2/3, 4-PSK, 8-PSK, 16-QAM) are adopted; In the forward channel, the
constant full power emission is adopted; Through the DRC Cover, the AT fulfills the virtual
soft handoff between the sectors in the valid pilot frequency set; The Multi-User Diversity
and Multi-Antenna Diversity are adopted.

♦ In the reverse link, the reverse pilot frequency of the AT is supported; The data rate is
variable from 9.6 kbps to 153.6 kbps; The open-loop and closed-loop power control are
supported; The soft switchover is support; For the AN, the forward RA channel can be used to
control the rate adjustment of the AT.

Because the above methods are adopted, the 1xEV-DO has gained remarkable advantages over the
other data transmission technique. The HRPD technique has attracted the attention of all the major
telecom equipment manufacturers and operators around the world. Currently, the manufacturers which
have officially introduced the 1xEV-DO system include Lucent, Nortel, Samsung, Ericsson, Hitachi
and ZTE. In the operation, the SK Telecom of South Korea introduced the HRPD service for
commercial applications at the beginning of 2002. As the users’ demand for the mobile data mounts up,
more and more operators and equipment manufacturers will join them.

5.1.3.2 Features of the cdma2000 1xEV-DO

Compared with the IS-95/cdma2000 1x technology, the 1xEV-DO has the following features in terms
of the high-speed packet data service.

Air interface: The 1xEV-DO technology has effectively solved the transmission bottleneck of the
data service in the air interface. To achieve that aim, the 1xEV-DO has made optimization and
improvement in the technique from many aspects. For example, in order to support the high-speed data
service without affecting the voice communication service, measures are taken in the 1xEV-DO to
separate the voice channel from the data channel. In fact, the data communication and voice
communication have different features. The data service has lower real-time requirements than the
voice service while its requirements for bit error rate are higher. In the channel structure, the data
service is usually asymmetric in the forward and reverse links and the rate required by its forward data
service (from the BTS to the mobile station) is several times higher than that required by its reverse
service, while the voice service is the strict symmetric service. Because the voice and data have
different requirements for the air link design, the separate processing of the voice and data will
substantially improve the efficiency of the entire system. Compared with the rate of 153.6 kbps of the
cdma2000 1x, the forward link of the 1xEV-DO has a peak rate up to 2.4576 Mbps/sector. In addition,

106
 Chapter 5 Evolution of cdma2000 1x EV and ZTE HRPD Solution

the separate processing of the voice and data has another advantage: The two services will be optimized
through different carriers. As a result, the development of the system software can bypass the
complicated load balance, significantly simplifying the development work of the system software,
reducing the development costs and shortening the product lead time needed by the equipment
manufacturers. Also, the reverse pilot frequency, power control, rate control and other technologies are
utilized in the reverse link. In the forward link, the optimized dispatch, rate control and channel time
division are adopted. The dispatching technique makes it possible for the BS to rationally arrange the
service requests of all the terminals according to the actual situation of the entire system. The rate
control technique is characteristic of the 1xEV-DO technology. It enables the terminal to request for the
customized transmission rate from the BS based on the needs of applications. During the signal
transmission, the forward link always fulfills the emission with the maximal power, so that the quality
and rate of the signal transmission can be enhanced. Besides, the burst pilot frequency channel is
adopted in the 1xEV-DO, capable of being added to the forward channel in the pre-determined time
segment, so that the reliable signal-to-noise ratio can be ensured. Meanwhile, the Turbo code and rate-
variable modulation are adopted in the 1xEV-DO forward link, in order to support various variable data
rates and adapt to various service environments. In the design of the reverse link, the introduction of the
Turbo code in the 1xEV-DO, as well as the separation of the coherence demodulation from the
relatively long packet data packet intended to complete the diversity, has led to the largely increased
capacity of the reverse link, which is 153.6 kbps/sector, several times of the IS-95A system.

Radio frequency specifications: In the 1xEV, the downward compatibility has been fully taken into
consideration. Although the 1xEV-DO needs another CDMA standard carrier frequency dedicated to
the data transmission, the 1xEV-DO and the IS-95/cdma2000 1x are the same, in terms of the radio
frequency, in the RF characteristics, symbol rate, power requirements and coverage. Thus, the radio
frequency part of the current IS-95/cdma2000 1x can be directly utilized when the 1xEV-DO upgrading
is conducted for the cdma2000 1x network. As a result, the current investment of the carrier is protected
to the maximum. Meanwhile, the combination of the 1xEV-DO BTS with the IS-95 or cdma2000
makes it possible to implement the low-cost network deployment. In addition, the compatibility
between the 1xEV-DO and the IS-95/1x has contributed to the ease of concurrent running of the two
systems. The dual-mode (IS-95/1xEV-DO) equipment allows the user to utilize the high-quality voice
service via the carrier of the IS-95/1x, while being provided the high-performance mobile data service
via the carrier of the 1xEV.

Technical implementation: The 1xEV-DO and the IS-95/cdma2000 1x are the same in the power
control, soft handoff, access process and Turbo coding. So, the developer can easily make a success in
the 1xEV-DO product by taking advantage of the mature development experience in the IS-
95/cdma2000 1x.

Networking: The 1xEV-DO is very flexible. For the users who only need the packet data service,
the networking can be built up independently, so that the high-speed packet data service can be
provided with the simple network configuration. At this time, the core network configuration is not

107
Chapter 5 Evolution of cdma2000 1x EV and ZTE HRPD Solution

necessarily built upon the ANSI-41-based complicated structure, but is based on the IP network
structure. For the users who need both the voice and data services, the joint networking along with the
IS-95/cdma2000 1x can be implemented while the voice and the high-speed packet data services are
provided. In addition, for the dual-mode terminal supporting both the cdma2000 1x and 1xEV-DO, the
1xEV-DO technology has provided the switchover system between the two systems (cdma2000 1x and
1x EV-DO).

Therefore, compared with the IS-95/cdma2000 1x, the 1xEV-DO technology can provide over ten
times faster high-speed packet data service. Meanwhile, the 1xEV-DO and the cdma2000 1x are the
same in many techniques. Its networking is simple and the current investment can be utilized for the
smooth upgrading. So, the joint networking with the cdma2000 1x will ensure that quality voice and
the high-speed packet data service can be simultaneously provided at low costs.

In order to expedite the development of the 1xEV-DO dual-mode or multi-mode equipment for
commercial applications, Qualcomm published as scheduled to the world the MSM5500 and CSM5500
end-to-end solutions in October 2001. It will help the mobile phone manufacturers to introduce the
1xEV-DO /IS-95/1x compatible multi-mode mobile phone for commercial applications, so that the
operators can timely introduce the large-capacity and high-rate 3G service for commercial purposes.
The 1xEV-DO system has not only largely improved the technical performance of the 1x, but also
brought more business opportunities for the manufacturers of mobile communication equipment and
the mobile communication operators while providing the enhanced quality service for the mobile
communication subscribers.

First of all, due to the compatibility between the 1xEV-DO and the IS-95A, IS-95B and cdma2000
1x, the operators of the current cdmaOne service are enabled to get larger capacity and better
performances by optimizing the voice and the data spectrum respectively, provide two kinds of services
with one network in order to utilize, to the maximum, the frequency spectrum and network resources,
and introduce the high-performance packet data service within the shortest time.

At the current stage, the complementation between the cdma2000 1x and the 1xEV-DO is a good
way to satisfy the demand for radio terminal data and multimedia communication. For the
communication equipment manufacturers, the allowable multiplexing of current software and hardware
designs in the 1xEV-DO will shorten the time needed to design and develop the mobile phone and the
radio device. It is thus easier for the communication equipment manufacturers to grab the market
opportunities ahead of others.

It is easy to find out the cdma2000 1x EV-DO has more extensive applications than the cable high-
speed data solutions, such as ADSL and the cable Modem, despite the fact that it is a radio data
transmission technique. Because what the users are really longing for is the free Internet experience at
any time and in any place. After the 1x EV-DO gets mature for the commercial applications, it will
provide that and enhance the life quality of the human beings.

108
 Chapter 5 Evolution of cdma2000 1x EV and ZTE HRPD Solution

5.1.3.3 cdma2000 1xEV-DO Network Structure

Fig. 5-3 is the reference model of the 1x EV-DO network structure. According to the figure, the access
network of the 1x EV-DO primarily has the following interfaces, the air interface with the AT, the A12
interface with the AN AAA, which is used for the access authentication, the A13 interface with the AN,
the A8 and A9 interfaces with the PCF, and the A10 and A11 interfaces with the PDSN.

Fig. 5-3 1x EV-DO network architecture

In the above A interfaces, the A8/A9 and the A10/A11 are almost the same as the old 1x, while the
A12 and A13 are the new interfaces of the 1xEV-DO. The A12 serves to support the access
authentication. In it, the Remote Authentication Dial-in User Service (RADIUS) protocol is adopted.

Please note that there is no RC concept because the 1x EV-DO does not support the voice service.

To implement the AN, there are multiple networking modes, such as the centralized networking
and the distributed networking. In the centralized architecture, the AN is split into the traditional
BSC/BTS structure. Such functions as the centralized call processing, selector and mobile management
are centralized in the NE of BSC, and the radio frequency system and HDR base band processing are
scattered over multiple BTS. See Fig. 5-4.

109
Chapter 5 Evolution of cdma2000 1x EV and ZTE HRPD Solution

Fig. 5-4 Schematic diagram of centralized networking

In the distributed networking mode, the full-scaled construction of 1x EV-DO network are used to
provide the high-speed data service. It is usually adopted when the radio data service rises dramatically
or the new operator enters the market. See its architecture in Fig. 5-5:

Fig. 5-5 Schematic diagram of distributed networking

110
 Chapter 5 Evolution of cdma2000 1x EV and ZTE HRPD Solution

According to the latest development, the 1x EV-DO will be developed based on the all-IP
platform. In that platform, the cdma2000 1x service will also be developed. Moreover, the 1xEV-DO
and the 1x can coexist in the same hardware platform, their channel boards allow to be inserted
together.

5.1.4 Brief Description of the cdma2000 1xEV-DV

5.1.4.1 Brief Description of the Scheme

The cdma2000 1xEV-DV is an extension of the cdma2000. It can support the voice and high-speed
packet data services at the same time in one carrier. The 1xEV-DV is completely compatible forward
and backward. In the 1x EV-DV, one channel provides, through the time division, one user with the
voice service and the high-speed packet data service at the same time.

In the future, the 1xEV-DV system should meet three operation requirements:

♦ The 1xEV-DV specifications should include and expand all the characteristics, functions
and services defined for the current cdma2000 1x in the cdma2000 Release A and Release B
standards.

♦ The 1xEV-DV specifications should provide the smooth evolution from the TIA/EIA/IS-
9A, TIA/EIA-9B and cdma2000, reducing the influence over the terminal and the BTS
equipment to the least in order to gain the maximized economic benefits.

♦ As the 1xEV-DV system comes into operation, the standby duration and call duration of
the 1x EV-DV mobile station will be extended.

5.1.4.2 Characteristics and Basic Requirements of the cdma2000 1x EV-DV

Below are some basic requirements of the cmda2000 1x EV-DO:

1. Core network

The 1xEV-DV specifications should be compatible with the ANSI-41core network standards.
According to the MC MAP specifications, the 1x EV-DV specifications should support and be
compatible with the GSM MAP core network.

2. System capacity and data rate

111
Chapter 5 Evolution of cdma2000 1x EV and ZTE HRPD Solution

The system supporting the 1xEV-DV should support the following system capacity and data rate.

♦ For the radio channel using the same sector configuration and voice encoder, the
concurrent voice calls are at least twice as many as those of the cdma2000.

♦ For any user in the high-speed outdoors vehicle-mounted surroundings, the peak rates of
the forward and reverse data transmission channels should be at least 1.25 Mbps. The forward
channel and the reverse channel must meet that requirement at the same time. Average data
rate requirement for one sector in the full-load system: at least 600 kbps for the forward and
reverse data transmission channels. The forward channel and reverse channel must meet the
requirements at the same time.

♦ For any user in the walking rate surroundings or in the static indoors surroundings, the
requirement for the peak data rate is: at least 2 Mbps for the forward and reverse data
transmission channels. The forward channel and reverse channel must meet that requirement
at the same time.

In addition, both the symmetric mode and asymmetric mode of the forward and reverse channels
should support all the above requirements. When the 1x EV-DV works under the 3x radio
configurations, the requirements for the system performance (peak value and system average value)
should be enlarged in proportion in the way defined by the Technical Standard Development Group.

3. General requirements

The 1x EV-DV specifications should also meet the following requirements:

♦ For the given radio frequency surroundings and system load, make the self-adaptive
adjustment to the data transmission rate and operation parameters while satisfying the QoS
requirements, so that the system capacity can reach the maximum.

♦ Supporting the services to be changed constantly according to the QoS’ requirements,

including the voice, video frequency and data transmitted in one or multiple channels.

♦ Switching over between the sector working in the 1x EV-DV and sector working in other
standards of the cdma2000 standard family. When the two sectors support equal data and
voice services, such requirements must be met, though the QoS or data rate may change
subject to the different capacities provided by the two sectors.

♦ Multiple concurrent packet data processes available for each user.

♦ Supporting the existing voice and packet data service functions

♦ Having a working mode that enables the voice quality to reach or exceed the cdma2000

112
 Chapter 5 Evolution of cdma2000 1x EV and ZTE HRPD Solution

system.

♦ Using the current BTS antenna to meet all the above requirements for system capacity,
information data rate and wireless surroundings.

♦ Supporting the current cdma2000 voice encoder.

The 1xEV-DV should never fail to support the AMR encoder, the GSM full-rate voice encoder.

4. Wireless environment

When the BSs have the same position, transmission power and antenna, and the mobile stations
have the same antenna gains, the system configured based on the 1x EV-DV specifications should have
a larger coverage than the system of the cdma2000 standard family. The out-of-band emission of the 1x
EV-DV system can be the same as that of the cdma2000 1x system. The system that supports the 1x
EV-DV should also support the mobile station and the fixed mobile station.

5. Compatibility

The 1x EV-DV specifications allow its system sector to provide services for a mobile station
complying with the version earlier than the cdma2000 standard family. The IS-2000 symbol rate and
frequency band planning should support the current frame length. But, the new frame length can also
be added. The 1x EV-DV specifications support the antenna configuration of a BS complying with the
version earlier than the cdma2000 standard family.

6. Cooperation

The 1x EV-DV specifications should be accommodated by an open radio access network based on
the evolved Version 4.0 cooperative specifications.

All the above are the basic characteristics and requirements of the 1xEV-DV specifications.

5.1.4.3 Status of the cdma2000 1xEV-DV

With the help of the operators and the major telecom companies, the 3GPP2 has promoted the
development of the 1xEV-DV. In order to help the cdma2000 seize some shares in the future 3G
market, the 3GPP2 has made great efforts to formulate the 1xEV-DV(cdma2000 Release C) standards.
Erricson even suggested delaying the work on the cdma2000 Release B standards, in order to introduce
the 1x EV-DV standards as soon as possible.

With regard to the 1 xEV-DV, there are three major groups of opinions, including the 1xTREME
represented by Motorola and Nokia, the L3QNS represented by Lucent, LSI Logic, LGE, Nortel,
Qulcomm and Samsung, and the LAS-CDMA represented by LinkAir (mainly supported by the

113
Chapter 5 Evolution of cdma2000 1x EV and ZTE HRPD Solution

CWTS). The groups have debated heatedly, and all of them successively introduce their own
Frameworks. In the 3GPP2 June session held in 2001, the 1x TREME (Motorola, NOKIA, TI and
PHLIPS&ALTERA) released 1x EV-DV Framework Proposal for 1x EV-DV, which covered many
aspects, such as LAC, MAC, L3, RLP and SeviceOption (C00 20010611 --- 007). The L3QS (Nortel
was not a member yet) also released its updated proposal for 1xEV-DV in that meeting. In the July
session, it submitted the related documents about the MSC and the signaling. The LinkAir and CWTS
also put forward the LASCDMA’s framework. Although the TSG C group has decided to adopt
L3NQS’ framework for the 1x EV-DV, it was regarded as necessary, after the discussion, to coordinate
and blend with the other two frameworks in order to have the optimal 1x EV-DV performance. In the
determination of components, the groups are also willing to absorb each other’s advantages and blend
with each other as much as possible in order reach a unanimous conclusion. For example, in the code, it
is recommended that the LA and LS codes put forward by the LinkAir be considered for using in the 1x
EV-DV. It is also hoped that the 64QAM put forward by the 1xTREME can be taken into further
consideration. All the groups wish to take the cooperative attitude, so that the 1x EV-DV standards can
be introduced as soon as possible.

America’s Verizon Wireless and SprintPCS, Canada’s Bell Mobility, South Korea’s SK Telecom
and Japan’s KDDI suggested that the 1x EV-DV standards should be passed before May 31, 2002. The
standardization organizations of all the countries, such as America’s TIA, South Korea’s TTA, Japan’s
TTC and China’s CWTS, also hoped that the 1x EV-DV standards can be introduced as soon as
possible. At present, the L3NQS’ framework scheme has been selected as the framework of the 1x EV-
DV. Now, the TSGC group is selecting the components for the 1x EV-DV.

Note: As the formulation of the standards is in process, please refer to the 3GPP2’s official website
for the latest information.

5.1.4.4 Brief Description about the cdma2000 3xRTT

In the forward link, the cdma2000 can support multiple radio frequency bandwidths through the
MultiCarrier (MC). For the forward link, because the forward links of different systems can keep
orthogonal in the same carrier frequency, the overlapped deployment can be made in order to achieve
the smooth evolution from the current narrowband system to the broadband system. The cdma2000 3x
means that there are three carriers. Because the cdma2000 1x and the IS-95 are backward compatible
and the overlapped deployment can be carried out for the 3x and IS-95, the old and new versions of
mobile terminals can work in the same carrier frequency. As a result, the interests and investment of the
users and operators are protected to the maximum.

According to the recent development, 3G’s requirements for the data rate have been met in the
cdma2000 1x DV version. So, the cdma2000 3x scheme may not be adopted in the future. Here, we
will not elaborate on it.

114
 Chapter 5 Evolution of cdma2000 1x EV and ZTE HRPD Solution

5.2 Evolution from ZTE CDMA to 1x EV

The cdma2000 1x EV includes the two phases of EV-DO and EV-DV.

Evolution from ZTE 1x system to the 1x EV-DO: In the BSC, it is necessary to add the EV-DO
signaling processing board and service processing board, and update the software. In the BTS, it is
necessary to replace the channel board and update the software.

The EV-DO needs to take up 1.25 MHz bandwidth and can only support the packet data service in
the EV-DO mode. Thus, the IS-95/1x voice service and the 1x packet data service are unavailable. If
the operator only has 1.25 MHz bandwidth, it is necessary to choose either EV-DO or 1x. If the EV-DO
is adopted, none of the 1x services, or the voice service, circuit data service and 1x packet data service,
is available to the IS-95 and 1x mobile phones. If the operator has a 2.5 MHz bandwidth, the 1x can be
used in the first carrier frequency and the EV-DO in the second carrier frequency. The IS-95 and 1x
mobile phones work in the first carrier frequency, using all the 1x services, including the voice service,
circuit data service and 1x packet data service. The EV-DO terminal works in the second carrier
frequency, using the packet data service in the EV-DO mode. This is what the EV-DO technique itself
has determined.

If the operator already has a one-carrier 1x BS, it is not necessary to add the radio frequency
module in order to implement the upgrading to the one-carrier EV-DO BS. All that should be done is to
replace the current 1x channel board with the EV-DO channel board and update the BS software.
However, after the upgrading, the BS cannot provide the 1x service, or support the IS-95 and 1x mobile
phones.

If the operator already has a one-carrier 1x BS, it is necessary to expand the one-carrier BS to a
two-carrier BS in order to support the 1x and the EV-DO simultaneously. The expansion is the almost
same as the expansion from the one-carrier 1x BS to the two-carrier 1x BS. That is, add the radio
frequency boards, such as the TRX and the HPA, the radio frequency interface board and the channel
board. The only difference is that the EV-DO channel board, instead of the 1x channel board, will be
added. At the same time, the BS software must be updated. The 1x can be added to the first carrier
frequency and the EV-DO can be added to the second carrier. The IS-95 and 1x mobile phones work in
the first carrier frequency. The EV-DO terminal works in the second carrier frequency.

If the operator already has a two-frequency 1x BS, the two-carrier BS can be expanded to a three-
carrier station in order to support the 1x and the EV-DO simultaneously. In the first and second carrier,
the 1x is added, while in the third carrier, the EV-DO is added. Another choice is to change the two-
carrier 1x BS into the 1x and EV-DO two-carrier BS. The change is the same as the upgrading from the
one-carrier 1x BS to the one-carrier EV-DO BS. All that should be done is to replace some 1x channel
boards with the EV-DO channel boards and update the BS software. The 1x can be added to the first
carrier frequency and the EV-DO can be added to the second carrier. The IS-95 and 1x mobile phones
work in the first carrier frequency. The EV-DO terminal works in the second carrier frequency.

115
Chapter 5 Evolution of cdma2000 1x EV and ZTE HRPD Solution

For the BSC, it is necessary to expand the BSC in order to support all the old users of the IS-95
and 1x as well as the new EV-DO users. That is, add the EV-DO signaling processing board and the
service processing board, and update the software.

In the BS, the software updating means that the configuration and control maintenance functions
for the EV-DO channel board are added to the old 1x software version, including the alarming,
troubleshooting, performance statistics, service observation and signaling tracing.

In the BSC, the software updating means that the configuration and control maintenance functions
for the EV-DO signaling processing board and service processing board are added to the old 1x
software version, including the alarming, troubleshooting, performance statistics, service observation
and signaling tracing.

ZTE’s next generation equipment can simultaneously support the 1x EV-DO and the 1x EV-DV.

Exercise

1. Compare and explain the similarities and differences between the cmda2000 1xEV-Do and the
cmda2000 1x.

2. Compare and explain the similarities and differences between the cmda2000 1xEV-DO and
cmda2000 1xEV-DV.

3. Briefly describe the development history and trend of CDMA.

4. Briefly describe the evolution of the cdma2000.

5. Briefly describer the technical features of the 3G.

6. Make a statement about the characteristics and basic requirements of the cmda2000 1x EV-DV.

7. Briefly describe the development status of the cmda2000 1x EV-DV (based on the latest
information).

8. Briefly describer the characteristics of the cmda2000 1x EV-DO.

116
Chapter 5 Evolution of cdma2000 1x EV and ZTE HRPD Solution

117
Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP

Solution

Objectives
After learning this chapter, you should:

♦ Understand the smooth evolution scheme from ZTE cdma2000 BSS side to the all-
IP.

♦ Command the hardware composition and typical configurations of the all-IP

cdma2000 BS.

♦ Command the performance features of ZTE all-IP scheme.

Introduction

The all-IP is the inevitable development trend of the network side standards. In the 3GPP2, an all-IP
special work group is dedicated to the all-IP standardization. Currently, the all-IP network reference
model has been introduced. The all-IP at the network side will bring the following benefits:

♦ The all-IP core network is independent of the access network. And, the core network can
support multiple accesses, such as the wired access, the radio access, WLAN and DSL. As a
result, the integration of multiple networks can really come true.

♦ All the interfaces between the all-IP NEs are open, bringing about the convenience in the
construction and maintenance.

♦ The all-IP Quality of Service (QoS) is better than or equal to the existing network.

♦ The all-IP network has led to the reduced network construction costs.

♦ The evolution to the all-IP is a gradual process. It can access not only the future IP
multimedia terminal, but also the terminals unable to support or possess the IP end-to-end
capability, such as the traditional voice terminal and the traditional data terminal. The all-IP
network can work together with the current network, such as the PSTN.

118
 Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

In order to guarantee the QoS of the all-IP network, some QoS-related NEs are separated from the
all-IP network, such as the Subscription QoS Manage, Core QoS Manager and Network Capability
Gateway. Meanwhile, the key NEs, such as AGW, MGW, BSC, BS and MS, will provide the end-to-
end and flow control-based QoS capability and support the QoS negotiation in such processes as
connection setup and switchover.

In order to accommodate the existing numerous IS-95/cdma2000 mobile terminals and network
equipment, the all-IP NEs can be divided into two parts, the IP multimedia domain and the traditional
MS domain. The IP multimedia domain will support the future mobile terminals with the end-to-end IP
capability. It needs the air interface for amendment in order to support the VoIP of the mobile station.
The traditional MS domain will access the existing voice services based on the circuit switching and
the current data services.

It takes a gradual process to evolve from the network side to the all-IP. For the all-IP, it is necessary
to implement the separate and phased evolution of the core network and the access network. The
evolution from the current TIA/EIA-41 and IOS4 to the all-IP will go through several phases. Firstly,
the air interface is kept unchanged. The access network side is still based on the IOS4.1 and the core
network on the TIA/EIA-41. Secondly, the signaling layer is separated from the bearer layer. The
signaling between the NEs of the access network is transmitted based on the IP, while the bearer layer
is still based on the IOS4.X and the core network can be based on the TIA/EIA-41 over IP. At last, the
concepts of traditional MS domain and IP multimedia domain are imported into the whole network,
supporting both the traditional MS service and the IP multimedia service. The bearer layer of the
multimedia service will be based on the IP. For the air interface, it is necessary to provide the additional
support for the IP multimedia domain. In the core network, the traditional MS domain is based on the
TIA/EIA-41 over IP, while the IP multimedia domain is based on the SIP. At this time, the NEs of the
traditional circuit only domain, such as the MSC/VLR and the HLR/AUC, will no longer exist, but
evolve into the media gateway, MGW. And, the current data access service unit, PDSN, will also
evolve into the more powerful access gateway, AGW. At last, the IP will be fulfilled in the whole
network, from the core network and radio access network to the mobile terminal.

119
Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

6.1 Smooth Evolution of ZTE cdma2000 All-IP BSS Side

Fig. 6-1 ZTE cdma2000 all-network solution

As shown in Fig. 6-2, ZTE cdma2000 all-network solution consists of the following parts:

♦ Mobile station: Mobile phone or mobile terminal.

♦ Core network: It provides the functions of the network side, such as the authentication
and the public network interface. It consists of the voice part and the data part.

♦ Base Station Subsystem (BSS): It is located between the mobile station and the core network,
serving to fulfill the processing of radio signals, terminate the radio protocols and connect the
mobile station with the core network. The BSS also consists of two parts, the BSC and the BTS.

In the air standard side, ZTE supports all the standards series, such as the IS-95, the cdma2000 1X
and the cdma2000 1XEV (including the HRPD and the EVDV).

120
 Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

Fig. 6-2 Smooth evolution from ZTE cdma2000 solution to all-IP

In the network-side interface, the leading all-IP framework is adopted. In the design phase, the
compatibility with the future all-IP network was taken into consideration. The benefit brought about by
the compatibility is: The same architecture can be used for ZTE equipment at any stage of evolution,
from the core network to the access network and even the final separation and consolidation stage of
the IP multimedia domain and the traditional MS domain.

121
Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

Fig. 6-3 Network architecture of ZTE cdma2000 BSS

In Fig. 6-3, we use ZTE cdma2000 BSS to illustrate the flexibility of ZTE equipment in the evolution.
According to the figure, both the BSC and the BTS are built upon the core of all-IP network, well
suited to the demand for evolution to the all-IP network in the future. ZTE will be one of the first
manufacturers that introduce the all-IP system in a large scale.

Inside ZTE all-IP BSC, two kinds of built-in gateways are provided in addition to the IP-based
trunk, the ATM gateway and the self-defined packet gateway.

The ATM gateway serves to terminate various ATM-related protocols, including the link layer and
the AAL, and deliver them, after the conversion to the IP packet, to the IP network for switching and
processing. The ATM gateway is mainly used to access the traditional ATM-based BSC or BTS of the
other manufacturers.

The self-defined packet gateway serves to terminate all the protocol contents relevant to the self-
defined packets, and deliver them, after the conversion to the IP packet, to the IP network for switching
and processing. The self-defined packet gateway is mainly used to access the traditional BSC or BTS
based on the self-defined packet.

The varieties of the all-IP NEs are far more than those of the current network. With its support for
the internal IP-based standard interface, ZTE all-IP equipment can easily implement the splitting of the
NEs. In ZTE all-IP equipment, the vocoder resources can move smoothly from the BSC to the future
MGW, in order to meet the all-IP demands. Meanwhile, ZTE equipment can flexibly implement the
separation or integration of various server functions.

6.2 Network Framework and Hardware Composition of ZTE All-IP

cdma2000

6.2.1 All-IP BSC

The cdma2000 all-IP BSC is an upscale radio access product based on the all-IP technique. Its
hardware is a completely made up of the 3G uniform platform. Below is its overall network framework:

The overall architecture diagram of ZTE’s all-IP BSC is as shown in Fig. 6-5. Functionally, the
BSC consists of the following parts:

♦ Level 1 IP switching center: It fulfills the IP switching for the whole BSC, in order to
bridge all the subsystems.

122
 Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

BSC
Packet data
分组数据控
control PDSN
制子系统
subsystem MSC
PBS A8,A9

Call
呼叫处理子
processing
系统
subsystem ATM交 A10,A11
CPS Level-1 IP
换子
switching
系统
Digital
AXS
数字中继子
trunk
系统
subsystem
DTS

Selector Vocoder
MSC
subsystem subsystem MSC

A1,A2,A5
Abis interface

A3,A7
Other BSC

Fig. 6-4 Overall architecture of ZTE’s all-IP BSC

♦ PCF: It fulfills the processing of the protocols relevant to the data service, and gets
connected to the PDSN via the A10/A11 interfaces.

♦ Call processing subsystem: It fulfills the calling and switching control for the mobile
station, and functions as the control center of the entire BSC.

123
Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

♦ Digital trunk subsystem: It fulfills the processing functions of the Abis interface, which
serves to connect the BTS.

♦ Selector subsystem: It fulfills the processing of some radio link protocols, and selects an
optimal one among multiple signals undergoing the reverse switchover.

♦ Vocoder subsystem: It fulfills the voice encoding/decoding, and gets connected to the
Mobile Switching Center (MSC) via the A interface.

♦ On the BSC side, the forward data flow in a call is as follows:

♦ In the case of the circuit data, the PCM code flow will enter the vocoder from the MSC
via the A interface, and be delivered, after the voice encoding, to the Level 1 switching center
as an IP packet. In the case of the packet data, the packet will enter the PCF from the PDSN
via the A10/A11 interfaces. After the protocol processing, IP packet will come to the Level 1
switching center.

♦ The Level one switching center will send the vocoder or the IP packet delivered by the
PCF to the selector subsystem for the relevant radio protocol processing, and then, return it to
the Level 1 processing center for the switching to the digital trunk subsystem.

♦ The digital trunk subsystem conducts the relevant processing according to the protocols
required by the Abis and delivers the data to the BTS.

The above data flow applies to the service. As for the signaling, it will be sent to the call
processing subsystem for processing.

The reverse data flow is just contrary to the above data flow. For the reverse switching data flow,
the selection operation must be conducted in the selector in order to select the better one for processing.

ZTE’s all-IP BSS is strong in the compatibility. It can access and process multiple service types:

♦ Circuit type service flow: It mainly refers to the data from the MSC A interface.

♦ ATM service flow: It mainly refers to the existing ATM interface-based BSS from the
other manufacturers.

124
 Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

Control Circuit
电路
switching
信元映射
Level-1 Protocol/
subsystem
主控子系统 service
协议 /业务
交换 switching
processing
处理

IP ........ Level-2
Line card: Ethernet
二级以
ATM protocol switching
太网交换
processing/access

Level-2 Level-2 Level-2 Level-2

Ethernet
二级以 Ethernet
二级以 Ethernet
二级以 Ethernet
二级以
switching
太网交换 switching
太网交换 switching
太网交换 switching
太网交换

Circuit IP access
电路域接入 IP ATM access
ATM HIRS HIRS
access
Circuit service flow domain access
接入 接入 接入
IP service flow

ATM service flow

HIRS service flow

Control flow Circuit IP ATM HIRS

Fig. 6-5 Network architecture of ZTE’s all-IP BSC

♦ IP service flow: It mainly accesses the all-IP-based BSS from ZTE or other
manufacturers.

♦ HIRS service flow: It mainly accesses the old ZTE cdma2000 equipment already
incorporated into the network.

125
Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

l
Cel ng IP
ppi service Enc
ma odi
ng

ATM access HIRS Vocoder

board access board
Frame
se
ver mapping De
el l re ing cod
ing
ATM C app HIRS Circuit
m
service service service

Fig. 6-6 Service mapping

The following description is about how the all-IP BSC accesses multiple types of services by
centering on the core of IP. As shown in Fig. 6-7, the ATM or circuit service must first be converted
into the IP service before entering the all-IP BSC for switching and processing.

♦ The ATM service is converted into the IP service through the cell mapping, or vice versa.

♦ The circuit service is converted into the IP service through the code mapping, or vice
versa.

♦ The HIRS service is converted into the IP service through the frame mapping, or vice
versa.

♦ The ATM service is converted into the circuit service through the indirect IP mapping, or
vice versa.

♦ The HIRS service is converted into the circuit service through the indirect IP mapping, or
vice versa.

♦ The HIRS service is converted into the ATM service through the indirect IP mapping, or
vice versa.

So, the IP is the core service of the uniform platform network, and the IP switching is the core
switching of the uniform platform network. The ATM, circuit and HIRS only undertake the access
functions.

Next, we will elaborate on the network architecture principles based on Fig. 8-5.

The uniform platform is a two-level switching architecture:

126
 Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

♦ Level 1 switching: For the IP service, it can be the Ethernet switch, the CrossBar+
network processor or direct network processor switch.

♦ Level 2 switching: For the IP service, it mainly refers to the Ethernet switching restricted
to a sub-rack.

♦ The processing can be classified into two types according to the processing rate:

♦ High-speed processing and access: Enter the Level 1 switching directly.

♦ Low-speed processing and access: Enter the Level 2 switching directly.

According to the different tasks undertaken, the service processing boards can be classified as:

♦ Access service board, such as the digital trunk board, the SDH interface board and the
Ethernet interface board.

♦ Protocol processing board, such as the call controller, vocoder and selector.

♦ Access + protocol processing board, such as the ATM protocol processing board.

♦ For the ATM service, the ATM protocol is terminated through the ATM access/protocol
processing/cell mapping board attached to the IP switching network, and the service is
mapped into the IP service. Or, the ATM service is accessed and terminated through the
interface in the high-speed service processing board (Level 1 switching line card), and is
converted into the IP service.

Such architecture, which uses IP as the only core platform of the whole network and supports
multiple protocol types at the access side, has brought to the BSC huge expandability, flexibility and
complete forward/backward compatibility.

127
Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

6.2.2 All-IP BTS

Fig. 6-7 Schematic diagram for the overall architecture of the all-IP BTS

The overall architecture of the all-IP BTS is as shown in Fig. 6-8. The BTS primarily consists of
two parts:

128
 Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

♦ One Master Digital Base Band Subsystem (MBDS): It consists of the channel board
(CHM), the communication control board (CCM), the data channel interface board (DSM),
the radio frequency interface (RIM), the built-in SDH and the GPS receiver. Inside the BDS,
the communication is fulfilled through the fast Ethernet.

♦ None or multiple slave digital base band subsystems (SBDS): Its structure is similar to
the master digital base band subsystem. But, it can do without the DSM, SDH or GPS
receiver. The CCM is replaced by the SCM, the slave BDS communication agent.

♦ One or multiple Radio Frequency Subsystems (RFS): It consists of the transceiver

(TRX), the radio frequency management board (RMM), the linear power amplifier/high
power amplifier (LPA/HPA), radio frequency front end (RFE) and testing module (BTM).

♦ The RFS can be classified into the local type and the remote type:

♦ Local RF Subsystem: Each BDS may have 0 to 1 local RF subsystem.

♦ Remote RF Subsystem: Each MBDS or SBDS may have 0 to multiple remote RF

subsystems. It can be 40 kilometers from the BDS, and can be placed in such special locations
as the cave and the subway.

♦ Forward: The service data from the BSC enter the BDS via the SNM/DSM. In the DSM,
they fulfill the header decompression and terminate the IP transmission protocols of the other
Abis interfaces. Then, they are delivered to the CCM through the fast Ethernet for switching
and arrive in the CHM, in which the cdma modulation is conducted. After the modulation, the
data are sent to the RIM and then, after the multiplexing, to the RMM and the TRX
successively. In the TRX, the up frequency conversion is made. After the combination, the
signal is delivered to the LPA (HPA) and the RFE, and then, is transmitted by the antenna.

♦ Reverse: The reverse cdma signals from the antenna are sent, after the amplification of
the RFE, to the TRX. After the down frequency conversion in TRX, they become the base
band digital signals. The RMM collects the base band digital signals of all the sectors and
delivers them to the RIM. The RIM simply distributes them to the CHM. After the CDMA
demodulation by the CHM, the original service signals are obtained and packed into the
Ethernet frame, which is transmitted, via the fast Ethernet, to the switching center and then, to
the DSM/SNM. In the DSM, the protocols relevant to the Abis IP transmission are terminated.
At last, the signals are sent to the BSC via the E1 or the STM-1. The BTS also provides the
access directly oriented to the IP network.

The major functions of the subsystems are:

♦ The BDS fulfills the modulation/demodulation, search, power control and RF control of
the CDMA signals, and communicates with the BSC via the Abis interface.

129
Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

♦ The RF subsystem fulfills the up/down conversion and the power amplification and
transmitting of the signals. It is connected to the base band through the cable or fiber.

♦ The major functions of the modules are as follows:

♦ The CHM is attached to the fast Ethernet, fulfilling the modulation/demodulation and
search functions of the cdma2000 (or HDR) forward/backward services, and forming the
sharing pool with the channel resources in the BDS.

♦ The CCM is the switching center of the internal fast Ethernet. It also conducts the routine
maintenance for the BDS and RFS.

♦ The DSM serves to terminate the Abis protocol.

♦ The SNM module serves to fulfill the transmission and networking functions.

♦ The GCM module receives, generates and distributes the clock.

♦ The RIM provides the exit from the BDS to the RFS, fulfilling the selection and
multiplexing of the forward/backward services and providing the optical interface for the
remote RF subsystem.

♦ The RMM is the service and control center of the entire RFS. On one hand, it distributes
the forward/reverse services to the TRX; On the other hand, it supervises the work of the
BTM, LPA (HPA), RFE and TRX. The remote RMM also provides the optical interface with
the BDS.

♦ The TSM/RSM fulfills the switch control of the RF link and supports the switching and
backup of the RF parts.

♦ The TRX undertakes the up/down frequency conversion of the base band digital signals.
The digital intermediate frequency is adopted to implement the up/down frequency
conversion.

♦ The LPA and HPA fulfill the power amplification of the forward signals.

♦ The RFE fulfills the filtering and low noise amplification of the reverse signals, and
functions as the interface with the antenna.

6.2.3 All-IP cdma2000 System Networking

The BSS includes two parts, the BTS and the BSC/PCF. The BTS also includes two parts, the local end

130
 Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

(such as the base band and the local RF subsystem) and the remote end. Between them, there are
multiple networking modes.

RRFS RRFS RRFS

The BTS may be either a .... .... ....

macro BTS or a micro BTS

RRFS RRFS RRFS

Abis
A10/A11
A8/A9
BTS BTS BTS
PDSN ....
PCF BSC
/AGW

BTS BTS BTS

A A3/A7 ....
....
....

Other BTS
MSC BSS

BSS
Fig. 6-8 Schematic diagram of the cdma2000 BSS networking

The BSS is connected to the PDSN/AGW through the A10/A11(via the PCF), mainly bearing the
packet data service.

The BSS is connected to the MSC through the A interface, bearing the voice and the circuit data
services.

As an external system, the PCF is connected to the BSC via the A8/A9 interfaces, bearing the
packet data service. One PCF can be connected to multiple BSCs. The PCF can also be installed inside
the BSC.

The BSCs are connected with each other via the A3/A7 interfaces, bearing the service and
signaling that fulfill the cross-BSS soft switchover.

The BSC is connected to the BTS via the Abis interface. Between the BSC and BTS can be the

131
Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

star networking, chain networking and ring networking. And the BTS can be a macro BTS or the micro
BTS.

♦ Star networking: Each BTS is connected to the BSC in the point-to-point way. It is a
simple and reliable way.

♦ Ring networking: Multiple BTS are connected to the BSC in series to form a ring. The
ring networking is high in reliability.

♦ Chain networking: Multiple BTS are linked together to form a chain, which is connected
to the BSC through the last BTS. The chain networking is applicable to the area extending in
a belt shape, with low density of users.

♦ Between the local end (such as the base band and the local RF subsystem) and the remote
end of the BTS, multiple networking modes are supported (The local end can be a micro BTS
or a macro BTS):

♦ Star networking: Each remote RF site is connected to the local end in the point-to-point
way.

♦ Ring networking: Multiple remote RF sites are connected in series to the local end to
form a ring.

Chain networking: Multiple remote RF sites are linked together to form a chain, which is
connected to the local end through the last RF site.

6.2.4 Introduction to Typical Configuration

6.2.4.1 Typical Configuration of BSC

The frames of the BSC can be generally classified as:

♦ Level 1 switching frame: It provides the IP switching for the service flow of the whole
office, when there is a large demand for capacity.

♦ Control frame: It is applied when a large number of main control boards are required. It
provides the IP switching for the control flow of the whole office.

♦ Small GPS frame: It provides the BSC with the system clock.

♦ General-purpose frame: It fulfills the processing of various services, such as the vocoder,

132
 Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

selector, digital trunk and data control.

Besides, the space is reserved for the background server in the rack. In the design of the BSC, the
diverse mixed insertion has been taken into full consideration. In the general-purpose frame and control
frame, multiple service processing boards can be mixed together, such as the digital trunk board (DT),
the vocoder board (VTC), the selector board (WPB) and the main processor board (MP). Based on the
actual situation, the most suitable configuration can be made to the office’s requirements.

Please note that the Level 1 switching frame is necessary only when the capacity is large enough.
For the small configuration, the Level 1 switching frame is not necessary. During the expansion, add
the general-purpose frame first and after a certain number of such frames have been added, add the
Level 1 switching frame.

Level-1
General shelf General shelf General shelf switching shelf … Control shelf

…
GPS shelf GPS shelf General shelf GPS shelf General shelf

…
General shelf
Server Server Server
…
General shelf

Minimum configuration of BSC Small configuration of BSC Large configuration of BSC

Fig. 6-9 Example of BSC configuration and upgrading

Although the BSC resource frame supports multiple mixed insertion modes, the typical ones are as
follows:

♦ DT+SDU mixed insertion subsystem, that is, the mixed insertion subsystem of digital
trunk and selector. It serves to provide the data processing and selector functions for the Abis
interface and the Abis interface.

♦ Vocoder mixed insertion subsystems: It can provide such functions as the voice
encoding/decoding, asynchronous data and G3 Fax, call processing, SS7 processing and A

133
Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

interface trunk.

♦ Packet data processing subsystem: It primarily fulfills the PCF function.

♦ Level 1 switching subsystem: In the case of large capacity, it fulfills the IP switching for
the service flow of the entire system.

♦ Main control subsystem: It includes the control maintenance, call processing, signaling
processing and clock.

General shelf
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

D DD D S S V V U U V V V V V V V
T T T T P P T T I I T T T T T T T
B B B B B B C C MMC C C C C C C

Fig. 6-10 Typical configuration example of the vocoder frame

General shelf
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

D DD I I I I U U W WW W W W W
T T T P P P P I I P P P P P P P
B B B B B B B MMB B B B B B B

Fig. 6-11 Typical configuration example of the Abis access and selector frame

134
 Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

General shelf
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

I I U U U U U U
C
U U
P P P P P P P H
P
I I
C C C C C C C U
C
MM
F F F F F F F B
F

Fig. 6-12 Typical configuration example of the PCF frame

Control shelf
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

C C
U U
MMMMMMMM MMMMH H
I I
P P P P P P P P P P P P U U
MM
B B

Fig. 6-13 Typical configuration example of the main control frame

Level-1 switching shelf

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

T T T T P P T T T T R R
MMMM S S MMMMP P
B B B B N N B B B B B B

T T T T T T T T T T T T T T T T
MMMMMMMMMMMMMMMM
B B B B B B B B B B B B B B B B

135
Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

Fig. 6-14 Typical configuration example of the Level 1 IP switching

MM
G G
C C
GPS shelf

Fig. 6-15 Typical configuration example of the main control frame

The processing capacities of the major boards in the BSC are estimated as follows:

♦ For the DTB, the calculation is based on 640 lines (32E1) per board.

♦ For the IPB, the calculation is based on 32E1 per board.

♦ For the WPB, the calculation is based on 650~800 lines of voice per board, or 30M data
processing capacity.

♦ For the VTC, the calculation is based on 480 lines per board.

♦ For the IPCF and the UPCF, the calculation is based on 400M per board (MNIC).

♦ For the IWF, the calculation is based on 120/240 lines per board.

♦ For the MPB, the calculation is based on 2 CPU units per board and 100 thousand users
per CPU unit.

For the SPB, the calculation is based on four 8260 units per board and 32 SS7 links processed by
one 8260 unit.

6.2.4.2 Typical Configuration of BTS

The BTS is primarily composed of the base band and the radio frequency. The base band consists of the
master base band chassis and the slave base band chassis. Each BTS has a maximum of 1 master base
band chassis and 0 to 4 slave base band chassis. Each base band chassis can carry multiple RF
chassises.

Each base band subsystem can support the processing of 24 carrier sectors at most, and can
support the cross-carrier and highly accurate channel sharing in a large scope. One BTS has 5 BDSs at
most, that is, the maximal processing capacity of 120 carrier sectors. They constitute ZTE’s unique all-

136
 Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

IP super BTS. In the configuration of super BTS, if the RF module is installed outdoors, only one
equipment room needs to be rent for the base band part in a quite large area, largely saving for the
office the costs related to the equipment room. In addition, the large capacity baseband is allowed to be
installed in the same address of the BSC, making the interface between the BSC and BTS a simplified
short-distance interface. In this way, the maintenance is facilitated and the operating costs are reduced.

Each RF chassis can achieve the maximal processing capacity of 8 carriers and 3 sectors, or 4
carriers and 6 sectors. Each base band chassis can correspond to multiple RF units.

The baseband and the RF units can be installed in the same place or different places (with the RF
address moved far away). In the case of the installation in the same place, the macro BS is built up. In
the BS, the primary power module can be installed inside.

Both the macro BS and the micro BS can carry multiple remote RF units, indoors type or outdoors
type. Between the baseband and the RF units is supported not only the traditional point-to-point or
chain connection, but also the more reliable ring networking. In each pair of fiber, the data of 24 carrier
sectors are integrated, largely decreasing the required quantity of fiber.

Power chassis

Slave base band

chassis
Slave base band
chassis
Slave base band
chassis
Power chassis Slave base band
chassis
Master base band Master base band Master base band
chassis chassis chassis

RF chassis RF chassis RF chassis

Fig. 6-16 Several typical configuration examples of the macro BTS

137
Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

……
……
RF
……

Power chassis

Slave base band

chassis
Slave base band
chassis
Slave base band RF RF
chassis
Slave base band
chassis
Master base band
chassis

Fig. 6-17 Configuration example of the 120-carrier sector super BTS

……
……
Outdoor RF
module ……

Outdoor RF Outdoor RF
Micro BTS module
module

Fig. 6-18 Configuration example of the micro BTS added with RF remote modules

The MBDS primarily consists of such modules as: the SAM which provides the environment
supervision, the active/standby GCM which provides the GPS clock, the CHM which fulfills the
channel unit processing, the RIM which fulfills the interface between the base band and the RF, the
CCM which fulfills the BTS control, the DSM which fulfills the ABIS interface with the BSC, and the
SNM which fulfills the SDH interface.

SBDS: It is similar to the MBDS frame in the structure. But, it is not necessary to configure the
DSM, SNM and GCM.

138
 Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

RF subsystem: It primarily consists of such modules as: the SAM which provides the environment
supervision, the BTM which fulfills the radio testing of the BTS, the 6+1 active/standby TRX which
fulfills the up/down conversion of the signals, the RMM which fulfills the interface between the RF and
base band, the 6+1 active/standby PA which fulfills the power amplification of the forward signals, and
the RFE which fulfills the interface of antenna feeder and the reverse low-noise amplification.

Master base band shelf

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

S G G C C C C R R C C C C C C D D S S
A C C H H H HI I H H H H C C S S NN
M M M MMMMMMMMMMMMMMMM

Fig. 6-19 MBDS in full configuration

Slave base band shelf

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

S C C C C R R C C C C S S
A H H H HI I H H H H C C
M MMMMMMMMMMMM

Fig. 6-20 SBDS in full configuration

139
Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

RF subsystem
1 2 3 4 5 6 7 8 9 10 11 12 13

S T T T T R R T T T T R
A BTS R R R R M M R R R S S
M X X X X MMX X X MM

RFE RFE RFE RFE RFE RFE

PA PA PA PA PA PA PA

Fig. 6-21 RFS in full configuration

6.2.5 Characteristics of ZTE Communications All-IP

ZTE’s all-IP is an upscale, high performance and prospective platform. It cannot only merge into the
future all-IP network, but also meet various demands, like the 1X, HRPD, 1XEV-DV and WLAN
access.

The All-IP BSS can provide the following features:

♦ It is built upon the all-IP architecture, which is the absolute evolution trend of the radio
communication network side standards. So, ZTE’s all-IP equipment can smoothly merge into
the future communication network and acquire all the advantages related to all-IP. Moreover,
ZTE’s all-IP equipment can accommodate the current ATM-based interfaces.

♦ Its ultimate capacity is huge. The whole BSS can support a maximum of 1.5 million
voice subscribers (0.02 Erl) and over 2G data service. With the extensive application of
network processors and sophisticated DSP and CPU techniques, the integration degree is
largely improved. It only takes a one frame for the BSC to constitute an office. The two
frames can support 60,000 subscribers. One rack can support over 100 thousand subscribers.

140
 Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

♦ ZTE’s all-IP BSS supports the architecture that allows the vocoder to smoothly upgraded
to the MGW in the future.

♦ In the all-IP BTS, the one digital frame can implement the services of 24 carrier sectors,
and support the smooth expansion through stacking. In the all-IP BTS, a single RF frame can
support a maximum of 8 carriers and 3 sectors, or 4 carriers and 6 sectors.

♦ The all-IP BTS supports the architecture of the unique super BTS. That is, one BTS
constitutes the extraordinarily high processing capability of 120 carrier sectors. Through the
remote RF, it can cover an area equivalent to the coverage attained by dozens of old BTSs.
Due to the simplification, it is easy to install the far end outdoors. So, only one equipment
room needs to be rent in the area, thus largely saving operating costs of the office. In addition,
the super powerful base band processing part can even be installed in the same address of
BSC, making the Abis interface a simplified short-distance interface. In this way, the
maintenance is facilitated and the costs are slashed.

♦ It provides series of BTSs, such as the micro BTS, remote RF module, super BTS and
macro BTS, and achieve the uniform architecture for various types of BTSs.

♦ The all-IP supports the complete sharing of channel unit: implement the channel sharing
of 24 carrier sectors with CSM as the resolution. Through the software configuration,
different types of BTSs can be configured, such as 8 carriers and 3 sectors, 8 carriers and 6
sectors, and 1 carrier and 24 sectors, while the board and the backplane remain unchanged.
So, it is highly flexible.

♦ It supports the configuration completely separating the base band from the RF, and
supports the multi-sector remote RF module.

♦ The RF unit not only supports the traditional point-to-point or chain networking, but also
supports the more reliable ring networking.

♦ In the BTS, there is a extremely high ratio from the base band to the RF fiber. Each fiber
pair supports 24 carrier sectors. The all-IP BTS supports the 4-carrier digital intermediate
frequency technique.

♦ The all-IP BTS supports the digital predistortion processing of the forward signals.

♦ The all-IP macro BTS has the smallest size in this industry, only 1.6m high with 24
carrier sectors.

♦ The clock system accommodates the GPS and the GLONASS at the same time, or the
Big Dipper timing system.

141
Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

♦ The all-IP BSS supports the board logic and the dynamic software downloading.

♦ The all-IP BTS supports the mixed insertion of such CHMs as the 1X, HRPD and 1XEV-
DV, facilitating the upgrading to the utmost.

♦ In the all-IP BTS, there are the fully built-in primary power, transmission and
monitoring.

♦ The support for the transceiver and the N+1 backup of power amplifier can be
customized.

♦ The extended support can be provided for the emission subset, intelligent antenna and
linear predistortion power amplifier.

Due to the flexible demand-oriented configuration, the high-configuration cost has dropped
substantially and the low-configuration cost is also reduced.

6.2.5.1 Super BTS

The support for the super BTS is an important feature of the All-IP BTS. The architecture of the super BTS
is as shown in Fig. 6-23.The extraordinarily power base band processing capability can be implemented
in a site. Then, its forward/reverse services are distributed to the RF subsystem scattered in different
places. The remote RF subsystem can be installed outdoors. One remote RF subsystem (capable of
supporting multi-carrier and multi-sector) is equivalent one old macro BTS. So, several even dozens of
macro BTSs can be replaced by one super BTS. Because only the BTS and a few RFS are installed
indoors, the equipment room is largely saved and the maintenance is facilitated.

142
 Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

Can be out door

i nst al l ed I ndoor Super BTS Mul t i pl e RFS support ,
Di gi t al shel f 120 sect ors or more
Mul t i - Sect or per Fi ber
Remot e Sl ave 24 sect ors
RFS Fi ber Baseband Channel Pool Bet ween
uni t Mul t i - Sect or/ Frequency
24 sect ors

....
....
....
....
Remot e

....
....
....
RFS Fi ber Sl ave
Baseband
uni t
Remot e Mast er Local
Fi ber
RFS Baseband RFS
uni t

I P Transf er t o BSC
E1s or STM- 1
I P Cl oud

Fig. 6-22 Architecture of the super BTS

In one BDS, the system can support the processing of as many as 24 carrier sectors. Because the
whole super BTS can support a maximum of 5 BDSs, the maximal gross processing capacity can
amount to 120 carrier sectors.

Since all the BDS and RFS are independent subsystems, there must be independent environment
supervision capability inside each subsystem.

6.2.5.2 Smooth Evolution of the Radio Standards

At the radio side, ZTE’s all-IP cdma2000 solution supports all the all-IP standard series, such as IS95,
IS2000 1X and IS2000 HRPD. It will also support the future IS2000 1XEV-DV.ZTE’s cdma2000
solution can implement the completely smooth transition between different standards.

At the BTS side, in order to fulfill the upgrading from the 1X to the 1XEV, you only need to
replace or add the HRPD or EVDVCHM and update the software. It is not necessary to make any
change to all the other equipment, such as the Abis interface unit, control unit and RF unit.

At the BSC side, when the capacity is enough, you do not need to make any change to the

143
Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

hardware. Just upgrade the software to support the new standard. In the same BSS system or even the
same BTS, the services of different standards can coexist.

Fig. 6-23 ZTE solution supports the smooth evolution between different radio interface standards

It is the good system characteristics that contribute to the cross-standard smooth upgrading of ZTE
solution. Within ZTE’s BTS, over 2 Gbps unblocked switching is provided. Within the BSC, the two-
level unblocked switching is provided. The core switching is based on the architecture of Cross Bar
plus network processor, capable of supporting the complicated QoS based on the differentiated service
and realizing the complete flow control. The total switching capability can amount to 40 Gbps and be
expanded to 160 Gbps smoothly. In the foreseeable future, the solution can support the joint impact
brought about by any voice and high-speed packet data service.

The bearer channels of BSC and BTS are respectively the signaling channels and service channels,
which are independent of each other completely. As the two kinds of channels do not bother each other,
the service quality is assured.

Besides, within the BTS, the complete sharing of cross-carrier is implemented and the
independence between the external interface and the standards is achieved. The CHMs of different
standards can be inserted together in the same BTS, in order to implement the maximal flexibility. At
the same time, ZTE’s BTS can provide the integrity of 8 carriers and 3 sectors per rack. It is very

144
 Chapter 6 Evolution of cdma2000 BS-Side and ZTE All-IP Solution

suitable to the standard with separate carriers for voice and data (such as HRPD).

Exercises

1. Describe the evolution of the CDMA network side standards.

2. What are the advantages of the all-IP?

3. What are the performance characteristics of ZTE’s All-IP?

4. What does ZTE’s all-IP BSC consist of?

5. What is the structure of ZTE’s all-IP BTS?

6. Describe the design thoughts of ZTE super BTS.

7. Describe the smooth evolution of the radio standards in ZTE’s all-IP solution.

145
146
 Chapter 7 Key Technologies and Advantages of CDMA

Chapter 7 Key Techniques and Advantages of CDMA

Objectives
After learning this chapter, you should be able to:

♦ Master the key techniques of CDMA, including power control, diversity

technique and soft handoff.

♦ Master the advantages of CDMA.

Introduction

This chapter mainly introduces the key techniques and advantages of CDMA.

7.1 Overview of the Key Techniques

This section introduces some key techniques, including power control, diversity technology and
soft switching.

7.1.1 Power Control

In the CDMA system, power control is regarded as the core of all key techniques. Power control is
to allot the power resources of the CDMA system (including the mobile stations and the base
station). If this technique is not well achieved, the advantages of the CDMA system will not be
shown, and the CDMA system with large capacity and high quality cannot be implemented.

The power control process is simply illustrated in Fig. 7-1.

A B

Fig. 7-1 Schematic diagram of power control

Power control of CDMA includes forward power control, reverse power control and cell

147
Chapter 7 Technologies and Advantages of CDMA

breath power control.

Power control of CDMA involves forward power control and reverse power control.

If all subscribers in a cell transmit the signals with the same power, the signals from the MSs
nearer to the base station will be strong, and the signals from the MSs farther away from the base
station will be weak. Then the strong signals will cover the weak ones, and this is called as the
problem of “far and near effect” in the mobile communication.

As CDMA is a self-interfering system, and all subscribers share the same frequency, the
problem of “far and near effect” becomes more serious. In the CDMA system, the strong signal
power of a subscriber is conducive to the proper receiving of this subscriber, but causes more
interference to other subscribers within the shared frequency band, and even conceal useful
signals. As a result, the communication quality of other subscribers will be degraded, and the
system capacity is lowered. To override the far and near effect, the power required by the
transmitter should be adjusted in real time according to different communication distance, and this
is called as “power control”.

The CDMA system capacity is mainly limited by the mutual interference of the mobile
stations of the system. If the signals at each mobile station have the min. required Signal-to-Noise
Ratio (SNR) when they reach to the base station, the system capacity would reach the max. value.
The goal of CDMA power control is to keep the high-quality communication, without causing
unnecessary interference to other subscribers who occupy the same channel. Therefore, power
control is adopted in the reverse link of the CDMA system, so that the signals reaching the BS
receiver can have same power by adjusting the power of the subscriber’s transmitter. Meantime,
the power should be within the threshold value of the SNR, and meet the requirements of the
communication quality. Through adjustment, the signals for each subscriber can be ensured to
have the same power when they reach to the receiver at the base station regardless of the location
and transmitting environment of the subscriber. In the actual system, the transmitting environment
of the subscriber’s signals will change at any time due to the subscriber’s mobility, thus causing
the transmitting paths for the signals to reach to the base station, signal strength, time delay and
phase shift to change all the time, and the power for receiving signals to fluctuate at the expected
value.

7.1.1.1 Forward Power Control

For the forward link, the MS will be more seriously interfered by the adjacent BS when it moves
towards the cell edge, and will be more seriously interfered by the multi-path in the local cell
when it moves towards the BS. These two kinds of interference will affect the reception of the
signals, hence degrading the communication quality, and even causing the link unable to be set up.
Therefore, power control is adopted in the forward link of the CDMA system. Through adjusting
the power of the transmitter at the BS in the traffic channel, the transmitting power in the forward
traffic channel can be minimized provided that it meets the SNR required by demodulation of the
MS. Through adjustment, on the one hand, the communication between the BS and the MS

148
 Chapter 7 Key Technologies and Advantages of CDMA

located at the cell edge can be maintained; on the other hand, the forward transmitting power can
be minimized with satisfactory communication transmission performance, hence reducing the
interference caused to the adjacent cells and increasing the relative capacity of the forward link.

In an ideal single cell model, the forward power control is not mandatory. If the inter-cell
interference and the heat noise are taken into account, the forward power control becomes an
indispensable key technique because it can deal with the following abnormalities occurring in the
communication process over the forward link.

♦ If an MS is nearer to one or more adjacent BSs than to its own BS, this MS is more
seriously interfered by the adjacent BSs, and the changing rule of the interference is
independent of the signal strength at the BSs where the MS resides. In this case, the BS
where this MS belongs to is required to enhance the signal power by several decibels to
maintain the communication.

♦ If an MS just locates at a converging position of several strong multi-path

interferences, the interference on the signal exceeds the allowable limit. In this case, the
BS where this MS resides is also required to enhance the signal power.

♦ If an MS locates at a place where the signal transmission performance is excellent,

the signal transmission loss is decreased. The BS can cut down the power of the signals
that are transmitted to the MS provided that certain communication quality is kept. Due
to the limit of the total transmitting power of the BS, the capacity of the forward link can
be increased, and the interference to other in-cell and out-cell subscribers can be
lightened.

From the above, we can see that the main goal of the forward power control is to ensure the
communication quality of each subscriber through appropriately allocating the power in the
forward traffic channel, which makes the transmitting power in the forward traffic channel
minimized provided that it meets the min. SNR required by the demodulation of the MS, so that
the interference to the traffic channel in the adjacent cells can be lightened, and the subscriber
capacity of the forward link can be maximized.

The forward fast power control is divided into forward external-loop power control and
forward closed-loop power control.

In the enabled state of the forward external-loop power control, the two power control
mechanisms take effects simultaneously to achieve the forward fast power control. Although the
forward fast power control takes effect at the BS side, the power control external-loop parameters
and the power control bits are the output results after the MS checks the signal quality over the
forward link, and the final results will be transmitted to the BS via the power control sub-channel
in the reverse pilot frequency channel.

The implementation point of the forward external-loop power control is at the MS. The BS is
to send the threshold value of the external-loop power control to the MS with the paging message.

149
Chapter 7 Technologies and Advantages of CDMA

7.1.1.2 Reverse Power Control

Reverse power control involves three parts: open-loop power control, closed-loop power control
and external-loop power control. In the actual system, the reverse power control is achieved via
the above three power control modes together, that is, first, the open-loop estimation is conducted
for the transmitting power of the MS, then the open-loop estimation is further corrected by the
closed-loop power control and external-loop power control, which try to achieve the accurate
power control.

The reverse power control is adopted to control and minimize the transmitting power of the
MS to meet the requirements of the cell reverse capacity provided that the transmitted signals of
the MS meet certain demodulation requirements when they reach to the BS. As the reverse signals
of different MSs are mutually interfered, theoretically, the reverse capacity can only be maximized
if the signals of the MSs that implement the same service have consistent power when they reach
the BS.

The reverse transmitting power of the MS is obtained via the effects together taken by the
open-loop estimation and the closed-loop power control. In the case of no closed-loop power
control, e.g., the transmitting power of the access channel, only the open loop takes effect.

7.1.1.2.1 Reverse Open-loop Power Control

Each MS of the CDMA system is calculating the signal loss in the path from the BS to the
MS. If the signals received by the MS from the BS are strong, it indicates that the MS is very close
to the BS, or the transmission path is extremely excellent. In this case, the MS may weaken its
transmitting power and the BS can still properly receive the signals. On the contrary, if the signals
received by the MS from the BS are weak, the MS strengthens the transmitting power to
compensate the signal consumption, and this is called as open-loop power control. The open-loop
power control is simple and direct, and it is unnecessary to exchange the control information
between the MS and the BS. Moreover, the control speed is fast and the overhead can be saved.
However, the frequencies used in forward and reverse transmission are different in the CDMA
system (the frequency difference specified in IS-95 is 45MHz), and the frequency difference
tremendously exceeds the coherence bandwidth of the channel. Therefore, it cannot be deemed
that the fading characteristic in the forward channel is equivalent to that in the reverse channel,
which is the constraint of the open-loop power control. The open-loop power control is achieved
by the open-loop power control algorithm, and mainly adopts a constant, i.e., the summation
between the forward receiving power and the reverse transmitting power of the MS, to implement
the control function. The specific implementation involves the design of such main techniques as
open-loop response time control, open-loop power estimation correction factor.

7.1.1.2.2 Reverse Open-loop Power Control

To overcome the unrelated Rayleigh fading in the forward and reverse links, the BS checks the
SNR of the signals from the MS, compares it with a threshold, and sends a instruction of
strengthening or weakening the transmitting power to the MS over the downlink channel
according to the comparison result. After having received the instruction, the MS adjusts its
transmitting power. This is called closed-loop power control. The key to achieve the closed-loop

150
 Chapter 7 Key Technologies and Advantages of CDMA

power control is to fasten the speed of generating, transmitting, processing and executing the
power control instruction, so as to trace the uplink Rayleigh fading as much as possible. The
closed-loop power control algorithm involves the design of such main techniques as burst power
control command recognition, and over-adjusting power control command processing.

In the reverse closed-loop power control, the threshold of SNR is inconstant and is
dynamically adjusted. This dynamic adjusting process is called reverse external-loop power
control. In the reverse external-loop power control, the BS counts the Frame Error Rate (FER) in
the reverse channel. If the FER is higher than the FER threshold, it means that the fading in the
reverse channel is serious. Then you should enhance the transmitting power of the MS by
increasing the SNR. Otherwise, if the FER is lower than the FER threshold, you should weaken
the transmitting power of the MS by decreasing the SNR. The adjustment of the closed-loop
power control based on the FER statistics is achieved via the reverse external-loop power control
algorithm. The algorithm is based on three states: variable rate operation state, full rate operation
state, and delete operation state. These three states fully show the actual working situation of the
MS, and the power thresholds are adjusted differently at different states. To ensure the best quality
of the voice frame in the rate of 9600bps, many criteria, such as 1% FER threshold, are added in
the full rate operation state. This algorithm involves design of such main techniques as step-length
adjustment, state transition, accidental error judgment and softswitching FER statistical control.

7.1.1.3 Cell Breath Power Control

Cell breath is an important function of the CDMA system, which is mainly implemented to adjust
the burden of each cell of the system. The forward link boarder indicates a physical place between
two BSs. If an MS locates at this place, the receiver will have the same performance regardless of
the signals received from which of BSs. The reverse link handoff boarder indicates that the
receiver of the two base stations will have the same performance compared with the mobile station
if a mobile station locates at this place. Base station cell breath control is to keep the overlap of the
handoff boarders between the forward link and the reverse link, which maximizes the system
capacity and avoids the handoff failure. The cell breath algorithm is controlled based on the fact
that the summation between the reverse receiving power and the forward pilot frequency
transmitting power is a constant. The specific approach is to adjust the proportion between the
pilot frequency signal power and the total transmitting power of the BS so as to control the cell
coverage. The algorithm involves the design of the specific techniques including initial state
adjustment, reverse link monitoring and forward pilot frequency gain adjustment.

7.1.2 Diversity Reception

In the narrowband modulation system, if the first-generation mobile system based on analog FM
modulation is adopted, the existence of multiple paths will cause serious fading. However, in the
CDMA modulation system, the multi-path signals can be received separately so as to significantly
weaken the multi-path fading of the signal. But the multi-path fading is not completely eliminated

151
Chapter 7 Technologies and Advantages of CDMA

because sometimes the demodulator can still not independently handle the multi-path, and this will
cause some fading.

Diversity reception is a satisfactory approach to weaken the fading. It takes full advantage of
the multi-path signals energy in the transmission to improve the transmission reliability. It also
collects the scattered energy in the time, space and frequency domains.

Different paths which are almost independent of each other at the receiving end can be
obtained based on different angles, methods and measures of the space, time and frequency
domains. Three most typical types of the diversity reception are available, i.e., time diversity,
space diversity and frequency diversity, which are all adopted in the CDMA. They will be
introduced respectively as follows.

7.1.2.1 Time Diversity

Due to the movement of the MS, Doppler frequency shift will be caused in the received signals. In
the multi-path environment, such frequency shift forms Doppler spread. The reciprocal value of
Doppler spread is defined as coherence time, which indicates the time variation channel
corresponding to the signal fading beat. This fading usually happens at the specified time of the
transmission waveform, and it is called as time selective fading. It will cause serious influence to
the bit error of the digital signals.

If the amplitude is sampled in the sequential order, two sample points will be unrelated in the
case the time interval is long enough (longer than the coherence time). Therefore, the time
diversity can be adopted to weaken the influence, that is, the given signals are repeatedly
transmitted for N times at a certain time interval. As long as the time interval is longer than the
coherence time, N independent diversity branches can be obtained.

According to the analysis of the communication principle, we know that the time interval Δt
at the time domain should be greater than the coherence time ΔT at the time domain, namely:

∆t ≥ ∆T = 1 B

Where, B is the diffusion interval of the Doppler spread shift, which is directly proportional to the
moving speed of the MS. Therefore, time diversity is useless for the MS in the relatively static
state.

Compared with space diversity, time diversity has the advantage of less receiving antennas.
But it has the disadvantage of occupying more timeslot resources, thus decreasing the transmission
efficiency.

7.1.2.2 Frequency Diversity

It is the process of modulating the information to be transmitted onto different carriers for

152
 Chapter 7 Key Technologies and Advantages of CDMA

transmission to the channel. Due to the frequency-selective feature of fading, when the interval
between two frequencies is greater than the correlative bandwidth, the fading of them is
uncorrelated. That is, as long as the interval between the carriers is large enough, i.e., the carrier
interval Δf is greater than the frequency correlated bandwidth, we will have:

∆f ≥ ∆F =1 L

Where L refers to the delay diffusion of the received signal’s delay power spectrum. The
correlative bandwidth for the urban and suburb areas is 50 kHz and 250 kHz, respectively,
whereas the signal bandwidth of the CDMA system is 1.23 MHz, therefore frequency diversity is
possible. Specifically, the frequency band is 800~900 MHz for the urban area and the typical delay
diffusion is 5μs, therefore we have:

∆f ≥ ∆F = 1 L = 1 5µs = 200kHz

That is, the carrier interval of the frequency diversity should be greater than 200 kHz.

Compared with space diversity, frequency diversity has the advantage that there are less
receiving antennas and devices and the disadvantages that more frequency spectrum is occupied
and there are more transmitters.

7.1.2.3 Space Diversity

In the base station, several antennas are established at some certain distance to each other to
receive or transmit signals independently. This guarantees the independence of fading between
each signal. One of the signals is selected by using the selective combination technique to reduce
the influence of fading. This method makes use of the independence of the signals received at
different positions (space) against fading.

The basic structure of space diversity is that there is one antenna for transmission at the
transmitting side and N antennas for receiving at the receiving side.

The distance between the receiving antennas is d. According to the principles of

communication, d is the correlative interval ΔR. It should satisfy the following expression:

d = ∆R ≥ λ ϕ

where λ refers to the wavelength and ϕ is the diffusion angle of the antenna. In urban area, usually
the diffusion angle ϕ=20o. Then we have:

d ≥ 360o 20o × 1 (2π ) × λ = 9λ π ≈ 2.86λ

The more diversity antennas there are, the better the diversity effect is. The diversity gain is

153
Chapter 7 Technologies and Advantages of CDMA

proportional to the tuple of diversity N. But the improvement of diversity gains decreases as N
increases gradually when N>2. There is a tradeoff between performance and complexity in
practice. Usually N=2~4.

There are two variants for space diversity:

♦ Polarization diversity: two antennas that are orthogonal in polarization direction are
used for transmitting the same signal and the signals received by two antennas with
different polarization show different fading characteristics. That is, horizontal and
vertical polarization antennas are established at the transmitting end and receiving end
respectively, and at the receiving end, polarization diversity for the two signals of
different fading characteristics can be obtained. Its advantages are that the structure is
compact and space is saved; its disadvantages are that the transmitting power is allocated
to two antennas, incurring 3 dB loss.

♦ Angel diversity: the receiving environment varies in terms of terrain and building,
this may in effect make the signals from different path look like from different
directions. Thus directional antennas can be used at the receiving side to point to
different directions. The multi-path signals received by two directional antennas are
irrelevant.

In space diversity, there are N antennas at the receiving side. If the size and gain of these N
antennas are the same, then apart from the anti-fading diversity gain that the space diversity
obtains, there is additional 3 dB equipment gain for each antenna.

At the soft handoff, to obtain better communication quality, the mobile station can keep
contact with the previous base station and select a better one from the two signals after it begins
communication with the new base station.

7.1.2.4 RAKE Receiver

The spectrum signals transmitted by the transmitter will be reflected and refracted by buildings
and hills and other obstructs until they reach the receiver with different delays, forming multipath
signals. If the delay of these multipath signals exceed the delay of the pseudo-code’s chip, then the
receiver will differentiate these different beams. These different beams pass different delay lines,
aligned, and combined. What was disadvantageous becomes advantageous: the original interfering
signals become useful combined signals. This is the principle of the RAKE receiver. That is, it
makes use of the space diversity technique.

A RAKE receiver is composed of searcher, finger, and combiner. The searcher searches the
path by making use of the code’s auto-correlation and cross-correlation features. The finger
despreads and demodulates the signals. The number of the fingers determines the number of
demodulated paths. Usually a RAKE receiver in the CDMA base station system is composed of 4
fingers and a RAKE receiver in the mobile station is composed of 3 fingers. The combiner
combines the several signals from the demodulator. The commonly used combination algorithm

154
 Chapter 7 Key Technologies and Advantages of CDMA

includes selective combination, equal-gain combination, and maximal ratio combination. The
combined signals are output to the decoder unit for channel decoding.

Specifically, the correlator of each path of the RAKE receiver despreads the received signals.
In terms of the coherent demodulation, the despread signals are multiplied with a complex
amplitude to correct the phase error and the path is weighted according to the selected
combination (maximal ratio or equal-gain combination). The impulse-response metering module
measures the multipath profile continuously. When the delay of the pulse response changes, the
metering module will assign new code phase to the code-tracing module to trace the minute
changes. The signals of different RAKE paths are combined and the channel codes are interleaved
and decoded. Furthermore, the searcher continuously searches the pilot signals of the adjacent
cells to provide pilot signal measurement for the handoff. The number of RAKE paths is
determined by the channel profile and chip rate. Higher chip rate offers more separable paths.
However, when there are too many RAKE paths, more energy is needed from the channel to
maintain good performance. Too many RAKE paths may lead to combination loss.

The following discusses the measurement of the impulse response, code acquisition, code
tracing, complex amplitude estimation, and the searcher. The impulse response measurement
correlates the pilot codes of different phases and the received signals to find out the multipath
component. The required metering rate of the impulse response measurement is determined by the
speed of the mobile station and radio environment. The quicker the mobile station’s moving speed
is, the faster the measurement is required for the RAKE paths to obtain the best multipath
components. However, in environments of longer delay extension, a broader scanning window is
required. Apart from metering, this module assigns the multipath components to the RAKE paths.
Different policies can be applied to the codes assignment. The assignment can be carried out when
the impulse response measurement is finished or the strong enough multipath component has been
found out. The code searching is carried out before the system synchronous searching.

The mobile station scans the pilot signal. The sequence of the pilot signal priority can be
determined by the nearest or adjacent pilot signals. If the connection is lost due to some reasons,
the scan will begin from the pilot signal of the highest priority. Under strong interference, the code
search may be a bottleneck. The matching filter may be used to search fast code. The typical code
tracing loop is leading and lagging locked loop. It includes two correlators (leading and lagging).
The chips assigned to them are half-chip short from the standard timing. The code phase is
adjusted according to the correlation result. The performance of the tracing loop is determined by
the loop bandwidth. If the update is faster than the movement of the multipath component delay,
then the synchronization error can be ignored. Otherwise the loop noise will increase. This,
however, also depends on the detection policy (that is, applying regular or multi-user detection).

The estimation of the complex amplitude includes that of amplitude and phase. In the
maximal ratio combination, the signal weight is the complex conjugate of the complex amplitude.
In case of equal-gain combination, only the phase error is corrected and each RAKE path can be
regarded as with equal weight. The estimation of the complex amplitude should be averaged in a
reasonable period duration. In this case the coherent time is regarded as the upper limit of the

155
Chapter 7 Technologies and Advantages of CDMA

average time. The searcher scans the pilot signals of other cells. During talk, the mobile station
searches the pilot signals, measures the downlink interference, and possible received the uplink
interference results. As there are a large number of pilot signals, it may take a long time to search
the pilot signals of the adjacent diversity set.

Therefore the searching time may limit the performance of the system, in particular under the
cellular environment, where a new base station can be activated because of the corner effect. One
possibility to reduce the needed hardware is to flexibly assign RAKE and path searchers. In a low
multipath environment it will increase the effectiveness of the scanning. The number of paths
scanned is determined by the expected rate of the preamble signal scanning.

7.1.3 Soft Handoff

Soft handoff is unique to the CDMA mobile communication system. Its principles are as follows:
when a mobile station moves to the adjacent BTS controlled by the same BSC, the mobile station
keeps radio connection with the source BTS and connects the target BTS, then releases the radio
connection with the source BTS. The soft handoff happening between different sectors of the same
BTS under the same BSC control is called softer handoff.

There are the following soft handoff modes:

♦ Handoff between different sectors with the same carrier in the same BTS, which is
also called softer handoff.

♦ Handoff between different BTSs with the same carrier in the same BTC;

♦ Handoff between different BSCs with the same carrier in the same MSC.

7.1.3.1 Soft Handoff

Soft handoff means that when a mobile station wants to communicate with a new base station, it
hands off to the new base station while maintains connection with the previous base station. Soft
handoff can only happen between CDMA channels of the same frequency. It acts as the traffic
channel diversity in the border between two areas covered by two base stations. This significantly
reduces the call-drop caused by handoff. According to the testing statistics of the analog TDMA,
90% of the call-drops in the radio channels happen during handoff. The soft handoff greatly
reduces the probability of call-drop, ensuring the reliability of the communication.

156
 Chapter 7 Key Technologies and Advantages of CDMA

Fig. 7-2 Soft handoff

The following analyzes in detail how the mobile station carries out soft handoff.

To carry out soft handoff, the mobile station first searches all the pilot components and
measures their intensity. The mobile station calculates the E c/Io (Ec refers to the energy of one bit
and Io refers to the total spectral density received, including noise and signal) of all the multipath
components (at most K) of the pilot as the intensity of the pilot, where K is the number of
demodulator units provided by the mobile station. When the pilot intensity E c/Io is stronger than a
specific value T_ADD, the mobile station will think that the intensity of that pilot is strong enough
to perform correct demodulation. At this time the mobile station does not establish connection
with the base station corresponding to that pilot, rather, it reports the measured pilot intensity to
the previous base station which forwards the report to the MSC; the MSC asks the new base
station to assign a forward traffic channel to the mobile station and the previous base station sends
a message to the mobile station instructing it to carry out the handoff. Hence it can be seen that the
CDMA soft handoff is under the assistance of the mobile station.

After it receives the handoff instruction from the base station, the mobile station integrates
the pilot of the new base station into its effective pilot set and begins to demodulate the forward
traffic channels of both new base station and previous base station. After that, the mobile station
sends a handoff-completion message to the base station, informing the base station that it begins to
demodulate the signals from both base stations.

Then, as the mobile station moves, the intensity of one of the two pilots of the two base
stations may become weaker than a specific value T_DROP, the mobile station will start a
handoff-drop timer (the mobile station maintains one timer for each pilot in its effective pilot set
and candidate effective pilot set, when a pilot intensity is weaker than a specific value D, the timer
corresponding to that pilot will start). When the handoff-drop timer T expires (during this time, the
pilot intensity must be always weaker than D), the mobile station sends pilot intensity
measurement message. After the two base stations receive the pilot intensity measurement
message, they send it to the MSC which returns the corresponding handoff instruction; then the
base station sends handoff instruction message to the mobile station which will drop the pilot
whose timer expires from the effective pilot set. After that, the mobile station only maintains
communication with the base station whose pilot is in the effective pilot set and sends a handoff-
completion message to the base station, informing it that the handoff has been completed.

157
Chapter 7 Technologies and Advantages of CDMA

The whole handoff procedure includes the following steps:

♦ When the pilot intensity reaches T_ADD, the mobile station sends a pilot-intensity
measurement message and moves the pilot to the candidate pilot set.

♦ The base station returns a handoff instruction message.

♦ The mobile station moves the pilot to the effective pilot set and sends a handoff-
completion message.

♦ If the pilot intensity reduces to below T-DROP, the mobile station starts the handoff-
drop timer.

♦ If the handoff-drop timer expires, the mobile station sends a pilot-intensity

measurement message.

♦ The base station returns a handoff instruction message.

♦ The mobile station moves the pilot from the effective pilot set to the adjacent pilots
set and sends a handoff-completion message.

7.1.3.2 Softer Handoff

The softer handoff is carried out by the base station and is not notified to the MSC. For a mobile
station, the received signals from antennas of different sectors look like different multipath
components from the point of view of the base station. These signals are combined into one voice
frame that is sent to the selector as the voice frame of the base station. Whereas the soft handoff is
carried out by the MSC. All the signals from different base stations are sent to the selector, which
will choose a best one for voice encoding/decoding.

Fig. 7-3 Softer handoff

As the procedure of softer handoff is included in the above soft handoff procedure, its steps
are not analyzed here. Its analysis method is essentially the same as that of the soft handoff.

158
 Chapter 7 Key Technologies and Advantages of CDMA

The above section describes the types of handoff, procedure of the handoff, and the concept
of softer handoff. At the system operation, these handoffs occur in combination, that is, soft
handoff, software handoff, as well as hard handoff may happen at the same time. For example,
when a mobile station is at the edge area of two sectors of one base station and the other base
station, both soft handoff and softer handoff will happen. If it is at the edge of three base stations,
three-party soft handoff will happen. The above two soft handoffs assume that the base stations
that have the same carrier frequency and free capacity. If the adjacent base station that has the
same carrier frequency is in full load, the MSC will ask the base station to instruct the mobile
station to hand off to the other carrier of that adjacent base station, this is known as hard handoff.
Where three parties are involved, if any of the other two parties has free capacity, soft handoff will
be preferred. That is, only when soft handoff is impossible will hard handoff be considered. If,
however, the adjacent base stations happen to be in different MSCs, even when they are at the
same carrier frequency, at present only hard handoff is available. This is because the vocoder
should be changed. If later on the IPI interface and ATM are used between BSCs, then the soft
handoff between MSCs is available.

There is another concept called idle handoff. It refers to the handoff happening when the
mobile phone is in idle status, and the base station does not know this handoff.

7.2 Advantages of the CDMA System

Compared with FDMA and TDMA, the CDMA system has many unique advantages. Some of
them are inherent in the spread spectrum communication system, and the others result from such
techniques as soft handoff and power control. The CDMA mobile communication network is
integrated by several kinds of techniques including spread spectrum, multi-address access, cellular
networking and frequency reuse, with the coordination of 3-D (frequency domain, time domain
and code domain) signal processing. Therefore, it has excellent interference resistance, multi-path
fading resistance, high privacy, frequency reuse in many cells, the less than Carrier-to-Interference
ratio (C/I) required , and convenient tradeoff between capacity and quality. These features enable
CDMA to have much more advantages than other systems. They are specifically shown in the
aspects described below.

7.2.1 Unique Frequency Reuse

159
Chapter 7 Technologies and Advantages of CDMA

GSM: CDMA:N
N=4 =1
3 频率复 频率复用
1 1
4 1 1 1
1 用 1
1 1 1
3 2 3 4 1 1 1 1
4 4 2 1 1 1
2 3 1 1 1 1 1
1 2 3 1 1
4 1 1

Fig. 7-4 Frequency reuse comparison between CDMA and GSM

In the CDMA system, as the frequencies at all cells are the same, the reuse coefficient is 1.
But in the GSM system, due to the frequency interference at the cell, the frequencies at the
adjacent cells are different, and the frequency reuse coefficient is 1/3.The following table gives a
comparison of the frequency use between GSM and CDMA.

Table 1 10 MHz frequency spectrum (5MHz for transmitting and 5MHz for receiving)
Parameter CDMA GSM
Carrier bandwidth 1.25MHz 0.20MHz
Carrier number 3 25*
Frequency reuse 1/1 3/9
Effective carrier 3/1=3 25/3=8.3
Voice call/carrier 25 to 40+ 7.25**
Voice call/cell 75 to 120+ 7.25×8.3=60.2
Sector/cell 3 3
Voice call/sector 75 to 120+ 60.2/3=20.0
Erlang / sector*** 64 to 107E 13.2
* In the best case, the GSM and AMPS have no protected band.

** 0.75 less than 8 voice call/carrier, which is used for overhead (e.g.
control/frequency pilot).

*** Based on 2% blocking

From the table, it can be seen that the capacity of CDMA is 5.5 times as large as that of GSM
in the case of the same frequency spectrum.

160
 Chapter 7 Key Technologies and Advantages of CDMA

7.2.2 Wide Coverage

The coverage radius of the CDMA system is twice as much as that of the standard GSM system.
As the code division technique is adopted for the CDMA system, the fading resistance capability
is stronger than that of the GSM system, hence increasing the coverage radius. For example, if the
coverage area is 1,000 km2, 200 base stations are needed for the GSM system, but only 50 for the
CDMA system. In the case of the same coverage area, the number of base stations in the CDMA
system is greatly decreased, and the investment cost is obviously cut down.

7.2.3 Large Capacity

The CDMA network is a self-interfering system. The users use the same frequency and they can
be differentiated with the channel code. So the signal of one user is interference to other users.
Likewise, the signals of other users are interference sources of this user. Increasing the number of
users will not cause the call failure, and it just slightly degrades the voice quality of users. The
network capacity depends upon the allowable interference margin.

As the power control technique is adopted in the system, the system power is very weak. The
power control technique of CDMA enables the power carried by the transmitted signals to be kept
at the min. level under assuring the excellent call quality. The weak power indicates less power
consumption, which results in less interference and larger call capacity. If each base station can
provides larger call capacity, it indicates that only less base stations are required to achieve a
certain quantity of traffic.

With the spread spectrum technology adopted, the CDMA system can provide larger system
capacity with less frequency spectrum resources and electric power resource. Compared with the
GSM network, the capacity of the CDMA network is 4~6 times larger, which leads the reduction
of the cost.

The variable rate voice encoder can decrease the number of channels occupied by the call
process when the calling and called parties do not speak. Therefore, the channel can be effectively
utilized, hence indirectly increasing the call capacity of the whole system.

7.2.4 High Voice Quality

The call quality in the CDMA system is better than that in the AMPS or TDMA system.

The voice quality of the CDMA system is excellent. The vocoder can dynamically adjust the
data transmission rate, and select different levels for transmission according to appropriate
threshold value. Meanwhile, the threshold value changes according to the background noise
change. Therefore, better call quality can be obtained even though the background noise is strong.

161
Chapter 7 Technologies and Advantages of CDMA

High-quality voice encoder: The channel structure of the TDMA system can only support the
voice encoder of 4 kbps at most, and it cannot support the voice encoder of 8 kbps or more. The
QCELP voice code is adopted for the CDMA system, hence tremendously suppressing the
background noise. Thanks to the excellent communication quality of the system, the voice
becomes clearer, resulting in such advantages as clear voice and weak background noise. The
performance is obviously better than that of other wireless mobile communication systems, and
the voice quality can compete with that of the wireline phone.

When a subscriber moves between mobile sites, he can obviously feel the call interruption
due to the hard handoff of the TDMA system. This phenomenon is particularly obvious in the
cities with centralized subscribers and dense base stations because the hard handoff will be
conducted for 2~4 times per minute in such areas. With the unique soft handoff technique of the
CDMA system, the subscriber’s communication with the previous base station will not be
interrupted when he moves from one to another base station until the communication is handed off
to the new base station. That is, the user communicates with two base stations at the same time
during handoff, thus enhancing the signal strength at the cell boarder, preventing the voice from
being weakened or the call quality from being degraded, greatly decreasing the possibilities of call
drop, and ensuring the quality of the long-time mobile conversation. The soft handoff technique
enables the calling and called parties to receive the signals from the adjacent 3~5 mobile sites.
After the received signals are combined, the conversation interruption can be eliminated in the
handoff process, and the signal quality can also be fully improved (through choosing the best
signals from the received 3~5 signals all the time).

With the broadband carrier transmission and the advanced power control techniques, the
phenomenon of discontinuous signals can be avoided. Moreover, thanks to the powerful error
correction code, the subscriber can also make a stable conversation on a car at the speed of 200
kilometers per hour.

7.2.5 Excellent Privacy

Spread spectrum communication technique is the latest wireless communication technique in the
world. One of its features is the excellent privacy performance. Being integrated with the perfect
authentication and privacy technique of the CDMA system, it can prevent the user from being
intruded, that is, the user will not be easily intercepted in his conversation process.

The broadband spectrum signal is very hard to intercept just as it is difficult to hear a low
sigh of a person in a noisy room. But in other techniques, the signal energies are all centralized in
a narrow waveband, which enables other people to easily intercept the transmitted signals.

Even on occasion, it is also difficult for an eavesdropper to intercept the conversation

contents over the CDMA system. This is because it is impossible for a simple radio receiver to
separate a channel of digital signal from all the radio frequency (RF) signals on a frequency band,
which is otherwise in the analog system.

162
 Chapter 7 Key Technologies and Advantages of CDMA

With the Pseudo-Number (PN) as the address code and the unique code scrambling mode, the
CDMA system has incomparable advantages over other networks in the aspects of preventing
cross-talking and illegal use, which further protect the privacy of the conversation in the CDMA
network.

7.2.6 User Satisfaction

Due to the specialties of the CDMA technique, the CDMA system has many advantages for users,
which can provide users with more satisfactory services. This can be shown in the aspects as
follows:

♦ Low call drop and high voice quality;

♦ Higher data transmission rate;

♦ More multimedia services;

♦ Low transmitting power, longer standby duration, less radiation of a mobile phone,
which is honored with “Green Mobile Phone”. The average transmitting power of a
GSM mobile phone is 125 mW, with the max. transmitting power being 2W, but the
average transmitting power of CDMA mobile phone is 2 mW, with the max. transmitting
power being 200 mW.

7.2.7 Economy

In the comparison of the economy between the CDMA system and other systems such as AMPS
and GSM systems, some advantages of the CDMA system, such as a cell coverage and its
capacity, must be carefully taken account in the cost factors.

One of the CDMA system’s advantages is to save power, and 2~4 dB power is saved in
CDMA than in GSM. Such factors as transmitting power, transmitter duty cycle, modulating and
encoding are taken account in this value.

As the maximum path attenuation ratio of the CDMA system can be 6 dB~10 dB more than
that of the GSM system, less base stations are only required in the CDMA system to provide the
same conversation quality as that in the GSM system. As a result, in the same coverage condition
and coverage area, less base stations are required in the CDMA system, hence tremendously
saving the investment cost.

Generally, when the CDMA system starts to provide a service, the number of corresponding
base stations is less due to less users. But the CDMA system can bear stronger path attenuation
than the GSM system, hence providing wider coverage areas to satisfy the requirements of the

163
Chapter 7 Technologies and Advantages of CDMA

users. When the number of users increases, thanks to the large capacity, the CDMA system
requires less number of base stations, with a lower cost. In view of saving the cost, this is very
important for an operator that just starts its service.

Additionally, another significant advantage is the compatibility of the CDMA system. First,
the IS-95 system can be smoothly upgraded to the 1x system. The upgrade can be implemented via
upgrading the software without changing any hardware. Secondly, the IS-95 system can coexist
with the 1x system, with the feature of backward compatibility.

Exercises

1. Briefly describe the types and roles of power control in the CDMA system.

2. How many kinds of soft handoff are there? What are the situations where they happen?
What are the advantages resulted from this technique?

3. How many kinds of diversity receiving are there? What is the technology adopted by the
RAKE receiver?

4. Briefly describe the advantages of the CDMA system.

5. What are the situations where the soft and hard handoff will happen?

6. What is the difference between the soft handoff and the hard handoff?

7. What are the roles of power control?

8. How many kinds of the power controls are there?

9. How many kinds of the diversity techniques are there?

10. What is the diversity technique adopted by the RAKE receiver? What is the feature of this
diversity technology?

11. Briefly describe the working principle of the RAKE receiver?

12. Briefly describe the advantages of the CDMA system.

13. Please compare the coverage area of a CDMA base station with that of a GSM base
station.

14. Briefly describe similarities and differences between the GSM and CDMA systems

164
 Chapter 7 Key Technologies and Advantages of CDMA

frequency reuse.

165
Part 2 CDMA Full Series Products

ZTE Corporation

-166-
 Preface

This part mainly introduces the solutions and products of ZTE CDMA, including the products at
the radio side, at the switching side, and the layered network management center ZXCOMC. It
also introduces the services, network planning and network optimization of ZTE cdma2000 1x.

This part includes 11 chapters. Chapter 8 introduces the mobile switching system ZXC10-
MSC&VLR&SSP (V3.0). Chapter 9 introduces HLR&AUC(V3.0). Chapter 10 introduces short
message center (ZXC100). Chapters 11-17 introduce some ZXC10 mobile base station systems,
including basic BSS, micro base stations, remote RF units, direct amplifier station, ZTE CDMA
indoor distributed system, ZTE CDMA wide and deep coverage schemes, and ZTE CDMA-WLL
policy. Chapter 18 introduces the data packet switching system ZXPDSS . Chapter 19 introduces
the layered centralized network management center, i.e., ZXCOMC. Chapter 20 introduces the
services of ZTE cdma2000 1x. Chapter 21 introduces the solutions of the ZTE network planning
and optimization.

After reading this part, the reader should basically be familiar with the complete solutions
provided by ZTE in respect of CDMA, including mobile switching, base station, packet switching
and mobile phone; roughly grasp the working principle and features of the ZTE CDMA products
as well as the basic services; have a fundamental recognition of the network planning.

-167-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

Chapter 8 ZXC10-MSC/VLR/SSP (V3.0)

Objectives
After learning this chapter, you shall be able to:

♦ Be familiar with the interfaces between the entities in the network structure
diagram of the cellular mobile communication system

♦ Master key technical indexes, hardware and software system structures of

ZXC10−MSC/VLR/SSP

♦ Master the networking mode and system configurations of ZXC10−MSC/VLR/SSP

Introduction

This chapter first introduces the network structure diagram of the CDMA cellular mobile
communication system, the interfaces between the entities in the network based on the diagram, and the
corresponding technical standards. Then it introduces the technical indexes, software and hardware
system structures of ZTE ZXC10−MSC/VLR/SSP, and gives a brief description of the services and
functions. Finally, it shows the networking and configuration modes of ZXC10−MSC/VLR/SSP.

8.1 Overview

8.1.1 Network Architecture Diagram of CDMA Cellular Mobile

Communications System

The schematic diagram of the CDMA cellular mobile communication system is shown in Fig. 8-1.

-168-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

MS MSC SCP PSTN

ISDN
Um E PSPDN

Abis A B
BTS BSC MSC/SSP VLR

Q C D G

M N
SC SC HLR VLR

M N
M
SME SME
AUC

Fig. 8-1 Network architecture of CDMA cellular mobile communications system

The description is given is Table 8-1.

Table 8-1 Explanation of abbreviations

Abbreviations Full name
MSC Mobile Switching Center
HLR Home Location Register
SC Short Message center
SSP Service Switching Point
AUC Authorization Center
PSTN Public Switched Telephone Network
ISDN Integrated Service Digital Network
PSPDN Packet Service Public Digital Network
SME Short Message Entity
BTS Base Transceiver Station
BSC Base Station Controller
BS Base Station
MS Mobile Station

-169-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

8.1.2 Major Interfaces between Entities

8.1.2.1 Interface between MSC and BSS (A-Interface)

In fact, it is the interface between MSC and BSC. It adopts 2 Mbps PCM digital link, the standard
protocols for this interface include IS-634, IOS2.4, IOS4.0 etc. Of which, IOS2.4 is the protocol
standard of IS-95, IOS4.0 is the protocol standard of IS-2000, which is compatible with IS-95.

A interface is mainly used to transmit the following information:

1. BSS management message;

2. Call processing;

3. Mobility management information.

8.1.2.2 Interface between MSC and VLR (B Interface)

As an internal interface, the interface has got no standard definition. Its function is as follows:

VLR is the location and management database of subscribers who roam to the related MSC
region. When the MSC needs the subscriber data of this MSC area, the MSC is to inquire the VLR. In
the case of mobile station location updating, the MSC will request VLR to store the related
information; when the user activates the supplementary services or modifies data, the MSC will request
the HLR (through VLR) to store the related data.

8.1.2.3 Interface Between MSC and HLR (C Interface)

Interface between the MSC and the HLR.

The system adopts the IS-41E protocol. This interface is based on 2 Mbps digital interface or 64
kbps interface, with its interface electrical performance conforming to GF002-9002.1 Chapter 7 of
Volume I General Technical Specifications for Digital SPC Switching Equipment in General Technical
Specifications for Telephony Switching Equipment of the Ministry of Posts and Telecommunications
and GB7611-87 Pulse Coding Modulation Communication System Network Digital Interface
Parameters. As for the signaling procedures, for detailed description of MAP, refer to Technical
Requirements for 800 MHz CDMA Digital Cellular Mobile Communication Network Mobile
Application Part (MAP). For detailed description of SCCP, refer to GF010-95 Technical Requirements
for National SS7 Signaling Mode Technical Specifications: Signaling Connection Control Part (SCCP).
For detailed description of MTP, refer to GF001-9001 Technical Specifications for China Telephone
Network SS7 Signaling Mode.

-170-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

C interface adopts 24-bit SS7 signaling mode.

8.1.2.4 Interface between VLR and HLR (D Interface)

This interface system adopts IS-41E protocol and is based on 2Mbps digital interface or 64kbps
interface, with its interface electrical performance conforming to Chapter 7 of Volume 1 General
Technical Specifications for Digital SPC Switching Equipment in GF002-9002.1 General Technical
Specifications for Telephony Switching Equipment of the Ministry of Posts and Telecommunications
and GB7611-87 Pulse Coding Modulation Communication System Network Digital Interface
Parameters. As for the signaling specifications, for detailed description of MAP, refer to Technical
Requirements for 800 MHz CDMA Digital Cellular Mobile Communication Network Mobile
Application Part (MAP). For detailed description of SCCP, refer to GF010-95 Technical Specifications
Technical Requirements for National SS7 Signaling Mode Signaling Connection Control Part (SCCP).
For detailed description of MTP, refer to GF001-9001 Technical Specification for China Telephone
Network SS7 Signaling Mode.

D interface uses 24-bit SS7 signaling mode.

The interface is used to exchange subscriber location information, authorization information and
service data. The main service function of the MS is the capability of originating and terminating calls
in the service area. To support this capability, location registers needs to exchange data. The VLR
notifies the HLR of subscriber location information, and provides subscriber roaming number during
calls. HLR sends the subscriber’s service data VLR needs. The exchanges of data normally take place
when a subscriber requests a special service and when a subscriber or network operator changes the
subscriber data.

8.1.2.5 Interface between MSC and MSC (E Interface)

The interface between MSCs.

The system adopts the IS-41E protocol and is based on 2 Mbps digital interface or 64 kb/s
interface, with its interface electrical performance conforming to Chapter 7 of Volume 1 General
Technical Specifications for Digital SPC Switching Equipment in GF002-9002.1 General Technical
Specifications for Telephony Switching Equipment of the Ministry of Posts and Telecommunications
and GB7611-87 Pulse Coding Modulation Communication System Network Digital Interface
Parameters. As for the signaling specifications, for detailed description of MAP, refer to Technical
Requirements for 800MHz CDMA Digital Cellular Mobile Communication Network Mobile
Application Part (MAP). For detailed description of SCCP, refer to GF010-95 Technical Requirements
for National SS7 Signaling Mode Technical Specifications Signaling Connection Control Part (SCCP).
For detailed description of MTP, refer to GF001-9001 Technical Specifications for China Telephone
Network SS7 Signaling Mode. The ISUP part is to be defined.

-171-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

E interface adopts the 24 bits SS7 signaling mode. Its function is as follows:

When a mobile station roams from one MSC to another, the MSC will perform a handoff in order
to keep the subscribers’ conversation uninterrupted. In this case data exchange must be implemented
between the MSCs.

8.1.2.6 Interface between MSC and EIR (F-Interface)

This interface has no standard definition. Its function is as follows:

When the mobile station is in communication, and the MSC authenticates the mobile station, it has
to inquire the EIR, so as to determine whether the mobile station is legal, and thus deciding whether to
provide services to this mobile station.

8.1.2.7 Interface between HLR and AUC (H Interface)

Currently an internal interface is used. Its function is as follows:

When accepting an authentication request from the MS, HLR obtains data from AUC. When the
AUC originates authentication commands to the MS, the AUC delivers authentication information to
subscribers via the HLR.

8.1.2.8 Interfaces between SC and SME and SC (M-Interface)

Current the SMPP phase I standard is used. Its function is as follows:

When the SC performs information interaction with the SME and another SC, this protocol must
be followed.

8.1.2.9 Interface between HLR and SC (N Interface)

ANSI-41E is employed for the interface standard. Its function is as follows:

When the SC sends a short message to a subscriber, and there is no address information of this
subscriber, it is necessary to inquire HLR about the route of the subscriber before sending the short
message to the subscriber.

8.1.2.10 Interface between SC and MSC (Q Interface)

ANSI-41E is employed for the interface standard. Its function is as follows:

During the submission and reception of a short message, short message transfer needs to be

-172-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

conducted between the SC and the MSC. At the same time, when the subscriber’s short message
capability changes, the mobile switching center needs to notify the SC in time.

8.1.2.11 Interface between the MSC and the OMC

The interface is in compliance with the network structure requirements of TMN, and the standard Q3
interface is provided to the upper-level TMN.

8.1.2.12 Interface with PSTN/ISDN (Ai/Di)

The CDMA digital cellular mobile network interworks with PSTN/ISDN via the Mobile Switching
Center (MSC), and provides subscribers with voice, data and some supplementary services. Its
interface is based on 2 Mb/s digital interface. The interface protocols takes TUP and ISUP of SS7 in
priority. Where conditions are not available, No.1 signaling can be used.

8.1.2.13 Interface with other PLMNs

The CDMA digital mobile network is normally connected with different types of PLMN networks
(such as GSM) through other public networks (such as PSTN and ISDN), or directly connected with
other types of PLMN networks. The protocols employed can be TUP or ISUP.

8.1.2.14 Interface with PSPDN

IS-658 protocol is employed for high layer interface, while X.25 or TCP/IP is employed for the bottom
layer. This interface is based on 2 Mbps digital interface or 64 kb/s interface, with its interface
electrical performance conforming to Chapter 7 of Volume 1 General Technical Specifications for
Digital SPC Switching Equipment in GF002-9002.1 General Technical Specifications for Telephony
Switching Equipment of the Ministry of Posts and Telecommunications and GB7611-87 Pulse Coding
Modulation Communication System Network Digital Interface Parameters. For the details of signaling
specifications, refer to Technical Requirements for Interface between MSC and PSTN in the CDMA
Digital Cellular Mobile Communication Network.

8.1.3 Technical Standards

ZTE CDMA cellular mobile communication system ZXC10-MSC/VLR/SSP (V3.0) supports the
following protocols and standards:

♦ Basic Dimensions Series for GB3047.1~82 Panel, Rack and Shelf

-173-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

♦ GB191-90 Graphic marks for Packing, Storage and Transportation

♦ GB4798.3-90 Fixed Usage of Electric and Electronic Products in Climate-protecting

Environment

♦ GB2423.1~4-81 Basic Environment Testing Procedure for Electric and electronic

Products

♦ GF018-95 Automatic Telephone Numbering for Public Telephone Network

♦ YDN 065-1997 General Technical Specifications of Telephone Switching Equipment

Issued by the Ministry of Posts and Telecommunications

♦ GB7611-87 Pulse Coding Modulation Communication System Network Digital Interface

Parameters

♦ YD/T627-93 Digital Switch Trunk Interface (2048 kb/s) Parameters and Transmission
Features between Digital Interfaces and Testing Methods

♦ YDN Technical Specifications for China Telephone Network Channel Associated

Signaling Mode

♦ GF001-9001 Technical Specifications for China National Telephony Network SS7

♦ YDN 068-1997 Technical Specifications for National SS7 Signaling — Message Transfer
Part (MTP)

♦ GF010-95 Technical Specifications for National SS7 Signaling — Signaling Connection

Control Part (SCCP)

♦ YDN 043-1997 Technical Specification for Digital Cellular Mobile Communication

Network SS7 Signaling ISUP

♦ YDN 066-1997 Technical Specifications for National SS7 Signaling – Operation and
Management Application Part (OMAP)

♦ YD/T 1031-1999 Technical Specifications for 800MHz CDMA Digital Cellular Mobile
Communications Network: Signaling System Mobile Application Part (MAP)

♦ YDN 094-1997 Technical Requirements for Interface Between MSC and PSTN in 800
MHz CDMA Digital Cellular Mobile Communication Network

-174-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

♦ YDN044-1997 Technical Mechanism for 800 MHz CDMA Digital Cellular Mobile
Communication Network

♦ YD/T 1048-2000General Technical Specifications for 800 MHz CDMA Digital Cellular
Mobile Communication System Equipment Switching Subsystem Part

♦ YD/T 1026-1999 Technical Specifications for Interfaces between Mobile Service

Switching Center-Base Station Subsystem in 800 MHz CDMA Digital Cellular Mobile
Communication Network

♦ YD/T 1026-1999 Testing Technical Specifications for Interfaces between Mobile Service
Switching Center-Base Station Subsystem in 800 MHz CDMA Digital Cellular Mobile
Communication Network

♦ YD/T xxxx-xxxx Technical Specifications for Interfaces of 800 MHz CDMA Cellular
Mobile Communication System WIN Phase 1

♦ YD/T 1049-1999 General Testing Specifications for 800 MHz CDMA Digital Cellular
Mobile Communication System Switching Subsystem Part

♦ YD/T 1052-1999 Testing Specifications for 800 MHz CDMA Digital Cellular Mobile
Communication Network Mobile Application Part

♦ YD/T xxxx-xxxx Technical Requirements for 800 MHZ CDMA Digital Cellular Mobile
Communication Network WIN Phase 1

♦ YD/T xxxx-xxxx Technical Specifications for 800 MHz CDMA Digital Cellular Mobile
Communication Network Wireless Intelligent Network (WIN) Phase 1: Service Switching
Point (SSP) Device

♦ YD/T xxxx-xxxx Technical Requirements for 800 MHZ CDMA Digital Cellular Mobile
Communication Network WIN Prepaid Service

♦ 800 MHz CDMA WIN SSP Equipment Testing Specifications

♦ 800 MHz CDMA WIN Phase 1: Prepaid Test Specifications

♦ ANSI T1.114-1992 Signaling System NO.7 (SS7)-Transaction Capabilities Application

Part (TCAP)

♦ TIA/EIA/IS-41E Cellular Radio-Telecommunications Intersystem Operations

♦ TIA/EIA/PN-4117 International Implementation of Wireless Telecommunication Systems

Compliant with TIA/EIA-41

-175-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

♦ N.S0018/TIA/EIA/PN4287 Wireless Intelligent Network Capabilities for Pre-paid

charging

♦ IS-807, TIA/EIA-41-D Enhancements for Internationalization

♦ IS-751, TIA/EIA-41-D Modifications to Support IMSI

♦ IS-771 Wireless Intelligent Network

♦ IS-826 Wireless Intelligent Network Capabilities for pre-paid charging

♦ TIA/EIA/IS-637, Short Message Services for Wideband Spread Spectrum Cellular

Systems

♦ TIA/EIA/IS-841, Network Support for MDN-Based Message Centers

♦ TIA/EIA/IS-824 Generic Broadcast Teleservice Transport Capability:

8.2 Technical Indices of ZXC10-MSC/VLR/SSP and Software Structure

and Hardware Structure of ZXC10-MSC/VLR

8.2.1 Technical Indices

The CDMA mobile switching center/visitor location register product produced by ZTE (i.e., ZXC10-
MSC/VLR/SSP for short) mainly implements the functions of the CDMA core network MSC and VLR.
At the same time, it integrates the functions of GMSC, SSP, TMSC2 and LSTP, and is characterized by
modularized design, advanced performances, good system reliability, standardized signaling interfaces
etc.

TMSCs include TMSC1 and TMSC2. As the first-level tandem MSC independently set up,
TMSC1 is mainly responsible for the tandem connection and transfer of the services of the connected
local networks second-level tandem MSC (TMSC2) or services between end offices. TMSC2 is the
second-level tandem MSC, responsible for the tandem connection and transfer of the services between
end offices of the connected local network. It can be independently set up, or included in the MSC or
GMSC devices. ZXC10-MSC/VLR/SSP is integrated with the TMSC2 functions.

STPs include HSTP and LSTP. HSTP is an independently set first-level STP, which transfers the
signaling messages of the second-level LSTP or SP connected with it. LSTP is the second-level STP,
which transfers the signaling message of the third-level SP connected with it. An LSTP can be
independently set up, or set up together with an SP. ZXC10-MSC/VLR/SSP integrates LSTP functions.

-176-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

The performance specifications of TMSC/GMSC/MSC/VLR/SSP/LSTP are listed below.

8.2.1.1 MSC Performance Indices

8.2.1.1.1 MSC Single-Module Technical Indices

Subscribers: 60,000

Trunk quantity: 6k time slots

Traffic: 2100 Erl

BHCA: 500k

Number of SS7 links: 64

8.2.1.1.2 MSC Multi-Module Technical Indices

Subscribers: 600,000

Trunk quantity: 60k time slots

Traffic: >21,000 Erl

BHCA: approximately linear growth

Number of SS7 links: 640

Inter-office trunk reference load:

Reference load A: 0.7 Erl/line

Call attempts on busy hour: 42/busy hour/incoming circuits

Reference load B: 0.85 Erl/line

Call attempts on busy hour: 57/busy hour/incoming circuits

8.2.1.1.3 MSC Call Loss Indices

Local calls: ≤10-2

Outgoing calls: ≤5×10-3

Incoming calls: ≤2×10-3

Transited calls: ≤10-3

-177-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

8.2.1.1.4 MSC delay probability

User signaling acknowledgement delay (average): ≤250 ms

User signaling acknowledgement delay (no greater than 95% probability): ≤300 ms

Signaling transfer delay (average): ≤200 ms

Signaling transfer delay (no greater than 95% probability): ≤400ms

Outgoing intercommunication connection delay (average): ≤250ms

Outgoing intercommunication connection delay (no greater than 95% probability): ≤300 ms

Local and incoming intercommunication connection delay (average): ≤250 ms

Local and incoming intercommunication connection delay (no greater than 95% probability): ≤300

Incoming call indication repeated sending delay (average): ≤400 ms

Incoming call indication repeated sending delay (no greater than 95% probability): ≤300 ms

Incoming call indication grouping sending delay (average): ≤600 ms

Incoming call indication grouping sending delay (no greater than 95% probability): ≤800 ms

Connection release delay (average): ≤250 ms

Connection release delay (no greater than 95% probability): ≤300 ms

Billing signal start timing (average): ≤100 ms

Billing signal start timing (no greater than 95% probability): ≤200 ms

Communication interruption time at handoff in the same MSC: ≤100 ms

Communication interruption time at handoff between different MSCs: ≤200 ms

8.2.1.1.5 Performance Indices of System Call Processing

Premature disconnection probability: P≤2×10-5

Release failure probability: P≤2×10-5

Billing error probability: P≤10-4

Routing error probability: P≤10-4

-178-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

No tone probability: P≤10-4

Other failure probability: P≤10-4

Unacceptable transmission quality probability: P≤10-5

8.2.1.1.6 MSC Transmission Performances Indices

Error performance: average long-term Bit Error Rate (BER) is better than 1×10 -9.

Bit integrity: The bit integrity is retained.

Bit sequence independence: in the 64 kb/s channel, there is not forced restriction on the number of
the consistently transmitted binary “1” or “0”or any other binary code pattern.

Absolute group delay:

Average value: 900 µs

The value within 95% probability: 1500 µs

8.2.1.1.7 MSC Synchronization Performance Indices

Synchronization clock: Stratum 2 clock Class A

Minimum clock accuracy: ±4 ×10-7

Pull-in range: ±4 × 10-7

Maximal frequency deviation: 10-9/day

Maximal initial frequency deviation: 5 × 10-10

Clock working mode: Fast capture, tracing, hold, free-run

Clock synchronous link interface requirements:

Signal jitter and wander at the input end: =1.5UI, 20 Hz ~ 2,400 Hz

Signal jitter and wander at the output end: =1.5UI, 20 Hz ~ 10000 Hz

2UI, 18000~100000 Hz

I=488 ns

-179-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

8.2.1.1.8 MSC Reliability Performance Indexes

Call cut-off probability: P≤2×10-4

Invalid call probability: P≤5×10-4

Single subscriber interruption: P≤30 min/year

Simultaneous interruption of both subscribers: P≤10 min/year

System interruption: P≤6 min/year

MTBF>10 years

8.2.1.2 VLR Performance Indices

8.2.1.2.1 VLR System Capacity

Single-module system capacity: 80,000 subscribers; multi-module capacity system capacity: 800,000
subscribers.

Reference load:

Call processing: 1.5 call/subscriber/busy hour

Mobility management: 8.5 call/subscriber/busy hour

Message loss probability: P≤10-7

Information retrieval delay: ≤1,000 ms (at 95% probability)

Registration delay: ≤2000 ms (95% probability)

8.2.1.2.2 VLR Transmission Performance Indices

The same as MSC.

8.2.1.2.3 VLR Synchronization Performance Indices

The same as those of MSC.

8.2.1.2.4 VLR Reliability Indices

The same as those of MSC.

-180-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

8.2.1.3 GMSC Performance Indices

ZXC10-MSC/VLR is integrated with the GMSC function.

When ZXC10-MSC/VLR is used as independent GMSC to form ZXC10-GMSC, it can at most

provide the following :

In the case of a single module:

Trunk quantity: 13,200 trunks

Traffic: 2,100 Erl

BHCA: 500K

In the case of multiple modules:

Trunk quantity: 72,000 trunks

Traffic: 21000 Erl

BHCA: approximately linear growth

Other specifications are the same as those for MSC.

8.2.1.4 SSP Performance Indices

The SSP function is integrated into ZXC10-MSC/VLR.

When ZXC10-MSC/VLR is used as independent SSP to form ZXC10-SSP, it can at most provide
the following:

Capacity in the single-module configuration:

Subscriber quantity: 60,000

Trunk quantity: 6k time slots

Traffic: 2100 Erl

BHCA: 500k

Capacity in the case of multi-module configuration:

Subscribers: 600,000

-181-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

Trunk quantity: 60k time slots

Traffic: >21000 Erl

BHCA: approximately linear growth

8.2.1.5 TMSC2 Performance Indices

the TMSC2 function is integrated into ZXC10-MSC/VLR.

When ZXC10-MSC/VLR is used as independent TMSC2 to form ZXC10-TMSC, it can at most

provide the following:

Port quantity: maximum capacity: 250,000 pure trunks;

Switching network capacity: Up to 256k×256k;

Traffic load (BHCA value): 500k for a single module, 20000k for multiple modules.

Traffic: 5.8k Erl for a single module, 216k Erl for multiple modules.

Maximum signaling processing capability:

Maximum number of SS7 signaling links is up to 1024;

Load of each signaling link is greater than 0.8 Erl;

The number of signaling networks supported simultaneously is up to 8.

Other performance specifications are the same as those of MSC.

8.2.1.6 LSTP Performance Indices

ZXC10-MSC/VLR is integrated with the LSTP function. When used as integrated LSTP, it can at most
provide the following:

Max. number of signaling links: greater than 512.

Max. number of signaling link groups: greater than 256

Signaling processing capability: Far bigger than 30,000 MSU/s.

When ZXC10-MSC/VLR is used as independent LSTP to form a ZXSTP10, it can provide the
following maximum performances:

-182-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

Max. number of signaling links: 1280

Max. number of signaling link groups: 640

Routing area quantity: greater than 2000

Link processing capability (links): 480 MSU/s

Link processing capability (whole-system): 400000 MSU/s

GT table capacity: >200,000

GTT: 45000/s

STP transfer delay: 13.5 ms (0.2 erl), 15.1ms 0.4 erl).

Other performance specifications are the same as those of MSC.

8.2.2 Rack Parameters

The parameters of each rack of the ZXC10-MSC/VLR/SSP system are as follows:

Dimensions: 2,200 mm×810 mm×600 mm (height×width×thickness) (the width is 870 mm with

the side board)

Weight: less than 250 kg under full load

Power supply: －48 VDC, and the allowed range: －57 V~－40 V

Power consumption: MPM<700 W, CSM<1200 W

The appearance of the MPM rack is shown in Fig. 8-2.

-183-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

Fig. 8-2 MPM cabinet

The open MPM cabinet is shown in Fig. 8-3.

Fig. 8-3 Open MPM cabinet

-184-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

8.2.3 ZXC10-MSC/VLR Hardware Structure

8.2.3.1 Overview
ZXC10-MSC/VLR has been developed on the basis of ZTE’s large-scale digital SPC switch ZXJ10
(V10.0) platform. It is mainly composed of the CSM (SNM+MSM), MPM and the operation and
maintenance system. Of these parts, the CSM module is used to control inter-module communication
and message interaction in multi-module configuration, and it can be configured or omitted according
to the actual requirement. One to ten MPMs can be configured based on the actual capacity requirement
to implement the MSC/VLR functions. Inter-module communication is implemented by means of
optical fiber transmission; the related functional modules inter-work with BSC, PSTN, ISDN, PSPDN
and PLMN by means of SS7 signaling network.

ZTE’s ZXC10-MSC/VLR system can implement the Service Switching Point (SSP) function of
the Wireless Intelligent Network (WIN) by means of software upgrading in embedded mode, without
the need of modifying the hardware platform. For the descriptions about WIN, please refer to Chapter
9.

The operation & maintenance of the ZXC10-MSC/VLR system is mainly composed of the OMM
server, billing server and operation & maintenance console. Among them, the operation and
maintenance console can be set either in the local way or in the remote way. The OMM Server is used
to manage related information, and adopts the Q3 standard to exchange information with the NM center
by means of X.25/DDN/E1. The charging server adopts the dual-system protection mechanism, sending
bills to the charging center by using the FTAM protocol or by converting into other compatible modes.

8.2.3.2 Overall Structure of the System

The overall structure of the system is shown in Fig. 8-4. Abbreviations in the diagram are described as
follows:

1. Central Switching Module (CSM): including SNM and MSM;

2. Switching Network Module (SNM);

3. Message Switching Module (MSM);

4. MSC/VLR/SSP Processing Module (MPM).

-185-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

Billing center NM center

X.25 X.25

Maintenance
Billing server OMM Server
console

TCP/IP

ZXC10-MSC/VLR

CSM

SNM MSM

MPM MPM .... MPM MPM

PSTN
ISDN
BSS
PDN
PLMN

Fig. 8-4 Schematic diagram of ZXC10-MSC/VLR system structure

8.2.3.3 Module Hardware Structure

ZTE’s ZXC10-MSC/VLR system adopts multi-module and fully distributed control structure. The
structure of the system is shown in Fig. 8-5.

The system is mainly composed of MSM, SNM, OMM and MPM.

-186-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

Fig. 8-5 System hardware diagram

8.2.3.3.1 MPM
MPM is a basic independent module in the ZXC10-MSC/VLR system. It can implement the voice
channel connection and signaling processing between subscribers within the module, connect the
signaling messages and voice channels between subscribers of different MSC modules onto the central
SNM, and implement the VLR and SSP functions.

The hardware block diagram of the MPM is shown in Fig. 8-6.

The MPM is composed of the following units:

1. DTU: Digital Trunk Unit. It includes:

DTI: Digital Trunk Interface subunit

2. ASIG: analog signaling unit. It includes:

MFC: multi-frequency compelled register subunit

DTMF: dual-tone multi-frequency signal sub-unit

Tone: signal tone sub-unit

-187-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

3. ECU: Echo Cancellation Unit, which includes:

EC: echo canceller. It integrates DT on the ECDT board. It can be plugged interchangeably with
DT.

4. CTLU: Control Unit, including the following subunits:

MP (Module Processor)

COMM (Communication Board)

PEPD (Peripheral Environment Parameter Detection)

MON (Monitor Board)

5. NETU: the digital switching Network Unit (briefed as T network unit sometimes) includes:

DDSN: digital time slot switching network sub-unit

DSNI: digital time slot switching network interface sub-unit

6. FBIU (Fiber Bus Interface Unit)

In the case of multi-module office networking, the FBI is plugged in the network layer. Its main
function is to connect the MPM with the central switching module network CSM with optical fibers.

-188-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

交换单元
8Mb/s 8K× 8K
DTU
（ DSN）
NETU
ASIG 8Mb/s 16K× 16K 48× 8Mb/ s
（DDSN） FBIU

ECU 8Mb/s

2Mb/s
512Kb/s
NO.7
V5.2 COMM COMM

CTLU

MP0 MP1

Fig. 8-6 The MPM hardware diagram

8.2.3.3.2 MSM
The MSM mainly serves to exchange messages between various modules . The MPM is connected to the
SNM via optical fibers, and their communication timeslots are connected through the SNM’s semi-
permanent connection to the MSM, while the MP in the MSM implements the message switching based
on the routing information.

The main control units of MSM and MPM are of the same structure: a pair of active/standby MPs
and several COMM subunits.

The block diagram of the MSM hardware is shown in Fig. 8-7.

-189-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

MPM MPM

Fig. 8-7 MSM hardware diagram

8.2.3.3.3 SNM
The SNM is the kernel module of a multi-module office system. It mainly implements the voice
channel switching among various modules in the multi-module system and sends the communication
timeslots from the multi-module to the MSM via semi-permanent connection.

The central switching network module (SNM) includes the following units:

1. Central digital switching network unit: implement the central switching network of 32K/64K by
using the digital time division network with the structure of 32K/64K a single T network.

2. Control unit: with the same structure of that of the main control unit in the MPM, its main
function is to control the connection of the central switching network and monitor the DTs.;

3. In the case of a multi-module exchange, the central switching network module side is also
equipped with an optical interface unit used to connect with the optical interface unit from the MPM.
Its function is to support some peripheral modules

The central SNM hardware block diagram is shown in Fig. 8-8.

-190-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

8.2.3.3.4 OMM
The OMM is used for the management of the switching entities of the CDMA system. It is composed
of three parts: system analysis, system maintenance and signaling maintenance. Its functions mainly
include billing management, security management, performance measurement, service observation,
fault management, configuration management, service observation, signaling tracing, version
management, clock management, etc.

The OMM system is divided into several modules according to the functions, and each module is
divided into foreground and background sub-modules, thus emphasizing the independence of each
module and the universality of the interfaces between modules for the adaptation to the system
structure changes and the addition of functions.

The operation and maintenance component adopts the client/server structure, the principle of
which is shown in Fig. 8-9. The Client/Server mode can provide strict controls over data integrity,
management and security, and store the data in a centralized way, so as to enable the system
administrator to perform centralized data backup and periodic maintenance. It works locally in a LAN,
which is connected via a router to a WAN, to complete remote access.

Interconnection MPM
network of the
central rack
interface board

48× 8 Mb/s Single-T

interface

Optical bus

Single-T switching network switching

Optical

network
64 K × 64K
16K x16K
( or 32 K × 32K)

MPM
interface

interface board
Optical

48× 8Mb/s Single-T

Optical bus

16×2 Mb/s switching

MSM network
16Kx16K

2 Mb/s 2 Mb/s
HDLC HDLC 512kb/s 512kb/s

COMM COMM COMM COMM

SNM MP0 MP0

LAN

OMM

Fig. 8-8 SNM hardware structure

-191-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

Foreground SNM
system

Background
system

Optical T ape Router

drive drive

Fig. 8-9 OMM working principle

The OMM performs centralized management and maintenance of the ZXC10-MSC/VLR system,
and it can be connected with the network management center in multiple modes (DDN, X.25, E1 etc.).
It supports operations such as inquiry, configuration, modification, cancellation, and request for reports
of the province-level network management center (or possibly the local network management center).

8.2.3.4 Description of Units/Boards

8.2.3.4.1 Digital Trunk Interface (DTI) Unit

Digital trunk unit is the interface unit between mobile switching systems (between exchanges) or
between mobile switching system and digital transmission system. It multiplexes 32* 64 kbps speech
channel signals and signaling into 2 Mbps signals for switching and connection processing within the
system according to the PCM time-division multiplexing principle.

In the ZXC10-MSC/VLR system, the DTI is mainly composed of the Digital Trunk Interface
(DTI) board and the Back Digital Trunk (BDT) board, and shares the same frame with the analog
signaling unit physically.

-192-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

Function

1. Receiving, sending and converting the line code pattern: This is to convert the input HDB3
codes or AMI codes into the internal Non Return to Zero codes (NRZ codes), and send them into the
digital switching network unit (abbreviated as T network hereinafter). Meanwhile, during the sending,
this function will convert the internal NRZ codes into HDB3 codes or AMI codes and send them to
transmission line.

2. Frame synchronization clock extraction: identify and extract the external reference clock from
the input PCM code flow, and send it to the synchronization timing circuit, serving as the frame
synchronization reference clock of the local end, guaranteeing the synchronization with the incoming
call.

3. Synchronization of frame and multi-frame: synchronize the frame or multi-frame according to

the received synchronization reference, i.e. frame alignment signal, so as to prevent the out-of-
synchronization caused by the delay.

4. Insert and extract signaling signals into/from TS16 for sending/receiving signals.

5. Detection of alarm: detect transmission quality, such as error code rate, slip code metering, out-
of-frame, out-of-multi-frame, and trunk signal loss.

In MPM, the position of the plug-in unit of trunk sub-unit and that of the slot of analog signaling
board ASIG are interchangeable. And the proportion of DT and ASIG configuration will be specified
according to the system capacity requirement. Each digital trunk sub-unit corresponds to 120 channels.
CPU of each trunk sub-unit (which is also called SP level processor) can implement the message
exchange directly with MP semi-permanent connection.

Principle blocking diagram

Each plug-in board of the DTU sub-unit has four E1 interfaces. Fig. 8-10 shows its principle
diagram.

-193-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

8 MHz HW to
2MHz HWx4 T network
Code rate
DT I converter

Control circuit

Fig. 8-10 Digital trunk unit principle diagram

As we can see from Fig. 3-7, the DT sub-unit consists of interface circuits, code rate converter,
and control circuit. Now we will give their introductions respectively.

The interface circuit provides following functions:

1. 2 Mbps PCM code flow input/output, HDB3/AMI code conversion;

2. Working in the channel-associated signaling/common channel signaling mode;

3. Supporting access of ISDN PRI subscribers;

4. Internal digital phase-lock loop, which allows the synchronous clock to work in three modes,
the external reference synchronization, the frame synchronization signal synchronization and the free
run.

5. Offering self-loop test functions.

The switching unit performs the following functions:

1. It multiplexes the four 2M PCM signal on a DTI board into an 8M PCM signal and send it to
the plane of T-net to implement connection. At the same time, it demultiplexes an 8M PCM signal from
the T net into four 2M PCM signals and send them to the four E1 interface units for transmitting.

2. Communicate with MP board through two communication TSs. The communication contents
are packed and unpacked through an HDLC protocol controller.

3. Self-loop test function. Extract one HW (upstream 2 MHz/downstream 8 MHz) from either of

-194-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

the two up/down link switching circuits to serve the self-loop test;

4. Implement ISDN protocol control.

The control circuits includes one main CPU and one clock circuit, performing the following
functions:

1. The clock handling circuit provides the trunk interface circuit with the 8 MHz, 2 MHz, and 8
kHz clock references.

2. The driving interface circuit mainly performs matching with the input circuit of the T network
and enhances anti-interference ability.

3. The main CPU acts as the processor of this subunit, to control various parts to make alarming &
processing over the out-of-frame or out-of-multi-frame faults.

4. An alarm will be given when the BER exceeds 10 -4, and will disappear when the BER is equal
to or lower than 10-4.

The alarm information channel can be analyzed in Fig. 8-11.

Semi-permanent Ts

T network
DT switching
unit

Inserting the alarm

message into Tsb

Fig. 8-11 Schematic diagram of alarm message channel

-195-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

After detected by the CPU, the alarm messages are packaged via the HDLC to a pre-determined
time slot (like Tsb’), sent to the uplink multiplexing circuit, and the Tsb’ content is transferred to the
Comm board after the semi-permanent connection through the TNET network, and then transferred to
the MP. The MP will inform the maintenance terminal.

The digital trunk sub-unit board can set the clock selection and line impedance match via jumpers.

8.2.3.4.2 Echo Canceling Digital Trunk (ECDT)

Besides all functions DTI possesses, ECDT has the echo-canceling function. It can cancel the echo in
2.048 Mbps PCM transmission network and provide TD (Tone Disable) function, that is, when 2,100
Hz signals or 2,100 Hz periodic anti-phase signals stipulated in ITU_T G.168 Recommendation are
detected, the EC function of this channel can be disabled automatically. The hardware diagram is
shown in Fig. 8-12.

2MHzHW× 4 8MHzHW to T network

Digital
trunk Echo Code rate
interface canceller converter
unit

Control circuit

Fig. 8-12 The block diagram of the DTI sub-unit with the ECDT function.

8.2.3.4.3 Analog Signaling Unit (ASIG)

The analog signaling unit ASIG only appears in the MPM. By loading different software, the ASIG unit
can implement such functions as DTMF, MFC, audio signal, voice prompt and conference call, etc.
ASIG is located at the DT layer, and can be exchangeably plugged with the DTI board.

-196-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

Main functions

1. Receiving DTMF and MFC: the down-link signals from the T net are stored in the memory after
the serial-parallel conversion, and then the power levels are tested by signal processor by way of DFT.
After the signal type is detected, it will be informed to the CPU for processing.

2. Sending DTMF and MFC: firming the DTMF to be sent and its level into EPROM. During
transmitting, read them out at a period of 125 µs, and then send them to a certain HW. ASIG can be
used to send no-voice signals.

3. When acting as the TONE board, it has two functions: Voice recording and voice reading.

Different signal tone functions on ASIG are implemented by the corresponding software. Different
functions correspond to different operational software.

Principal block diagram

In the MPM of ZXG10MSC/VLR system, ASIG mainly consists of code rate converting circuit,
digital signal processing circuit and CPU control circuit. The basic principle is shown in Fig. 8-13.

Uplink

Communicate with M P

Communic ate with T net Code rate

converting Digital CPU
circuit signal control
processing c ircuit

Downlink

Fig. 8-13 Schematic diagram of the ASIG board

1. Code rate converting circuit

The functions of code rate converting circuit are completed by two chips. It demultiplexes the
8Mbps HW from T net into 2 Mbps primary rate, and converts the voice signals from 2 Mbps rate into
8 Mbps code flow and sends them to T net for downlink (T net to ASIG) and uplink (ASIG to T net)

-197-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

processing.

The uplink 2 Mbps HW has 8 lines connected to the code rate matching circuit, which are the
conference circuit, HDLC protocol controller, and other 6 channels from the digital processing circuit.

The downlink 2 Mbps HW also has four lines, which are HDLC, conference call circuit, and 2
chips special for digital signal processing.

The data from the T network is sent via the high-speed chip downlink circuit to the digital signal
processing circuit chip, which will judge the signal type and value and decodes it and send it to CPU.
Meanwhile, the data output by the digital signal processing chip will be sent to the uplink circuit high-
speed chip, converging into the corresponding time slots of the T network PCM code stream.

2. Digital signal processing circuit

The digital signal processing circuit is to check and generate the values of analog signal needed.
And the transmission of commands and data of the digital signal processing chip and CPU is
implemented through dual port RAM.

When the DSP circuit sends the MFC and DTMF signals: the signal samples firmed in the
EPROM are repeatedly read out and sent (the sampling period must be the same as the reading period)
with digital tone.

The audio signal board (voice signals), adopting the 64M FLASH tone board, can access up to 32-
minute audio signal.

3. CPU control circuit

The major function of CPU is to input the commands to the DSP chip, read the data from the DSP
chip, and to exchange necessary information with MP.

The communication between CPU and MP is fulfilled through the HDLC controller and main
control layer CTL’s COMM. The communication route is shown as in Fig. 8-14.

EMBED Visio.Drawing.6

-198-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

2Mb 8Mb 8Mb

DRV 2Mb
HDLC High-speed chip T network

64Kb

Comm
Demultiplexing
CPU

MP

Fig. 8-14 Communication route diagram

8.2.3.4.4 Main control unit

The main control unit is responsible for the monitoring of all the functional units and boards. It
establishes message links among various processors and provides an operating platform for software
systems to satisfy various service requirements. The main control unit of the MPM is composed of a
pair of active/standby module processors (MPs), shared memory board (SMEM), communication board
(COMM), backboard of control layer (BCTL), monitoring board (MON) and peripheral environment
parameter detection board (PEPD). The BCTL provides bus connection and other support for various
boards. COMM, MON and PEPD can be plugged interchangeably.

1. MP

1) MP’s basic structure

The MP consists of CPU, bus system, memory system, system controller, and I/O interface. It
occupies four physical slots in the controlling layer BCTL. The MP has a powerful processing capacity
at a high speed. Here, the CPU uses a Pentium processor, with a main working frequency up to 200
MHz, with the BUSI interface, the Ethernet interface and hard disks. A brief introduction is given on its
architecture in the following.

♦ CPU: Pentium 586, clock frequency of 200 MHz;

♦ Bus system: the PCI bus and ISA bus are used inside.

♦ Memory system: consists of Cache, DRAM and the floppy/hard disk memories.

♦ System controller: consists of DMA, ITC, the timing circuit and the logic array circuit
(EPLD).

-199-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

♦ I/O interface equipment: consists of Ethernet controller, keyboard, mouse interface, FDC
interface, IDE interface (floppy/hard disk interface), asynchronous serial bus interface UART
and the BUSI bus interface of the MP unit.

2) Functions of MP:

The MP is the core of the main control unit. Its major functions are as follows:

♦ Controlling connection of the switching network;

♦ Responsible for transmission of data and commands between the foreground and
background;

♦ Completing the message communication with the peripheral processing units.

♦ Controlling the active/standby status. During the power-on reset, the active MP and
standby MP are decided through contention. There are four kinds of active/standby
changeover modes: command changeover, manual changeover, reset changeover and fault
changeover;

♦ Providing two 10M Ethernet interfaces, one for connecting the background terminal
server, while the other for expanding the links between the control layers.

♦ Introducing the reference clock of the switching system as the precision clock reference
of the main board; and setting node no. and enabling/disabling status of all the functions.

♦ Other service functions: including the Watchdog function, the 5 ms timed interruption
services, timing counting services, configuration settings and introducing the switch system
reference clock as the precision clock of the master board.

A further introduction on related functions of the BUSI bus and the switching controllers in MP
board is given as follows:

1) BUSI bus

BUSI is the bus interface circuit of the MP unit. Its main function is to enhance the driving
capability of the MP unit over the backboard bus ISA, and perform Ethernet active/standby handover
control and check functions.

The BUSI chiefly includes the following functional units:

♦ Bus driver: providing the backplane bus driving of the main control layer.

♦ Bus controller: Conducting the parity checking for the data bus, and monitoring and

-200-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

prohibiting the buses.

MP should receive interruption signals sent from 13 COMM boards and 1 MON board, as well as
the trunk signals from DRAM, which are then sent to CPU after concentrated by the interruption
controller.

2) Active/standby changeover controller

The active/standby MPs contents the active/standby working status upon power-on reset (the
resetting of MP is different from the other active/standby equipment).

2. Communication board (COMM)

The control layer is mainly to accommodate the COMM boards besides the MP0 and MP1 module
processing units. The COMM board is the hub for the communication between MP and peripheral
processing units. It is also the second processing layer of the SS7 signaling unit. So, the importance of
the COMM board is obvious.

1) Relationship between COMM and MP

MP connects to various COMM boards through the backplate ISA bus. MP0 and MP1 work in the
active/standby mode, but COMM boards work in the load-shared mode. A COMM board must be
connected to MP through two independent and identical ISA buses as shown in Fig. 8-15.

Among them:

DPRAM: Dual-port RAM

MON: Monitoring board

PEPD: Environment monitoring board

-201-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

PCI BUSI
MP0 ISA

DPRAM COMM COMM COMM PEPD MON

PCI
MP1 BUSI
ISA

Fig. 8-15 Connections between COMM and MP0/MP1

2) Working modes of COMM board

In sending messages, MP writes the message to be sent into DPRAM, which is then extracted from
the related HDLC controller to be converged into the switching chip in a certain frame format. After
being processed by the chip, it is sent to the DDSN by selecting an outgoing link.

In receiving messages, the messages from the TNET are sent to the switching chip of the COMM
board via a certain downward data link. After processed by the switching chip on a relevant HDLC
controller, the messages are received by the MP.

When received, messages are forwarded to DPRAM to be checked by a related HDLC controller.
They are put into DPRAM after being confirmed of no error by the frame format, otherwise, re-sending
of messages is required. If messages are wrong in undertaking checkout, CPU in the COMM board
sends interruption alarm to MP.

Both the COMM board and the MP board have signals to request the opposite party for
interruption, with which the COMM and MP notify the opposite side of the interruption during message
exchanging.

A diagram of COMM board is as Fig.8-16 shows:

-202-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

HD Switching
CPU To DDSN network
To MP0/MP1 DPRAM1 DPRAM2 chip
LC

Fig. 8-16 Block diagram for the COMM board

3. Monitoring board (MON)

All the units in the ZTE’s ZXSC100 (V3.0) system that can perform the self-monitoring and
communicate with the MP through COMM and semi-permanent connection switching can exchange
with MP the status and alarming information of various units. However, there are still many sub-units
(plug-in units) having no such communication function (e.g. the POWERB sub-unit). To monitor these
sub-units, the system specifically sets the MON sub-unit plug-in board.

The MON board is installed with 8 RS-485 interfaces and 2 RS-232 interfaces. Each RS-485
interface can carry 32 monitored subunits. A simple flow diagram is shown in Fig. 8-17.

To MP0/MP1 RS232/RS485 interface

MON CPU
ISA interface

Fig. 8-17 Simple working flow of MON

Between the MON board and the board under monitoring, the master-slave work mode is utilized.
The MON board is the controlling party (master) and the board under monitoring is the controlled party
(slave). The MON board queries the sub-unit under control regularly. When queried, the sub-unit under

-203-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

control sends the response data to the MON board. That is, the MON board is informed of the state and
alarm of the board. The CPU in the MON board makes the judgment. If there is any abnormality, the
interruption alarm will be sent to the MP and alarming message is issued.

The communication between a MON and an MP is performed via mutually sending signals of
request for interruption.

All the data sent from the MP to the MON should be checked by the CPU on the MON. If any
error is found out, MP is asked to re-send the data.

On the MON board, there are 8 RS-485 interfaces, which can monitor a maximum of 256 objects
(32×8), i.e., covering all subunits to be monitored in this system.

4. Peripheral Environment & Power Monitor Board (PEPD)

The PEPD board can process the secondary signals sent from the external sensor, detects in real
time the physical parameters of the switch working environment, like the temperature, humidity, smog,
infrared etc., and report them to the MP. Once abnormalities occur, the alarm box shall be started
immediately to give alarms, so as to conduct processing in time and avoid losses.

1) PEPD test range:

Temperature: Range: 0 ~ 50°C

Precision: ±0.5°C

Humidity: Range: 20 % ~ 100 %

Precision: ±3%

Infrared: Maximal effective area: 90 degree sector with the radius of 15 m (adjustable)

Smog: Sensitivity: 1dB/m

Electrical current: 100 µA

2) PEPD working flow

The working flow of PEPD board is as Fig. 8-18 shows.

-204-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

To MP0/MP1
Incoming sensor signal

PEPD CPU Sensor

Fig. 8-18 PEPD principle diagram

The PEPD and active/standby MPs can send the interrupt signals to each other. Only when one of
the two boards writes data to the mailbox of the other side can the other side encounter the interruption.

The environment monitoring principles are as follows:

♦ Once there is smog detected by the smog sensor, a current signal will be generated. The
current signal will be converted to a level signal inside the board and be sent to CPU in
PEPD. Then the CPU will perform the related test.

♦ The sensors of temperature and humidity modulate the variation of temperature and
humidity into the square wave varying in accordance with the frequency. The square wave is
sent to the CPU in PEPD. The CPU performs the relevant tests.

♦ The infrared sensor can detect the surroundings. If someone approaches, the sensor will
send a switch level signal to the CPU of the PEPD board. Then, CPU will conduct the related
detection.

5. SMEM

The SMEM can provide the active MP0/standby MP1 with the 8k-byte dual-port RAM and shared
2Mbyte RAM that can be accessed simultaneously. Meanwhile, it can provide the corresponding 1 bit
data parity check bit to ensure data accuracy. It can be employed by MP as message exchange channel
and for data backup, which facilitates the quick changeover between the active/standby MPs.

Which MP (active or standby) can access the shared 2MB SMEM at a specific time is determined
via the arbitration mechanism of the shared memory hardware. Only the MP that has been granted the
control over the SMEM is allowed to access the SMEM. The control must be handed over as soon as
the access is completed. If one party attempts to make the access after the other party has already been
granted the control, it will receive the “BUSY”, while the party with the control right will not be
affected at all.

-205-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

The 8K dual port RAM can be accessed by active/standby MP simultaneously. When the same
address unit is accessed by the active/standby MPs at the same time, the shared memory board will
make the arbitration with the “BUSY” signal.

The SMEM can set up active/standby MP “mailbox” through 8K DPRAM. When party A sends a
mail to party B’s Mailbox, party B will receive an interruption signal sent by party A. After party B
takes away the mail, the interruption signal will be reset.

The working principle is sketched in Fig. 8-19.

MP1 BUFFER BUFFER

8K 2MB
EPLD RAM
RAM

MP2 BUFFER BUFFER

Fig. 8-19 A principle diagram of the shared memory board

8.2.3.4.5 Digit Switching Unit

The digital switching network unit includes digital timeslot switching network sub-unit (DDSN) and
digital timeslot switching network interface sub-unit (DSNI).

6. DDSN

-206-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

In the ZXG10MSC/VLR system, DSN sub-unit is time division switching network (simply called
T net), which mainly performs the following functions:

1) It performs the intra-module channel connection for the subscribers;

2) It interconnects with the central exchange and performs the inter-module channel connection;

3) Message communication between MP and the external units via a semi-permanent connection.

4) Support n×64kb/s dynamic TS switching, available for the ISDN H0 channel transmission and
the communication among band-variable modules (n≤32).

5) Adopt the differential driving mode so as to improve the common mode interference resistance
capability.

The DDSN digital switching network board is a single T-structure time division unblocked
switching network, with capacity of 16K × 16K time slots. The rate of the PCM bus is 8Mbps. It works
in the double-in-single-out hot standby mode. The connection control for TNET is performed by the
MP via the 256 kb/s (4×64 kb/s) super-channel HDLC links through the COMM. The main controller is
used to control the HDLC communication the board and the connection of the switching part of the
board. The switching part can be implemented by using the complier components and dual-port RAM.

This board provides the system with 123 pairs of single-end 8M HWs, 5 pairs of difference HWs
and related 8 MHz, 8 kHz clock, two pairs of HDLC communication HWs and related clocks.

The DDSN is mainly composed of TS switching network, communication circuit with controlling
layer MP, core CPU system, control and alarming circuits, clock processing circuit, PCM 8 Mbps bus
interface, driving isolation circuit and active/standby controlling circuits. Its working principle is
shown in Fig. 8-20.

♦ Circuit communicating with the control layer of MP

The function of these circuits is to communicate with the MP, so as to control the connection of
the time slot switching network. In order to raise the communication rate and improve the reliability,
super-channel is employed for the transmission on the physical layer (4×64 kb/s), and the link layer
employs HDLC protocol.

♦ Core CPU system

The switching network is an intelligent network. As it has to control many chips with a high
demand for real-time processing, so it adopts the embedded CPU 386EX, and the 16-bit data-line
operation mode. It receives connection commands from MP, and then converts the connection
commands into address codes, so as to perform management over the switching network chip and the

-207-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

HDLC protocol control chip.

Clock input
Clock control circuit

Peripheral
To module
COMM

Drive & isolation circuit

Communication circuit

Time-division switching
Alarm circuit

matrix circuit

Active/standby
changeover
CPU processing sy stem

Fig. 8-20 DSN structure principle diagram

♦ Control and alarm circuits

The control circuit controls outgoing and incoming HWs.

The alarming circuit processes such faults as hardware failure and clock loss, as well as obvious
frequency changes on the switching network, and show the LED display on the board at the same time.

♦ Clock control circuit

The clock control circuit receives the clock input from the system, creates various working
frequencies needed by the local board. The digital phase locker is employed to lock the phase.

♦ PCM bus interface and drive and isolation circuit

This part of circuit mainly drives the PCM 8 Mbps bus that comes into and goes out the switching
network unit, and isolates the external signals.

-208-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

♦ Active/standby changeover circuit

There are two circumstances for the active/standby T net changeover control:

During power-on resetting, both boards are in the standby status, and CPU arbitrates and appoints
one of them to be active so as to prevent competition at the power-on start.

Normally, the active/standby changeover has two modes: Manual changeover and fault
changeover.

DSNI

The DSNI chiefly provides an interface for signals between MP and the T network and between
SP and the T network, performing the driving function of various transmission signals between MP, SP
and the T network. As the HW rate from the T network is the standard rate of 8.192 Mbps, it is
necessary to conduct the 8M→2M rate conversion when it serves as the unit with the rate of 2 Mbps.

DSNI falls into the two main categories: MP-level interface board and SP-level interface board.
Furthermore, to enhance the driving capacity and the anti-interference ability, DSNIs are all equipped
with differential balanced input/output driving circuits.

We will give illustrations respectively on DSNI circuits of both SP and MP level.

♦ MP level DSNI (DRV)

When it is used as MP-level interface board, it implements the conversion of 8 Mbps flow and 2
Mbps flow for the message channel from SP level to MP level, and implements the distribution of the
4M and 8K clocks supplied to the communication board at the same time.

The bi-directional rate conversion of 8 Mbps HW from T net and 2 Mbps HW from MP is
performed at this interface circuit, which converts the downlink 8 Mbps HW into 2 Mbps HWs and the
uplink 2 Mbps HWs into 8 Mbps HW (uplink: from MP to T net; downlink: from T net to MP), as
shown in Fig. 8-21.

As the output /input links on the T network are led out in form of high-resistance multiplexing, the
active/standby T network and active/standby MP level driving circuits (DSNI) are directly connected
with each other. So, in the case of T network active/standby changeover, as long as one DSNI (MP) is
left in slot, it will not affect system running. If two are left in slot, they are automatically switched over
accordingly, so as to remove any DSNI. DSNI makes automatic changeover, without affecting the T
net.

The DSNI (MP) can also perform the manual changeover and automatic changeover functions on
faults.

-209-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

The control core of DSNI is CPU. Its major tasks include controlling the code rate conversion,
communicating with the main control unit MON through RS-485, monitoring the clock and code rate
converting circuit, and giving alarms to MP once there is any abnormality (via MON).

Clock input Clock output to

Clock processing circuit respe ctive units

Drive & isolation circuit

Drive & isolation circuit

To
Code rate To
T net
Conversion COMM
circuit

Active/standby
CPU processing system changeover
BID

To monitor unit

Fig. 8-21 MP-level DSNI block diagram

♦ SP Level DSNI (DRV)

As the SP-level interface board, it changes the single-ended driving of HW to difference driving or
otherwise, and implements the 8M and 8k clock distributions for each level SP.

The SP level DSNI circuit is basically the same in the form as the MP level DSNI circuit. So, the
same plug-in components are used in circuits. Only the jumpers on the board are used to differentiate
the SP and MP level functions.

The major difference between the SP level DSNI and MP level DSNI is that the input of the SP
level DSNI is 16-channel 8 Mbps HW and the output is 16-channel 8 Mbps HW, too. Logically, it only
serves for transparent transmission, and physically it only functions as the driving isolation, adapting
with the difference balanced driving.

-210-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

The SP-level DSNI circuit is formed as Fig. 8-22 shows:

Clock output to
Clock input
Clock processing circuit respe ctive units

Drive & isolation circuit

Drive & isolation circuit

To respe ctive SP
To T net Code rate
level subunits
conversion
circuit

Active /standby
BID CPU processing system changeove r

To monitor unit

Fig. 8-22 SP-level DSNI block diagram

8.2.3.4.6 Fiber Bus Interface (FBI)

Since the fully distributed control technique is adopted between the MPM and the SNM, the
information transmission between the MPM module and the SNM is characterized by big volume and
high rate. Therefore, the advanced optical fiber technique is adopted in the ZXC10-MSC/VLR system.
A pair of optical fibers is used between the MPM module and the SNM to fulfil 16 × 8Mbps
information transmission, and thereby the problem of transmission quality deterioration of the
transmission line due to electric interference, lightning etc. has bee greatly reduced. With the
introduction of the optical fiber, the distance between the scattered modules is largely extended.

FBI structural characteristics

Using optical fibers as the transmission medium, normally two types of fibers are available.
Generally, when the distance is not long (less than 2 km), it is recommended to use the multi-mode
optical fiber transceiving components. When the distance is relatively long, it is recommended to use
the single-mode optical fiber transceiving components (reaching 30~50 km). The design of FBI in the
ZXG10MSC/VLR system employs the compatibility technique. According to the user requirements,

-211-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

one of them can be chosen.

In order to guarantee the consistency between the local clock and the frame synchronous signals in
data transmission among multi-modular offices. The insertion/extraction of the synchronization clock is
added in the FBI design. And at the receiving side, the data flexible buffer is set so as to facilitate the
synchronization clock adjustment.

Due to the 204.8 Mbps transmission capability of the FBI transceiving component, with improved
design, it can be expanded as the interface of STM-1 synchronous network SDH, thus laying a
foundation for broadband network access.

Reliability is taken into consideration in FBI design, and the RS-485 half duplexing serial port for
MON centralized monitoring is added, realizing MP dynamic centralized monitoring.

FBI working principle diagram

Major function units of FBI are: the clock synchronization circuit, balanced/non-balanced HWs
input circuit, fiber receiving/sending circuit, pseudo number plug-in circuit, output driving, CPU and
memory, active/standby changeover circuits, and EPLD logic circuit.

The schematic diagram of RS-485 serial interface circuit is shown in Fig. 8-23.

-212-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

8Mb/s × 16
FIBER
UB 0I
Optical
transceiver
8Mb/s × 16 B0 I

EPLD O utput 8KHz

Clock CPU
processing logic processing
circuit control circuit D
circuit
R
I
V
E 8M bit/s
Active /standby R
change ove r
To moni tor uni t

Fig. 8-23 The schematic diagram of FBI

When the FBI plug-in unit is used at the SNM switching network layer, its input from the DSNI
(DRV) interface is balanced differential motion input. When this FBI plug-in unit is used at the NET
network layer, its input is not the balanced PCM driving.

After the synchronization signal from the system is processed by both the clock processing circuit
and phase-lock loop, the 8 kHz synchronization clock and 8 MHz and 8 kHz monitoring clocks will be
generated.

Now come to the transceiving working status of FBI.

During FBI signal transmission, it puts 16-line 8 Mbps code streams under the control of the CPU,
and the FS signal leads them into the Tx, and Tx transmitting code rate is 204.8 Mbps. There are three
channels of Tx input, which are:

1. The normal 16-line 8Mbps code streams, or the 16-line pseudo code sequences generated by the
EPLD.

-213-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

2. A Frame Synchronization (FS) signal.

3. A CPU control signal.

When the FBI receives signal, the optical Rx circuit downloads the code stream to DPRAM. After
being read, it will be output by the driver in 16-channel 8 Mbps code stream and the extracted 8 kHz
synchronous signals.

When FBI is in the standby status, the CPU Control Cable (CB) enables the output drive to be in
the high resistance status.

FBI simultaneously provides the RS-485 interface, and provides the MON board with the
monitoring signal for the board.

FBI has four self test functions in all, which are: the electric performance self-loop test, optical
receiving/sending self-loop test, bit stream full-duplex self-loop test and bit error monitoring, emulation
environment used pseudo number sequence self-loop test.

FBI provides statistical alarming for the fiber receiving/transmitting error code. When the statistic
value reaches the alarming threshold, it requests CPU for interruption, and enters the software
active/standby changeover and at the same time, sends alarming information to MP.

Similarly, FBI has four types of active/standby changeover operations: Power-on reset changeover,
manual changeover,

man-machine command changeover, and fault alarm software changeover.

The active/standby changeover occurs to FBI if any of the following happens:

1. 8 MHz, 8 kHz clock signal losing or failure on the current FBI board.

2. Passive signal input, i.e., the opposite optical transmitter is damaged or the optical fiber is
disconnected.

3. Manual forced changeover.

4. When error code statistical value out of threshold, software changeover command is started.

8.2.3.4.7 Synchronous Clock System

The clock synchronization of mobile switching system is the key to implement the telecommunication
network synchronization. ZXC10–MSC/VLR clock synchronization system is composed of clock input
(CKI), sync clock (SYCK) and clock driver (CKDR) boards, to provide the uniform clock for the
whole system and performs synchronization tracing of the upper-level external clock. Physically, the

-214-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

clock synchronization unit shares the same frame with the digital switching network unit, with a BNET
board providing support and inter-board linkage.

The synchronous clock reference signal is provided from the SNM module. For each peripheral
module (MPM), the method to obtain this reference clock signal (E8K) is: first to obtain the signal via
DTI or FBI interconnected with the SNM module, and then to send this reference clock to the clock
synchronization unit of the peripheral module to trace the synchronization, thus implementing the
synchronization between the peripheral module and the SNM module. When a multi-module office
offers the slave clock and needs to be synchronized with the external system, the synchronization with
the external clock can be implemented based on the external synchronous signal or atomic frequency
marker extracted by the DTI or BITS. The basic principle is shown as in Fig. 8-24 (taking the MPM as
an example).

MPM FBI ～ FBI SNM FBI ～ FBI MPM

Ext
SYCK SYCK SYCK
Reference Reference Reference
synchronization signal synchronization synchronization

Fig. 8-24 Schematic diagram of system synchronization

Here the external reference synchronous signals may be: atomic frequency marker, BITS signal,
etc. In this system, the highest clock level is: Stratum 2 Class A.

8.2.3.4.8 Clock reference board (CKI)

In the ZXC10-MSC/VLR system, the clock extraction is implemented by the clock reference board
(CKI). CKI provides three kinds of interfaces: The interface for connecting 2.048 Mbps (bridge
connection or pass-through), the interface of 2.048 MHz, and the interface of 5 MHz.

CKI can receive the 8 kHz clock reference signals sent from DT or FBI in form of balanced
∆f
transmission. Besides, it can monitor if above clock references are degraded ( > 2 ×10 −8 ) on a
f
cyclic basis. The working principle is sketched in Fig. 8-25.

-215-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

Clock
signal input
Clock extraction circuit

Frequency division circuit

Clock detection & monitoring and

Output control circuit

synchronous oscillation system

8K clock signal

Fig. 8-25 Basic working principle of CKI board

8.2.3.4.9 Synchronous Oscillation Clock Board (SYCK)

1. Major functions of the SYCK

The SYCK board works with the reference clock board (CKI) to provide the centralized clock
system for the entire system, and conducts synchronization tracing for the external clock at the upper
level. Its major features are as follows:

♦ Directly receiving the reference of the digital trunk. Through the CKI, the reference of
the BITS interface or the atomic frequency marker can be received.

♦ In order to ensure the reliability of the synchronization system, two sets of SYCK boards
work in concurrent hot backup mode.

♦ The synchronous clock of the ZXG10MSC/VLR system uses the “loose coupling” phase
lock technique. Thus, it can work in 4 modes, namely, fast capture, tracing, holding, and free

-216-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

running.

♦ This synchronization system can be easily configured as the clock in Stratum 2 or 3 only
by replacing the OCXO and the solid-state EPROM in different levels.

♦ The RS-485 interface is used for the communication between the entire synchronization
system and the monitoring board, which is easy and feasible.

♦ It is furnished with the critical alarm adjustable in the phase-locked loop frequency.
When the inherent clock frequency deviates from the control range of the phase-locked loop
due to the aging of the clock crystal (The control signal exceeds the adjustment range of the
clock by three fourths), a warning will be sent out.

♦ The SYCK board can output 20 groups of 8 MHz/8 kHz clock signals and 10 lines of 16
MHz/8 kHz frame header signal. To enhance the output reliability and the anti-interference
ability of the clock, the difference balanced symmetrical output circuit is adopted.

Communication between SYCK and CKI is implemented through FIFOs. CKI reports the clock
reference status and clock quality deterioration information of each line to SYCK through FIFO. SYCK
reports this information through RS-485 interface to MON, and then to MP. According to the type of
the reference input, the SYCK notifies the CKI to select a certain clock as the reference of this system.

∆f
When each input clock reference is degraded to ( > 2 ×10 −8 ), SYCK reports this to MON
f
and MP.

2. Working principle of synchronous oscillation clock board SYCK

SYCK working principle is shown in Fig. 8-26:

-217-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

8MHZ
To the
D
8KHZ 20 pairs
monitor unit CP U
CP U D/A OCXO R 16MHZ
V 8KHZ 20 pairs

CKI FIFO Divider 8KHZ

CKI reference
output Phase comparison
result
8KHZ
fref. phase
DTI
Clock select compar
FB I extraction

BITS

Fig. 8-26 SYCK element diagram

The SYCK board uses a single chip as its CPU. It communicates with the MON board through the
RS-485 interface. SYCK sends the local status and CKI status through RS-485 interface to MON,
while MON sends the commands from MP to SYCK through the RS-485 interface. The SYCK itself
has the clock receiving circuit, which can receive four lines of 8 kHz clock reference signals
transmitted in a balanced way from DTI and FBI. In this way, when there is no BITS or other clock
reference, the CKI cannot be employed. The CKI provides the clock reference and its status (whether
there is a clock and whether the clock quality is deteriorated) for the SYCK. And they communicate
through the FIFO equipment. SYCK can read out the clock reference status directly, and can control the
CKI in selecting a clock reference output. The SYCK CPU system controls the reference selection
circuit to select a clock reference as the reference for the phase lock. The CPU can control OCXO
output via the D/A converter according to the phase data generated the phase comparator, thus
implementing the phase-lock function. The frequency divider, phase comparator and the reference
selection circuit are all integrated in one EPLD.

The SYCK can output 20 lines of 8 MHz/8 kHz frame header signals and 10 lines of 16 MHz/8
kHz frame header signals.

8.2.3.4.10 Clock Driving Board (CKDR)

The clock driving board (CKDR) provides the clock for some layers (BSNM, BFBI) inside the central
frame that cannot get the clock. The following describes its major functions and the allocation methods

-218-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

of the system synchronization clock.

1. Major functions of CKDR

♦ In the BSNM layer, it receives the 16 MHz/8 kHz clock from the SYCK, distributes it to
the boards in this BSNM layer after processing, and sends out the 8 MHz/8 kHz clocks.

♦ When used in the BFBI layer, it receives the 8 MHz/8 kHz clock from BSNM layer, after
being processed, it is distributed to each single board of the local BFBI layer.

♦ Providing the active/standby mode. It can monitor the clock. Once the loss or big
deviation of the used clock occurs , the switchover will be made immediately.

2. Distribution of the system synchronization clock

The 20 lines of 8 MHz/8 kHz, and 10 lines of 16 MHz/8 KHz from the SYCK will be sent to each
sub-system of the whole system, and are taken as the synchronous clock and the clock resource of the
whole system.

10 lines of 16 MHz/8 kHz clock will be used by the SNM and the T net, while the rest 20 lines of
8 MHz/8 kHz serve as the clock source for the DSNI.

Restricted by the number of its leading wires, the SYCK cannot meet the tremendous clock
requirements of SNM switching network and the BFBI layer. The CKDR provides four groups of 16M
and 8K clocks for the switching network and 28 groups of 8M and 8K clocks for the DSNI or FBI
board.

8.2.3.4.11 POWER B
POWER B supplies power for the control layer, network layer and digital trunk layer and optical
interface layer of the MPM. Its main parameters are as follows:

Input: -48 VDC

Output: +5 V (60 A), +12 V (2 A), -12 V (2 A) DC

Efficiency: >75%

Ripple wave: <60 mV

Noise: <500 mV

Surge current: <14 A

The POWERB board is used in parallel in a single layer. It has the 1+1 backup function, and can

-219-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

be plugged in/out safely with power on. When the output voltage exceeds the rated value by ±10%, an
alarm is set off; in case of the input connection-reversed or load short-circuited, the EA fuse is reliably
blown out, and overvoltage protection is provided. Under normal working conditions, the power
components’ temperature rise does not exceed 50°C, so as to ensure safe operation. It is required that
the monitoring circuit performs monitoring only without control, so as to avoid CPU mishandling.

The working principle of the POWERB is shown in Fig. 8-27.

Common-mode

Delayed start

Power module
suppression

Powe r input

+5V

Fig. 8-27 Working principle of POWER B

When the －48V voltage enters POWERB from the primary power supply, it first goes through the
common-mode inductance to suppress common-mode noise, and the delayed start circuit slowly
increases the input voltage in about 0.4 ms buffer time to eliminate surge. Then it goes through low
frequency filtering and reaches the input of the power supply module. At the same time, the on-off
logic circuit generates the corresponding logic order to switch the module on, so that the module starts
to work and generates outputs. These outputs go through high frequency and low frequency filters and
isolating diode and become the power supply. The output voltage can be adjusted within a certain
range, and goes through sampling and comparison in the over-/under-voltage detection circuit to
generate the over-/under-voltage logic signals, which are identified and processed by the monitoring
circuit. After the monitoring circuit has implemented the identification and processing, it notifies the
alarm circuit of the processing result. The serial port query status is displayed at the working status
area. MP commands are executed. Under the alarming status, the power supply is cut off manually.

-220-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

8.2.3.5 Reliability Design

To improve the reliability of the hardware, we adopt mainly the redundancy design. The key parts in
the ZXG10-SC (V3.0) system are all designed with the redundancy design.

8.2.3.5.1 MP
The MP of ZXC10-MSC/VLR has been designed as an active/standby system. One MP is in the active
status while the other MP is in the standby status. The active MP handles all services, and the standby
MP is in the hot backup status. The standby MP scans the running status of the active MP every 10 ms,
when it finds that the running status of the active MP is abnormal or switches from the active status to
the standby status, it will perform immediate changeover. After successful changeover, the original
standby MP becomes the active MP and undertakes all the service processing tasks.

To guarantee correctness and continuity of service correctness and continuity after MP

changeover, the data of the standby MP should be synchronized with the data of the active MP. The
synchronization process contains two stages: startup and running. When the standby MP starts, it
synchronizes the system configuration data with the active MP. This synchronization is carried out by
the database application process. After the standby MP enters the running status, all processes in the
standby MP will make inter-process data synchronization with the same processes in the active MP at a
certain cycle.

8.2.3.5.2 T Net
The T net is composed of two switching network cards that work in the active/standby mode. The
active/standby status of these two switching network boards is controlled by MP. When the active T
switching network board is faulty, the MP can detect it immediately and will change the standby T
switching network board to the active one. It takes less than five seconds to complete the changeover
after fault occurs.

When the T switching network is faulty, the system will notify the maintenance personnel in the
graphic interface and the audible and visible modes so that the faulty T switching network card can be
replaced in time.

8.2.3.5.3 T Network Driving Board

The T network driving board of the SP level operates in the active/standby mode. The standby driving
board monitors the status of the active driving board continuously. When the active driving board gets
faulty, the standby driving board will immediately detect this, and change itself over into the active
status, in a short moment of 1 to 2 seconds. The switching time is between 1~2 s.

8.2.3.5.4 FBI Board

The FBI board operates in the active/standby mode, with the standby driving board monitoring the
status of the active driving board continuously. When the active board fails, the standby board will

-221-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

immediately detect the failure and switch itself to the active state within about 1 second.

8.2.3.5.5 Main Processor Network Card

Each module processor has two network cards working in the active/standby modes. If the active
network card has not got any data package within 10 seconds, it will turn off the active network card,
and start the standby network card.

8.2.3.5.6 Communication Board (COMM)

In order to enhance the reliability of the intra-module communications of ZXC10-MSC/VLR, the
hardware connection is made in dual backup, and each SP is connected with a pair of COMM boards
through 64 kbps HDLC links. In order to quicken the link changeover at the time of failure, both links
between the same SP and this pair of mutual-assistant COMM boards should be established. As for
which link is to be selected, it is up to the active MP. When both links have been successfully
established, in order to equalize the load on this pair of mutual-assistant COMM boards, the active MP
adopts preference selection method for link selection, and the principle is that the even-numbered
channels on the communication boards select the link on the left COMM board with preference, and the
odd-numbered channels select the link on the right COMM board with preference. When the selected
COMM board link fails, the MP will select a normal link on the other COMM board.

8.2.3.5.7 Power
Each frame of the ZXC10-MSC/VLR system is fed by dual power supplies in parallel connection.
When one power supply is faulty, normal power supply can still be ensured. When the power supply is
faulty, the system will notify the maintenance personnel in the graphic interface and the audible and
visible modes so that the faulty power supply will be replaced in time.

8.2.3.5.8 Billing Server

The billing server of the ZXC10-MSC/VLR system works in dual-system hot backup and RAID modes
to ensure the reliability of the billing system. The dual-system technology is based on the CLUSTER
architecture. One cluster contains multiple servers with shared data storage space. When one server
fails, another server will automatically take over the application running on it.

The dual-system structure of the Billing system of CDMA cellular mobile communication system
ZXC10-MSC/VLR (V3.0) is shown in Fig. 8-28

As shown in the diagram, Ethernet card 1 forms a heart beating line connecting the dual systems,
used for system internal communication and monitoring. This is implemented by means of serial
communication mode.

When any of the following faults occurs, the system will initiate changeover, so that the other
takes over.

-222-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

T o HUB T o HUB

Ethernet card 1

SCSI adapter Ethernet card 2

Ethernet card 2 SCSI adapter

Ethernet card 1

Server 1 Server 2

Disk cabinet

Fig. 8-28 Structure of dual-system billing servers

1. Server breakdown caused by the system software or application software.

2. Server failure in reading data from the RAID caused by SCSI card damage.

3. Server breakdown caused by hardware damage.

4. Server shutdown

In the dual-computer system, each has its own name and IP address. They provide a common
virtual computer name and IP address for the outside, via which the services are provided.

-223-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

8.2.4 Software System of ZXC10-MSC/VLR

8.2.4.1 Overview
The software system of ZXC10-MSS has been designed following the modularized-hierarchical design
principle. One-way invoking in the primitive mode is used between different layers, while the message
interface mode is adopted between modules within the same layer, stressing on the independence of
modules and university of inter-module interfaces. Also following this principle, the whole software
system of ZXC10-MSC/VLR is composed of a series of functional sub-systems. Being independent
from each other, each sub-system communicates with others by the message mechanism. Each sub-
system can be further divided into multiple functional modules. This chapter will describe in detail the
software system and its sub-systems.

8.2.4.2 Software Structure

ZXC10MSC/VLR software system is mainly composed of the operation supporting sub-system,
database management subsystem, signaling subsystem, mobile subscriber sub-system and operation &
maintenance sub-system. The layered structure of the system is shown in Fig. 8-29.
Operation & maintenance

Database management

Mobile subscriber
sub-syste m
subsystem
sub-system

Signaling proce ssing

subsyste m

O peration supporting sub-system

Fig. 8-29 The layered structure of the software system

-224-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

8.2.4.2.1 Operation supporting subsystem

The operation supporting sub-system includes operating sub-system, control sub-system, loading sub-
system, file management sub-system etc. It provides a virtual machine environment for the upper-level
applications. The following paragraphs will describe the functional modules of the operation support
sub-system and the functions of these modules.

1. Memory management module

Its main function is to provide allocation of memory data zones to the application processes,
allocate temporary data and perform stack management.

2. Process scheduling module

It has two functions: one is the process message queue management and the other is the process
PCB table management. Of which, the process PCB table management includes process PCB table
initialization, process activation and suspending, process status management, etc.

3. Task scheduling module

The main function of the task schedule module is to perform task priority management. Different
tasks are scheduled as per different time chips.

4. Clock management module

Its main functions include performing system clock management, setting and releasing the process
timer, and providing timer invocation primitives to the application processes.

5. Internal communication function module

Its main function is to provide the application part with reliable invoking of primitive for message
transmission between processes, between active and standby systems, between modules, between the
MP and PP and between the foreground and the background subsystems.

6. System control functional module

Its major function is to ensure the normal running of the system. Specifically, it involves the alarm
information management, system restart management, control of the CPU occupancy, load control, etc.

7. Interface driving module

Its main function is to implement initialization of the hardware interface

-225-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

8. File management module

Its main function is to provide reliable file reading, copying and other functions for applications.

9. System loading function

This major function is to implement software and data loading following system startup.

8.2.4.2.2 Signaling Processing Sub-system

The signaling sub-system includes the following functional modules:

1. Channel-associated signaling processing (CAS) module;

2. Link level module (MTP-2) of SS7 signaling;

3. Message Transfer Part Level 3 (MTP-3) and signaling connection control part (SCCP) of SS7
signaling;

4. ISDN User Part (ISUP) of SS7 signaling;

5. Transaction Capability Application part (TCAP) of SS7 signaling;

Telephone User Part (TUP) of SS7 signaling.

8.2.4.2.3 Mobile Subscriber Subsystem

This sub-system is mainly used for information interaction to implement various services in MAP. It
notifies the database (DB) components about the user’s latest data, including the user-related
information obtained from the database components for modification.

1. A interface module

Its major function is to process the A interface messages at the MSC side. The processing includes
converting the SCCP connection-oriented message and connectionless message received from Interface
A into the corresponding MSC internal message format, and distributing the messages to various MSC
processing parts according to the message categories.

2. Call processing module

This is an important processing component in the MSC. It mainly implements functions such as
access of mobile subscriber paging, channel allocation, call connection, traffic control etc., and
provides call connection function oriented to fixed networks (PSTN, ISDN and PSPDN). In addition, it
adopts different signaling modes, such as CAS, TUP, ISUP etc., based on different user requirements,
and implements connection control to different signaling modes. When the user conducts a

-226-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

supplementary service operation or when a handoff occurs, it invokes the corresponding supplementary
service processing and switching processing components to carry out the required processing.

3. Mobility management and security management module

Its major function is to conduct the mobile users related functions, such as to registering,
deregistering, authenticating, updating SSD, etc. The information of the mobile subscribers is mainly
stored and managed at VLR, therefore the mobility processing part of MSC only performs some initial
processing on these messages before transferring them to VLR for processing.

4. Circuit management and processing module

It mainly implements the processing of messages related to MSC-BS circuit management, such as
global reset, circuit reset, blocking/unblocking etc.

5. Resource management module

The resource management module mainly implements the establishment, management and release
of various resources in the MSC. Resources in the MSC include subscriber idle Index queue, various
processing component data areas, etc.

6. Handoff processing module

It mainly hands off services when the subscriber location area changes during a call.

7. Supplementary service module

It mainly performs processing to various supplementary services.

8. Short message processing module

Its main function is to send or receive short message services.

8.2.4.2.4 Operation and Maintenance Subsystem

The ZXC10-MSC/VLR system provides powerful operation and maintenance functions. Based on the
functions, the operation and maintenance components are divided into such modules as authority
management, log operation, data configuration, billing management, performance statistics, traffic
statistics, failure management, diagnostics and testing, channel associated signaling, SS7 signaling
maintenance, call connection observation, security management, file management, version
management, voice loading, clock management, database management and service observation
modules.

Each module contains two sub-modules: foreground sub-module and background sub-module, and

-227-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

the independence of modules and uniform inter-module interfaces are emphasized, so as to be flexibly
adapted to the changes of system structure and addition of functions.

The operation and maintenance system adopts the client/server structure, and is composed of three
parts: the foreground program running on the MP, background server and background operation and
maintenance terminal. The operation and maintenance network structure is shown in Fig. 8-30.

MPM1 MPMn MPMn

Foreground TCP/IP

Background

Client
NT Server

Fig. 8-30 Operation and maintenance network structure

1. Authority management module

The authority management module is used to manage the operation authority of the operators. It
can set different access authorities for different users, so that they have different access to perform

-228-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

corresponding operations and maintenance to the mobile switching system.

The operator authority setting process is briefly described as follows:

Step 1: set up authority groups with different authority levels;

Step 2: add operators into relevant authority groups.

Thus, the operators have obtained the authorities associated with the authority groups, and all the
operators within the same authority group having the same authority.

In the authority management system, the authority groups include two types: build-in group and
customized group, which are described as follows. .

1) Built-in authority group

The build-in authority group refers to the authority group generated at the beginning of installing
the ZXC10 maintenance system. Five types of authority groups are available: System administrator,
console operator, data maintenance administrator, and data maintenance operator.

2) Customized authority group

A customized authority group is set up by an operator having the “authority group” operation
authority, such as “system administrator”.

Upon completion of the ZXC10 maintenance system, ordinary operators will have no authority to
perform operation and maintenance, and the operation authority of ordinary operators must be assigned
by the system administrator. Therefore, after the successful installation of ZXC10 maintenance
system”, a system manager should log in to run “Authority management” system so as to give various
ordinary operators a certain authority, add users and set up the users IDs (to regulate to which category
of operator a user belongs), and so on. After that, the users assigned with certain authority can log in to
the ZXG10 maintenance system with an operator ID and to make corresponding system operation and
maintenance.

2. Operation log module

In order for the office staff to perform better switch operation and maintenance, ZXC10-
MSC/VLR provides log viewer, which facilitates the operators to implement operation and
maintenance. The operations to the switch implemented by the operators are automatically logged in a
certain form. Operators can check these records under specific circumstances. The log files are stored
in the server, which can be checked by the corresponding terminal.

3. Data configuration module

-229-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

The configuration management structure of the ZXC10-MSC/VLR system can be divided into two
parts: the server-centered background sub-system in the Client/Server structure and the foreground sub-
system with the MP as the core. The source information of the maintenance and modification of large
amount of data initially occur in the background subsystem, and then the related data are modified to
the foreground subsystem. The background database is designed to provide a reliable, well-developed
and easy-to-use data maintenance tool for the foreground. The operations to the database should be
timely implemented, so as to accurately feed data to the foreground system. The system provides
maintenance functions such as inquiry, modification, deletion and creation to terminal operators, and all
these functions can be implemented by means of the control components on the screen.

4. Charging management module

Due to the characteristics of “mobility”, the billing management of the system is more
complicated than that of a wired switch. Functionally, the ZXC10-MSC/VLR charging system consists
of 3 parts: the foreground original bill collection and transfer, original bill collection, processing and
backup and bill record transmitted to the billing center.

The billing management system of ZXC10-MSC/VLR uses double buffers (bill buffer and sending
buffer), dual-system server, cluster technology, RAID technology and stop-and-wait answering
mechanism with serial number between the foreground and background to ensure the reliability and
integrity of the bills.

1) Bill collection and transfer

The foreground MPM module is responsible for collecting the original bills and sending them to
the charging server. On the foreground, a bill is generated at the end of each call, and it is then
transferred to a bill buffer of the foreground. If a conversation exceeds 30 minutes, an intermediate data
record will be generated in case of data loss.

The size of the bill buffer is 1400 bit. When the number of received bills in the bill buffer reaches
a full frame, the bills are sent to the sending buffer, which then sends the bills to the dual-backup hard
disks on the server.

In order to ensure the billing security, the foreground is also provided with a hard disk. When the
traffic volume is high or the foreground-background communication becomes abnormal, the newly
generated bills will be first stored on the foreground hard disk; when the sending buffer becomes idle,
they will be sent to the sending buffer, which will then send them to the dual-backup hard disks.

2) Billing Server

The billing server is designed in the dual-system structure and with CLUSTER technology. Both
the systems work in the active/standby mode, each having their respective names and IP addresses,
providing externally a virtual machine name and IP address and serving externally in such capacity.

-230-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

Their respective IP addresses will be invalid in the active state and the virtual IP addresses will be in
use. The system can detect the host system failures and network adapter communication failures in real
time. When a failure occurs, the system will automatically implement changeover, so that the other
server system will take over the application.

The server is designed in the stop-and-wait response mechanism corresponding to the foreground
to receive the bills transferred from the foreground, then save the received bills immediately and send
the responding messages. The hard disks on the server adopt the disk Mirror technology to ensure the
data security. The size of each hard disk is 9G. Calculated on the basis of 12 calls and 24 bills per
second, only 270M hard disk space is needed a day, and therefore the size of the hard disk can satisfy
the requirement of the maximum traffic volume. When the overflow degree of the hard disk files
reaches the preset threshold, the system alarm station will generate an alarm. In this case, the operator
must back up the files to the magnetic tape or CD-ROM before erasing the bill files on the hard disk.

3) Billing client end

It is used mainly to provide the man-machine interface. It provides well-designed concrete

functions as well as simple and convenient operation modes.

4) Bill transfer

The billing system transmits the bills to the charging center in real time. The server is connected
with the collector of the billing center via network cables and sends bill files to the billing center by
means of FTAM or FTP protocol. The bill files are generated in the standard ASN.1 format.

5. Performance statistics module

Designed strictly in accordance with the international standards, the performance statistics module
provides powerful functions. It performs measurements and statistics of some performance parameters
and traffic data in the system so as to reflect the mobile communication system’s performance
specifications for the service provider’s reference. The performance statistics module contains
extensive contents, mainly including the statistics of traffic and signaling performance, QoS
measurement, network configuration verification, availability measurement, throughput capacity
measurement and handoff function measurement.

On the maintenance terminal, you can define the performance measurement flexibly. A
performance measurement job includes the start/end time, days of duration, measurement object set and
granularity period. The maintenance terminal allows you to generate, delete, modify and observe in real
time the performance measurement. The performance measurement covers extensively, including
traffic and signaling performances, service quality measurement, network configuration verification,
availability measurement, throughput measurement and switching function measurement.

6. Traffic statistics

-231-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

Designed strictly in accordance with international standards, the traffic statistics system of the
ZXC10-MSC/VLR system has powerful functions. It can provide real-time observation of the global
traffic and system resources utilization. The extensive statistics contents mainly include the statistics of
number of calls to MSC, traffic, CPU occupancy, DTMF, MFC average occupancy time, SS7 signaling
status, supplementary services utilization status, circuit utilization status etc. In addition, it also
performs statistics on the connection status information of the common channel signaling system, the
traffic of specific modules, the utilization of supplementary services, the occupancy of public devices
and processors, etc.

The traffic statistics background adopts the Client/Server network architecture. The server-side
software of the traffic statistics system mainly implements functions of control, communication,
database, operation, etc., and the client-side software mainly implements the functions of setting,
displaying, querying and analyzing and outputting the statistics result.

7. Fault management module

The fault management system is mainly used to perform centralized monitoring of the whole
switch’s running status and real-time collection of the abnormal information of various boards, links,
databases, servers etc., so as to facilitate the operator’s analyses and judgments for maintenance and
repair.

The information collected by the Fault Management includes alert, alarm and alarm recovery
information. Alert information means operation or abnormal information that has happened and does
not affect the system. It cannot be recovered. Alarm information means that a certain part of the switch
becomes abnormal. When an alarm occurs, the operator should calmly analyze the reasons of the fault
to eliminate the trouble. When the system becomes normal, the fault management system will receive
an alarm recovery message.

8. Diagnosis test module

This module adopts a fully-distributed control structure. Each module is composed of a series of
basic units, including digital switching network (T network), trunk unit (DT), DTMF number receiver
(DTMF), MFC transceiver (MFC), signal tone unit (TONE) etc. Diagnosis tests include intra-module
tests and inter-module tests. The intra-module test is mainly used to test whether the functions of every
component unit, links between the units and MPs, voice channels between units and switching
networks in a module are normal. And the inter-module test is mainly used to test the communication
and voice channels of the adjacent modules.

9. Channel associated signaling tracing module

Channel associated signaling refers to transmitting the control signals (such as occupancy,
response, disconnection and dialing) required by a voice channel via the voice channel itself or a

-232-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

signaling path (channel) of constant connection with it. That is, to transmit the voice information and
the corresponding signaling via the same path.

The CAS tracing system of ZXC10-MSC/VLR observes and records in real time the process of
the controlled changes of the inter-office CAS, thus providing reliable and direct reference basis for
office startup commissioning and debugging activities.

10. SS7 signaling maintenance

SS7 signaling maintenance includes three parts: signaling tracing, MTP maintenance and SS7
signaling statistics.

1) Signaling tracing part

Trace the signaling messages on the links and display the corresponding explanations so that the
maintenance personnel can discover the problems of signaling interworking. It mainly traces four types
of messages: MTP, TUP, SCCP and ISUP, and it can also trace the MTP testing messages. Besides, after
the setting of SS7 signaling tracing, the signaling messages lost at MTP layer 3 (except the message
lost normally) will also be displayed.

2) MTP maintenance part

It can be used to view some dynamic configuration information of the third level of the MTP
(signaling link, signaling link group and signaling route group). By viewing the MTP’s alarm records,
the operator can know the events that have occurred on the links to facilitate locating MTP failures.

Monitor the state of SS7 signaling board and view the current state to know the current state of
SS7 signaling board and the links on the board as well as the state change of the signaling board, so as
to facilitate the maintenance of MTP level 2.

3) SS7 statistics part

The main content is the statistics of MTP. For instance, the number of faults in the signaling links,
the changeover and changeback times, providing performance data of MTP of SS7 signaling system for
the personnel of the equipment buyer in their maintenance.

11. Connection observation module

Subscriber connection observation module is a service observation functional module in CDMA

operation maintenance. It mainly provides information about change process, time length, cause of
failure etc. during different connection phases of mobile subscriber, used for the assessment of QoS and
the connection performance of the switch.

The functions provided by the connection observation module include:

-233-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

1) Providing the capability of simultaneous observation on at least 40 subscribers.

2) Providing basic information such as calling and called numbers, connection time length, cause
of failure etc., and dynamically drawing the subscriber connection status shift diagram.

3) Saving the subscriber connection observation result in the local disk files, and providing the
printing function.

12. Security management module

In order to ensure the security of the ZXC10-MSC/VLR system, prevent malicious sabotage, and
restrict unauthorized access and erroneous access, security management must be performed to the
whole system. The security management system safeguards the access of network management system
and PLMN sensitive data. The security management system mainly includes mobility security
management and variable controls.

1) Mobility security management

The feature of wireless transmission makes the mobile subscribers’ security and interests
vulnerable. In order to safeguard the mobile subscribers’ interest, “identity authentication management”
subsystems of the “mobility security management” is provided. These subsystems are not only able to
prevent access of illegal users, but also able to provide communication security measures for legal
subscribers. Generally, it is up to the operator to decided whether to use these subsystems for non-
roaming subscribers. For roaming subscribers, it is mandatory, unless the agreement of all related
PLMN operators to the contrary is available.

2) Variable Controls

The variable controls include A-interface function control, call function control, digit extension
control, service control etc.

13. File management module

The file system provides read/write support for procedures. When the file system is located in
tasks of low priorities in the system, it can be seized by other tasks of higher priorities. The file system
puts the concurrent file access requests of multiple processes in a queue based on “first in and first
served”, in order to achieve the mutual exclusion of the file operations. The management system can
implement typical file management functions such as file listing, file copying, file renaming, file
deleting between switch foreground network MPs, active/standby MPs as well as among the
background maintenance network terminals.

14. Version management module

-234-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

The version management system implements the management of the main processors (MPs) of the
ZXC10-MSS system and the upgrading of the various peripheral processing units (PPs). MP includes
MSC, VLR, etc. PP mainly includes DDSN, DTI, ASIG, etc. It works in single-user mode, that is,
allowing only one user to perform the version management operation at any time. If the user fails to
communicate with the server within 300 seconds, the user will be regarded to have exited, so that other
users will be allowed to execute the updating operation.

The version management of MP is controlled manually. That is, the user controls the addition and
copying of MP version and the resetting of MP

PP version management adopts full automatic mode, that is, copying and loading the PP version
are automatically executed by the foreground. All the operator has to do is to set the version number to
be used by the current PP, and then the foreground will automatically perform version copying and PP
loading according to the version number.

If specified loading of a certain port is desired, the version management system also provides an
interface, and each operator has to do is specifying the port to load the version to and the version file to
be loaded.

15. Voice loading module

The voice system is designed to enable the user to perform on-site editing and modification of
switch voice announcement contents. It has the voice playback, recording, editing and transmission
functions.

16. Clock management module

The timer management system is a utility package for developing and testing the SPC switch
foreground programs, which can be operated on any terminal of the background. This system mainly
implements the following functions:

1) Timer management: To manage all the module timers of the foreground. This includes
displaying parameters of the MP timer, modifying the name and current time duration of the MP timer,
etc.

2) Time management: to implement clock management to all foreground modules.

3) PP memory management: to implement the management work to all the foreground subscriber
processors.

17. Database management module

Database management provides a tool to manage, back up, recover and inspect the database on the

-235-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

background server.

18. Service observation module

Service observation is the tool for debugging, maintenance and observation of the system,
providing accurate and reliable maintenance means with the characteristics of simple operation,
providing accurate and reliable information and rich contents. With the service observation system,
users can observe various information in the switch system on the man-machine interface provided by
the maintenance, e.g. usage of the MSC and VLR foreground process data area, data contents of the
specified data area, release of the falsely occupied data area, base station management, numbers
management, service failure causes, inter-office service observation and SS7 observation, etc.

8.2.4.2.5 Database Management Subsystem

Running on various switching modules, the database system is the data center of the ZXC10-
MSC/VLR system. It provides data support and coordination and implements corresponding functions
for the service layer, signaling layer, system restart, system testing, traffic statistics etc. In addition, it
implements some database self-maintenance work to ensure the integrity and consistency of the
database foreground and background, active and standby systems

The database system of the ZXC10-MSC/VLR system has the following features:

1. Employ the object-oriented relational data mode to manage data. Each data object separately
forms a segment, thus improving the data security.

2. Data maintenance management system employs the client/server structural mode and the
subscriber terminal employs the interactive graphic interface, easy and visual for operation.

ZXC10MSC/VLR system data management manages basic data, mobile data, SS7 data and
dynamic data, etc. And here the basic data management includes office capacity configuration data,
exchange configuration data, physical configuration data, number analysis data and trunk configuration
data. The mobile data management includes the base station controller data, cell data, location area
management data, number management data and VLR data.

The database system includes the database and the database software.

A database is a structured set of relevant data, covering the data themselves and the relations
between the data. It is independent of the application programs, and functions as the core and
management object of the database system.

The database software implements database management and maintenance. It has functions of data
definition, description, operation, maintenance etc., receives and completes different requests of the
user program and database, and protects the data from various interference and sabotage. The core of

-236-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

the database software is the Database Management System.

The data model of the ZXC10-MSC/VLR system adopts the relational model. For the
management of the data, the object-oriented management mode is adopted. The data model of ZXC10-
MSC/VLR is illustrated in Fig. 8-31.

Application management: View 1 View 2 View V

Object instance: Table instance 1 Table instance 2 Table instance n

Method n
Method 1 Method 2
Index 1 Queue 1 Index 2 Queue 2 Index n Queue n

Basic object type: Table object Index object Queue object

Table method Index method

Queue method

Fig. 8-31: Data model of the database subsystem

8.2.4.3 Reliability Design

8.2.4.3.1 System Running Monitoring and Logs

The operation support system provides the operation & monitoring function. It can timely detect errors
such as over-frequent running of process, process dead cycle, as Int 12 and Int 13, and provides fault
self-recovery function. When the system becomes abnormal, the site operation data are recorded into
the log on the disk. The data in the log can facilitate the development staff to quickly find and eliminate
errors, thus enhancing the system’s reliability.

The modules of the operation maintenance sub-system write the abnormal conditions detected

-237-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

during system operation into the log database. By inquiring the log database, the maintenance staff can
promptly find and eliminate errors.

8.2.4.3.2 Reliable Resource Management

1. Memory resource management

The software system of ZXC10-MSC/VRL uses two methods to prevent memory exhaustion. The
first mode is static distribution, suitable for the cases where the required memory is fixed. The method
is to define global data in programs. The second method is dynamic memory allocation at system
initialization, which is suitable for the case where the required memory is variable. These two methods
avoid dynamic memory allocation during system operation, thus preventing memory exhaustion and
enhancing the system’s reliability.

2. Data area resource management

Each service handling process is performed under timer monitoring to prevent resource
suspending due to message loss. Abnormal messages of related entities are processed under every
status, so as to avoid resource suspending.

Due to the restriction of the MP memory, there is a certain size limitation of the VLR database.
After a long time operation, the VLR database will contain the data of some subscribers that have been
long inactive. These subscriber data takes up the size of the VLR database, and this may make data of
other subscribers unable to be stored into the database, causing voice channel connection failure. In
order to avoid this situation, the system periodically clears long-inactive subscriber information to
release the resource.

The address mode is adopted for process internal message transmission, so as to reduce the length
of transmitted messaged and the use of memory.

3. Management of trunk, T network timeslots, bridge timeslots and tones and timer
resources

Occupancy flags and states are provided for resources taken up by processes. In addition to
releasing resources during normal processing, uniform protection is performed when calls are released,
to check the occupancy flags and release the resources.

During the call processing, when the all-busy message “EV_TRUNKALLBUSY” of a certain
trunk group is received, the system will perform a semi-call existence tests to the data areas of the trunk
groups occupied by all the calling states of the calls. If no semi-call exists, all the resources that it
occupies will be released. If the test response is received and a semi-call exists, it means that the
response is successful. After the system receives the test response message, it starts testing the next data
area. In case of timeout, it will release itself.

-238-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

During call processing, calls in the calling status and holding status are protected. At the time of
changeover, check is made to see if the related A-interface data exist. The occupied resources will be
released if it does not exist.

During an inter-office call, if all the trunks have been occupied, the system will start the
suspending checking process to check if the occupancy of related resources and data areas are invalid.
If invalid occupancy exists, the system will automatically release the invalid occupancy of resources
and data areas. Besides, the system provides the background man-machine interface, detecting if there
are super long conversations. If so, the system will forcibly release such calls.

In fact, after active/standby changeover, the active system can timely release invalid resource
occupancy, so as to avoid the accumulated effect of unstable factors. Therefore, frequent active/standby
changeover helps enhance the stability.

8.2.4.3.3 Prevention of Pointer Overflow and Stack Overflow

Every process in the system has its own stack, and the size of a stack is fixed. The local variables
defined in the process functions seize the address space of the stack. Too many local variables defined
will lead to stack overflow, that is, Int 12. To avoid this, long local variables are usually not defined in
the process functions, but rather defined are the global variables.

During message reception in a process, the messages are copied into global variables as per the
reception length while the length of message contents is checked to see if they are too short, so as to
avoid Int 13 possibly caused by forced type conversion.

When data areas are located, the range of data area index is judged to prevent address out-of-
range.

The above methods minimize the possibility of occurrence of pointer out-of-range and stack
overflow, thus enhancing the reliability of the whole system.

8.2.4.3.4 Overload Control

The software system of ZXC10-MSC/VRL performs strict control of the system load, mainly in the
following control methods:

1. MAP overload control

The overload control of MAP refers to the load control at six levels (Levels 1 through 6)
implemented based on the overload degree of the traffic, with Level 6 being the most severe level.
When the traffic overload is between 1% and 20%, then Level 1 overload control is implemented, that
is, the overload traffic of the corresponding proportion (1~20%, similarly hereinafter) will be
discarded; when the traffic overload is between 20% and 40%, Level 2 overload control is
implemented; when the traffic overload is between 40% and 60%, then Level 3 overload control is

-239-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

implemented; when the traffic overload is between 60% and 75%, then Level 4 load control is
implemented; when the traffic overload is between 75% and 90%, then Level 5 load control is
implemented; when the traffic overload is between 90% and 100%, the Level 6 load control is
implemented.

2. A-interface flow control

In the case of CPU overflow, or when the data area resources are nearly exhausted, or memory is
nearly exhausted, or traffic is too large, the traffic will be reduced level by level (for example, by 1/4,
1/3, 2/3, 3/4 and 1), so as to prevent breakdown of the MP. If the BSC supports overflow control
process, overflow indication will be sent to the BSC.

8.3 ZXC10-SSP System Structure

8.3.1 System Overview

When the CDMA cellular network of North America became mature, the Wireless Intelligent Network
(WIN) service function was introduced. WIN is based on Capability Set 2 (CS2), and the introduction
of intelligent functions can provide seamless terminal services, personal mobile services and advanced
network services for the subscribers in the mobile environment.

As a new service network in the wireless communications industry, the WIN system can not only
control to the most extent, by means of wireless pre-paid charging service, the over-due payment and
malicious overdraft phenomena currently existing in the telecom field, reduce the risks of the telecom
operators, and safeguard their normal business interests, but also provide conveniently, flexibly,
economically and effectively various wireless intelligent services, and can be integrated with the
business system, customer service center, short message center and bank system to provide the users
with better, timely and humanized services. It is foreseeable that the WIN will be one of the new
service growth points for the telecom operators.

On the basis of the company’s many years’ experience in the R&D of digital SPC switches,
CDMA cellular mobile communication systems, fixed intelligent networks and mobile intelligent
networks, and great efforts invested in this field, ZTE Corporation has developed independently a full
set of CDMA WIN product series – ZXC10-WIN, to provide complete sets of WIN solutions.

The complete set of CDMA WIN product series – ZXC10-WIN provided by ZTE include:

1. ZXC10-SCP;

2. ZXC10-SMP/SMAP;

-240-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

3.ZXC10-SCEP;

4. ZXC10-IP;

5. ZXC10-MSC/VLR/SSP and ZXC10-GMSC/SSP.

This chapter will present detailed description of the SSP part.

8.3.2 ZXC10-SSP System Structure and its Functions

8.3.2.1 The Location of ZXC10-SSP in WIN Distributed Functional Plane

Based on the ITU-T Q.1224 (CS2) protocol, the WIN Distribution Function Plane (DFP) describes the
functional entities included in the WIN and their inter-relations. In addition to the original IN functional
entities, the WIN DFP also abstracts the functions proper to CDMA networks as WIN functional
entities. The WIN DFP is shown in Fig. 8-32.

-241-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

Fig. 8-32 Logic distribution diagram of WIN modules

The above figure is a logic distribution diagram of various functional modules in the WIN system
defined in IS-771. Their functions are respectively as follows:

Location Registration Function (LRF): providing service logic and service data functions and
mobility management proper to wireless users. Such functions include LRF H and LRFV. LRFH
implements the mobility management functions of HLR, while LRF V implements the mobility
management function of VLR.

-242-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

Authentication Control Function (ACF): providing authentication, voice encryption and signaling
message encryption functions for service logic and service data.

Mobile Station Access Control Function (MACF); storing subscriber data and providing dynamic
management of subscriber calling system resources.

Radio Access Control Function (RACF) providing specific service logic and service data functions
related to radio links.

Radio Control Function (RCF): providing radio ports and their control functions.

Radio Terminal Function (RTF): providing wireless subscriber access function, as the interface
between wireless subscribers and network call control functions.

CCF, SSF, SCF, SCEF, SDF, SMAF and SRF are similar to the definitions in fixed intelligent
network.

8.3.2.2 ZXC10-SSP Product Structure

Developed on the ZXJ10 platform of ZTE’s large-scale digital SPC switch, ZXC10-SSP is mainly
composed of CSM (SNM+MSM) module and all-in-one MPM module. The CSM is the central
switching module, which is used for the control of inter-module communication and message
interaction in multi-module configuration. It can be configured or omitted based on the actual
requirement (refer to networking scheme). MPM is an all-in-one processing module with MSC, VLR
and SSP functions, which can be independently configured in the case of small subscriber capacity
requirement. When the subscriber capacity is big, one CSM module and one to ten MPM modules can
be configured as required to implement the SSP and MSC functions, and such a configuration can meet
the requirement of up to 600,000 subscribers. The inter-module communication can be implemented by
means of optical fiber transmission. Related functional modules can interwork with BSC, PSTN, ISDN,
PSPDN and PLMN through the SS7 signaling network.

The operation maintenance system of ZXC10-SSP is mainly composed of the OMM server, billing
server and operation and maintenance station, of which the operation and maintenance station can be
either locally configured or remotely configured. The OMM server is the operation and maintenance
server, which is used for the management of related information, and can communication with the
network management center via the X.25/DDN/E1 link in accordance with the Q3 standard. The billing
server adopts the dual-system protection mechanism, and it can transfer bills to the billing center as per
the FTAM protocol or by converting bills into other compatible forms. Its system structure is shown in
Fig. 8-33.

-243-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

Billing center NM center

X.25 X.25
Maintenance
Billing server OMM Server
console

TCP/IP

AGXC10-SSP

CSM
SNM MSM

MPM MPM MPM MPM

....

PSTN
ISDN
BSS
PDN
PLMN

Fig. 8-33 Schematic diagram of ZXC10-SSP system structure

Among them:

Central Switching Module (CSM): including SNM and MSM.

Switching Network Module (SNM);

Message Switching Module (MSM);

MSC/VLR/SSP Processing Module (MPM);

We can see that the above diagram is identical to the hardware structure diagram of MSC/VLR
(Fig.8-4). In fact, the hardware structure of ZXC10-SSP is exactly the same with that of ZXC10-
MSC/VLR, and the SSP module functions in WIN can be implemented based on ZXC10-MSC/VLR by
means of embedding method and different software upgrading of the system. Therefore, the discussion
of the hardware structure of ZXC10-SSP will be skipped.

The following paragraphs will first describe the SSP functions, and then the software system of
SSP.

-244-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

8.3.2.3 Main Functions of ZXC10-SSP

ZXC10-SSP mainly implements the SSF, CCF and the build-in SRF functions in the DFP. It provides
control to service, call control and resource management functional entities. With the CDMA mobile
switch as platform, and based on the operation code, resource code and detection point (DP) in the SCP
message, ZXC10-SSP performs call flow control and resource scheduling, and returns the execution
result and detected status to the SCP for it to determine the further service direction.

8.3.2.3.1 Service MSC Function

When processing services to be supported by WIN, the service MSC receives the subscriber’s
TRIGADDLIST from the VLR, and requests the SSF for instruction. During the processing, the MSC
monitors the requested call status (event) and notifies the SSF about the status, so that the SSF can
control the call processing in the MSC.

8.3.2.3.2 VLR Functions

When a subscriber roams to the VLR area, the VLR stores TRIGADDLIST in the database as
subscriber data for use in call processing.

8.3.2.3.3 SSF
As the interface between the MSC and the SCF, the SSF can detect the control trigger of WIN services
and communicate with SCF, and it respond to the SCF’s request, permits the service logic in the SCF to
affect the call processing, and modifies the call and connection processing under the control of the SCF.

8.3.2.3.4 SRF
SRF provides various special resources and private special resources needed by the WIN service,
including the digital collecting equipment, tone generator, recorded announcement, etc. It has certain
logic and processing capabilities: receiving information from the subscriber, sending information to the
subscriber, or converting the information received from the subscriber, and able to manage the bearer
connection of private resources.

8.3.2.4 Services and Other Functions of ZXC10-SSP

In addition to the functions that the MSC and VLR should include, ZXC10-SSP can also provide well-
developed intelligent service functions including ordinary caller pre-paid charging (PPC) service. When
a PPC subscriber initiates a call as the calling party, the ZXC10-SSP implements trigger judgment, DP
mounting, DP detection, number analysis, routing, call status control and bill output.

8.3.2.4.1 Ordinary Called Pre-Paid Charging Service

When a PPC subscriber acts as the called party, and when a subscriber calls such a PPC subscriber, the
system implement trigger judgment, DP mounting, DP detection, call status control and bill output.

-245-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

8.3.2.4.2 Single Service of Pre-Paid Charging

The system supports the single pre-paid charging service function. A subscriber with the single service
authority can dial the single service activating operation code to implement the pre-paid charging
function of the current call.

8.3.2.4.3 External IP Function

The system allows other SCPs or SSPs to use its resources through standard MAP or TUP
operations to perform operations such as playback or recording.

8.3.2.4.4 Built-in SRF

With the switch own tone resource, the system can provide intelligent service SRF, and improve the
resource utilization through the built-in mode.

8.3.2.4.5 Standalone SSP Function

The system can provide large-capacity independent SSP functions by separating the software modules
and uninstalling MSC and VLR functions.

8.3.2.4.6 Pre-Paid Call Forwarding Function

It can implement call forwarding on unconditional, on-busy, no-replay and default.

8.3.2.4.7 Pre-Paid Multi-party Call Function

It supports PPC subscribers’ use of three-party calling and conference calling functions, and can
provide correct billing information.

8.3.2.4.8 Other Supplementary Service Functions

The system also permits PPC subscribers to use other CDMA supplementary services provided by the
mobile switching system.

VPN service: the system can provide the wireless virtual private network (WVPN) of the CDMA
network. With flexible VPN numbering modes, various control functions within and without the
WVPN and a variety of billing modes are implemented. In addition, it provides various telecom
services and supplementary services for WVPN subscribers.

Fault recovery function: when the SSP fails and gets restarted, the related SCP can be notified
about the failure time, so that the SCP will modifies related subscriber call records. In addition, if the
SCP signaling point is inaccessible, the system can store the call records of related IN subscribers, and
sends the stored subscriber’s records and corresponding billing data to the SCP when receiving the
failure recovery message sent from the SCP device.

-246-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

8.3.2.4.9 Other Intelligent Service Extended Functions

The system retains related service interfaces to facilitate intelligent extension, such as the future WVPN
services, AD services, free-phone etc., and new service extension.

8.3.3 Software Architecture of ZXC10-SSP

ZXC10-SSP inherits the software system of ZXC10-MSC/VLR. Therefore, for the detailed description
of the SSP software system, please refer to the description about ZXC10-MSC/VLR software system.
This section only describes the difference of intelligent services (mainly the prepaid service) from
MSC/VLR. In fact, the major difference in the software architecture between SSP and MSC/VLR lies
in the service processing sub-module. In view of this, the following first will give an overall
introduction to the SSP software architecture and then will detail the service processing sub-system.

8.3.3.1 Overall Description of Software System

The software system of intelligent services (mainly refer to pre-paid charging services) is described as
follows.

The SSF/CCF functions of intelligent services are mainly implemented by the OPCC process and
the GMSC process; the SRF (IP) function is mainly implemented by the SRF process; the MSC MAP
process provides supports to T1 interface (MSC-SCP), T3 interface (IP-SCP) and C interface (HLR-
MSC) after modification with IS-826.

The intelligent service-supporting SSF/CCF functions mainly include DP mounting, detection and
the interaction with the SCP. The SSF/CCF function is embedded into the OPCC/GMSC processes at
the message assignment level to control the DP mounting and detection and implement interaction with
the SCP. The WIN service processing process is shielded from the OPCC/GMSC processes, so as to
facilitate the independent programming of the two parts’ programs and eliminate the influence of WIN
service on ordinary call flows in terms of programs.

By means of MSC MAP, the SRF process supports all MAP operations with the SCP, which are
implemented in the form of independent IP. Apart from interfaces for local SSF/CCF, it also provides
interfaces for non-local SSF/CCF. In addition, SSF/CCF also provide supports to flows that use non-
local IP resources.

8.3.3.1.1 Triggering of Pre-Paid Charging (PPC)

Realization of the basic PPC service in embedded mode: when the PPC subscriber acts as the calling
party, the SSF/CCF function is implemented by the OPCC process of the originating office. When the
PPC subscriber acts as the called party, and if the calling party is PSTN, the SSF/CCF function is
implemented by the GMSC process of the location request initiating office. If the calling subscriber is a

-247-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

mobile subscriber, the SSF/CCF function is implemented by the OPCC process of the originating
office.

8.3.3.1.2 SSF/CCF Function Description

Before the messages sent by other processes to the OPCC/GMSC process enter the message processing
function, they should go through pre-processing by the SSF/CCF function, before it is decided based on
the processing result that the process goes further into the ordinary call processing flow or the ordinary
call processing flow is temporarily suspended, and the process returns.

Accordingly, the messages received by the OPCC/GMSC process can be divided into three
categories. The first category messages are messages irrelevant to PPC services, and in this case, the
SSF/CCF function performs no processing but instructs the program to continue execution through a
return value (CONTINUE); the second category messages are messages related to PPC but irrelevant to
ordinary call services. In this case, the SSF/CCF function, after corresponding processing, sends a
return value (BREAK) to instruct the program to stop processing and return directly to the upper level
invocation. The third category messages are the messages related to both PPC service and ordinary call
services. In this case, based on the processing result, the SSF/CCF function determines whether the
ordinary call flow is to be suspended (by returning BREAK) or to be continued (by returning
CONTINUE). As described above, the SSF/CCF function only processes messages that it is interested
in.

So, the SSF/CCF function only process the information that concerns it. The processing categories
include DP mounting, detection and interaction with SCP. The interaction with SCP relies on the
existing MSC MAP process to implement the support to the extended TIA/EIA-41E signaling. If the
SSP and MSC use different SSNs, a TM will be needed to send the message with the SSN being SSP to
the MSC MAP process as well when transferring messages upward.

8.3.3.1.3 Description of Extended SRF

In view that the IP may have different SSN from MSC, the TM needs to transfer the message with its
SSN being IP to MSC MAP, and the latter transfers the IP-related message to the SRF process.

For the same call, there are two kinds of relations between SRF and SSF/CCF in terms of network
distribution:

1. SRF and SSF/CCF are located in the same MSC. Upon receiving the SCP resource request
message, and confirming the resource availability, SRF will request for a TLDN at the VLR, and
carries it in the response message to the SCP, which is carries to the SSF/CCF by means of resource
message. The SSF/CCF analyzes this TLDN, and, if finding it assigned for the local office, it will carry
this TLDN to the VLR by means of internal messages. Based on the corresponding relation between the
TLDN and SRF index number established at the time of TLDN assignment, the VLR obtains the SRF
module number and index number and sends the initialization message to SRF, carrying the calling

-248-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

party information (module number + index number), and the latter initiates the establishment of the
connection to the SSF/CCF.

SRF and SSF/CCF are located in different MSCs. In this case, the TLDN assignment steps are the
same with 1), with the only difference in that the SSF/CCF establishes call connection to the office that
the SRF belongs to based on the TLDN analysis result. For the office to which the SRF belongs, when
the incoming-side GMSC receives this call, it sends a call-in request message to the VLR. The VLR
analysis this TLDN, and, if finding it assigned for the SRF, it will directly send the initialization
message to the SRF process, and the latter simulates the coordination between the TPCC process and
incoming semi-call to implement the call process, so as to establish the connection with the non-local
SSF/CCF.

8.3.3.2 Software System of the Service Processing Subsystem

The software module of the service processing subsystem is shown in Fig. 8-34.

The service processing subsystem includes CCF component, mobility processing component,
MAP component, SSF component and SRF component.

CCF
ISUP, etc. SSF
SRF
CC

MM MSC_MAP VLR_MAP

TCAP

SCCP

MTP

Fig. 8-34 Software composition of service subsystem

8.3.3.2.1 Call Control (CC) Component

The CCF component is a major processing component in the MSC. It is responsible for channel

-249-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

allocation, number analysis, routing, voice switching and connection of channels (including channels
among BSs or other MSCs or fixed PSTN), request and management of various voice resources etc. At
the same time, different signaling (such as CAS, TUP and ISUP, etc.) should be used to perform access
control depending on different users. When a user is engaged in the supplementary service operation or
switching occurs, the part is also responsible for calling the processing parts of the corresponding
supplementary services and switching the processing parts.

8.3.3.2.2 Mobility Management (MM) Components

The MM component is mainly responsible for the registration, de-registration, authentication and SSD
update of the mobile subscribers. The information of the mobile subscribers is mainly stored and
managed at VLR, therefore the mobility processing part of MSC only performs some initial processing
on these messages, before transferring them to VLR for processing.

8.3.3.2.3 MAP
The MAP component includes MAP service processing part and TM (transfer module) part. The service
part invokes the TC primitive through the TM, implements dialog between the MSC and the HLR or
another MSC by means of TCAP, and converts the TCAP dialog into internal message and transmits it
to the call processing module to complete the call connection. The TM module establishes
communications mainly between the MAP service processing part and the TCAP software,
implementing conversion and encoding/decoding between the two.

8.3.3.2.4 Service Switching Function (SSF) Component

The service switching function component (SSF) receives the MAP instruction from the SCF, controls
the MSC to complete calls and implement service switching function, and transfers the MAP
instructions between the SCF and the SRF.

8.3.3.2.5 Special Resource Function (SRF) Component

The SRF component controls various special resources, and provides the interaction function between
the network and terminal users by controlling such resources as DTMF number receiver, announcement
and voice processing etc.

8.4 ZXC10-MSC/VLR/SSP Function.

As mentioned previously, MSC is the switch that processes all the switching and signaling functions for
the users in the particular MSC area, and the kernel of CDMA mobile communication. VLR is the
database that performs management to the mobile users active in the current MSC area; SSP is the part
embedded into the MSC to connect WIN network and work for service switching. The following
paragraphs will first describe the general functions of ZXC10-MSC/VLR/SSP, and then present
detailed descriptions about the specific service functions of MSC/VLR/SSP.

-250-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

8.4.1 General Functional Description

8.4.1.1 MSC Functions

8.4.1.1.1 Call Connection Function

1. MSC is capable of host exchange call, outgoing call, incoming call and transit call functions; MSC
can implements call processing for the incoming and outgoing calls of the legal subscribers in the MSC
area and provide suitable services based on the contract with the subscribers.

2. MSC has the functions of gateway MSC (GMSC).

3. MSC has the special call processing function necessary for paging called mobile subscribers.

4. During toll connection, MSC can send the calling subscriber category and calling subscriber
number to the toll office. MSC can also send calling subscriber category and calling subscriber number
to other MSCs.

5. MSC can ensure calls to be protected from being cut-in or released by force by other calls.

6. MSC has the malicious call tracing function (limited to calls from MSC to fixed subscribers).

7. During connection, in the case of vacant number or unreachable subscriber, MSC will give
corresponding prompts (recorded voice announcement, subscriber ensured to hear once completely),
and a number-unobtainable tone can be given in the case of vacant number.

8. During automatic connection, if the called party is busy, MSC will not perform cut-in or forced
release, but it will immediately release the circuit and sends a busy tone to the caller.

9. MSC can establish 64 kb/s semi-permanent connection through man-machine commands.

10. MSC supports operation and maintenance call processing functions.

11. MSC has the function of accessing to various nearby special service stations.

12. MSC has subscriber international and domestic roaming restriction functions.

13. MSC can perform trunk call barring to subscribers.

14. MSC distinguish subscribers of different networks based on the “originating indicator” in the
subscriber service list, and determine to use which route based on the analysis of the number dialed by
the calling subscriber.

15. MSC has the capability of selecting a particular fixed network based on the inter-working

-251-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

protocol (such as dialing of different operator numbers).

8.4.1.1.2 Number Storage and Decoding Capability

1. Receiving and storing 24-digit numbers.

2. Number addition, deletion and translation.

3. Number forwarding: supporting package number forward and overlapping number forward.

4. It has the capability of processing numbers with variable lengths in the same area.

5. After GMSC receives the called subscriber’s DN, the system can inquire the corresponding
HLR based on this number to obtain the TLDN of the mobile subscriber.

8.4.1.1.3 Release Control Mode

1. Coordinating with the exchange of main control call release mode (PSTN), with the mobile
subscriber as called party.

2. Mobile users first end the call: Releasing the radio resources and sending the hookup signal to
the calling party.

3. The calling party hooks up or the originating office timer is timeout: Releasing the inter-office
trunk line.

4. Coordinating with the called party control special service center, if the mobile subscriber acts as
the caller and hooks on first, the wireless resources and inter-office trunk line are released.

When used as a transit office, MSC can immediately transfer the hook-on signal.

8.4.1.1.4 Time Monitoring and Forced Call Release

1. The switching device of MSC contains a time monitoring device, which monitors various connection
states. When the monitoring timeout is reached, it can immediately release the circuit by force and send
the busy tone (or instructions) to the related subscriber or establish corresponding connection in
accordance with various connection state requirements.

2. Outgoing calls to PSTN.

3. Answer (no response for a long time) time monitoring: Local calls (60 s); toll calls (90 s);
international calls (120 s);

4. Busy tone time monitoring: 40 seconds.

5. Incoming calls from PSTN.

-252-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

6. Without setting of supplementary services, the called subscriber timer timeout is 45 seconds.

7. At timeout, the call is directed to the announcement device in the system or a busy tone is given.

8. After the above-mentioned processing, the call can be released.

9. Change of digital transmission system.

10. If the transmission system interruption lasts less than 6 seconds, the MSC/VLR will not cause
call release.

11. If the transmission system interruption lasts over 12 seconds, an alarm will be given and the
voice channel will be released.

8.4.1.1.5 Routing Function

1. In the rated leading-out range, the trunk route quantity and circuit quantity of each channel: allocated
according to actual needs. They can be changed with the man-machine commands.

2. Requirements for the quantity of incoming/outgoing trunk circuit groups: A switching device
shall select at least 5 routes toward one destination office.

3. MSC can share the traffic volume of the circuits of the same level; the precision of traffic share
ratio is 1%, which meets the requirements the specifications.

4. The selection of each circuit group route can be performed based on the full availability.

5. Selection of inter-office circuits allows all circuits to have equal chances to be selected.

6. MSC has the function of direct routes and alternative routes.

7. MSC can satisfy the requirement of alternative routing once within the same level and can
prevent cyclic alternative routing.

8. During call establishment of MSC, if the call fails to be connected due to equipment trouble, the
switching device can perform repeated connection. MSC will send the congestion tone to the subscriber
only after twice or more failed reconnection attempts. The times of reconnection attempts can be
adjusted as required.

9. The system has the capability of determining routing after 6-digit called number. For a called
mobile subscriber, the route can be selected according to TLDN.

8.4.1.1.6 Echo Control

1. MSC contains an echo canceller.

-253-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

2. MSC can control the connection of the echo canceller.

3. MSC can instruct the follow-up switching office whether to connect the echo canceller.

8.4.1.1.7 Overload Control

1. Access overload control.

MSC can cooperate with BSS to prevent the occurrence of access overload. The realization mode
of processor overload control: Protecting the calls with conversations started and denying the calls in
the establishment stage.

Automatically restricting outgoing calls of ordinary subscriber level by level, with the restricted
subscribers evenly distributed among ordinary subscribers.

2. Internal overload control.

Overload control is performed according to the processor occupation rate. 6-level control is
provided and the controlling rate is adjusted with the man-machine command.

8.4.1.1.8 Mobility Management

1. Handoff function

The following handoff modes are supported:

♦ Various soft handoff modes within the same BSC;

♦ Soft handoff between different BSCs;

♦ Hard handoff between BSCs within the same MSC;

♦ Hard handoff between different MSCs.

Registration

The following registration types are supported:

♦ Power-on registration;

♦ Power-off registration;

♦ Timer-based registration;

♦ Distance-based registration;

-254-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

♦ Area-based registration;

♦ Parameter alteration registration;

♦ Service channel registration;

♦ Default registration.

MS Deactivation

When the MSC confirms that a registered MS is inactive for a long time, the MSC can internally
mark it as deactivated and notify the VLR.

8.4.1.1.9 Security Function

1. Authentication.

The MSC supports the subscriber authentication function, and the available authentication cases
include:

♦ Mobile station registration;

♦ Mobile call origination (MO);

♦ SSD updating authentication;

♦ Mobile call termination (MT);

♦ Data burst authentication;

♦ Unique challenge authentication.

The authentication algorithm is the authentication part in the CAVE algorithm.

2. Subscriber information enciphering

♦ Supporting the enciphering of the voice information and data information in BSS; and

♦ supporting different enciphering algorithms in BSS.

8.4.1.1.10 TLDN Allocation

1. Supporting TLDN allocation at each call; able to reallocate TLDN according to requirement.

2. Timely releasing the TLDN in case of failure during calling.

-255-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

8.4.1.1.11 Radio Resources Management

1. MSC can indicate to BSS the different types of wireless channels to be used during different
processing phases.

2. MSC can control the release of wireless channels.

8.4.1.1.12 Channel Management between BSC and MSC

1. The MSC takes charge of the allocation of the selected channels between the BSC and the MSC.

2. The MSC can receive from the BSS or send to the BSS blocked channel messages.

8.4.1.1.13 ESN Management

The MSC can perform management to the mobile station’s ESN. It can check the ESN at each call
establishment, registration and supplementary service operation. If the ESN is illegal, it refuses to
provide service.

8.4.1.1.14 DTMF Conversion

The system can work in coordination with the BSS for DTMF signal conversion.

8.4.1.1.15 Timeslot Paging

It supports timeslot-paging operations.

8.4.1.1.16 Queuing function

The MSC can support call (MO or MT) queuing in the BSS.

8.4.1.1.17 Air Activation

The MSC supports the air activation function.

8.4.1.2 Functions of VLR

8.4.1.2.1 Storage of User Data

Data saved in VLR includes:

1. IMSI/MIN (permanent);

2. DN (permanent);

3. ESN (permanent);

4. Type of the calling user(permanent);

-256-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

5. Mobile station grade flag (permanent);

6. Mobile station version protocol (permanent);

7. Time slot period index (temporary);

8. SSD-A (temporary);

9. SSD-B (temporary);

10. Call history counter (temporary);

11. List of services provided (temporary);

12. Information of services borne (permanent);

13. Information of user terminal service (permanent);

14. TLDN (temporary);

15. HLR number (permanent);

16. The base station identifier registered at the last time (temporary);

17. The type registered at the last time (temporary);

18. The time registered at the last time (temporary);

19. No-answer timer (temporary).

8.4.1.2.2 Subscriber Data Retrieval

During call establishment, subscriber information can be provided to the MSC according to the MIN or
TLDN.

8.4.1.2.3 Registration
1. When a mobile subscriber appears in a new location area, or when a registration, call establishment
or supplement service operation message is received from the mobile station, the system can send a
registration notification to the HLR.

2. It can implement registration, de-registration functions, and can search the subscriber information
from the HLR.

3. If a subscriber does not appear in the MSC/VLR area within 24 hours, the VLR can delete the data
related to this subscriber, and notify the HLR.

-257-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

8.4.1.2.4 MS Deactivation
When receiving a mobile station deactivated notification, the MSC can delete the data of this subscriber
and notify the corresponding HLR that this subscriber has been deactivated.

8.4.1.2.5 Authentication
1. When SSD is shared, the VLR can implement the authentication operation.

2. It can demand the authentication parameters from AUC and store them.

3. It can notify the HLR/AUC about the authentication result.

8.4.1.2.6 Providing TLDN

When an MS is called, the terminating VLR can allocate TLDN when requested by HLR and send the
TLDN to the requesting HLR.

8.4.1.2.7 VLR Restoration

When the VLR encounters data errors, the VLR can notify the corresponding HLR to delete the related
data.

8.4.1.3 Billing System Functions

8.4.1.3.1 Basic Billing Function

1. The original bills are generated through the mobile switching center (MSC).

2. Detailed call data records (CDR) are used as the original bills, and detailed bills are generated
for both the calling and called parties. The categories of bills include mobile calling party, mobile
called party, intra-network roaming, inter-network roaming, trunk bill, transit bill, supplementary
service, handoff bill, short message bill, etc.

3. The content of billing information is defined in reference to relevant GSM specifications, with
supplements.

4. The unique stop-and-wait answering mechanism is employed to implement the error-free, non-
repeated and loss-free transmission of original bills between the service main processing unit and
billing processing unit. If the transmission link between the main processing unit and the billing
processing unit fails, the service main processing unit provides temporary storage of bills, which can
hold 10-day bills under the circumstances of heavy traffic.

5. Billing files generated by means of the standard ASN.1 coding of the original bills defines the
ZTE-format ASN.1 bills.

-258-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

6. Provides billing information storage function. Adopting the billing handling unit based on the
Cluster and RAID techniques, the system ensures secure, reliable and large-capacity billing information
storage. In addition, multiple backup modes such as CD and magnetic tape are provided;

7. The system supports on-line billing, with the FTAM protocol adopted for transfer between the
system and the billing center. Based on the requirement of the billing center, it sends billing
information at fixed time or fixed length (bill length) to the billing center in real time. Multiple
protocols, such as X.25, TCP/IP etc. can be used as the bottom layer communication protocol with the
billing center.

8. It supports the off-line billing mode and different off-line devices, such as magnetic tape drives
of multiple models, MO drives, DVD-RAM drives etc.

9. The system can automatically delete bill files that have been backed up. Different types of bill
files, such as files being processed and not closed, generated and closed but not sent to the billing
center, already sent to the billing center, already backed up, are distinguished by means of the prefix or
suffix of the billing files. The billing files are renamed automatically by the program.

10. Gateway bills are provided for the CDMA wireless access system for incoming and outgoing
calls. The generation of such bills can be defined based on the actual requirement. Gateway bills
provide clear accounting basis for Internet transactions;

11. For calls that last longer than 30 minutes, intermediate billing records can be generated to
protect the operators’ interests. The intermediate records are generated at the time interval of 30
minutes, and the billing system can combine them into an integral record.

12. In the bill, the svCat member is added. It records the service mode of that conversation, e.g.
the local outgoing calls, toll incoming calls, etc. Specifically, User A from Place 1 and User B from
Place 3 come to Place 2 at the same time, and they make calls to each other. If the svCat item is not
provided and only the protocol requirement is met, relatively complicated comparison will be made
when settlement between A and B needs to be made. However, if svCat is added, whether to charge the
toll call fee for the conversation between A and B by simply judging the value of svCat. By means of
svCat, when subscribers call each other in the same city (no matter whether the subscribers are mobile
subscribers of the same city or roaming subscribers), their telephone charge accounting becomes very
simple, and this greatly eases the accounting work of the billing center.

8.4.1.3.2 Billing Management Functions

1. Safe management means are provided. Each operation is provided with authority protection,
and detailed operation log records are provided.

2. Billing system configuration options can be customized, including bill file fixed-length
generation setting (file length customizable) and timed generation setting (timing interval

-259-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

customization), bill file naming rule, bill directory, off-line and backup device type and drive letter,
automatic deletion interval etc.

3. Manual intervention of bill generation mode is available. The billing system can be forced to
close the current bill file by means of man-machine interface.

4. Powerful bill browsing function, which allows the user to browse all the bills within a period of
time, or a certain type of bills of a certain subscriber within the specified period of time.

5. Bill tracing function, which displays the original bills received by the billing processing unit on
the screen in real time, for the user’s analysis.

8.4.2 Mobility Management Services, Basic Call Services and Handover

Mobility management services include service registration/de-registration, mobile station deactivation

and authentication.

Basic call services include mobile calling calls, and mobile terminating calls.

Handover includes the soft handover and hard handover.

For more about the services and working flow of this section, please refer to the related contents
of the first edition.

8.4.3 ZXC10-MSC/VLR/SSP Related Services

The service functions that MSC/VLR/SSP can implement with the coordination of other functional
entities are listed in Table 8-2.

Table 8-2 Various service functions of MSC/VLR/SSP

Service type Service name
Mobile Telephone service
teleservices Emergency service
Fax service
Short Message Service (SMS)
Voice mailbox service
Supplementary Call Forwarding On Busy (CFB)

-260-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

Service type Service name

services Call Forwarding Unconditional (CFU)
Call Forwarding on No Replay (CFNR)
Call Forwarding – Default (CFD)
Calling Number Identification Presentation (CNI))
Calling Number Identification Restriction (CNIR)
Subscriber PIN Access (SPINA)
Subscriber PIN Interception (SPINI)
Password Call Acceptance (PCA)
Select calling access
Do-Not-Disturb service
Call waiting
Call transfer
Three-way calling
Message waiting notice
Voice message retrieval system (VMS)
Preferred language
Conference call
Remote feature control
IN services Pre-paid charging service
WVPN service
AD service
Free-phone service
SMS services Point-to-point short messages
Chinese short message
Global user broadcast
Cell broadcast
Value-added services: manual attendance console,
automatic attendance console, information desk,
EMAIL, WEB, securities, Super paging, mobile
bank
Two-way short message service between CDMA
and GSM

Among the above services, the teleservices and supplementary services are provided with the
cooperation of both ZXC10-MSC/VLR and ZXC10-HLR/AUC. The SMS service is implemented by
ZXSC100, ZXC10-MSC/VLR, ZXC10-HLR/AUC and extended short message entity. The intelligent
network services are implemented with the cooperation of ZXC10-MSC/VLR/SSP, ZXC10-SCP, and
ZXC10-HLR/AUC.

-261-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

The system design is suitable for the future communications development direction and satisfies
the requirements for the addition of various new services.

The following details the service functions in terms of the mobile telecommunication services,
data services, supplementary services, intelligent network services, etc.

8.4.3.1 Mobile telecom Services

In the CDMA mobile communication system, the most basic services that ZXC10-MSC/VLR/SSP
(V3.0) provides are mobile telecom services. This type of services includes telephone service,
emergency service, fax service, short message service and voice mail service. The following paragraphs
will first present a brief description of the mobile telecom services, and then will give a relatively
detailed description based on the processing process of the mobile telecom services.

8.4.3.1.1 Telecom Services

1. Telephone service

The telephone service is one of the telecom services defined by CDMA specifications, and it is the
service most widely used in the CDMA mobile communication system. The telephone service provides
the mobile subscribers the voice communication capability with other mobile subscribers in the CDMA
system or other subscribers in another telecom network (such as GSM, PSTN, ISDN etc.).

2. Emergency service

Emergency service permits mobile subscribers to initiate calls to the nearby emergency call center
(such as 110 police call). Emergency service is similar to telephone service but with relatively simpler
and faster call establishment. The CDMA mobile communication system has definitions for various
emergency calls, and, of course, the telecom operators can set the emergency call numbers based on the
actual situations in their own countries or regions. Emergency calls will be directed to the nearby
emergency call center in the mode of cell-oriented routing.

3. Fax service

Fax service refers to such a communication mode that the graphic and text information to be sent
is decomposed into a number of “pixels”, and then these pixels are converted into electrical current
signal, by means of which point-to-point transmission is implemented. The fax service provides the
mobile subscribers image and text information communication capability with other mobile subscribers
in the CDMA system or other subscribers in another telecom network (such as GSM, PSTN, ISDN etc.)

8.4.3.1.2 Short Message and Voice Mailbox Services

The contents of this section will be detailed in chapter 9.

-262-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

8.4.3.2 Supplementary Services

8.4.3.2.1 Description of Supplementary Services Supported by the System

This chapter will first present general explanations about the above-mentioned supplementary services,
followed by detailed descriptions on how to implement these supplementary services.

1. Call forwarding supplementary services

♦ CFU

When this supplementary service has been activated, all the incoming calls to this subscriber will
be unconditionally forwarded to a third-party subscriber registered by the called subscriber. The third
party here might be a mobile network, the public network, or the private network subscriber, or it might
be such an entity as the voice mailbox.

♦ CFB

With this service of a mobile subscriber activated, all incoming calls to this mobile subscriber
when the subscriber is busy will be forwarded to a third subscriber registered by this subscriber.

♦ CFNA

No response means that the called mobile subscriber does not hook off for a long time after the
MB rings. When the CFNA service has been activated, incoming calls of the subscriber will be
forwarded to a third party if the mobile subscriber does not answer.

♦ CFD

CFD service forwards the incoming calls of the mobile subscriber to a third-party subscriber when
the mobile subscriber fails to respond to paging, to answer the call or when he is unavailable (in a blind
area).

Call restriction supplementary services

Call restriction supplementary services include out-going call restriction and incoming call
restriction services.

Out-going call restriction supplementary services include:

♦ SPINA

When this service has been activated, the subscriber will not be able to make calls on this MS
unless he can provide the correct password (PIN).

-263-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

♦ SPINI

With this service activated, when the subscriber dials a number meeting the predefined conditions,
such as local call, national call, international call etc., the corresponding PIN code must be input before
the call can be continued.

Incoming call restriction services include:

♦ PCA

The PCA service provides a call filtering function. When the MS that has subscribed for this
service acts as the called party, the calling user must input the correct password before the call can be
accepted.

♦ Selective Call Acceptance (SCA)

The SCA service also provides a call filtering function. With this service activated, the subscriber
can accept only calls from the numbers specified in the SCA filtration list, and all other calls will be
rejected.

♦ Do-Not-Disturb (DND) service

When this service has been activated, the subscriber will be inaccessible to all incoming calls.

3. Supplementary services of number identification category

Number identification supplementary services include the following two types:

♦ Calling Number Identification Presentation (CNIP)

This service is a called-party-initiated service. If a subscriber has subscribed for the CNIP service,
he will receive the calling number at the same time when he receives an incoming call.

♦ CNIR

This is of calling initiating service, restricting the calling line identification representation for the
connected line.

4. Other supplementary services

♦ Call Waiting (CW)

With this service subscribed, when no channel is available for an incoming call, the called
subscriber will be notified of it and the call will be put on waiting. The called subscriber can decide

-264-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

whether to answer the call. Only one waiting call is acceptable at a time.

♦ CC

This service permits calling among multiple subscribers. With this service subscribed, the
subscriber can hold a telephone conference at any time as the controlling party. The controlling party
can add the number of the conference attendants by inputting telephone numbers one by one. This type
of communication is only suitable for voice communication. Each subscriber keeps his original identity,
and can get disconnected respectively or temporarily get disengaged from the group calling.

♦ CT

During a two-party calling, one of the subscribers can transfer the call to a third party and
disconnect himself, so that the other subscriber continues the conversation with the third subscriber.

♦ Three-Way Calling (3WC)

This service allows the telephone conversation among three parties.

♦ Preferential Language (PL)

By means of this service, a subscriber can select language suitable for him for voice prompt
through the network. Currently, two languages, Chinese and English, are provided for subscribers’
selection. In the future, other languages can be added based on the actual situation for subscribers’
selection.

♦ RSC

By means of this service, a subscriber can perform certain operations, such as call forwarding
services etc., on other terminals (fixed telephone set or mobile handset).

♦ Message waiting notification (MWN)

With the MWN service subscribed, when there is a voice message for an MWN subscriber, the
system will notify the subscriber.

♦ VMS

This service enables a subscriber to retrieve his own mailbox message from the voice mailbox
system. ANSI664 defines two operation methods. As the first method, the subscriber dials his own
number; as the second method, the subscriber dials a short number. The second method is
recommended by international standards to facilitate the subscriber’s usage.

-265-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

8.4.3.2.2 Implementation of Supplementary Services (SS)

1. Operations of supplementary services

The CDMA mobile communication system ZXC10-HLR/AUC supports various supplementary

services. It can implement seven operations of supplementary services: authorization, de-authorization,
registration, de-registration, activation, de-activation and invoking.

Authorization: an operation implemented by the service provider to make the service available to
the subscriber.

De-registration: contrary to authorization, it is an operation implemented by the service provider

to make the service unavailable to the subscriber

Registration: on operation implemented by the service provider or subscriber to make the service
executable. It mainly includes inputting necessary information.

De-registration: an operation implemented by the service provider or subscriber to delete the

information inputted at the time of registration.

Activation: to make the subscriber to enter the “Ready to provide service” status.

Deactivation: contrary to the activation operation, this operation cancels the subscriber’s entering
of the “Ready to provide service” status.

Invoking: the service execution process.

Note: The operations of supplementary service authorization, de-authorization and invoking are
implemented internally by the service programs jointly with the data base systems. Other operations are
implemented through the calling process, with the corresponding program units shown in Fig. 8-35.

SS registration unit

SS de-registration unit
SS
SS activation unit

SS de-activation unit

-266-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

Fig. 8-35 Program units of supplementary services

2. Additional functions for supplementary services

From the service approach, the CDMA system provides some additional functions for
supplementary services, thus making the usage of supplementary services more flexible and more
convenient.

♦ Courtesy Call

This is an additional function for call forwarding services. When a subscriber has activated the call
forwarding service and forwards a call to another subscriber, the subscriber should, by courtesy, notify
the destination subscriber and ask for his agreement. This process is courtesy call. When the subscriber
activates the call forwarding service, the CDMA system can automatically create a call to the
destination number based on the requirement, thus allowing the subscriber to query the destination
subscriber.

This additional function can be executed when the subscriber activates the CFB, CFD, CFNA and
CFU services.

In addition, at the time of call forwarding, the telecom operator can decide whether to execute the
courtesy call function by means of configuration in the HLR.

♦ Single service

During a call, a subscriber may hope to temporarily activate or de-activate a certain service, and
restore the service to the original status after he hooks on. For example, when a subscriber makes an
important telephone calls, in order to avoid disturbance, he usually de-activates the call waiting service,
and, upon completion of the call, he would re-activate the call waiting service. The CDMA system
allows the subscriber to activate or de-activate a certain service when dialing the number, and makes
the service to resume automatically to its original status after the subscriber hooks on.

This additional function can be used for single de-activation of CW, single activation of CNIR,
single de-activation of CNIR, single activation of MWN and single de-activation of MWN services.

8.4.3.3 Wireless Intelligent Network (WIN) service

8.4.3.3.1 Brief Description of WIN

The whole telecommunications network is developing towards the direction of intelligence, broadband

-267-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

and personality. The CDMA network is also going in this direction. Along with the rapid development
of the mobile communications market and the arrival of the information era, the subscribers require the
mobile service providers to provide a greater number of more convenient services. The basic services
and supplementary services that the CDMA mobile communication system could offer have become far
from satisfaction to mobile subscribers’ demand. In order to bring more profits to the service providers
and provide more convenient, flexible and cost-effective services, ZTE has duly rolled out WIN
services.

Wireless intelligent network (WIN) is a kind of network that introduces functional entities (such as
SSF, SCF etc.) to the wireless network to implement the intelligent control of wireless calls. It
completely separates services from controls, and therefore it can implement various telecom services
rapidly, conveniently, economically and flexibly. One of its distinct features is that it uses the
centralized service control points and database mode, without the need of modifying the software
system of every switch node, thus saving the time and investment and making it possible to provide
rapidly and cost-effectively new services to the subscribers.

8.4.3.3.2 Intelligent Services Provided by ZTE CDMA Mobile Communication System

Using the well developed CDMA mobile communication system hardware platform and by means of
embedding method, ZTE embedded the SSP in WIN into ZXC10-MSC/VLR, so as to facilitate the
service providers in networking and provide perfect WIN services to subscribers. The WIN services
currently implemented include:

1. Pre-Paid Call (PPC);

2. WVPN service

3. Advertisement service (AD);

4. Free-phone service.

CDMA WIN Phase II and Phase III services to be provided include:

1. AOC immediate charging;

2. Location-based services and charging;

3. Enhanced paging and routing services.

The system design is suitable for the future communications development direction and satisfies
the requirements for the addition of various new services.

-268-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

8.5 ZXC10-MSC/VLR/SSP Networking and Configuration

8.5.1 Networking Mode

ZXG10-MSC/VLR has powerful and flexible networking capability:

1. Forming small, medium, or large scaled wireless office according to the specific requirements
of the subscriber. With full modularized design, it is easy for expansion.

2. Processing TUP (PSTN), ISUP (ISDN) signaling. Therefore, it can interwork with the ISDN
and PSTN net.

The following is a description of the networking methods of ZXC10-MSC/VLR system.

8.5.1.1 Networking for Medium- and Small-Capacity Offices

Fig. 8-36 shows the networking mode.

OMM

48× 8M
MPM MPM

Fig. 8-36 Networking diagram with MPM as the central module

This networking mode is suitable for small and medium capacity switch offices, and can satisfy
the requirement for 120,000 subscribers. The system can be configured with one to two MSC
processing modules (MPMs), with each MPM providing the same processing capability with that of
single-module MPM, able to support 60,000 subscribers. OMM is the operation maintenance system.

-269-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

MPMs are connected with each other via optical fibers, and all MPMs provide interfaces for BSC,
PSTN and ISDN.

8.5.1.2 Networking for Large-Capacity Office

Fig. 8-37 shows the networking mode.

This networking mode is suitable for the exchange of large capacity, which meets the need of
600,000 subscribers. The system includes a CSM, 1 to 10 MSC MPMs, each MPM able to support
60,000 subscribers and provide interfaces to PSTN, private networks and BSCs. MPMs are connected
with the CSM via optical fibers; OMM is the operation maintenance module.

OMM

48× 8M
CSM MPM

48× 8M

48× 8M 48× 8M
MPM

MPM MPM

Fig. 8-37 CSM-centered networking diagram

8.5.2 System Configuration

8.5.2.1 MPM Configuration

An MPM rack contains 6 layers, and the MPMs use Layer 1 ~ Layer 6, which are as follows:

1. BNEN: for accommodating the switching network board, clock reference board,
synchronization clock board, optical interface board, switching network interface board and so on.

-270-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

2. BCTL: for accommodating the MP board, COMM board, SMEM board and MON board can be
inserted here.

3. Four BDT shelves: Each BDT shelf contains 16 effective slots, each of which can be installed
with a DTI, ECDT or ASIG. The ASIG board can be initialized as DTMF, MFC, TONE or multi-party
conference calling.

The standard arrangement of the MPM rack is shown in Fig. 8-38.

MPM

Layer 6 BDT

Layer 5 BDT

Layer 4 BCTL

Layer 3 BNEN

Layer 2 BDT

Layer 1 BDT

Fig. 8-38 Configuration of MPM rack

The board configuration on the rack in the typical MPM configuration is shown in Fig. 8-39.

1. The configurations of the 5th, 6th, 2nd, and 1st layers of DT are as follows:

In the fifth layer, Slots 15, 16, 18, 19, 21, 22, 24 and 25 are installed with the ASIG boards. The
DTI boards should be installed from the left to the right from Slot 13. Each DT board can be connected
with four PCM lines, 120 lines totally. If necessary, more DT boards can be installed in the sixth,
second and first layers. (DTI boards, ECDT boards and ASIG boards are collectively referred to as SP
boards).

-271-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

2. Configurations of the Fourth Layer – BCTL Layer:

COMM1 and COMM2 are a pair of mutual-assisting communication boards, which are used for
inter-module communication; COMM3 through COMM6 are two pairs of mutual-assisting
communication boards used for control of network board connection and the communication between
the MP and the first, second, fifth and sixth DTI layers (MP – SP) and between ECDT and ASIG.
COMM boards 7-12 are used for SS7 function, with each COMM board handling 16 SS7 links. Slot 26
is installed with a MON board.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
P D D D D D D D D D D D D D D D D P B
6 W T T T T T T T T T T T T T T T T W
D
R I I I I I I I I I I I I I I I I R
B
B T
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
P D D D D D D D D A A A A A A A A P B
W
5 R
T T T T T T T T S S S S S S S S W D
I I I I I I I I I I I I I I I I R
B T
G G G G G G G G B
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
P
W
S M M C
O
C
O
C
O
C
O
C
O
C
O
C
O
C
O
C
O
C
O
C
O
C
O
M P
W
B
M P P O
4 R
E
M M M M M M M M M M M M
N R C
M M M M M M M M M M M M
B
M 1 2 3 4 5 6 7 8 9 1 1 1
B T
0 1 2 L
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
P F F F F F F F F S S D D D D D D D D D D D D P B
3 W B B B B B B B B Y Y D D S S S S S S S S S S W N
R S S N N N N N N N N N N R
B
I I I I I I I I C C
N N E
K K I I I I I I I I I I B
C C 1 2 3 4 5 6 7 8
N
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
P D D D D D D D D D D D D D D D D P B
W T T T T T T T T T T T T T T T T W
2 R D
I I I I I I I I I I I I I I I I R
B
B
T
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
P D D D D D D D D D D D D D D D D P B
1 W T T T T T T T T T T T T T T T T W D
R
I I I I I I I I I I I I I I I I R
B T
B

Fig. 8-39 MPM rack board arrangement diagram

-272-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

3. Configuration of BNET boards:

DSNI C is an interface board of MP level, DSNIs 1-8 are interface boards of SP level (each pair of
DSNIs support 16 SP-level boards).

Slot 10 and Slot 12 are for the active/standby SYCK boards, Slots 15 and 16 are for the
active/standby network boards, and Slots 2 through 9 are for the active/standby FBI boards. For the
configuration of 60,000 subscribers, only three pairs of FBI boards are required, installed on Slots 2
through 7.

8.5.2.2 CSM Configuration

In the large-capacity office, CSM needs. CSM includes MSM and SNM. The rack layout is shown as in
Fig. 8-40.

CSM

Layer 7 BCTL（MSM）

Layer 6 BCTL（SNM）

Layer 5 BNET

Layer 4

Layer 3 Extractor fan

Layer 2 BCN

Layer 1 Extractor fan

Fig. 8-40 Layout of CSM rack

-273-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

Among them:

The rack has 7 layers. The boards are set up in layers 1, 3, 5 and 7. Layer 7 is the control layer for
the MSM, Layer 6 is the control layer of the SNM and Layer 5 is BNET layer. Layer 2 is the BCN
layer. Layers 1 and 3 are the fan layers.

1. Board configuration in the rack

The standard configuration of the boards on each layer of rack is shown as in Fig. 8-41.

♦ Configuration of layer 2 (network layer)

Slots 11 and 13 are used to install network boards (CDSN or CPSN); Slots 14 and 15 are used to
install the clock and drive (CKDR) boards; Slots 2-9 and 16-23 are used to install Central Fiber Board
of Interface (CFBI); Slots 1 and 24 are used to install power switch board (POWS).

♦ The fourth layer is not configured for the time being.

♦ The network layer (the fifth layer) has two synchronous clock boards installed as shown in the
figure. If needed, slot 3 can be used to install clock input (CKI).

♦ Configuration of layers 7 and 6 (BCTL)

-274-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
P S M M C C C C C C C C C C C C P
7 W M P P O O O O O O O O O O O O W M
R E M M M M M M M M M M M M
B M M M M M M M M M M M M M
R S
B
1 2 3 4 5 6 7 8 9 1 1 1 M
0 3 4
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
P S M M C C C C P M P S
W M P P O O O O E O W
6 R E M M M M P
N R N
B M M M M M D M
B
1 2 3 4
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
P C S S P
B
5 W K Y Y W N
R
B
I C C R E
B
K K T
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

3
CFM
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
P C C C C C C C C C C C C C C C C C C C C P
W F F F F F F F F D D K K F F F F F F F F W
B
R B B B B B B B B S S C C B B B B B B B B R
2 S I I I I I I I I N/ N/ D D I I I I I I I I S
C
C C N
P P
S S
N N
1
CFM

Fig. 8-41 MPM rack board arrangement diagram

1) Configuration of the controlling layer of MSM

MSM communications are all MPMP, instead of MP-SP. Each COMM can process the
communications between MSM and PSMs. The COMMs used for the communications with MPM are
inserted from the left to the right starting from slots 13 and 14. The COMMs in Slots 25 and 26 are
used for the communications with SNM.

Slots 5, 6, 7 and 9, 10, 11 are used to install the two active/standby module processors.

Slot 3 is used to insert the shared memory board.

2) Configuration of SNM control layer

There are a total of 2 pairs of COMM boards on the BCTL of SNM, COMM1 and COMM2 are

-275-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

used to communicate with MSM, and COMM3 and COMM4 are used to communicate with the S
network layer.

Slots 25 and 26 are for inserting the MON board.

Slots 5, 6, 7 and 9, 10, 11 are used to install the two active/standby module processors.

Slot 3 is used to insert the shared memory board.

8.5.3 Configuration of Operation and Maintenance System (OMS)

Generally, the OMS includes two parts: one is the OMC-S system maintenance part at the switching-
side (MSC/HLR/SSP, HLR/AUC and SC), and the other is OMC-R system maintenance part at the BS-
side (BSC and BTS) . As far as an operation and maintenance system is concerned, the two parts are
not strictly separated. In fact, from the point of view of the whole system, the entire CDMA mobile
communication system (including MSC/VLR/SSP, HLR/AUC, SC, BSC, BTS, etc.) should be
controlled by a high-efficient operation and maintenance system.

The following will present a detailed description about the equipment configuration of the OMC-S
part operation and maintenance system (Note: Fig. 8-42 only sketches the MSC/VLR/SSP and
HLR/AUC parts).

-276-
 Chapter 8 ZXC10-MSC/VLR/SSP(3.0)

Business
Billing OMC operation OMC
console
server console server

Ethernet Ethernet

Billing center

DCN

Ethernet Ethernet
TCP/IP TCP/IP
Billing
HLR
server Background
Operation &
Maintenance
Operation & server
console
maintenance console

No. 7 Agent
Application
server front-end
processor
HLR service
processor

Fig. 8-42 Schematic diagram of the operation and maintenance system structural framework

As shown in figure: MSC/VLR (including the SSP part inside) and HLR/AUC operation and
maintenance are composed of two parts: Local operation and maintenance (OMM) and centralized
Operation and Maintenance Center (OMC). OMC and OMM form an integral body to implement
management and maintenance to the CDMA system, and OMM and OMC are connected with each
other via the Data Communication Network (DCN). In fact, in the ZTE mobile communication system,
the switching-side network management should also include SC part network management, which is
not given in the diagram.

8.5.3.1 OMM Configuration

OMM mainly consists of the charging unit, application server, operation and maintenance console,
communication unit and printer.

-277-
Chapter 8 zxc10-MSC/VLR/SSP(3.0)

8.5.3.2 OMC Configuration

The OMC system adopts the Client/Server mode, and is composed of two servers, RAID, CLUSTER
software and workstations. The two servers work in active/standby mode, and the RAID adopts the
RAID5+1 image technology, thus ensuring the high reliability of the OMC system.

The two OMC servers work in the active/standby mode. They have their own system names and IP
addresses, but externally they provide the same virtual machine name and IP address, and provide
services to the outside in this way, with their own IP addresses becoming invalid in the host state and
the virtual IP address used. The system can detect the host system failures and network adapter
communication failures in real time. The system can monitor in real time faults in the active system and
communication faults in the network adapter and switch automatically for the other server to take over.

Exercise

1. Give brief description of the protocol standards of major functions of the CDMA cellular
mobile communication system network.

2. Give brief description of the major performance indices of ZXC10-MSC/VLR.

3. Give brief description of the software and hardware structures of ZXC10-MSC/VLR.

4. Give brief description of major service functions of ZXC10-MSC/VLR/SSP (V3.0).

5. Give brief description of the system structure and major functions of ZXC10-SSP.

6. Give brief description of the major functions and services of ZXC10-MSC/VLR/SSP.

7. Give brief description of the structure framework of the operation and maintenance system.

8. Give brief description of the networking configuration of 300,000 lines of ZXC10-

MSC/VLR/SSP.

-278-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

Chapter 9 ZXC10-HLR/AUC (V3.0)

9.1 Overview

9.1.1 Network Architecture Diagram of the CDMA Cellular Mobile

Communication System

The schematic diagram of the CDMA cellular mobile communication system is shown in Fig. 9-1.

MS MSC SCP
SCP PSTN
ISDN
Um E PSPDN

Abis A B
BTS BSC MSC/SSP VLR

Q C D G

M N
SC SC HLR VLR

M N
M
SME SME
AUC

Fig. 9-1 Network architecture of the CDMA cellular mobile communications system

The meanings of all parts in Fig. 9-1 are as shown in Table 9-1.

-279-
Chapter 9 ZXC10-HLR/AUC (V3.0)

Table 9-1 Meanings of all parts in Fig. 9-1

Abbreviation Full name

AUC Authentication Center
BS Base Station
BSC Base Station Controller
BTS Base Transceiver Station
HLR Home Location Register
ISDN Integrated Service Digital Network
MS Mobile Station
MSC Mobile Switching Center
PSPDN Packet Service Public Digital Network
PSTN Public Switched Telephone Network
SMC Short Message Center
SME Short Message Entity
SSP Service Switching Point
VLR Visitor Location Register

9.1.2 Major Interfaces between Entities

9.1.2.1 Interface between MSC and BSS (A interface)

It actually is the interface between MSC and BSC with the 2 Mbps PCM digital link and standard
protocols as IS-634, IOS2.4 and IOS4.0. IOS2.4 is the protocol standard for IS95, while IOS4.0,
compatible to IS95, is the protocol standard for IS2000.

A interface is mainly used to transmit the following information:

1. BSS management information;

2. Call processing;

3. Mobility management information.

-280-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

9.1.2.2 Interface between MSC and VLR (B interface)

As an internal interface, the interface has no standard definition. Its functions are described as
follows:

VLR is the location and management database of subscribers who roam to the related MSC
region. When MSC needs the subscriber data of the particular MSC area, MSC is to inquire the
VLR. In the case of mobile station location updating, the MSC will request VLR to store the
related information. When the user activates the supplementary services or modifies data, the
MSC will request the HLR (through VLR) to store the related data.

9.1.2.3 Interface between MSC and HLR (C interface)

Interface between MSC and HLR.

The IS-41E protocol is adopted in the system. This interface is based on 2 Mbps digital
interface or 64Kbps interface, with its interface electrical performance conforming to Chapter 7 in
Volume 1 Digital SPC Switching Equipment General Technical Specifications in GF002-9002.1
The General Technical Specifications for Telephone Switching Equipment of the Ministry of Posts
and Telecommunications and GB7611-87 Pulse Coding Modulation Communication System
Network Digital Interface Parameters. As for the signaling specifications, for detailed description
of MAP, refer to Technical Requirements for 800MHz CDMA Digital Cellular Mobile
Communication Network Mobile Application Part (MAP). For detailed description of SCCP, refer
to GF010-95 Technical Requirements for National SS7 Mode Technical Specifications Signaling
Connection Control Part (SCCP). For detailed description of MTP, refer to GF001-9001 China
Telephone Network SS7 Mode Technical Specifications.

The 24-bit SS7 mode is adopted in C-interface.

9.1.2.4 Interface between VLR and HLR (D interface)

The IS-41E protocol is adopted in the system. This interface is based on 2 Mbps digital interface
or 64Kbps interface, with its interface electrical performance conforming to Chapter 7 in Volume
1 Digital SPC Switching Equipment General Technical Specifications in GF002-9002.1 The
General Technical Specifications for Telephone Switching Equipment of the Ministry of Posts and
Telecommunications and GB761187 Pulse Coding Modulation Communication System Network
Digital Interface Parameters. As for the signaling specifications, for detailed description of MAP,
refer to Technical Requirements for 800MHz CDMA Digital Cellular Mobile Communication
Network Mobile Application Part (MAP). For detailed description of SCCP, refer to GF010-95
Technical Requirements for National SS7 Mode Technical Specifications Signaling Connection
Control Part (SCCP). For detailed description of MTP, refer to GF001-9001 China Telephone
Network SS7 Mode Technical Specifications.

-281-
Chapter 9 ZXC10-HLR/AUC (V3.0)

The 24-bit SS7 mode is adopted in D interface. Its functions are described as follows:

The interface is used to switch subscriber location information, approval information and
service data. The major service function of MS is the capability of initiating and receiving calls
within the service area. To support the capability, HLR switches the data, VLR notifies the HLR of
the subscriber location information, and provides the subscriber roaming numbers during calls.
HLR sends the subscriber’s service data that VLR needs. The data exchange normally takes place
when a subscriber requests a supplementary service and when a subscriber or network operator
changes the subscriber data.

9.1.2.5 Interface between MSC and MSC (E interface)

Interface between MSC and MSC

The IS-41E protocol is adopted in the system. This interface is based on 2 Mbps digital
interface or 64Kbps interface, with its interface electrical performance conforming to Chapter 7 in
Volume 1 Digital SPC Switching Equipment General Technical Specifications in GF002-9002.1
The General Technical Specifications for Telephone Switching Equipment of the Ministry of Posts
and Telecommunications and GB761187 Pulse Coding Modulation Communication System
Network Digital Interface Parameters. As for the signaling specifications, for detailed description
of MAP, refer to Technical Requirements for 800 MHz CDMA Digital Cellular Mobile
Communication Network Mobile Application Part (MAP). For detailed description of SCCP, refer
to GF010-95 Technical Requirements for National SS7 Mode Technical Specifications Signaling
Connection Control Part (SCCP). For detailed description of MTP, refer to GF0019001 China
Telephone Network SS7 Mode Technical Specifications.

The 24-bit SS7 mode is adopted in E interface. Its functions are described as follows:

When a mobile station roams from one MSC to another, the MSC will perform handoff in
order to keep the subscribers’ conversation uninterrupted. In this case data switching must be
implemented between the MSCs.

9.1.2.6 Interface between MSC and EIR (F interface)

This interface has no standard definition. Its functions are described as follows:

When the MS is in communication, and the MSC authenticates the MS, it has to inquire the
EIR, so as to determine whether the MS is legal, and thus deciding whether to provide services to
this MS.

-282-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

9.1.2.7 Interface between HLR and AUC (H interface)

Currently an internal interface is used. Its functions are described as follows:

When receiving an authentication request from MS, HLR obtains data from AUC. When
AUC originates authentication commands to MS, AUC delivers authentication information to
subscribers via HLR.

9.1.2.8 Interface between SMC and SME and between SMCs (M interface)
Currently the SMPP phase III standard is used. Its functions are described as follows:

When the SMC performs information interaction with the SME and other SMCs, this
protocol must be abided by.

9.1.2.9 Interface between HLR and SMC (N interface)

ANSI-41E is employed for the interface standard. Its functions are described as follows:

When the SMC sends a short message to a subscriber, and there is no address information of
the called subscriber, it is necessary to inquire about the route of the subscriber to the HLR, after
which can the short message be sent to the subscriber.

9.1.2.10 Interface between SMC and MSC (Q interface)

ANSI-41E is employed for the interface standard. Its functions are described as follows:

During the submission and reception of a short message, short message transfer needs to be
conducted between SMC and MSC. At the same time, when the subscriber’s short message
capability changes, MSC needs to notify SMC in time.

9.1.2.11 Interface between MSC and OMC

The interface is in compliance with the network structure requirements of TMN, and the standard
Q3 interface is provided to the upper-level TMN.

9.1.2.12 Interface with PSTN/ISDN (Ai/Di interface)

The CDMA digital cellular mobile network interworks with PSTN/ISDN via the MSC, and
provides subscribers with voice, data and some supplementary services. Its interfaces are
2048kbps-based digital interfaces. The interface protocols takes TUP and ISUP of SS7 as the

-283-
Chapter 9 ZXC10-HLR/AUC (V3.0)

priority. Where conditions are not available, R2 signaling can be used.

9.1.2.13 Interface with other PLMNs

The CDMA digital cellular mobile networks interconnect with different PLMNs (e.g. GSM) via
some other public networks (e.g., PSTN and ISDN), or directly interconnect with other PLMNs.
The protocols employed can be TUP, ISUP, or R2 signaling.

9.1.2.14 Interface with PSPDN

IS-658 protocols are employed for upper layer interface, while X.25 or TCP/IP is employed for the
bottom layer. This interface is based on 2 Mbps digital interface or 64Kbps interface, with its
interface electrical performance conforming to Chapter 7 in Volume 1 Digital SPC Switching
Equipment General Technical Specifications of GF002-9002.1 The General Technical
Specifications for Telephone Switching Equipment of the Ministry of Posts and
Telecommunications and GB761187 Pulse Coding Modulation Communication System Network
Digital Interface Parameters. For details of signaling specifications, refer to The Technical
Requirements for Interface between CDMA Digital Cellular Mobile Communication Network
MSC and PSTN network.

9.1.3 Technical Standards

The ZXC10-HLR/AUC (V3.0), the CDMA cellular mobile communication system of ZTE,
supports the following protocols and standards:

1. GB3047.1~82 Series of Basic Dimensions of Boards, Racks and Frames

2. GB191-90 Graphic Labels for Packing, Storage and Transportation

3. GB4798.3-90 Fixed Usage of Electric and Electronic Products in Climate-protecting

Environment

4. GB2423.1~4-81 Basic Environment Testing Procedure for Electric and Electronic Products
5. GF018-95 Public Telephone Network Automatic Telephone Numbering

6. YDN 065-1997 General Technical Specifications of Telephony Switching Equipment Issued

by the Ministry of Posts and Telecommunications

7. YDN065-1997 The General Technical Specifications for Telephony Switching Equipment

Issued by the Ministry of Posts and Telecommunications

-284-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

8. GB7611-87 Pulse Coding Modulation Communication System Network Digital Interface

Parameters

9. YD/T627-93 Digital Switch Trunk Interface (2048kbps) Parameters and Transmission

Features between Digital Interfaces and Testing Methods

10. YDN China Telephone Network Channel Associated Signaling Mode Technical
Specifications

11. GF001-9001 Chinese National Telephony Network SS7 Technical Specifications

12. YDN 068-1997 National SS7 Signaling Technical Specifications — Message Transfer
Part (MTP)

13. GF010-95 National SS7 Technical Specifications — Signaling Connection Control Part
(SCCP)

14. YDN 043-1997 Digital Cellular Mobile Communication Network SS7 ISUP Technical
Specifications

15. YDN 066-1997 National SS7 Technical Specifications—Operation and Management

Application Part (OMAP)

16. YD/T 1031-1999 800MHz CDMA Digital Cellular Mobile Communications Network
Signaling System Mobile Application Part (MAP) Technical Specifications

17. YDN 094-1997 800MHz CDMA Digital Cellular Mobile Communication Network MSC-
PSTN Interface Technical Requirements

18. YDN044-1997 800MHz CDMA Digital Cellular Mobile Communication Network

Technical Mechanism

19. YD/T 1048-2000 General Technical Specifications for 800MHz CDMA Digital Cellular
Mobile Communication System Equipment: Switching Subsystem Part

20. YD/T 1026-1999 800MHz CDMA Digital Cellular Mobile Communication Network
MSC-Base Station Subsystem Interface Technical Specifications

21. YD/T 1026-1999 800MHz CDMA Digital Cellular Mobile Communication Network
MSC-Base Station Subsystem Interface Testing Technical Specifications

22. YD/T xxxx-xxxx 800MHz CDMA Cellular Mobile Communication System WIN Phase 1:
Interface Technical requirements

23. YD/T 1049-1999 General Testing Specifications for 800MHz CDMA Digital Cellular

-285-
Chapter 9 ZXC10-HLR/AUC (V3.0)

Mobile Communication System: Switching Subsystem Part

24. YD/T 1052-1999 800MHz CDMA Digital Cellular Mobile Communications Network
Testing Technical Specifications Mobile Application Part (MAP)

25 YD/T xxxx-xxxx 800MHZ CDMA Digital Cellular Mobile Communication Network WIN
Phase 1: Technical Requirements

26. YD/T xxxx-xxxx 800MHz CDMA Digital Cellular Mobile Communication Network WIN
Phase 1: SSP Equipment Technical Specifications

27. YD/T xxxx-xxxx 800MHZ CDMA Digital Cellular Mobile Communication Network WIN
Prepaid Service Technical Requirements

28. 800MHz CDMA WIN SSP Equipment Testing Specifications

29. 800MHz CDMA WIN Phase 1: Prepaid Service Testing Specifications

30. ANSI T1.114-1992 Signaling System NO.7(SS7)-Transaction Capabilities Application

Part (TCAP)

31. TIA/EIA/IS-41E Cellular Radio-Telecommunications Intersystem Operations

32. TIA/EIA/PN-4117 International Implementation of Wireless Telecommunication Systems

Compliant with TIA/EIA-41

33. N.S0018/TIA/EIA/PN4287 Wireless Intelligent Network Capabilities for Pre-paid

Charging

34. IS-807 ,TIA/EIA-41-D Enhancements for Internationalization

35. IS-751, TIA/EIA-41-D Modifications to Support IMSI

36. IS-771 Wireless Intelligent Network

37. IS-826 Wireless Intelligent Network Capabilities for Pre-paid Charging

38. TIA/EIA/IS-637 Short Message Services for Wideband Spread Spectrum Cellular Systems

39. TIA/EIA/IS-841 Network Support for MDN_Based Message Centers

40. TIA/EIA/IS-824 Generic Broadcast Teleservice Transport Capability

-286-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

9.2 ZXC10-HLR/AUC Indices

9.2.1 Technical Indices

9.2.1.1 HLR technical standards

System capacity: 1,200,000 subscribers;

Reference load:

Call handling: 0.5 handling/subscriber in busy hours;

Mobility management: 2 handling/subscriber in busy hours;

Number of SS7 links: 32 for single modules and 192 for multiple modules;

Message loss probability: P ≤ 10-7;

Information retrieval delay: ≤ 1000 ms (95% probability);

Registration delay: ≤ 2000 ms (95% probability);

9.2.1.2 AUC technical indices

System capacity: Support the capability of storing and processing subscriber security parameters
with a full load of HLR;

Algorithm: CAVE (Cellular Authentication and Voice Encryption Algorithm) and other
algorithms required by operators are supported;

Message loss probability: P ≤ 10-7;

Information retrieval delay: ≤ 2000 ms (95% probability);

When a new subscriber data is added to AUC or an old subscriber data is modified, the time
delay for processing input data ≤ 1000 ms (95% probability)

9.2.1.3 Transmission indices

Error performance: The average long-term Bit Error Rate (BER) is better than 1 × 10-9;

-287-
Chapter 9 ZXC10-HLR/AUC (V3.0)

Bit integrity: Keep bit integrity;

Bit sequence independence: In the 64kbps channel, there is not forced restriction on the
number of the continuously transmitted binary “1s”or “0s”or any other binary code pattern;

Absolute group delay:

Mean value: 900 μs;

The value within 95% probability: 1500 μs.

9.2.1.4 Synchronization indices

Synchronous clock: Stratum-2 clock class A;

Minimum precision of the clock: ± 4 × 10-7;

Traction range: ± 4 × 10-7;

Maximum frequency offset: 10-9/day;

Initial maximum frequency offset: 5 × 10-10;

Clock work mode: Fast capture, tracing, holding, free running.

Clock synchronous link interface requirements:

Incoming end signal jitter and wander: ≥ 1.5UI, 20~2400 Hz

Outgoing end signal jitter and wander: ≤ 1.5UI, 20~10000 Hz

≤0.2UI, 18000~100000 Hz

1UI=488 μs

9.2.1.5 Reliability indices

MTBF of the ZXG10-HLR/AUC > 10 years

Interruption of each user is not more than 30 min per year. For interruption of two users at the
same time, the upper limit is 10 minutes per year, and interruption of the whole system, it is 6
minutes per year.

-288-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

9.2.2 Rack Parameters

The following shows the parameters related to the racks of the parts of the ZXC10-HLR/AUC
(including the SM signaling gateway, the service server and the database):

9.2.2.1 CPM
The parameters of the rack are as follows:

Dimensions: 2,000 mm × 810 mm × 600 mm (height × width × thickness). A cap needs to be

added when the upper wiring mode is used, with a height of 2200mm, and a width of 870 mm
when side plates are attached);

Weight: < 250 kg;

Power supply: －48 VDC, allowable range: －57 V ~ －40 V;

Power consumption: ≤ 170 W for single shelf, 120 W/single shelf for multi-shelves.

The CPM rack is shown in Fig. 9-2.

Fig. 9-2 CPM rack

9.2.2.2 Service processor

The parameters of the rack are as follows:

-289-
Chapter 9 ZXC10-HLR/AUC (V3.0)

Dimensions: 2,000 mm× 600 mm × 600 mm (height × width × depth), the height shall be
2,200 mm with the base;

Weight: < 300 kg;

Power supply: 220 VAC ± 10%, 50 Hz ± 5%;

Power consumption: ≤ 1,500 W.

The service processor rack is shown in Fig. 9-3.

Fig. 9-3 Service processor rack

9.2.2.3 Database
The database consists of servers and a disk chassis, which can be installed in a rack, or placed
separately. The rack parameters are as follows:

Dimensions: 2,000 mm × 600 mm × 900 mm (height × width × thickness);

Weight: < 350 kg;

Power supply: 220 VAC ± 10%, 50 Hz ± 5%;

Power consumption: ≤ 1,500 W.

-290-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

The database rack is shown in Fig. 9-4.

Fig. 9-4 Rack arrangement of the database

9.3 ZXC10-HLR/AUC System Hardware Structure

Home Location Register (HLR) is a central database used for storage of such subscriber
information as ESN, MDN, IMSI, MIN, service item information, current location and approved
validity period.

Authentication Center (AUC) is a functional entity managing the authentication information

related to the mobile station. AUC can be combined with or separated from HLR. When
combined, the H interface turns into the internal interface.

In the CDMA HLR/AUC products developed by ZTE, the ZXC10-HLR/AUC system, HLR
and AUC are combined in the structure, with full design considerations for the high reliability,
usability and data consistence of the system. Furthermore, the flexible multi-level and multi-
module structure is employed for the convenience of expansion.

-291-
Chapter 9 ZXC10-HLR/AUC (V3.0)

9.3.1 System Overview

HLR/AUC functions as the central data processing center in the CDMA mobile communication
system, mainly processing subscriber services, managing subscriber data, exchanging messages
via SS7 with other functional entities, as well as implementing system maintenance and service
handling. The system structure of the ZXC10-HLR/AUC is as shown in Fig. 9-5.

Operation & maintenance module

Common
signaling process Operation & Service handling Local operation &
module maintenance console maintenance
server console

Ethernet

HLR service Database module Router

processing module
module
DDN/FR/X.25/
PSTN

Remote operation & Remote service Network

maintenance console handling console management center

Fig. 9-5 ZXC10-HLR/AUC structure

The ZXC10-HLR/AUC system of CDMA mobile communication system mainly consists of

the Common Signaling Process Module (CPM), HLR Digital Processing Module (HDM,
constituting the database), HLR Service Processing Module (HSM), and Operation &
Maintenance Module (OMM). Various modules are connected via Ethernet and communicate
based on TCP/IP, and the dual-network connection is employed to ensure reliability. Described
below are the functions and structure of respective module:

9.3.1.1 CPM
CPM, mainly performing SS7 processing, consists of one or multiple SS7 front-end processor
(CPM) modules, serving as the interface between HLR/AUC and other functional entities. The
CPM hardware is based on the switching platform of ZTE large-scale digital SPC switch ZXJ10
(V.10.0). Each CPM can provide 32 SS7 links, and the number of CPMs can be flexibly
configured as required.

-292-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

9.3.1.2 Service processing module

The service processing module is in the multi-module load sharing mode, and it is composed of
one or more HLR Service Processing Modules (HSMs). The number of HSMs can be flexibly
configured as required by the subscriber capacity. Multiple HSMs execute service processing in
parallel and share load. If any of the HSMs fails, its task will be shared by the others on an equal
basis.

The HSM is designed with a high-performance processor, chiefly processing the mobility
management service. Meanwhile, it accesses the database in real time, and performes signaling
interaction via CPM with other functional entities.

9.3.1.3 Database
The database consists of one or more HDMs. It is designed in the distributed storage mode, to
divide the subscriber data according to scopes into different segments. Different segments are
stored in different HDMs.

Each HDM consists of two servers and one disk array. The Cluster technology is employed to
enhance the system reliability, and data are saved in the mirror mode.

The database supports multiple operating systems (such as Windows and UNIX). Large
commercial database systems like Oracle, Sybase, Informix or Microsoft SQL Server can be
selected as the database. The operating system and database system may be selected as required by
the user, with Windows and Microsoft SQL Server database recommended.

9.3.1.4 OMM
OMM includes the Operation & Maintenance Server (OMM Server), and the service handling
console and the maintenance console connected to the OMM Server. The service handling console
and the maintenance console provide the man-machine operation platform. Operators can obtain
running information of the HLR/AUC system through the maintenance console to detect and
remove faults, or perform subscriber management through the service handling console. In
addition, the operator can also implement remote services handling, operation and maintenance
via routers.

OMM is connected to the Network Management Center (NMC) in X.25, DDN, E1 or other
mode.

-293-
Chapter 9 ZXC10-HLR/AUC (V3.0)

9.3.2 Module Functions

In terms of functionality, the ZXC10-HLR/AUC falls into the following logic functional modules:

 Common cannel signaling module

 MAP signaling module

 Data storage and management module

 AUC service module

 OMM

9.3.2.1 Common channel signaling function

The common channel signaling module mainly processes the SS7 Message Transfer Part, (MTP),
SS7 Connection Control Part (SCCP), SS7 Transaction Application Part (TCAP) and SS7
Operation & Maintenance Application Part (OMAP).

9.3.2.2 MAP signaling function

It mainly processes mobility management service, call service, supplementary service, short
message service, operation & maintenance and other aspects.

9.3.2.3 Data storage management function

It mainly stores such data as subscriber basic information, subscriber supplementary service
information, and security information.

9.3.2.4 AUC service function

It mainly implements subscriber authentication.

9.3.2.5 Service handling function

Service handling includes multiple functions, which are summarized as follows: single or batch
subscriber account(s) establishment, mobile subscriber query, mobile subscriber information
modification, mobile subscriber information deletion, number (phone number) change of mobile
phones, batch subscriber information processing and statistics, subscriber information printing,
help information, etc.

-294-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

9.3.2.6 Operation & maintenance functions

Operation & maintenance mainly implements the following functions:

1. Local operation & maintenance;

2. Storing, querying, and modifying operation & maintenance data.

3. Functions of the remote operation & maintenance console;

4. Communicating with the superior NM.

9.3.3 Hardware Structure

9.3.3.1 Basic structure of the ZXC10-HLR/AUC of CDMA mobile communication system

As described in Section 2.3.1, the ZXC10-HLR/AUC of the CDMA mobile communication
system mainly consists of four parts: CPM, HSM, HDM and OMM. Modular design is employed
internally at each level, as shown in Fig. 9-6.

HLR/AUC
OMM
OMM Operation Service
maintenance handling
HLR service Databas e Server console console
processing module
module module

TCP/IP communication network (dual-network)

CPM

SS7 link

PLMN

Fig. 9-6 Hardware structure the ZXC10-HLR/AUC of the CDMA mobile communication
system

-295-
Chapter 9 ZXC10-HLR/AUC (V3.0)

Here:

CPM: It is also known as the SS7 front-end processor or signaling process front-end
processor.

OMM server: Operation & Maintenance Server

The multi-level modularized design facilitates installation and expansion of the whole
system. The following respectively introduces each component of the system.

9.3.3.2 CPM
The CPM hardware design is based on the compact platform of ZTE large-scale digital SPC
switch ZXJ10 (V10.0), employing the fully distributed structure. Varying with the system capacity,
CPM can consist of 1~6 SS7 front-end processors. The SS7 front-end processor is the SS7 process
module of the ZXC10-HLR/AUC, which provides the SS7 link connection with MSC, performs
MTP, SCCP, and TCAP functions of SS7, and provides an interface with the service processor.
The hardware structure of the SS7 front-end processor is as shown in Fig. 9-7.

As shown in Fig. 9-7, the SS7 front-end processor consists of the following basic units:

Digital Trunk Unit (DTU), which includes:

Digital Trunk Interface (DTI)

Control Unit (CTLU), which includes:

Module Processor (MP) sub-unit

Communication Board (COMM board)

Peripheral Environment Parameter Detection (PEPD) sub-unit

-296-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

交换单元
8K× 8K
（ DSN）
DT 8Mb/s
TNET
4K×4K
Sy nchronous switching
network

NO.7 2Mb/s

256Kb/s

COMM COMM

MP0 MP1

Fig. 9-7 Hardware structure of SS7 front-end processor

Monitor Board (MON) sub-unit

The digital switching network unit Network Unit (NETU) (“T network unit” for short),
includes:

Timed & Network (TNET)

POWER B: power supply, supplying power for each unit

Set out below is a brief introduction to the hardware structure of each unit in the SS7 front-
end processor.

9.3.3.2.1 DTU
DTU is the interface unit between the mobile switching systems. It multiplexes the 32-channel
64kbps channel signals and signaling into 2048 kbps signals according to the PCM TDM
principle, so as to perform switching connection processing in the system.

The digital trunk is the interface device between the digital SPC switches or the digital
transmission devices. Its functions mainly include:

1. Line signal code pattern receiving, sending and converting: It converts the input high
density bipolar excess three code (HDB3) or AMI code into an internal NRZ code so as to access

-297-
Chapter 9 ZXC10-HLR/AUC (V3.0)

TNET. At the same time, it converts the internal NRZ code into HDB3 code or AMI code and
sends it to the transmission line.

2. Extracting of the frame synchronization clock: Namely, it identifies and extracts the
external reference clock from the input PCM code flow, and sends it to the synchronous timing
circuit. The clock is used as the local frame synchronization parameter clock, ensuring
synchronization with the incoming office.

3. Frame synchronization and multi-frame synchronization: Based on the extracted

synchronization reference, i.e., frame alignment signal, it implements frame or multi-frame
synchronization adjustment and avoids the out of step caused by delay.

4. It inserts and extracts signaling via TS16 to receive/send signaling.

5. Alarm checking: It checks the transmission quality, such as error code rate, slip code
metering, out of frame, out of multi-frame, and trunk signal loss. Furthermore, it informs the
maintenance equipment of the detected fault signals and associated channel disconnection alarm
signals for manual processing.

Message exchanging between the trunk sub-unit CPU and the MP processing unit chiefly
means the transfer of service information and fault information.

To implement the above-mentioned service functions, and provide a seamless interface with
the switching network layer, DTU is composed of the following functional modules: digital trunk
interface circuit, code rate conversion unit, control circuit, etc. Its schematic diagram is as shown
in Fig. 9-8.

8MHzHW to TNET
2MHzHW*4
interface unit
Digital trunk

switching unit
Code rate

Control circuit

Fig. 9-8 Schematic diagram of DTU

Each functional module is respectively introduced in the following.

-298-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

9.3.3.2.2 Digital trunk interface circuit

The interface circuit provides the following functions:

1. 2 Mbps PCM code flow input/output and HDB3/AMI code conversion;

2. It works in the associated channel signaling/common channel signaling mode;

3. It supports the mobile communication of ISDN PRI subscribers;

4. The internal digital phase lock loop enables the synchronous clock to work in three modes:
external reference synchronization, synchronization of frame synchronization signals and free
oscillation.

5. It offers the self-loop test function.

9.3.3.2.3 Code rate switching circuit

The switching unit mainly implements the following functions:

1. It multiplexes the four 2 Mbps PCM lines on a DTI board into an 8 Mbps PCM line
leading to a plane of TNET, realizing the connection. At the same time, it de-multiplexes an 8
Mbps PCM line from TNET into four 2 Mbps PCM lines and sends them to the 4-port E1 interface
unit for transmitting.

2. It communicates with the MP board through two communication TSs. The communication
contents are packed and unpacked through an HDLC protocol controller.

3. Self-loop test function: It extracts one HW line (uplink 2 MHz/ downlink 8 MHz)
respectively from the uplink and downlink switching circuits for use in the self-loop test.

4. It can implement ISDN protocol control.

9.3.3.2.4 Control circuit

The control circuit includes the main CPU and clock circuit, performing the following functions:

1. The clock processing circuit provides the trunk interface circuit with the 8 MHz, 2 MHz,
and 8 kHz clock references.

2. The drive interface circuit mainly performs the matching with the input circuit of TNET
and enhances anti-interference capability.

3. The main CPU acts as the processor of this sub-unit, controls various parts and makes
alarm processing over the following faults.

1) Out of frame or out of multi-frame: It gives an alarm when the code error rate exceeds 10 -4,

-299-
Chapter 9 ZXC10-HLR/AUC (V3.0)

and eliminates the alarm when it is lower than 10-4.

2) Slip code alarm: indicating advancing and lagging of the external/internal clocks;

3) When there occurs input signal loss or the remote connection failure, it gives the
emergency alarm.

After CPU detects the alarm message, the message is packed by HDLC at a certain preset TS
(for example, Tsb’), and sent to the uplink multiplexing circuit. Then, TNET sends the Tsb’ to the
COMM board via the half-fixed connection, then to MP, which informs the maintenance terminal.

The digital trunk sub-unit can be selected via clock setting of the jumper and matched with
the line impedance.

Channels of the related alarm messages are as shown in Fig. 9-9.

Fig. 9-9 Channels of alarm messages

9.3.3.2.5 Main control unit

The main control unit includes MP, COMM board, MON board, PEPD, Shared Memory (SMEM),
power board, etc.

9.3.3.2.5.1 MP
1. Basic structure of MP

MP consists of CPU, bus system, memory system, system controller, and I/O interface
equipment. It occupies four physical slots in the control layer BCTL. The MP is both powerful and
rapid in its processing. Here, the CPU is Pentium processor, with its main working frequency up to
200 MHz, a BUSI interface, an Ethernet interface and hard disks. Its structure is briefly introduced
in the following.

1) CPU: Pentium 586, with clock frequency 200 MHz;

2) Bus system: internally, the PCI bus/ISA bus is employed;

3) Memory system: It consists of high-speed CACHE memory, dynamic RAM (DRAM) and
floppy/hard disk memories;

4) System controller: It consists of DMA, Interrupt Controller (ITC), timing circuit and

-300-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

logical array circuit (EPLD);

5) I/O interface equipment: It consists of an Ethernet controller, a keyboard interface, a

mouse interface, an FDC interface, IDE interfaces (floppy/hard disk interfaces), asynchronous
serial bus interface UART and the BUSI bus interface of the MP unit.

2. Functions of MP

MP is the core of the main control unit, whose major functions are as follows:

1) Controls the connection of the switching network;

2) In charge of transmission of the background/foreground data and commands;

3). Implements the message communication with the peripheral processing units;

4) Controls the active/standby statuses. The active/standby MPs obtain the active/standby
operation statuses via competition at power-on resetting. There are four kinds of active/standby
switchover: command switchover, manual switchover, resetting switchover and fault switchover;

5) Provides two 10M Ethernet interfaces, one for connecting of the background terminal
server, the other is the line between the expanding control layers;

6) Introduces the reference clock of exchange system as the precision clock of main board,
sets node No., enables/disables various functions, etc;

7) Other service functions: Include the Watchdog function, 5 ms timed interruption service,
timed counting service, configuration setting, and introducing of the reference clock of exchange
system as the precision clock of the main board.

Set out below is a further introduction to the relative functions of the BUSI bus and the
switchover controller in the MP board.

1) BUSI bus

BUSI is the bus interface circuit of the MP unit. It mainly enhances the driving capability of
the MP unit to the backplane bus ISA, and provides the Ethernet active/standby switchover control
and check functions.

BUSI chiefly includes the following functional units:

Bus driver: It mainly provides backplane bus driving to the main control layer.

Bus controller: It performs parity check for the data bus, bus monitoring and barring.

-301-
Chapter 9 ZXC10-HLR/AUC (V3.0)

MP should receive the interruption signals sent from 13 COMM boards and 1 MON board, as
well as the trunk signals from DRAM, which are then sent to CPU after collected by the
interruption controller.

2) Active/standby switchover controller

The active/standby MPs obtain the active/standby working statuses in the competition mode
at power-on resetting (the power-on resetting of MP is different from that of the other
active/standby part).

9.3.3.2.5.2 COMM board

The main control layer is mainly located with the COMM board besides the MP0 and MP1 units.
The COMM board is the hub for MP to communicate with peripheral processing units, and is also
the second processing layer of the SS7 unit, serving important functions.

1. Relations between COMM board and MP

MP is connected to various COMM boards via the backplane ISA bus. Both MP0 and MP1
work in the active/standby mode, but COMM boards work in load-sharing mode. A COMM board
must be connected to MP through two independent and identical ISA buses, as shown in Fig. 9-10.

PCI BUSI ISA

MP0

DPRAM COMM COMM COMM PEPD MON

PCI
MP1 BUSI ISA

Fig. 9-10 Connection between COMM boards and MP0/MP1

Here:

-302-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

DPRAM: Double Port Random Memory

MON: Monitoring Board

PEPD: Peripheral Environment & Power Detect Board

2. Working mode of COMM board

At message sending, MP writes the message to be sent into DPRAM, then the relevant HDLC
controller extracts and converges it into the switching chip in a certain frame format. After being
processed by the chip, it is sent to TNET via a selected directional link.

At message receiving, the message from TNET is sent to the switching chip of the COMM
board via a certain downlink data link. After being processed by the switching chip on the relevant
HDLC controller, the message is received by MP.

When received, the message is forwarded to DPRAM for check by the related HDLC
controller. It is put into DPRAM after being confirmed free of error with the frame format.
Otherwise, message re-sending is required. If the message is found inaccurate in the receiving
check, the CPU in the COMM board will send an interruption alarm to MP.

Both the COMM board and the MP board have signals to apply for interruption to the
opposite party. During message switching, COMM and MP notify the opposite party in this very
interruption mode.

The schematic diagram of COMM board is as shown in Fig. 9-11.

Fig. 9-11 Schematic diagram of COMM board

9.3.3.2.5.3 MON
All units in the ZXC10-HLR/AUC (V3.0) system that can perform the self-monitoring and
communicate with MP via COMM and semi-permanent connection switching can exchange with
MP the status and alarm information of respective unit. However, quite a few sub-units
(connectors) have no such communication function (e.g., the POWERB sub-unit). In order to
monitor these sub-units, the MON sub-unit connector board is set in the system.

-303-
Chapter 9 ZXC10-HLR/AUC (V3.0)

The MON board is installed with eight RS-485 interfaces and two RS-232 interfaces. Each
RS-485 interface can carry 32 monitored sub-units. A simple flow chart is as shown in Fig. 9-12.

Fig. 9-12 Simple working flow of MON

The MON board works with the monitored board in master/slave mode, with the former one
being the monitoring party, and the latter one the monitored (slave) party. The MON board
regularly checks each sub-unit under monitoring, which sends the response data to MON while
being checked. That is, the monitored sub-unit sends the local sub-unit status and the alarm
information to MON. The CPU on the MON board judges whether it is abnormal, if yes, it sends
an alarm.

The MON board and the MP board communicate with each other via mutually signals
sending for information exchange.

CPU should check the data sent from MP to MON, and requests MP to resend if any error is
found.

There are 8 RS-485 interfaces on the MON board, monitoring a maximum of 256 objects (32
× 8), i.e., covering all sub-units to be monitored in this system.

9.3.3.2.5.4 PEPD
PEPD can process the secondary signal provided by the external sensor. It performs real time
monitoring on the physical parameters of the exchange’s working environment such as
temperature, humidity, smog and infrared and reports the results to MP. Once an abnormality is
detected, the alarm box will be started instantly, in an effort to avoid unnecessary loss.

1. PEPD measurement range

Temperature: Range: 0~50 °C

Precision: ±0.5 °C

-304-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

Humidity: Range: 20%~100%

Precision: ±3%

Infrared: the maximum effective area: a 900 sector with a 15 m radius (adjustable)

Smog: sensitivity: 1 dB/m

Current: 100 µA

2. PEPD work flow

The work flow of PEPD is as shown in Fig. 9-13.

Fig. 9-13 PEPD principles

PEPD and active/standby MP can mutually send interruption signals, and as soon as either
party writes data to the mailbox of the other, the other party will be interrupted.

The environment monitoring works as follows:

1) Once smoke is detected by the smoke sensor, a current signal will be generated. The
current signal will be converted to a level signal inside the board and be sent to CPU in PEPD.
Then CPU will perform the related test.

2) The temperature and humidity sensors modulate the variations of temperature and
humidity into positive spike waves corresponding to frequency changes, before sending the waves
to CPU in PEPD for relevant tests.

3) An infrared sensor can test the peripheral environment at any time. Once physical
approaching is detected, the infrared sensor can output a switch level signal to the CPU in the
PEPD for the CPU to perform relevant tests.

9.3.3.2.5.5 SMEM
SMEM provides the 8 kbyte simultaneously accessible double-port RAM and the shared 2M
byte RAM for the active MP0/standby MP1. Meanwhile, it also provides 1 data parity check bit
with the corresponding capacity to guarantee data correctness. These can be employed by MP as

-305-
Chapter 9 ZXC10-HLR/AUC (V3.0)

message switching channel and data backup, for quick changeover between the active/standby
MPs.

The shared 2MB SMEM is available for access by that MP (active or standby) at the same
time, and the choice of MP is up to the mediation mechanism of the SMEM hardware. Only the
MP secured with SMEM control right can access SMEM, and it should surrender the control right
immediately after access. When one party has obtained the control right, the other one attempting
to access will receive a “BUSY” signal, leaving the party in control not affected.

The 8KB double-port RAM can be accessed by the active/standby MPs at the same time.
However, SMEM has to mediate via the “BUSY” signal when both active/standby MPs happen to
access the same address unit at the same time.

SMEM can set up active/standby MP “mailboxes” through the 8 KB double-port RAM.

When party A sends a mail to party B’s “Mailbox”, party B will receive an interruption signal sent
from party A, a signal to be reset after party B fetches the mail.

The working principle is as shown in Fig. 9-14.

MP1
BUFFER BUFFER

8K 2MB
EPLD
RAM
RAM

MP2 BUFFER BUFFER

Fig. 9-14 A principle diagram of SMEM

9.3.3.2.6 Digital switching unit

The digital switching network unit Network Unit (NETU) ( T network unit for short), includes:

-306-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

TENT: synchronous clock switching network sub-unit

9.3.3.2.6.1 Overall functions

In the ZXC10-HLR/AUC (V. 3.0), the switching module in the SS7 front-end processor is a model
of simplified configuration, which is successfully developed on the basis of the platform of the
ZTE large-scale digital SPC switch ZXJ10 (V10.0). To make the most of the space in shelves for
compact structure and reasonable resources configuration, the clock system and the switching
network are combined to form the synchronous clock switching network board (TNET).

This synchronous switching network board is an unblocked full time division switching
network, with a maximum capacity of 4K ×4K time slots. Besides the necessary 2 Mbps and 8
Mbps differential HWs, it can provide not only the 8M and 8K differential clocks demanded by
the multiple-channel SP board, but also the necessary 4M and 8K differential clocks. Its schematic
diagram is as shown in Fig. 9-15.

256 Kb/s
Switching
MP0 COMM
network

256 Kb/s

256 Kb/s
Switching
MP1 COMM
network
256 Kb/s

Fig. 9-15 Schematic diagram of the synchronous switching network unit

9.3.3.2.6.2 TNET board synchronous clock

The TNET board synchronous clock maintains accordance between the output data code rate and
the input data code rate so as to avoid the code rate slip loss for asynchronization during data
transmission and switching.

The synchronous clock has the following features:

1. It is in the master/slave synchronization mode, with four-channel E8K synchronous

reference clock input interfaces, employing the “loose coupling” phase-locked circuit, while such

-307-
Chapter 9 ZXC10-HLR/AUC (V3.0)

circuit can run in the four modes: fast capture, tracing, holding and free running modes.

2. The discontinuity of clock phase between two TNET boards is below 1/8UI cell.

3. Maintainability of clocks: OCXO provides the frequency adjustment knob which is used
for adjustment when the central frequency offset reaches certain extent due to quartz crystal aging.

4. The functions of manual switchover of clock reference and active/standby switchover.

Furthermore, the clock reference can be shielded by software against any influence in the case of
manual switchover.

5. The critical alarm function of phase-locked loop frequency adjustment. When the inherent
clock frequency shifts beyond the phase-locked loop control range (the control signal exceeds 3/4
of the clock adjustment range) due to clock crystal aging, a minor alarm will be sent.

6. The 16-bit D/A converter with high resolution is applied. It has the serial data interface and
voltage output, holds the 16-bit monotony in the entire working range, and has the ±1 LSB
integrated linear degree. This converter has a built-in precise voltage reference source, with
extremely low noises. The peripheral circuits of D/A are simple, yet good in performance.

7. The TNET board can output two pairs of 16M and 8K clocks and 21 pairs of 8M and 8K
clocks.

9.3.3.2.6.3 Switching network in TNET (T net)

The simplified configuration TNET is an unblocked time-division switching network in a single T
structure, with a 4K × 4K TS capacity and an 8 Mbps PCM bus rate, working in a dual-input and
single-output hot active/standby mode. In TNET, the connection is controlled by MP via the 256
kbps (4 × 64 kbps) super-channel HDLC link through the COMM board. The connection
messages are sent from MP to COMM, which in turn forwards them to the active/standby
switching networks, to ensure that the connections of the active/standby switching networks are
completely the same.

The TNET switching network consists of four 2K × 2K unblocked time division switching
chips with switching functions. These four chips physically constitute a 4K × 4K switching
matrix, thus realizing the 32 PCM buses of 8 Mbps. When working, the chip requires 16 MHz and
8 MHz clocks.

Its switching network is as shown in Fig. 9-16.

-308-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

Switching Switching
chip chip

Switching Switching
chip chip

Fig. 9-16 Schematic diagram of a 4K × 4K switching matrix

Set out below is a further introduction to the switching part.

1. Communication circuit with the control layer MP

This part communicates with MP, in order to control the connection of the time slot switching
network and manage the clock part. The ultra channel (4 × 64 kbps) transmission is applied to the
physical layer of the switching part, and the HDLC protocol is used in the link layer.

2. Core CPU system

The switching network is an intelligent network with high demand for real-time processing.
To meet this requirement, this board employs two processors in control.

1) It employs embedded CPU and works in a 16-bit data line mode. It receives connection
commands from MP, and converts the connection commands into address codes in turn, so as to
perform management over the switching network chip and the HDLC protocol control chip.

2) The single-chip microcomputer is employed, and 32 K SRAM is externally connected. It

communicates with MP via RS-485, performing control and management over the clock part.

3. Clock generation and drive circuit

The clock part of this board generates 2 pairs of 16M and 8K clocks as well as 21 pairs of 8M
and 8K clocks. The source of the two pairs 16M and 8K clocks are as follows: a pair of 16M and

-309-
Chapter 9 ZXC10-HLR/AUC (V3.0)

8K clocks generated by this board, while the other pair by the opposite board. Their distribution is
as follows: A pair of 16M and 8K clocks (the clocks of this board are used in the active status,
while clocks of the opposite board are used in the standby status) is to be used by respective
module chips of this board; the other pair is subject to such processing by EPLD as frequency
dividing and synchronizing, generating 4 MHz and 8 KHz clocks to be used by the COMM board.
Amid the 21 pairs of 8M and 8K clocks, 20 pairs are provided to the SP-level board via the
differential drive, and one pair is for the opposite board.

4. Control and alarm circuits

The control circuit controls the outgoing and incoming HWs.

The alarm circuit processes such faults as hardware failure, clock loss and obvious frequency
changes on the switching network, and shows the LED display on the board at the same time.

5. Active/standby control circuits

There are two circumstances for the active/standby TNET board switchover control:

1) The two boards are in the standby status during the power-on resetting. The CPU will
judge and designate one as the active board so as to avoid power-on conflict.

2) During normal running, active/standby switchover depends on the following cases:

Manual switchover: The maintenance personnel implement the active/standby switchover via
sending man-machine commands. Both active/standby indicators change accordingly after the
switchover;

Fault switchover: When the active network board fails, the CPU will send the active/standby
switchover command, and the active/standby indicators change accordingly.

6. EPLD design

EPLD consists of three related chips:

One chip integrates the active/standby control alarm circuits, as well as the reference
selection, phase detection and control circuits of the clock system.

Another chip integrates the parallel/serial conversion logic, E8K signal detection and multi-
channel selection circuits;

The third chip integrates logic circuits such as HDLC time sequence processing and
switching network slices.

7. PCM bus interface and drive isolation circuit

-310-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

This part of circuits mainly drive the PCM 8 Mbps buses accessing the switching network
board, and isolates them from the external board signals.

9.3.3.2.7 POWER B
POWER B provides power for the control layer, network layer, digital trunk layer and optical
interface layer:

Input: －48 VDC

Output: +5 VDC (60 A), +12 VDC (2 A) and －12 VDC (2 A)

Efficiency: >75%

Ripples: <60 mV

Noises: <500 mV

Surge current: <14 A

POWERB is used in parallel mode in a single layer. It has 1+1 backup function, and can be
plugged in/out safely with power on. When the output voltage exceeds the nominal value range by
±10%, an alarm is sent. In case of reversed input or load short circuit, the EA fuse is reliably
broken, functioning as over-voltage protection. In the normal working status, the temperature rise
of power supply power components does not exceed 50°C so as to ensure safe operation. The
monitoring circuit should monitor yet not control, so as to avoid wrong CPU operations.

The working principle of POWERB is as shown in Fig. 9-17.

Power input

Common-mode

Power supply
suppressing

Slow start

module

+5V

Fig. 9-17 Schematic diagram of POWER B principles

-311-
Chapter 9 ZXC10-HLR/AUC (V3.0)

When the － 48V voltage enters POWERB from the primary power supply, it first goes
through the common-mode inductance to suppress common-mode noises. The slow starting circuit
slowly increases the input voltage, in about 0.4 ms buffer time to eliminate surge. Then it goes
through the low-frequency filter and reaches the power supply module input end. At the same
time, the switch logic circuit generates the corresponding logic command to switch the module on,
so that the module starts to work and generates outputs. These outputs go through the high-low
frequency filters and isolating diode, before becoming the power supply. The output voltage can
be adjusted within a certain range, and goes through sampling comparison in the over-/under-
voltage detection circuit to generate the over-/under-voltage logic signals, which are identified and
processed by the monitoring circuit. After the monitoring circuit identified the signals, it notifies
the alarm circuit of the processing results. The serial port query status is displayed at the working
status area. MP commands are executed. Under the alarm status, power supply is cut off manually.

9.3.3.3 Service processor

The service processor of the ZXC10-HLR/AUC of CDMA mobile communication system is the
core for performing the functions of the whole HLR/AUC system. The system employs TCP/IP for
communication with the database server, SS7 front-end processor, OMM, etc. Under support of
Windows and SQL Server client software, it can run multiple applications to implement such
functions as MAP signaling processing, data access, version management and alarm management,
so as to implement the service processing functions of the HLR/AUC system.

The service processor is housed in a stainless steel chassis, which is antimagnetic, shockproof
and well sealed. Double fans are installed in the front/back of it, so as to ensure the internal
chassis in the micro-positive voltage status. The service processor has a passive backplane and a
CPU plug-in card, thus the system features convenient part changing and other advantages. There
are a built-in PCI video card, two PCI network cards, monitoring cards and other components in
the service processor.

At present, the ZXC10-HLR/AUC system can be connected with 2~16 service processors, or
even more as required in the future.

To meet the demands of service processors for high frequency access to the database, the
ZXC10-HLR/AUC system works in load sharing and mutually hot backup modes. Moreover, the
link monitoring function is set between the CPM component and the service processor. When any
service processor fails, other service processors will evenly share the load.

In the face of subscriber capacity growth in the ZXC10-HLR/AUC system, expand the
service processor can be smoothly expanded, so as to enhance the HLR service processing
capability. Each time a service processor is added, the CPM can automatically detect it, without
affecting the normal running.

-312-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

9.3.3.4 Database
The data capacity, processing speed and running reliability of the database server are vital to the
normal running of HLR/AUC and further the whole CDMA system, especially noteworthy are the
reliability and security of the database system. Therefore, appropriate technical measures must be
taken as assurance. The ZXC10-HLR/AUC system database is designed with the Clustering
technology and works in the shared disk array mode.

One set of database servers includes two hosts (server 1 and server 2) and one shared disk
cabinet. Each host is inserted with one SCSI adapter card, and the disk cabinet provides two SCSI
interfaces. This way each host is connected to the disk chassis via the SCSI bus. Besides, each
server is configured with three Ethernet cards (cards 1, 2 and 3), of which the integrated network
card (Ethernet card 1) on the server is used for the heartbeat line, while the rest two cards are
respectively connected to different HUBs, further accessing the mobile communication LAN.
They are mutually backed up, thus enhancing the system reliability.

Two servers in the database work in the active/standby mode. The backup server monitors all
the time the working status of the active server via the heartbeat line, taking over control once
detecting any abnormality in the active server. The database structure is as shown in Fig. 9-18.

To HUB 1 To HUB 1 To HUB 2

To HUB 2
Ethernet card 3
SCSI adapter
card SCSI adapter
Ethernet card 2
card

Ethernet card 1

Server 1 Server 2

Disk chassis

Fig. 9-18 Database structure

-313-
Chapter 9 ZXC10-HLR/AUC (V3.0)

To ensure secure and reliable running of the database system and implement rapid access of
the subscriber data, medium/high-end servers are used as the server hardware of the ZXC10-
HLR/AUC database, and the transmission speed between Cluster servers is above 10,000 per
second. This system supports one to four CPUs with a main frequency as high as PIII 933MHz
and a memory of 2GB.

The database supports multiple operating systems (such as Windows and UNIX). The large
commercial database system like Oracle, Sybase, Informix or Microsoft SQL Server can be
employed as the database. The operating system and database system may depend on the
subscriber’s requirements, and Windows and Microsoft SQL Server database are recommended.

Furthermore, the following measures are taken for the ZXC10-HLR/AUC database
subsystem to ensure data security and reliability:

1. The synchronous mirror and the stripping technologies are employed for the disk medium
of data storage.

2. The operator everyday backs the data up to the local disk or the tape drive. In case of data
collapse, the system can quickly restore the backup data of the previous day.

3. Any operation at the service handling console is recorded in the log form for convenience
of operations and records. If any wrong operation is detected, it can be recovered easily.

4. On the access interface, the operations over the service handling console and the
maintenance console are separated from those over the mobile application part (MAP). Different
physical nodes of access interfaces have different database subscribers. Therefore, operations over
the service handling console and the maintenance console do not affect those of MAP over the
database, and each part can process data only within valid authorities.

5. The system provides flexible management and maintenance tools with powerful functions.
The maintenance console has not only powerful functions, but also flexible configurations.
Moreover, the system provides multiple database management and maintenance functions, such as
remote communication, operation logs management, account management of operators, timed
backup and database check.

9.3.3.5 Operation & maintenance module (OMM)

The OMM is used for managing HLR/AUC, including authority management, data configuration,
security management, performance statistics, fault management, diagnostic test, signaling tracing,
version management, file management, service observation, clock management, and database
management.

The OMM system is divided into several modules according to their functions, each further

-314-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

divided into the foreground and background sub-modules. The independence of each module and
the universality of the interfaces between each module are emphasized, so as to adapt to the
system structure changes and the function increases. Its schematic diagram is shown in Fig. 9-19.

The client/server structure is employed for the OMM, so as to provide strict control over data
integrity, management and security, perform centralized storage of data, and enable the
administrators to perform centralized data backup and regular maintenance. It works locally in a
LAN, which is connected via a router to a WAN, to implement remote access.

The OMM implements centralized management and maintenance over the ZXC10-
HLR/AUC system, and connects to the network management center in multiple modes (DDN,
X.25, E1, etc.). It supports the query, setting, modification, cancellation, and report demanding of
the provincial network management center (or possibly, the local network management center).

Fig. 9-19 Schematic diagram of the OMM

9.3.4 Hardware reliability redundancy design

9.3.4.1 Module processor (MP)

The MP of the ZXC10-HLR/AUC is of active/standby design. One MP is in active status while the
other is standby. The active MP handles all services, and the standby MP is in the hot backup

-315-
Chapter 9 ZXC10-HLR/AUC (V3.0)

status. The standby MP scans the running status of the active MP every 10 ms. Once it finds that
the running status of the MP is abnormal, it will perform immediate changeover. After successful
switchover, the original standby MP becomes the active MP and takes over all the service
processing tasks.

To guarantee the service handling correctness and continuity after MP changeover, the data of
the standby MP should be synchronized with the data of the active MP. The synchronization
process falls into two stages: startup and running. When the standby MP starts, it performs system
configuration data synchronization with the active MP. This synchronization is carried out by the
database application process. After the standby MP enters the running status, all processes in the
standby MP will perform regular inter-process data synchronization with the same processes in the
active MP.

9.3.4.2 TNET synchronous switching network

The TNET switching network consists of two switching network boards working in the
active/standby mode. The active/standby status of these two switching network boards is
controlled by MP. When the active TNET switching network board fails, MP will detect this
immediately, and change the standby TNET switching network board into active. It takes less than
5 sec to complete the switching after a fault occurs.

When the TNET switching network fails, the system notifies the maintenance personnel with
graphic icons and in the audible and visual modes so as to replace the failing TNET switching
network board in time.

9.3.4.3 Main processor network card

Each module processor has two network cards working in the active/standby mode .If the active
network card has not got any data package within 10 sec, it will turn off the active network card,
and start the standby network card.

9.3.4.4 COMM
In order to enhance the reliability of the in-module communication of the ZXC10-HLR/AUC, the
hardware connection is made in dual backup mode, and each SP is connected with a pair of
COMM boards through the 64 kbps HDLC link. In order to quicken the link switchover at the
time of failure, both links between the same SP and this pair of mutual-assisting COMM boards
should be established. As for which link is selected, it is up to the active MP. When both links have
been successfully established, in order to equalize the load on this pair of mutual-assisting COMM
boards, the active MP uses preference selection method for link selection, and the principle is that
the even-numbered channels on the communication boards select the link on the left COMM

-316-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

board with preference, and the odd-numbered channels select the link on the right COMM board
with preference. When the selected COMM board link fails, the MP will select a normal link on
the other COMM board.

9.3.4.5 Power supply

The shelf on each layer in the ZXC10-HLR/AUC of the CDMA mobile communication system
uses double power supply boards connected in series. When one power supply is faulty, normal
power supply can still be ensured, and the failure of the power supply will be reported to the
maintenance personnel in graphic interfaces or audible and visual mode, so as to replace the failed
power supply in time.

9.3.4.6 Database server

The database servers of the ZXC10-HLR/AUC in the CDMA mobile communication system work
in forms of hot dual backups and redundant disk arrays to ensure database server reliability. The
dual-system technology is based on the CLUSTER architecture. The design purpose of the cluster
technology is to enhance system reliability, expandability, and resistance to catastrophes. One
cluster server is composed of two servers and one disk array. When the following abnormalities
occur to the active server, the standby server will take over the application automatically.

1. Server breakdown caused by the system software or application software.

2. Server failure in reading data from the disk array caused by SCSI card damage.

3. Server hardware breakdown caused by hardware damage.

4. Server switchoff

Both servers have their own machine names and IP addresses. They present the same virtual
machine name and IP address to the outside so as to provide services.

9.3.4.7 Service processor

The service processing module in the ZXC10-HLR/AUC of CDMA mobile communication
system can be composed of multiple service processors, and can be designed in N+1 mode. It
works in hot backup and load sharing mode. The load of service processing is allocated to multiple
service processors on average. By adding more service processors, we can increase the service
handling capacity. The service processor uses the dual network card design to enhance the network
transmission reliability.

-317-
Chapter 9 ZXC10-HLR/AUC (V3.0)

9.4 Software structure of the ZXC10-HLR/AUC

9.4.1 Software architecture

The ZXC10-HLR/AUC (V3.0) software system adopts a layered structure, and a modular design
concept in strict accordance with the software engineering specifications. This chapter
systematically describes the advanced software architecture of the ZXC10-HLR/AUC (V3.0).

The ZXC10-HLR/AUC (V3.0) software architecture is as shown in Fig. 9-20.

Operation & Maintenance Subsystem

Database
Service Processing Subsystem

Signaling Processing Subsystem

Running Support Subsystem

Fig. 9-20 ZXC10-HLR/AUC software architecture

The ZXC10-HLR/AUC (V3.0) software consists of the following five parts:

Operation Support Subsystem

SS7 subsystem

Database subsystem

Service processing subsystem

Operation and maintenance subsystem

The above subsystems will be introduced in detail below.

-318-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

9.4.2 Operation Support Subsystem

The operating system is the bottom layer of the operation support subsystem, the SS7 processing
part of the ZXC10-HLR/AUC (V3.0) runs on the SS7 front-end processor.

The operation support subsystem provides a unified operation interface for the upper-layer
service development, so that the upper-level applications are not influenced by the detailed
architecture of the lower-level hardware platform.

The operation support subsystem includes: Process dispatching timing, system control and
communication system, as shown in Fig. 9-21.

SS7 subsystem Database Service Operation &

subsystem Processing Maintenance
Subsystem Subsystem

Running Support Subsystem

System control File management

Dispatch timing Communication

Real-time operating system

Hardware

Fig. 9-21 Operation support system architecture

As can be seen from the diagram above, the operation support subsystem is above the real-
time operating system. It includes four parts, process dispatching timing, system control, file
management and communication. Next we will describe each part respectively.

9.4.2.1 Process dispatching and timing system

The process dispatching and timing system is subdivided into the process dispatching system and

-319-
Chapter 9 ZXC10-HLR/AUC (V3.0)

the timing system.

The process dispatching system resides on the MP and HSM of the ZXC10-HLR/AUC
system. In a real-time multi-task environment, it provides a process oriented and message driving-
based development platform, with memory management and memory troubleshooting functions.
Synchronous and asynchronous messages can be sent between processes. Coupled with the
communication system, it has the ability to control and maintain the message sending and
addressing on the whole network.

The process dispatching system has the system operation monitoring function and the system
failure recovery capability, and can monitor the usage of the CPU and the important system
resources as well as the over-frequent and deadloop operations of the processes, and can monitor
and restore the abnormal interruption in the process operation.

Besides, the process dispatching system can provide process-oriented debugging.

The timing system can provide timing for 20,000 pieces of software for a process, including
the relative software timing and absolute software timing. Even with extremely frequent settings
and clearings of the timer, it seizes only minimum CPU resources.

The timing system provides software clock, which makes use of the external high-precision
clock reference so that its accuracy is ensured.

9.4.2.2 System control

System control implements control over the following aspects:

1. Control over the starting process of the CPM.

The system starting process includes automatic recognition of the hardware environment,
system initialization, loading CPM data, starting file management, starting the database system,
starting the alarming system, and finally starting the service handling and signaling handling parts.

2. Control over the starting process of the service processor

The system starting process includes system initialization, HSM data configuration, starting
file management, and finally starting service handling.

The system controls the clock of the HSM so as to maintain the synchronization with the
clock of the OMM.

3. Control over the switchover of MP

It controls the MP MMC (man-machine command) changeover, MP fault changeover, MP

-320-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

manual panel changeover, periodic changeover, changeover of foreground/background

communication disconnection, and the changeover processing procedure of application processes.

4. Control over the Peripheral Processor (PP)

The control over PP includes two aspects, as introduced respectively below:

1) Control over the active/standby status of PP

System control is responsible for the active/standby status control and the active/standby
changeover of the PP.

2) Control over the running status of PP

It processes the signals sent from the PP, and detects the abnormalities of the PP. When a PP
fails, it will inform the database to block the related resources and the service processing process
to handle the failure. After the PP returns to normal, the database resources will be unblocked.

9.4.2.3 Internal communication system

Fig. 9-22 shows the network communication structure of the ZXC10-HLR/AUC of the CDMA
mobile communication system.

CPM

PP

Intra-module communication
64kbit/s

CPM MP HSM
Inter-module
communication
IRMX communication IRMX communication NT communication
system system system
4X64Kbit/s

Ethernet. TCP/IP

NT communication NT communication NT communication

system system system

HDM OMM sever OMM client

OMM

-321-
Chapter 9 ZXC10-HLR/AUC (V3.0)

Fig. 9-22 Structure of ZXC10-HLR/AUC of CDMA mobile communication system

Fig. 9-22 illustrates that the communication system consists of inter-module communication,
intra-module communication, communication between the foreground and the background, and
communication between the active and standby MPs, which are described respectively as follows.

1 Inter-module communication

Inter-module communication is responsible for the error-free message transmission between

two CPMs. The physical layer of the inter-module communication employs the HDLC link with
the rate of 4×64 kbps. The data link layer performs the error and flow control in compliance with
the 12-frame sliding window protocol, so as to reduce the message transmission delay and
improve the channel’s utilization ratio and the message throughput. The network layer fulfills such
functions as the disassembly, reassembly, and forwarding of the messages as well as the selection
and switching of the links.

2 Intra-modular communication

The intra-module communication provides the error-free message transmission channel

between the MP and the PP. The physical layer of the intra-module communication employs the
HDLC link at the rate of 64 kbps. The data link layer follows the stop-and-wait protocol, with its
link control in the active/standby triple handshaking mode. The network layer is responsible for
such functions as the packing and the unpacking of the messages as well as the selection and the
switching of the links.

The intra-module communication has set enough buffer arrays on the network layer and the
data link layer so as to handle short-time message peaks.

3. Communication between the foreground and background

The foreground and background communication is responsible for the error-free message
transmission between the CPM and the HSM as well as the OMM. It uses the standard TCP/IP
protocol. The data link layer is the Ethernet.

The communication system on the HSM is responsible for receiving the messages from the
other nodes on the network and submitting the received messages to the higher layer applications.
In the meantime, the communication module transmits the messages (which are sent by the higher
layer applications to the other network nodes) to the destination accurately. The communication
system is responsible for the communication between the HSM and other modules. These modules
include the CPM, the HDM, and the OMM.

-322-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

The communication programs in the HDM and the OMM provide transparent communication
services for each application, which exchanges information with the communication programs by
invoking the dynamic connection database.

4. Communication between active and standby processors

In the ZXC10-HLR/AUC of CDMA mobile communication system, the active/standby MPs

in the CPM communicate via the shared memory board. The shared memory board provides the
dual-port RAM accessible to both the active and standby MPs, with minimum error possibility. So
the control of active/standby communication does not use any standard link layer protocol, but the
traffic and errors should be properly processed.

9.4.2.4 File system

The file operation enables write/read of processes. The file system locates in the lower-priority
tasks in the system, which can be preempted by higher-priority tasks, so as to prevent the low-
speed I/O operations from affecting the real-time response of the system.

For the access requests of concurrent files with multiple processes, the file system puts them
in a queue based on the “first in, first served” principle, in order to achieve mutual exclusion of the
file operations.

The file system provides the typical file management functions such as file listing, file
copying, file renaming, and file deleting between MPs, between active/standby MPs, service
processors in the switch foreground network as well as between various terminals in the
background maintenance network.

9.4.3 SS7 subsystem

For applications in a multi-brand environment, all functional entities of the CDMA system are
connected through the standard SS7 network. The HLR/AUC exchanges information with other
functional entities (MSC, VLR) of the CDMA mobile system through the SS7 network. The
following gives a detailed description of the SS7 of the ZXC10-HLR/AUC system of CDMA
mobile communication system.

9.4.3.1 Overview
The main functions of the SS7 are to implement the receiving and sending of the SS7 and the
information interaction with the HSM, and support the OMM to perform the operation and
maintenance processing.

-323-
Chapter 9 ZXC10-HLR/AUC (V3.0)

The common-channel signaling processing of the ZXC10-HLR/AUC of the CDMA mobile

communication system uses the semi-fixed connection mode to transmit the signaling into the
mobile communication network.

The SS7 physical layers of the ZXC10-HLR/AUC of the CDMA communication system are
distributed between the MP, the SS7 signaling board (STB) and the switching network. The link
layer protocol is implemented by HDLC in STB, and the third network layer functions are
performed by the MP.

The following will discuss the SS7 in detail.

9.4.3.2 Basic mode of SS7

Fig. 9-23 shows the SS7 mode.

BSSAP BSS
OMAP MAP INAP DTAP
BSSMAP OMAP
OSI-7 application layer ISUP TUP

TCAP

OSI-6 representation layer

OSI-5 Session layer ISP
OSI-4 Transport layer

OSI-3 Network layer

SCCP

L3
MTP-3

OSI-2 Data link layer L2 MTP-2

OSI-1 Physical layer L1

MTP-1

OSI-0 Media layer SS7 structure diagram

Fig. 9-23 SS7 mode

At present, the SS7 is divided into four levels. MTP and SCCP belong to the lowest three
levels, corresponding respectively to the physical layer, data link layer and network layer in the
OSI model. Each application entity is a functional unit concurrent in the fourth level and

-324-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

corresponds to the application layer in the OSI model. In the figure, the ISP (Intermediate Service
Part) enclosed in the broken line box corresponds to the layers 4~6 in the OSI model. It is not
defined yet.

In the ZXC10-HLR/AUC of the CDMA mobile communication system, the SS7 signaling
mode is divided according to specifications into the following several function blocks:

1. Message transfer part (MTP)

2. Signal connection control part (SCCP)

3. Transaction capability application part (TCAP)

4. Mobile application part (MAP)

The following discusses the contents included in all the above-mentioned levels involved in
the SS7.

9.4.3.2.1 MTP
MTP is further divided into MTP1, MTP2 and MTP3, corresponding respectively to layers 1, 2,
and 3 in the 7-layer protocol. MTP1, at data link level equivalent to L1 of OSI—physical layer, is
mainly a two-way data transfer channel comprising the digital transfer channel and signal terminal
equipment. The basic rate of the digital transfer channel is 64 kbps.

MTP2 is the signal link level, corresponding to L2-link function level. In the ZXC10-
HLR/AUC of CDMA mobile communication system, MTP2 is embodied on the STB. Its main
functions are to provide signal links for reliable signal information transfer between two directly
connected signal points. Its main functions are: Signal unit delimiting and locating, error check
and correction, signal link monitoring and traffic control.

MTP3 is the signal network function level. Together with the extended function level SCCP,
it is called the OSI L3 function level. The main functions of this layer include signal message
handling and signal network management.

1. The signal message processing mainly implements message routing, message identification
and message distribution.

2. The signal network management mainly includes signal traffic management, signal link
management and signal route management.

The signal traffic management mainly functions to perform the message transfer and traffic
control in case of fault and congestion. The signal link management mainly functions to perform
effective management over the links when the signals are recovered, enabled and disabled in the
signal network. Signal route management mainly functions to exchange the information on the

-325-
Chapter 9 ZXC10-HLR/AUC (V3.0)

signal routes reliably, including the functions of enabling, restriction and transferring.

9.4.3.2.2 SCCP
As the MTP layer addressing is restricted to only inter-node transfer, merely performing the
connectionless message transfer, it can provide neither directional connection services nor global
addressing, so another SCCP functional layer is added to MTP3. SCCP is a function supplement to
MTP, capable of providing MTP with connection-oriented functions. In addition, the SCCP can
also provide the GT (global title) function which can translate GT into DPC+SSN at the message
source point or at the STP point. (DPC is the destination signal code, and SSN is the subsystem
number of the local identification SCCP subscriber).

9.4.3.2.3 TCAP
The TCAP of the CDMA mobile communication system uses the North America ANSI standards.
The TCAP is an intermediate layer between the service layer and SCCP, however, it belongs to the
7th layer of OSI 7-layer protocol. The application layer supported by the TCAP includes the
OMAP, MAP and INAP. The TCAP has the application layer specifications and functions, but not
the layer 4~6 specifications and functions. So services included in TCAP all directly use the
SCCP-supported functions.

In order to control the operations and sessions, the TCAP itself is subdivided into two
sublayers, the component sublayer (CSL) and the transaction sublayer (TSL), as described below:

1. TSL:

1) Management of signaling communication between local and remote transaction

subscribers;

2) The only user of the transaction sublayer is the component sublayer.

3) The start/end of bi-directional information exchanging between the two TC users is

controlled and released by the local layer.

2. Component Sub-Layer (CSL)

1) Error check and dialogue distribution of the operation management component

2) Setting up a status diagram for each originating subscriber.

The component sublayer mainly includes the switching “component” between TCAP
subscribers, but the transaction handling sublayer includes switching of various messages
including components.

-326-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

9.4.3.2.4 MAP application layer

MAP, i.e., mobile application part, is a protocol specially designed for mobile communication. In
the OSI reference model, it is on the layer above TCAP. It uses only the SCCP connectionless
mode. Between MSC/VLR and HLR/AUC, the standard MAP protocol is used to set up sessions
to transfer information.

In the ZXC10-HLR/AUC of the CDMA mobile communication system, MAP mainly

includes the following signaling processes:

1. Location registration and deletion.

2. Supplementary service processing.

It includes the activation, de-activation, registration, cancellation of supplementary services.

3. Retrieving subscriber parameters during the call establishment

It includes three circumstances:

1) Direct information retrieval: MSC directly obtains required parameters from VLR without
the interference of HLR.

2) Indirect information retrieval: VLR also gets part or all of subscriber parameters from
HLR.

3) Route information retrieval: When a mobile subscriber is called, the caller side gateway
MSC (GMSC) requests HLR for such data as the roaming number.

4. Subscriber management

It includes subscriber location information management and subscriber parameter

management. In particular, VLR requests HLR for information or HLR updates information from
VLR. It can be used for data recovery or normal data updating (service handling) in VLR after the
restarting of VLR and HLR.

5. Fault recovery of location registration

It includes the recovery of VLR and HLR. The recovery process of HLR is as follows.

After the HLR is restarted, it sends the “Roaming data unreliable” message to all or related
VLRs. After VLR receives this message, all MS subscriber data belonging to this HLR will be
deleted.

6. Short message service (SMS)

-327-
Chapter 9 ZXC10-HLR/AUC (V3.0)

It includes the processing of the originating, terminating and notification services of the SM.

7. Intelligent service

It mainly processes the triggering of intelligent services.

8. Subscriber authentication

Main functions include: Management over the MS registration, origination, SSD update, MS
called, data burst authentication, and unique query authentication.

9.4.3.3 SS7 message format

The SS7 uses different-length messages to transmit signaling. In the SS7, there are three signal
units: message signal unit (MSU), link status signal unit (LSSU) and fill-in signal unit (FISU).
Here, MSU is the signal unit that practically carries messages; LSSU is the signal unit that
transmits network link status; and FISU does not contain any information, which is used to send a
null signal to the opposite side when the network node has no information to send. Its function is
to make the signaling link maintain a communicating status and at the same time to acknowledge
that the message sent from the opposite side is received.

The formats of the three signal units: MSU, LSSU and FISU, are shown in Fig. 9-24, 9-25
and 9-26:

1. MSU: message signal unit.

The MSU format is shown in Fig. 9-24.

2. LSSU: link status signal unit

The LSSU format is shown in Fig. 9-25.

3. FISU: fill-in signal unit

The FISU format is shown in Fig. 9-26.

Here:

F: Flag

CK: Check bits

BIB: Back Unit Indicating Bit

-328-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

Fig. 9-24 MSU format

Fig. 9-25 Message format of LSSU

Fig. 9-26 Message format of FISU

-329-
Chapter 9 ZXC10-HLR/AUC (V3.0)

BSN: Back Unit Sequence Number

FIB: Forward Unit Indicating Bit

FSN: Forward Unit Sequence Number

SIF: Signalling Information Field

NI: National Indicator

LI: Length Indicator

SF: State Field

SI: Service Indicator

9.4.3.4 ZXC10-HLR/AUC signaling physical platform

The three layers of SS7 protocols, i.e., MTP1, MTP2, and MTP3 + SCCP, are implemented by the
STB and MP of CPM, the T network (TNET), and corresponding software.

The physical platform of the MTP1 (L1) layer is mainly located on the MP_COMM. Each
pair of COMM board HDLC protocol provides signaling channels with a maximum of 32
timeslots (TS). The COMM signaling information is sent via the semi-permanent (fixed)
connection in the TNET to a corresponding link, as shown in Fig. 9-27.

The two HDLC cables in COMM can be sent at different moments by selecting different TSs
to different links for the purpose of simultaneous handling. COMM1, COMM2 connections are in
traffic load-sharing multiplexing mode, the module processors are in the active/standby
multiplexing mode.

The signaling physical platform of the ZXC10-HLR/AUC of CDMA mobile communication

system is located in the same TNET network module as the channel connections through the semi-
permanent connection, therefore it is easier for link fault detection and signaling channel
detection. Besides, in the ZXC10-HLR/AUC of CDMA mobile communication system, the
COMM communication program is written to/read from all COMM boards. Suppose that B03 is a
MTP3 third level function, we can use Fig. 4-9 to demonstrate this relationship:

-330-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

TUP

Application entity
DTI ISUP

TNET Synchronous
switching network
To other
(PRI)
INAP systems

MAP
L3

TS signaling channel

Comm1 Comm2

HDLC HDLC

L2/L1

MP0 MP1

LAN1 LAN2

Fig. 9-27 Physical platform of the system signaling

Fig. 9-28 shows the processing process of SS7 third layer of the ZXC10-HLR/AUC of
CDMA mobile communication system.

TUP→Comm

Comm→TUP

-331-
Chapter 9 ZXC10-HLR/AUC (V3.0)

Fig. 9-28 Schematic diagram of the communication process

In Fig. 9-29, TUP represents only the MP process of sending/receiving messages to/from
COMM. In ZXC10-HLR/AUC of CDMA mobile communication system, the DPRAM
communication is performed in the interruption mode.

9.4.3.5 SCCP
The signaling connection control part is simplified as SCCP. In the layered structure of the SS7
signal mode, it belongs to the MTP user part, and provides MTP with the global code-based routes
and routing functions. This enables it to transmit various types of information unrelated to circuits
and other types of information between switching offices and specialized centers in the telecom
network through the SS7 signal network, and set up connectionless or connection-oriented
services. If the data that the user wants to transmit exceeds the MTP limit, SCCP will provide the
necessary functions of segmentation and re-assembly.

9.4.3.5.1 SCCP location in the system

In the signaling system of the ZXC10-HLR/AUC of the CDMA mobile communication system,
the SCCP is located under the TCAP layer and above the MTP layer. Its schematic diagram is
shown in Fig. 9-29.

Fig. 9-29 Location the SCCP

-332-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

9.4.3.5.2 Functions of SCCP in the system

In the ZXC10 HLR/AUC of the CDMA mobile communication system, SCCP has the following
functions:

1. Setting up logical signaling relationships in the SS7 network;

2. Able to transmit signaling data units regardless of whether logical signaling connections
are set up or not;

3. Performing global code-based routing functions;

4. Providing basic connectionless services, sequential connectionless services, basic

connection oriented services and connection-oriented flow control services.

9.4.3.5.3 Module structure of SCCP

The SCCP functional module is shown in Fig. 9-30.

SCCP user MTP

Connection-oriented message
SCCP
Connection-oriented
Routing error
N_transfer primitive transfer control

SCRC
Connectionless message MTP_transfer
primitive

N_transfer primitive SCLC Routing error

The message sent to the unavailable

S S S S S
O O S S S subsystem of this node is received.

R G A P T

SCMG
N_management primitive
MTP_management
primitive
SCCP functional module structure

Fig. 9-30 Functional module structure of SCCP

-333-
Chapter 9 ZXC10-HLR/AUC (V3.0)

The SCCP can provide two types of services, namely, connectionless services and
connection-oriented services, as described below.

9.4.3.5.4 Connectionless services

The connectionless service is practically the datagram in the packet switching, that is, to send
signaling messages without a connection being set up beforehand. Here, the sent data messages
are taken as independent messages and sent to the destination signaling point (DPC) in the route
numbering labels. In basic connectionless services, all messages are independently transmitted,
and are irrelevant to each other. So messages cannot be ensured of being sent to the destination
signaling point in the transmission sequence. In the sequenced connectionless service, the data
message from the same information is attached with the same signaling link selection field, so as
to guarantee that these data messages will be transmitted via the same signaling link. Each time
the data is sent by connectionless service to the destination SP in the sending sequence, a re-
routing is required.

The specific operation is as follows:

An SCCP subscriber at the originating node sends out N_unit data request primitives to
request the connectionless data transfer services. Then, it makes use of the SCCP route control and
MTP to send the unit data message to the called address specified in the unit data request
primitives.

When the unit data message cannot be sent to the destination point, the Unit Data Service
(UDTS) message will be sent to the originating point; when the destination node receives UDTS
message, it sends N_unit data indication primitive; when SCRC cannot send the unit data or
UDTS message, it will send one UDTS message to the address of the caller or call N_notice
indication primitives.

When the data length in the N_unit data request primitive is longer than X (temporarily set as
200), the UDT message cannot transmit the data of so large quantities. Therefore, the data has to
be divided into several shorter segments, each transmitted via an XUDT message. Accordingly,
when SCCP receives an XUDT message, the divided data must be reassembled to form one
N_unit data indication primitive, and then sent to the SCCP subscriber. This process is called as
segmentation/reassembly.

The connectionless service transmission process is shown in Fig. 9-31:

-334-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

Fig. 9-31 Connectionless service transmission process

9.4.3.5.5 Connection-oriented service

The connection-oriented service is actually the virtual circuit in the packet circuit, that is, it is
necessary to set up logic connections before data transmission. In basic connection-oriented
services, no data message carries serial number, so neither sequence control nor flow control can
be implemented. In the connection-oriented flow control service, however, sequence control and
flow control can be performed.

Connection-oriented services can be further subdivided into temporary signaling connection

and permanent signaling connection. The establishment of temporary signaling connection should
be started and controlled by SCCP subscribers, which is similar to the connection of telephone
dialing; permanent signaling is established and released by local (or remote) O&M function or
node management function, which provides SCCP subscribers with semi-permanent connection
similar to leased telephone lines.

The connection-oriented transmission process is shown in Fig. 9-32.

Fig. 9-32 Connection-oriented transmission process

-335-
Chapter 9 ZXC10-HLR/AUC (V3.0)

It includes the following parts:

1) Connection establishment process

When the SCCP function of the originating node receives a signaling connection request
N_ConnectReq, it analyzes the called address, so as to identify the destination node to which the
established signaling connection will be sent. If the destination node is not a local node, SCCP will
perform MTP functions to send a Connection Request (CR) message to the destination signaling
point.

When the SCCP of the destination node receives a CR message, it sends an N_ConnectInd
primitive to the subscriber. If the subscriber agrees to establish a connection, an N_ConnectRes
primitive will be invoked, and SCCP will send a Connection Confirmation (CC) message to the
originating node; if he does not agree, an N_ConnectReq primitive will be invoked, and SCCP
will send a Connection Rejection (CREF) message to the originating node.

During the above course, it is also required to perform negotiation on the protocol types and
the credit volume of the flow control. Besides, the SCCP of the originating node, the destination
node, and the intermediate nodes should record the necessary information of this signaling
connection so as to set up the logical signaling connection link.

The signaling connection setup and rejection process is shown in Fig. 9-33.

SCCP user SCCP user

N_ConnectInd
N_ConnectReq N_ConnectCon N_ConnectRes

CC CC
SCCP SCCP SCCP
CR CR

Signaling connection establishment process

SCCP user SCCP user

N_ConnectReq N_ConnectInd N_ConnectReq N_ConnectInd

CREF CREF
SCCP SCCP SCCP
CR CR

Signaling connection establishment rejection process

Fig. 9-33 Setup and rejection process of signaling connection

-336-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

2) Data transfer process

Data transfer functions ensure that subscriber data are transferred in temporary signaling
connections. Functions provided here include segmenting and reassembling, flow control,
inactivity control and accelerated data transfer.

Segmenting and reassembling are to segment subscriber data if the length is longer than 255
octets, insert them into the data parameters of DT1 or DT2, then reassemble them with the multi-
data indicating codes (M bits) at the receiving end. Flow control means to control message flow
with a sliding window when the protocol is the flow control connection-oriented service.

The purpose of inactivity control is to prevent:

1) Loss of “connection confirmation” during connection setup;

2) Unnoticed termination of connection segments during data transfer;

3) Inconsistency of connection data at both ends of one connection.

Whenever the connection section sends a message, the inactivity controller for sending
should be reset; when the timing of the inactivity control timer expires, the connection release
process should be started.

Data transfer acceleration occurs when the protocol type is the flow control connection
oriented service, and what to be transferred is the data with a maximum data length of 32 octets,
with a high rate requirement (not controlled by flow, not providing segmenting and reassembling
functions).

3) Connection release process

In order to start and terminate the connection release, two kinds of information are needed:
the released message (RLSD) and release completion message (RLC). The release process can be
initiated by SCCP users or by SCCPs. Besides the release of logical links and local references, the
release process should also be able to freeze the local references, in order to prevent the startup of
processes not suitable to the present connection due to the reception of messages related to
originally established connections.

4) Restoration process

The purpose of the restoration process is to re-initialize the connection segment, to reject data
messages, data confirmation messages, accelerated data messages and accelerated data confirming
messages, to set the sending sequence number P (S) to 0 and to restore the window value to the
original value.

-337-
Chapter 9 ZXC10-HLR/AUC (V3.0)

9.4.3.6 SCCP management functions

The SCCP management function (SCMG) is to re-select signaling routes or restrict signaling
traffic when failure or congestion occurs at SP or the SP subsystem so as to ensure normal
signaling network performance. The subsystem here actually refers to an SCCP user. The SCCP
management process stipulates that dual nodes or subsystems should both be configured as
active/standby dual systems, and assume that they work in the active-control mode. That is, the
standby system is started only when the active system breaks down. And once the fault is
removed, it is immediately changed over to the active system. The SCCP management function is
applicable to connectionless services and connection-oriented services. It can be divided into two
sub-functions according to its management objects:

1. SP status management: It serves to modify the SCCP address translation table and node or
subsystem status according to the signaling point code provided by MTP, so that the subscriber
can take measures to re-send or reduce the signaling messages sent by related SP.

2. Subsystem status management: It serves to modify the SCCP translation table, update the
status labels and perform the changeover and changeback of signaling information between
active/standby subsystems according to the received information about subsystem failure, exit and
recovery.

9.4.3.7 Services and management functions used in the system

In the SS7 of the ZXC10-HLR/AUC in the CDMA mobile communication system, the only user
of SCCP is TCAP. Messages are transferred between the two via the N_UNITDATA primitive.
The subscriber data can reach 3,200 bytes. When the data length is longer than 200 B, data are
transferred in the segmenting /reassembling mode. SCCP handles address translation and route
selection on global codes in the message, so as to provide network support to TCAP and upper
layer users.

9.4.3.8 TCAP
The North America ANSI TCAP (short for Transaction Capability Application Part) adopted in the
CDMA mobile communication system belongs to the SCCP user part in the hierarchical structure
of SS7. Its main purpose is to provide a uniform support for various application services for
information interaction in the network environment, to transmit circuit unrelated information such
as address translation information, subscriber data information, billing or management information
between switching nodes and control nodes. The TCAP signaling process is the handling and
control procedure over operations and sessions.

In the ZXC10-HLR/AUS system of CDMA mobile communications, TCAP supports a

unique user-MAP.

-338-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

9.4.3.8.1 TCAP hierarchical structure and functions

The TCAP hierarchical structure is shown in Fig. 9-34:

Fig. 9-34 TCAP hierarchical structure

Where:

CSL—operation management

TSL –session management

CSL and TC—user interface through TCprimitives

CSL -TSL interface through TRprimitives and session control

TCAP is subdivided into two parts, transaction management and component management.

9.4.3.8.2 Transaction Capability Application Part Sub-Layer (TCAPTSL)

TCAPTSL serves to manage the transaction, i.e., the signaling communication process between
the local transaction sublayer users and remote transaction sublayer users. The transaction
sublayer user is the TR-user. The only TR-user known at present is the component sublayer.
Communication between peer component sublayers is performed between peer TC-users, which is
named a session. So, in the currently defined TCAP protocol, transaction is completely equivalent
to the dialog with a one-to-one correspondence between the two.

To complete the signaling process of one application service, two TCusers make a two-way

-339-
Chapter 9 ZXC10-HLR/AUC (V3.0)

exchange of a series of TCAP messages. The start, end, sequence and message content of message
exchange are all controlled and explained by TCusers. The TCAPTSL manages the starting,
holding and termination of sessions, including detection and handling of abnormalities. The
protocol process is applicable to the sessions of any application services.

9.4.3.8.3 Transaction Capacity Application Part Component Sub-layer (TCAPCSL)

The main functions of the component sublayer include operation management, component error
detection and session component assignment.

In normal cases, one operation means the TC-user initiates an invoking request, so the
component sublayer sets up a status diagram for each operation, so as to enable operation
management.

Component errors include protocol error and response timeout. Protocol errors exactly refer
to the inconsistency between the component type received by the component sublayer and the
expected input into the operation status diagram, syntax error or unrecognization on the
component format. The response timeout refers to the timeout of various operation timers.

The component sublayer allocates dialog components through its management of dialog ID.

9.4.3.8.4 Function classification

The TCAP hierarchical module structure is shown in Fig. 9-35.

Where:

The CHA module on the component sublayer is to handle component, perform the interaction
of TC component handling primitives between TCAP and TCusers, and manage each operation
invoking.

The DHA module on the component sublayer serves to process session. It mainly performs
the interaction of TC session handling primitives between TCAP and TC users, as well as
assignment of session components.

-340-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

Fig. 9-35 TCAP hierarchical module functions

When the component sublayer receives the normal session processing TC request primitive
from the TC-subscribers, the DHA module will request the component part contained in that
session. When the component sublayer receives the abnormal session processing TC request
primitive, the DHA module will transmit the session termination instruction to the CHA module to
make the CHA module terminate all the unfinished operations contained in that session. When the
component sublayer receives the TR instruction primitive, the DHA module will transmit all the
components contained in the received session to the CHA module to check the components’ syntax
and their operation status.

The ISM in the CHA module is the operation invoking finite state machine. The component
sublayer that originates the operation request node manages all operations accordingly.

The CCO module in the CHA module is the component coordinating module. Each session
corresponds to one CCO module, generates the components to be sent by the TCuser and also
assigns the components contained in the received session to ISM for further check. When ISM
detects any component error, it starts the rejecting mechanism.

9.4.3.8.5 TCAP component operation handling process

1. Basic handling process

A successful operation processing is shown in Fig. 9-36. In the diagram, I in the bracket is an

-341-
Chapter 9 ZXC10-HLR/AUC (V3.0)

operation invoking ID code. If the operation fails, then subscriber 2 will send a Return Error (RE)
component and the corresponding TC primitive should be TC-U-RROR.

T C us e r 1 CS L1 CS L2 T C us e r 2

TC – I N VO K E r e q u e s t IN V( I ) co m p o n en t T C – IN V O K E c o m m a n d

TC – R – N L c o m ma n d R R N L ( I ) co mp o n e n t TC – R – N L r e q u e s t

TC – R – L c o m m a n d R R L ( I) c o m p o n e n t TC – R – L r e q u e s t

Fig. 9-36 A successful operation handling process

Operation invoking ID in the component is dynamically assigned by the TC-user when

initiating an operation request. At any given moment, there might be multiple remote operations
executed simultaneously. Each operation invoking ID corresponds to one component status
diagram. The end node responds only to this operation without interfering with the operation
status management. The component status diagrams are managed by the process TCAPISM. After
an operation process is completed, the component status diagram returns to idle status. At this
time, the operation ID is released. After the release, it must be frozen for a period of time before
being re-used. The freezing method is specified by the TC-user.

TCAP allows two nodes to send an operation request to each other during an application
service session. Thus, the destination will send an operation request for information to the opposite
side. The second operation invoking component has its own operation invoking ID assigned by the
destination TC user. But this component must still return the ID of the first operation to the peer
end, called an “associated operation ID”, so as to show that the invoking of the second operation is
requested for executing the first operation.

The handling process of an associated operation is shown in Fig. 9-37. Where, Subscriber 1
firstly initiates a test request to Subscriber 2 with the test operation ID as 1. The test has multiple
test conditions for your choice, which are preset at Subscriber 1. After receiving the request,
Subscriber 2 sends a request for choosing test conditions inversely to Subscriber 1. The invoking

-342-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

component operation ID is 2 and the associated operation ID is 1. Upon the request, Subscriber 1
sends selected test conditions and Subscriber 2 completes this test.

2. Abnormality handling process

The processes for handling several abnormal cases are described as follows:

1) Timeout handling

After each operation invoking component is sent out, the component sublayer (process
TCAPISM) will start a related timer. If no response from the peer end is received within a set
period of time, this component sublayer will cancel the operation (component status diagram
returns to idle). Meanwhile, it will notify the TC user by using the TCLCANCEL indication
primitive. At any time, if the TC user wishes to cancel an operation under execution, it can notify
the component sublayer by using the TC-U-CANCEL request primitive. What is cancelled is only
a partial process inside the node, without sending any component notice to the peer end. If a
response is received from the peer end after the cancellation, it will be regarded as an illegal
message by the component sublayer and rejected.

TC user 1 CSL1 CSL2 TC user 2

TC–INVOKE
TC–INVOKE request INV(1,test) indication
(1, test) (1,test)
TC–INVOKE indication INV(2,1, condition selection) TC–INVOKE request

(2,1, condition selection) (2,1, test condition)

TC–R–L request RRL(2, test condition) TC–R–L indication

(2, test condition) (2, test condition)

TC–R–L indication RRL(1, test result) TC–R–L request

(1, test result) (1, test result)

Fig. 9-37 Handling process of associated operation

2) Illegal component handling

An illegal component is one that has format errors or inconsistent type and status diagram, or
is not identifiable. After this type of component is received, the component sublayer will perform
the rejection process, generate and store a rejection component (RJ) for sending, notify the TC

-343-
Chapter 9 ZXC10-HLR/AUC (V3.0)

user via the TC-L-REJECT indication primitive, and inform the user of the cause. The handling of
this process is executed in the process TCAPCSL0.

If a user finds the component semantic wrong or not in compliance with the application
service specifications, the TCUREJECT primitive can be used to send the rejecting component.
After the peer end gets this component, it will use the TCUREJECT indication primitive to notify
its user. The TCAP of the receiving side determines whether this rejection is done by the peer end
user or the peer end TCAP according to the problem code in the component.

If a TCAP message contains multiple components and if one component is rejected, then all
the subsequent components will be aborted. For the segmented and transferred return result, if any
component is rejected, it means that whole return result is rejected.

If even the operation invoking ID in an illegal component is unrecognizable or is an illegal

number that is not assigned, the above rejection process should be executed. The only exception is
that the received illegal component itself is a rejected component. In this case, the component
sublayer needs only to notify its own user, with no need to send any new rejecting component to
the opposite side.

3) Other abnormal cases

Here we mean component loss, repetition or wrong sequence. For TCAP, such cases hardly
occur, so protocols may not take these into consideration. Otherwise, it will result in an
unnecessary increase of the overhead and the degradation of real-time performance. If these cases
occur very frequently for a certain application, we should use the connection-oriented network
layer service. If the information of a certain protocol, such as billing information, is extremely
important, the application protocol should take measures to ensure a high reliability of the
information.

From the operation process we can see that for TCAP, component loss is usually presented as
operation response timeout. Component repetition and wrong sequence are normally impossible to
detect, unless it is the last returned result component (RRL). In this case, the component sublayer
will refuse to process it.

9.4.3.8.6 Session handling process of TCAP

1. Basic handling process

In a signaling process, session interaction takes place between two peer entities. There are
two types as non-structured and structured sessions. The former has only one message, which
doesn’t need management, while the latter must be granted with the transaction ID, so as to
differentiate the different sessions. Assignment and management of transaction IDs are executed in
the process TCAPTSL.

-344-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

A basic structured session process includes three stages: session start, hold and end. Here we
will mainly describe the end mode of a session: basic mode and preset mode.

1) Basic mode

The user sends the TREND request primitive to the transaction sublayer. The primitive end
type parameter indicates that it is a basic ending. After the transaction sublayer receives this
request, it sends an ending message to the opposite side and all components originally stored that
belong to this session are sent together with this message. After the receiving side gets this END
message and transfers it to the user, it will abort all components of this session that are not yet sent
out.

2) Preset mode

This mode indicates that the application entity itself knows when to end the dialog. When the
application signaling protocol runs to a designated point, the user sends to the transaction sublayer
the TR-END request primitive, in which the end mode parameter indicates it as preset end. Here,
the transaction sublayer will not send any END message to the opposite side and the component
sublayer will abort all components of the dialog that is not sent out. Correspondingly, the peer end
user also knows when this session should end and will end this session in the preset mode.

In whatever mode to end a session, after TCAP receives a corresponding primitive request or
indicator, it will resume the transaction status diagram and all status diagrams belonging to the
session to idle status, without checking whether the operation request has received the final return
result.

2. Abnormality handling process

Abnormal cases include:

1) Receiving one message with unobtainable destination transaction ID (unrecognizable or

unavailable) or an illegal number that is not yet assigned;

2) Receiving one message with a legal destination, but the message type is not consistent
with the transaction status diagram. In this case, the receiving end (process TCAPCSL) will
process it according to the source end transaction ID number first and then make corresponding
processing;

3) If the source end transaction ID number can not be obtained, then this message is aborted,
without being handled at all. That is to say, neither the aborted message is sent, nor is the
transaction ended;

4) If the source end transaction ID is available, then an aborting message is generated,

showing the protocol aborting reason (PABORT), to be sent to the source end. After receiving this

-345-
Chapter 9 ZXC10-HLR/AUC (V3.0)

message, if the source end checks and finds that this ID is actually assigned, it ends this
transaction.

In whatever cases, the whole wrong TCAP message should be aborted.

After the peer end receives the aborted message, its transaction sublayer will do the
following:

1) If the aborting message contains the “user aborting information”, it will use the TR U-
ABORT primitive to notify the user;

2) If the aborting message contains the “protocol aborting reason”, it will use the TRP-
ABORT primitive to notify the user;

3) In the above two cases, all messages not sent out by this transaction are aborted, and the
transaction status diagram returns idle.

9.4.4 Service Processing Subsystem

Service processing of the ZXC10-HLR/AUC (V.3.0) is the core part of the whole system, mainly
including the MAP signaling management and subscriber data management.

In the CDMA system, information interaction between the HLR/AUC and other functional
entities (MSC and VLR) is performed via the HLR/AUC service processing subsystem.

The service processing subsystem consists of the mobile application module, the transfer
layer module and the message distribution module. Its structure is shown in Fig. 9-38.

The service processing subsystem implements various service functions, including subscriber
mobility management, call processing services, supplementary services, short message services,
radio intelligent services and operation & maintenance services.

-346-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

Service processing sub-module

Mobile application (MAP) module

Transfer module (TM)

Message distribution (MD) module

Fig. 9-38 Structure of the service processing subsystem

9.4.4.1 Message distribution module

The message distribution module is composed of the TMD sub-layers and the MMD sub-layers.
Here, the TMD sub-layers are located in respective CPM nodes, while the MMD sub-layers are in
the respective service processor nodes. Signaling messages are evenly distributed between the
TCAP layer of the CPM nodes and the TM layer of the MAP nodes. The distribution of the MD
module is shown in Fig. 9-39.

CPM 1 CPM n
SS7 SS7

TMD …… TMD

MAP 1 MAP m
MMD MMD
……
TM TM

MAP MAP

Fig. 9-39 MD distribution structure

The message distribution module implements the following functions:

-347-
Chapter 9 ZXC10-HLR/AUC (V3.0)

1. Load balancing;

2. Dynamic distribution and management of the session resources;

3. Load recording;

4. Check and alarms of the connected nodes;

5. Dynamic updating of the configuration;

6. Disconnection of the service processing module HSM;

7. Version updating of the service processing module HSM;

8. TCAP message packing, unpacking and processing.

9.4.4.2 TM
TM is not an independent structural layer as stipulated in the standard protocol, but one part of the
MAP application layer. Since its functions are relatively independent, it is separated from the
software modules. It mainly manages the sessions between the application layers, and can be
divided into the session processing unit, service request unit and service execution unit.

The transfer layer receives messages sent from the MAP, including session processing
messages and service messages. It converts the session messages into the TC session processing
primitives and then sends these session messages to the TCAP for management of sessions
between the entities on the same layer. The service messages are encoded through ASN.1 to be
converted into the TC component primitives, and then the component messages are sent to TCAP.
In the same way, the transfer layer receives the TCAP messages. Session messages are converted
into MAP session messages and then forwarded. Finally, the component messages are received
from TCAP, and then decoded via ASN.1. The service messages are sent to the application layer.

9.4.4.2.1 Mobile application module

The relations between the mobile application module and other modules and its internal module
division are shown in Fig. 9-40.

-348-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

DB interface module

HLR/AUC MAP module

OMM interface sub-

Service processing sub-
module module

Resources management
Control sub-module
sub-module

TM

Function invoking interface

Message invoking interface

Fig. 9-40 Structure of the service processing module

9.4.4.2.2 Control sub-module

It receives various messages sent from the TM, the OMM interface sub-component and other
components or processes, invokes the resources management sub-module and the corresponding
processing functions in the service processing sub-module according to the resources status and
message types. The program logic is shown in Fig. 9-41.

The control module receives various messages sent from the transfer layer TM, OMM and
other processes (such as accessing the database), and then classifies and processes them.

1. For the MAP signaling sent from the transfer layer TM, the control module invokes the
resources management module to query or create the corresponding data areas, and invokes
different processing functions in the service processing module according to the different MAP
signaling.

2. For the operation & maintenance command sent from OMM, the control module invokes
the corresponding OMM functional module.

3. For messages sent from other processes, it invokes different processing functions.

-349-
Chapter 9 ZXC10-HLR/AUC (V3.0)

Start

Receive messages from outside

Message types

Messages from other

Messages from OMM Messages from TM processes

Invoke the resources Invoke the resources

management module management module Invoke the corresponding
processing function

Invoke the service processing Invoke the service processing

sub-module sub-module
OMM processing function MAP processing function

Fig. 9-41 Processing flow of the control sub-module

9.4.4.2.3 Service processing sub-module

The service processing sub-module processes various types of services, receives the invoking of
the control sub-module, and implements corresponding processing according to different cases.
During processing, this module might invoke the DB interface module, to query and modify the
subscriber information (function invoking). Meanwhile, this module directly sends the information
to be sent to corresponding modules (TM and OMM interface sub-component), as shown in Fig.
9-42.

During processing, it invokes the resources management sub-module to obtain related

resources.

The CDMA mobile communication system ZXC10-HLR/AUC can process the following
services: mobility management services, operation & maintenance management services, call
processing services, supplementary services, short message services and radio intelligent network
services.

-350-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

Service processing sub-module

Mobility management services

management services
Operation

Call processing services

Supplementary services

Short message services

Wireless intelligent services

& maintenance

Fig. 9-42 Processing flow of the service processing sub-module

1. Mobility management services

1) When the subscriber location is updated, the service processing sub-module performs
related HLR processing;

2) When VLR is faulty and restarted, the service processing sub-module triggers the HLR
recovery program during service processing, so as to recover the data;

3) When HLR is faulty, the service processing sub-module notifies the related VLR of this
message after system restart;

4) The Operation & Maintenance Center (OMC) deletes subscribers from VLR. After VLR
informs HLR about this, the service processing sub-module performs related processing of HLR.

5) The service processing sub-module also implements authentication processing.

6) When the HLR subscriber subscription information changes, the service processing sub-
module automatically sends a synchronization message, so as to ensure that the data registered in
VLR is consistent with the data in HLR.

2. Operation & maintenance management services

Operators can handle such matters as mobile phone loss reports and arrears of subscribers via
OMC.

3. Call processing services

-351-
Chapter 9 ZXC10-HLR/AUC (V3.0)

The service processing sub-module queries the VLR where the subscriber is currently located
for the roaming number and returns this route information to GMSC of the caller subscriber.

4. Supplementary services

1) The service processing sub-module performs the functions of registering, deleting,

activating and deactivating of various supplementary services;

2) The service processing sub-module checks and registers the service operation password of
the subscriber in HLR.

5. Short message services

It cooperates with the ZXC10-MSC/VLR and ZXC10-SC for short message-related

processing.

6. Radio intelligent service

It cooperates with the ZXC10-MSC/VLR/SSP, ZXC10-SCP and other IN functional entities

for processing of the related radio intelligent services.

9.4.4.2.4 Resources management sub-module

It manages sessions and tables related to the MAP process data areas of the subscribers. Besides,
this sub-module also provides function invoking interfaces for the control sub-module and the
service processing sub-module.

In the MAP module, 2,000 data areas are created. Such process data areas are used according
to the rule of “first released, first used”. This module manages the use of the resources in the MAP
data areas in the following way, as shown in Table 9-2.

Table 9-2 Resources in the MAP data areas

Data area 0 1 2 3 ... i … n-1**

index No.
Occupied/The N-1* Occupied 3 i ... j .… 0***
next idle data HEAD TALL
area index No.
Notes: *…: If the index No. is “0”, it specially refers to the quantity of idle data areas;

** : n indicates the maximum quantity of the subscriber data areas provided by MAP;

*** : The end of the idle queue indicated with “0” means that there is no subsequent idle area index No..

A one-dimensional number set is used to manage the idle MAP data areas. The subscript of
the number set indicates the index No. of the MAP data area, and its value indicates the index No.

-352-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

of the next idle MAP data area. The value of the number set with subscript 0 indicates the quantity
of currently existing idle data areas. Two pointers are respectively used to indicate the index No.
of the first idle data area and the index No. of the last idle data area.

9.4.5 Database

The HLR/AUC database falls into two parts: the subscriber database stored on the database
module and the system management database on the OMM Server, as shown in Fig. 9-43.

OMM server

System maintenance service Maintenance

Service processor 1 module console

Service handling
console 1
Service processor 2
System management
database
Service handling
console 2
。。。

…
Service processor n
Service handling module Service handling
console n

Mobile subscriber Mobile subscriber

database database …

Fig. 9-43 Database structure

9.4.5.1 System management database

The system management database on the operation & maintenance server stores various basic data
necessary for the system running, such as system structure configuration, system security
information, system running status, service handling console accounts, service handling console
authorities, service handling console operation logs, etc.

-353-
Chapter 9 ZXC10-HLR/AUC (V3.0)

The OMC mainly implements the following functions via the maintenance console and the
system management database:

1. It manages and configures the system settings, and sends the new configuration data to
respective parts of the system.

2. It performs security control over the subscriber’s use authorities through the system
defined rules or by default.

3. It collects and processes various information (such as alarms) generated during system
running, so as to implement remote monitoring management over the system.

4. It provides management of system module versions and implements system upgrading.

The service handling console mainly implements the following functions via the service
handling console service module and the system management database:

1. Service handling console accounts management (account generation, cancellation,

prohibition, etc).

2. As required by the specific service handling console, it controls the authorities of the
service handling console to meet different client requirements.

3. It records various operation information of the service handling console.

4. It responds to the service requests of the service handling console, to implement the service
modifications required by the mobile subscribers and inform the service processor of the service
modifications.

9.4.5.2 Subscriber database

The subscriber database, as the central database which stores the basic subscriber information,
subscriber services information, short messages information, intelligent services information and
authentication information, performs the following functions:

1. It performs storage management of the subscriber information and the system data.

2. It implements integrity restriction on subscriber basic information and service information

according to the subscriber defined rules or by default.

3. It provides corresponding operation authorities to different subscribers to implement data

security management.

4. It provides reliable data protection functions, to perform data dumping and recovery, as

-354-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

well as processing of system logs and application logs.

9.4.5.3 Data security

Redundant Arrays of Inexpensive Disks (RAID) are selected for the ZXC10-HLR/AUC (V3.0)
system as the system storage devices, and all data required by the ZXC10-HLR/AUC (V3.0)
system are stored in the disk arrays.

The ZXC10-HLR/AUC (V3.0) database system is designed in a client/server structure,

demanding for an efficient, stable and reliable system. Therefore, the disk system with higher
performance/cost ratio is preferred.

Disk arrays are employed in the RAID technology to maximize the disk performance and the
data validity. With data distributed into the redundant disk arrays, both the read/write operations
and the data validity are improved. Furthermore, the read/write performance is improved through
multiple magnetic heads accessing multiple disks at the same time, with throughput efficiency also
improved. The data validity is improved as a result of redundant storage of the data.

By integrating the disk mirroring, stripping and parity check techniques, the RAID
technology improves the data storage technology.

The disk mirroring technology: to store the same data on two independent disks in the array.
This one-to-one redundancy mode enhances the data validity and security. If one of the disks fails,
the other one with exactly the same data can be immediately in use.

The stripping technology: to distribute data on multiple disks. In this way, all disks in the disk
arrays can be used simultaneously in the operation, thus greatly improving the disk performance.

The parity check technology: to store the data parity check information on an independent
disk or on one partition of each disk at the time of distributing the data onto multiple disks in a
stripping mode. If data failure occurs, such information can be used to re-establish the data.

Based on different functions, the common RAID modes can be divided into six modes: of 0,
1, 2, 3, 4 and 5. At present, in the ZXC-HLR/AUC (V3.0) system, the database stores and
manages data in the RAID0+1 mode.

9.4.5.4 Interfaces between the database and service processing subsystem

The interfaces must be designed to meet the requirements of high reliability, high efficiency,
consistency, and convenient expansion. In the ZXC10-HLR/AUC (V3.0) system, the interface
software mainly consists of the following independent modules: the basic service interface
module, supplementary service interface module, short message interface module and intelligent

-355-
Chapter 9 ZXC10-HLR/AUC (V3.0)

service interface module.

9.4.6 Operation & Maintenance System (OMS)

It mainly manages the subscriber data, operates and maintains such aspects as system monitoring,
alarms, version management, logs observation, performance measurement, service statistics and
data management, and provides standard interfaces for the OMC in the whole CDMA network
system.

9.4.6.1 OMS overview

The OMC is divided into three major modules according to their functions: the server, the
maintenance console and the service handling console. Each module is further divided into the
foreground and background sub-modules. The independence of each module and the interface
universality between the modules are of great importance so as to adapt to the system structure
changes and the addition of functions.

The system structure is as shown in Fig. 9-44.

Database
CPM Service processor

Server
(Windows NT server)

Client Client Service handling console

(Windows Nt workstation) (Windows Nt workstation)

Fig. 9-44 OMM system structure

9.4.6.1.1 OMM server

The OMM server implements the pre-processing of accessing the system (including management
of multi-terminal tasks) by peripheral modules (the service handling console, maintenance console

-356-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

and communication routers), and it provides multiple communication modes such as X.25, DDN,
TCP/IP and E1. Besides, the server also implements information receiving/sending management
of the background and foreground.

9.4.6.1.2 Service handling console

The service handling console module belongs to the man-machine operation console in the
ZXC10-HLR/AUC system. It manages the subscriber information, including adding of mobile
subscribers, query, modification, deletion of mobile subscriber information and support to
processing for batch subscribers. Furthermore, the service handling console implements printing
of relevant mobile subscriber information and provides abundant on-line helps (answering upon
asking). Meanwhile, it supports the virtual HLR function.

9.4.6.1.3 Maintenance console

It is a maintenance console for the WINDOWS operating system, enabling the subscriber to
conveniently and flexibly operate and maintain the HLR/AUC. The maintenance console mainly
provides the following management & maintenance means:

Authorities management, performance statistics, service observation, data configuration, SS7

front-end processor alarms, service processor alarms, diagnostic test, files management, SS7 front-
end processor version management, service processor and service handling console version
management, clock management, maintenance logs, signaling tracing, SS7 maintenance, etc.

9.4.6.2 Description of the operation & maintenance subsystem

9.4.6.2.1 Service handling console system

The service handling console of the ZXC10-HLR/AUC system has powerful functions, and it can
be located in the local end, or connected to the remote end. It accesses the system via different
communication modes (e.g., X.25, DDN, TCP/IP and PSTN). Besides, the service handling
console provides a friendly operation platform for subscribers. Operators can implement
management over mobile subscribers through all the functions provided by the console. Such
management includes:

1. Subscriber login to the service handling console;

2. Canceling of login accounts;

3. Subscriber password setting of the service handling console;

4. Query of subscriber attributes in the service handling console

5. Account opening: providing the service of accessing the network immediately upon

-357-
Chapter 9 ZXC10-HLR/AUC (V3.0)

purchasing the mobile phone or accessing the network with the subscriber’s own mobile phone;

6. Query of the mobile subscriber information;

7. Modification of the mobile subscriber information (excluding the location information):

loading/canceling of service items; default settings of the mobile subscriber information
(subscriber settings are permitted by default or at adding in batches);

8. Deletion of the mobile subscriber information;

9. Query/changing of the subscriber’s password;

10. Processing of the location information: query, modification and deletion (subscribers with
special authorities can make such operations);

11. Processing of the authentication information: query and modification (subscribers with
special authorities can make such operations);

12. Default setting of the mobile subscriber information;

13. Processing of the subscriber information in batches;

14. Printing of the specified mobile subscriber information;

15. Providing abundant help information;

16. Implementing multiple connection modes of the service handling console (TCP/IP, X.25,
Ethernet and PSTN).

As required by the subscriber, other management functions can be provided via software
upgrading.

9.4.6.2.2 Authorities management system

In order to guarantee the security of the ZXC10—HLR/AUC system, to prevent the malicious
destruction, to restrict the unauthenticated mobile communication or error mobile communication,
and to control the operation authorities of each operator, the whole system has to be put under
systematic management.

To meet this need, the “Operator authorities management” is set in the background OMS of
the ZXC10-HLR/AUC system. The operator authority management system manages the operation
authorities of the operators. Subscribers are allowed to set operators in different categories, so that
different subscribers can be different operators with different authorities, and perform
corresponding operations and maintenance over the mobile switching system.

-358-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

9.4.6.2.3 Performance statistics

The ZXC10-HLR/AUC performance statistics system is designed based on the national standards.,
with perfect functions. It can observe the use status of the global traffic and system resources in
real time. The performance statistics background is designed in the Client/Server network
architecture.

The maintenance terminal can flexibly define the performance statistics measurement work.
One performance statistics measurement task includes the start/end time, days of duration, set of
statistics measurement objects, and the granularity period. The maintenance terminal can generate,
delete, modify or suspend/recover the performance statistics measurement.

The specific functions are as follows:

1. Over 50 items of HLR performance data;

2. The foreground data are fixed at 5-minute granularity, with the measured data sent to the
background at a 5-minute interval.

3. The foreground and the background shake hands with each other every 15 sec, and the
handshaking message is sent continuously when the link is broken until the connection is restored;

4. Multiple terminal subscribers can define several measurement tasks, and each
measurement task can be respectively designated with measurement items, measurement time
ranges (plans), etc.

5. According to the measurement task corresponding to each terminal, the measurement data
designated in the measurement task are sent to the designated terminal;

6. The measurement results are saved into the database based on a 5-minute granularity for
the background history query, analysis and reports.

9.4.6.2.4 Alarm system

The ZXC10-HLR/AUC alarm system falls into the SS7 front-end processor alarm, service
processor alarm and database alarm. The SS7 front-end processor alarm is employed to monitor
the running status of CPM. The service processor alarm is to monitor the core module of the
ZXC10-HLR/AUC system-the service processor. The database alarm is to monitor the database
nodes.

9.4.6.2.5 Service observation

In the development and debugging stage of the ZXC10-HLR/AUC system, service observation
provides a dynamic debugging observation tool for the user. It features simple operation, correct
and reliable information provision and abundant contents. Via the HLR service observation system

-359-
Chapter 9 ZXC10-HLR/AUC (V3.0)

and on the maintenance console, users can in real time observe the process data area use status of
the foreground service processor in the ZXC10-HLR/AUC system. Furthermore, they can specify
the data content of a specified data area and observe the service failure data in real time.

9.4.6.2.6 Data configuration

Data configuration management of the ZXC10-HLR/AUC configuration management system is
composed of two parts: service processor data configuration and SS7 front-end processor (CPM)
data configuration.

Subscribers can implement many data configuration functions on the maintenance console,
and all these functions can be implemented via the control modules on the interface. The details
are as follows:

1. Query: The terminal sends a query command to the server, and the server will return the
query results to the terminal after the command is executed. Therefore, query will not result in
inconsistency between the server data and the MP data.

2. Modification, deletion, creation and cancellation: After the subscriber performs the
operation, if the data in the server is inconsistent with that on MP, both data should be coordinated.
After coordination, the data transfer function should be started to transfer the changed data to the
foreground MP.

3. Configuration: backup and recovery of the configuration data.

9.4.6.2.7 Diagnostic test

The diagnostic test system functions to test the communication control system of exchange,
switching network, interface units and resources device boards, and locate the fault to a specific
board or a connection between the boards according to the test result.

For the diagnostic test of an object under test, the test resources should first be applied for to
the database via a normal interface before the test is carried out. After test, the resources are
returned to the database. In this way, the normal service work of the exchange is not affected
during the system test.

In the diagnostic test, concurrent processing should be applied as much as possible for the
selected test objects. In this way, the test time is largely reduced and the efficiency is improved.

For one object to be tested, the test contents usually cover whether the communication is
normal, whether the connection with the switching network is normal and the functions within the
board are normal.

The diagnostic test includes the intra-module test and inter-module test. The intra-module test
is mainly used to test whether the followings are normal: functions of every component unit, links

-360-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

between the units and MPs, voice channels between units and the switching network in a module.
The inter-module test is mainly used to test the communication and voice channels of the adjacent
modules.

The diagnostic test includes the routine test and the instant test. In both tests, the object to be
tested can be selected through the user-friendly interface. For the routine test, the startup cycle and
startup time can be set.

9.4.6.2.8 Files management

The file system provides read/write support for the processes. When the file system is located in
tasks with low priorities in the system, it can be seized by other tasks with higher priorities. For
concurrent file access requests from multiple processes, the file system puts them in a queue based
on the “first in, first served” principle, in order to achieve mutual exclusion of the file operations.
The file management system can provide typical file management functions such as file listing,
file copying, file renaming and file deleting between the exchange foreground network MPs,
active/standby MPs and the background maintenance network terminals.

9.4.6.2.9 Version management

The version management system manages the upgrade of SS7 front-end processor versions and
service processor versions.

The SS7 front-end version management performs management and upgrade control over
versions of the SS7 front-end processor MP and respective peripheral processors. It can control the
simultaneous upgrade of active/standby MPs of 1~6 modules, and can automatically recover to the
previous version once the upgrade fails. During the upgrade process, the selected MPs will be
processed concurrently, thus greatly improving the upgrade speed. Such measures as re-sending on
timeout, block CRC check and version file CheckSum check are taken to ensure the successful
upgrade. This system supports remote upgrade. Version upgrade is performed by first copying
from the background network to the central module (multi-module) in the exchange, then
simultaneously upgrading other modules attached to the central module by the central module.
Therefore, even in the case of slower remote transmission, the version upgrade of multi-modules
will not take a long time, making the remote upgrade easy and feasible.

The version management system of the service processors and service handling console
enables the operator, on the background maintenance terminal, to query the detailed history
records of the running versions and old versions of all service processors and service handling
consoles. As required, the operator can select one or more modules to automatically load and start
the new version. Thus, working efficiency is improved, maintenance cost is reduced, and the
system reliability is enhanced.

During version updating and version loading of the ZXC10-HLR/AUC, the normal running
of other modules or units will not be affected. During the version upgrade, the system also

-361-
Chapter 9 ZXC10-HLR/AUC (V3.0)

provides the broken link check and various protective mechanisms, so as to ensure the accuracy
and reliability of version file transmission. All version information is stored in the background
database, and the service processor and service handling console respectively correspond to one
data table. As a result, security of the version information is guaranteed, and query and
management are facilitated.

9.4.6.2.10 SS7 system maintenance

SS7 maintenance falls into three parts: status observation, signaling statistics and signaling
tracing.

Here:

1. Signaling tracing part

It serves to trace the signaling messages on the signaling link and display the corresponding
interpretations, so that the maintenance personnel can discover the problems of signaling
interworking. The current system can trace the information of two message types: MTP and SCCP,
in addition, the system can trace the MTP test messages. Besides, after the SS7 tracing function is
set, the system will display the signaling messages discarded by MTP level-3 (excluding the
normally discarded messages).

2. MTP maintenance part

Some dynamic configuration information of MTP level-3 (signaling links, signaling link
groups and signaling route groups) can be viewed.

One can know what happened on the link via checking the MTP alarm records, facilitating to
locate the MTP fault. By checking the running status of the SS7 board, one can know the current
status of the SS7 board and the links on it as well as the status change of the signaling board,
facilitating the maintenance of MTP level-2.

3. SS7 statistics part

It mainly deals with the statistics of the MTP part, e.g., times of faults on the signaling link,
times of changeover, times of changeback, etc. All these statistical results provide some
performance data of the MTP part to the equipment buyer, facilitating link maintenance.

9.4.6.2.11 Maintenance logs

For better operation and management over the exchange by the equipment buyer, the ZXC10-
HLR/AUC provides a log checker to be used for system management and maintenance.
Operations on the exchange by the operator are automatically recorded in a certain mode, for the
operator’s reference in a specific occasion. The log files are stored in the server, and can be
viewed from corresponding terminals.

-362-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

9.4.7 Redundancy Design for Software Reliability

The following methods are used in the ZXC10-HLR/AUC, the CDMA mobile communication
system, to improve software reliability.

9.4.7.1 Hierarchical and modularized design

The ZXC10-HLR/AUC software system can be divided into the sub-systems as follows:

1. Operation supporting sub-system;

2. Database subsystem;

3. Signaling subsystem;

4. Service control subsystem;

5. Operation and maintenance subsystem.

These subsystems are independent with each other in a hierarchical structure, as shown in
Fig. 9-45:

Operation & maintenance subsystem

Service control subsystem

Signaling subsystem

Database subsystem

ZXG10-HLR/AUC(V3.0) hardware platform

Operation support subsystem

Fig 9-45 Schematic diagram of software structure

The running support system is a virtual machine as the result of the first expansion on the
basis of the hardware platform. Later, each addition of a subsystem layer is equivalent to an
expansion on the hardware platform, forming one more new virtual machine. Therefore, so long as
the lower layer module design is correct, a solid basis is formed for the design of upper layer

-363-
Chapter 9 ZXC10-HLR/AUC (V3.0)

function modules, improving the system reliability.

According to the high cohesion and low coupling principle, each subsystem is further
subdivided into multiple functional modules so as to enhance system reliability.

9.4.7.2 System running monitoring and logs

The operation support subsystem provides the operation supervision function. It can detect such
faults as too frequent process operations, the process endless loop, the disconnection 12 and
disconnection 13, and can automatically restore from failures. When the system becomes
abnormal, the running site data will be recorded to the logs on the disk. Data in the logs can help
R&D personnel quickly spot and remove troubles, so as to enhance system reliability.

Various modules of the operation and maintenance subsystem will write the abnormalities
detected in the running process to the log database. By querying the log database, the maintenance
personnel can timely detect and remove the faults.

9.4.7.3 Resource management

9.4.7.3.1 Memory resource management

Two modes are adopted in the ZXC10-HLR/AUC software system to avoid memory resource
exhaustion. The first mode is static distribution, suitable for cases where the required number of
memories is invariable, specifically defining the global array in the program. The second mode
dynamically distributes the memory in the course of the system initialization, suitable for cases
where the required number of memories is not invariable. Both modes avoid the dynamic memory
distribution in the system running process to keep the memory resources from exhaustion, hence,
raising the system reliability.

9.4.7.3.2 Data area resources management

When the system is delivering a short message, it will first apply for a process data area to save
the relevant information. After receiving a delivery response, it can process it according to the
saved information, and release this process data area after processing. But if the system fails to
receive any delivery response message for some reasons, this process data area will be seized for a
long time, causing a decrease in available system resources and a final exhaustion of all system
process data areas. Thus, normal service handling can no longer proceed.

To avoid the above phenomena, the system records the period each process data area is
seized, and queues all the seized data areas by the sequence of seizure (in the link table mode).
Then, it regularly checks the seizure duration of the process data area that is seized the first. If the
duration from the time to current time exceeds a specific threshold, it can be regarded the
messages in the process data area have lost. The process data area will be released.

-364-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

9.4.7.4 Prevention of pointer overflow and stack overflow

Each process in the system has its own stack, and the size of a stack is invariable. The local
variables defined in the process functions seize the address space of the stack. Too many local
variables defined will lead to stack overflow, i.e. interruption 12. To avoid this, long local
variables are seldom defined in the process functions, but defined as the global variables instead.
This method reduces the stack overflow possibility, thus enhancing system reliability.

The system receives messages from the bottom layer, including the message event No.,
message pointer, message length, etc. The message pointer points to the memory space that
contains this message, and the message length indicates the size of the memory space. The system
will access the message contents according to the message pointer. If the message length is shorter
than expected, then pointer overflow will occur when the system accesses the memory area
containing the message, which will lead to system collapse.

To avoid this, the system will first compare the message length parameters to see whether it is
shorter than expected each time it receives a message. If it is, the system will reject this message
and regard it as an error. Otherwise, normal processing will be conducted.

9.4.7.5 Monitoring program

The software watchdog is adopted at the OMC Server to monitor the running of the server
program. The software watchdog periodically sends handshake messages to each server program.
If the server program does not return any response, the software watchdog regards it as faulty,
cancels the server program process, and restarts the program.

9.4.7.6 Data reliability

9.4.7.6.1 Data access

When different subsystems in the system access such information as subscriber data and SM data,
intelligent service data, different authorities will be allocated according to different level
requirements. The subsystem cannot conduct unauthorized operations and damage system data.

9.4.7.6.2 Data storage

Important data in HLR/AUC, such as subscriber service information and SM information are
stored and managed with mature and reliable commercial database systems. They are saved on
disks and can be backed up to magnetic tape drives, or CDs. Once the data is lost due to system
fault, they can be restored to the status of latest backup.

9.4.7.6.3 Data handling

In the data handling process, the commercial database transaction handling mechanism is used to

-365-
Chapter 9 ZXC10-HLR/AUC (V3.0)

put related handling into the same transaction so as to ensure that the handling of associated data
will not damage the data integrity and consistency. By locking records, records consistency is
ensured during modification or deletion of the same record performed by multiple handling
processes.

9.4.7.6.4 Excellent programming style

Before the programming starts, both general and detailed designing of the system should be
provided, an SDL drawing should be worked out according to the processing flow, and
programming is conducted according to the SDL structure. The programs should be consistent
with the design descriptions one by one so as to satisfy the design requirements.

The programming of all modules inside the system strictly follows the standard programming
specifications. Make sure that the programming modes are all the same so as to facilitate reading
and maintenance, arrange the intra-module structure according to the hierarchical modular mode,
reduce mutual interconnection between each subsystem, nominate all global and local variables in
a uniform mode, judge all input abnormalities inside the system, program the disconnection point
and perform the alarm processing so as to ensure that the mutual interfaces are correct and the
errors can be traced.

9.5 ZXC10-HLR/AUC Service Function

HLR is a core database used for storage of related subscriber’s information, e.g. access capability
of mobile subscribers, contracted services, etc. Besides managing subscriber data, HLR has to
work with other functional entities in the CDMA mobile communication system (e.g. MSC, VLR
and SC) in the CDMA system, in order to conduct mobility management and call processing. AUC
is the authentication center processing services related to security management.

The chapter first introduces all types of service functions of HLR/AUC, and then goes on to
describe detailed ways to implement all service processing procedures related to the service
functions.

9.5.1 List of Various Service Functions of HLR/AUC

The service functions that HLR/AUC can implement with the coordination of other functional
entities are listed in Table 9-3.

-366-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

Table 9-3 Various service functions of HLR/AUC

Service type Service name

Mobile telecom Telephone service
services Emergency service
Fax service
SMS
Voice mailbox service
Supplementary Call forwarding busy
services Call forwarding unconditional
Call forwarding no reply
Call forwarding default
CID
CID restriction
Subscriber PIN access
Subscriber PIN capture
PIN call acceptance
Selective call acceptance
Do-not disturb service
Call waiting
Call forwarding
Three-way calling
Message waiting notice
Download voice messages
Priority language
Telephone conference
Remote service control
IN services Prepaid service
Wireless virtual private network service
AD service
Collect call service
SMSs Point-to point SMS
Chinese SM
All users broadcasting
Cell broadcasting
Value-added services: assisted operator position, automated
operator position, information desk, EMAIL, WEB,
securities trading, super paging, mobile banking, etc.

-367-
Chapter 9 ZXC10-HLR/AUC (V3.0)

Service type Service name

SMS interworking between CDMA and GSM

Among the above services, the telecom services and supplementary services are provided
through the co-work of ZXC10-MSC/VLR and ZXC10-HLR/AUC. And SMSs are performed via
ZXSC100, ZXC10-MSC/VLR, ZXC10-HLR/AUC and ESMEs. The IN services are performed
via joint work of ZXC10-MSC/VLR/SSP, ZXC10-SCP and ZXC10-HLR/AUC.

The system is designed to cater to the future communications development trend and satisfy
the requirements for the subsequent addition of various new services.

The following are detailed introductions to service functions of mobile telecom services, data
services, supplementary services and IN services.

9.5.2 Mobile Telecom Services

In a CDMA network, the most basic services of the ZXC10-HLR/AUC (V3.0) are telecom
services. The following paragraphs will first present a brief description of the mobile telecom
services, and then detail an analysis for the processing process of the mobile telecom services.

9.5.2.1 Telecom services

9.5.2.1.1 Telephone services

Telephone services are one of the telecom services defined by CDMA specifications, and it is the
service most widely used in the CDMA mobile communication system. The telephone services
enable voice communications between CDMA mobile subscribers, or with subscribers in other
telecom networks (e.g., GSM, PSTN, and ISDN).

9.5.2.1.2 Emergency service

Emergency service permits mobile subscribers to initiate calls to the emergency call center (such
as 110 police call in China) in the vicinity. The emergency service, a kind of telecom service, is
similar to the telephone service but with simpler and faster call establishment. The CDMA mobile
communication system has definitions for various emergency calls, and, of course, the telecom
operators can set their emergency call numbers based on the actual situations in their own
countries or regions. Emergency calls will be directed to the nearest emergency call center in the
mode of cell-oriented routing.

-368-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

9.5.2.1.3 Fax service

Fax service refers to such a communication mode that the graphic and text information to be sent
is decomposed into a number of “pixels”, and these pixels are converted into electrical current
information, by means of which point-to-point transmission is implemented. The fax service
enables image and text communications between CDMA mobile subscribers, or with subscribers
in other telecom networks (e.g., GSM, PSTN, and ISDN).

9.5.2.2 Handling process of mobile communication services

The CDMA mobile communication system, ZXC10-HLR/AUC (V3.0) performs MAP signaling
handling, subscriber location registration, HLR/AUC and VLR troubleshooting. When VLR
deactivates a subscriber, the mobility management service invokes relevant service units for the
handling of HLR/AUC and authentication information. The makeup of the whole mobility telecom
management service is as shown in Fig. 9-46.

Location registration unit

Mobility management

VLR restart unit

service

Synchronizing-to-VLR data
unit

HLR restart unit

VLR subscriber deactivating

unit

Authentication processing unit

Fig. 9-46 Composition of mobility management services

Handling process of mobility communication services is described as follows:

9.5.2.2.1 Location registration

Due to the mobility of mobile subscribers, the locations of mobile subscriber tend to change from
time to time. In order to spot the mobile subscribers’ location information during the processing of
the call service, SMS and supplementary services, and to enhance the utilization rate of radio
resources, the system requires that the mobile subscribers’ locations in the network be registered
and the mobile subscribers’ activation statuses be reported, that is, location registration.

-369-
Chapter 9 ZXC10-HLR/AUC (V3.0)

The CDMA system supports the following nine registration types:

1. Power-on registration: When the MS is powered on or switched from an analog system to

the CDMA system, MS initiates a registration.

2. Power-off registration: If the MS has already been registered in the current service system,
MS initiates a registration when power-off.

3. Periodical registration: When the timer is time out, MS initiates a registration.

4. Distance-based registration: When the distance between the current BS and the last
registered BS exceeds the threshold, MS initiates a registration.

5. Area-based registration: When MS enters a new registration area, MS initiates a

registration.

6. Parameter change registration: When MS enters a new system or when the parameters
stored in MS are changed, the MS initiates a registration.

7. Registration on demand: MS performs registration at the request of BS.

8. Default registration: When MS succeeds to send an initial call message or a paging

response message, the network can deduce to find the MS location, which can be regarded as
default registration.

9. Service channel registration: When the network has obtained the registration information
of an MS to which the service channel has been assigned, the network can notify MS that the
registration has been performed.

As described above, the location registration operation falls into multiple categories with
somewhat different handling processes. An example on its calling process is given as follows:

When a subscriber conducts power-on registration in a new area, MSC/VLR in the visited
area initiates a registration to HLR of the subscriber. If the subscriber has registered to MSC/VLR
in the roamed area, it is required to modify the location information of the subscriber for the
MSC/VLR in the roamed area instead of initiating registration to HLR. The process of initiating
the location registration operation to HLR is shown in Fig. 9-47.

-370-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

VLR HLR PVLR

RegistrationNotification(invoke)
(a)
RegistrationCancellation(invoke)
(b)

RegistrationCancellation(result)
(c)
RegistrationNotification(result)
(d)

Fig. 9-47 Registration operation flow

The workflow is described as follows:

Step (a): The VLR where MS is currently located initiates a location registration request to
HLR. HLR determines whether to allow this subscriber to register. If yes, then next;

Step (b): HLR initiates a registration cancellation request to VLR (recorded as PVLR) where
MS is previously located;

Step (c): PVLR responds, and then deletes the subscriber data and cancels the response from
the registration;

Step (d): HLR cancels the response from the VLR registration where the subscriber is
currently located;

9.5.2.2.2 VLR restart

VLR may be faulty due to various causes. At this time, VLR notifies all related HLR. HLR deletes
the faulty VLR address, indicating the subscriber roaming in the VLR cannot receive incoming
calls. It has to wait for the re-registration of the subscriber and restore the incoming call ability of
the subscriber. The handling process is shown in Fig. 9-48.

-371-
Chapter 9 ZXC10-HLR/AUC (V3.0)

VLR HL R

B u l k De r e g i s t r a t i o n ( i n v o k e )
( a)

B u l k De r e g i s t r a t i o n ( r e s u l t )
( b)

Fig. 9-48 VLR restarting service flow

The workflow is described as follows:

Step (a): VLR sends a message to HLR to indicate a VLR fault;

Step (b): HLR responds a message of successful operation to VLR, and deletes the VLR
address.

9.5.2.2.3 Data synchronization

When the subscriber contract information in HLR changes, it will initiate a synchronous message
to keep the subscriber data in VLR consistent with those in HLR. The service flow is shown in
Fig. 9-49:

Fig. 9-49 Data synchronization

The workflow is described as follows:

Step (a): VLR initiates a QualificationDirective request to VLR, and modifies subscriber
data;

-372-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

Step (b): VLR sends back a QualificationDirective response after successfully modifying
subscriber;

9.5.2.2.4 HLR restart

After restarting, HLR sends an UnreliableRoamerDataDirective message to VLR, which will
delete HLR-related data HLR after the reception. This process is shown in Fig. 9-50.

Fig. 9-50 HLR restarting flow

9.5.2.2.5 Data deletion

Data deletion means to delete subscriber records from VLR, including data deletion initiated by
HLR and data deletion notice initiated by VLR;

1. In the case that the subscriber roams to a new VLR, HLR, after receiving a location
registration message from VLR, will initiate a data deletion operation to the original VLR to delete
the subscriber data in VLR; The service flow is shown in Fig. 9-51.

The service process is described as follows:

Step (a): HLR, after receiving the location registration request of VLR where MS is located,
will initiate a RegistrationCancellation request operation to VLR (PVLR) where MS is previously
located so as to request PVLR to delete data of this subscriber;

Step (b): After PVLR deletes the data of this subscriber, it sends a response message to HLR.

-373-
Chapter 9 ZXC10-HLR/AUC (V3.0)

P VL R HL R

Regi s t r a t i onCa nc e l l at i o n( i nv ok e)
( a)

Re gi s t r at i o nCanc el l a t i on( r e s ul t )
( b)

Fig. 9-51 Process of data deletion flow initiated by HLR

2. If the subscriber makes no operation for a long time (flexibly set by the system
administrator, normally 24 hours) or if the system administrator requires deleting invalid
subscriber records in VLR via maintenance and management function, VLR will delete the data of
this subscriber and notify HLR. The service flow is shown in Fig. 9-52.

VL R HL R

MS I n a c t i v e ( i n v o k e )
( a)

MS I n a c t i v e ( r e s u l t )
( b)

Fig. 9-52 Flow of data deletion requested by VLR

The workflow is described as follows:

-374-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

a) The service VLR sends MSINACT containing parameters of the registration deletion type
to MS-related HLR, and deletes all records of MS in the memory.

b) HLR cancels the registration of MS (i.e. deleting the pointer point to VLR), and sends a
blank msinact to the service VLR to confirm the operation.

9.5.2.2.6 Security management

Technically, radio transmission is more vulnerable to interception and deceit than fixed line
transmission. But ZXC10-HLR/AUC guarantees system security with multiple measures.

1. Barring unauthorized mobile communications, by means of authentication;

2. Protecting subscriber privacy by encrypting;

3. Authentication Center (AUC)

The mention of security management must involve AUC. As part of ZXC10-HLR/AUC,

AUC is involved only in security management.

AUC is an authentication center, which provides the system with necessary data for
subscriber authentication and protects air interfaces from unauthorized usage. In ZXC10-
HLR/AUC, as HLR and AUC are the only function units in the whole network, the data of the two
closely correspond to each other, and the signaling access of AUC is sent via HLR. Therefore
HLR and AUC share one physical entity and perform HLR and AUC functions.

AUC of the system performs the following functions:

1) Storage of authentication data: Storing MIN/A-Key/SSD (the mobile subscriber

ID/authentication encryption key/shared encryption data) of each subscriber and authentication
algorithm CAVE;

2) Authenticating the subscriber, and generating the subscriber encryption key –

CDMAPLCM and SMEKEY;

3) Performing SSD updating process.

2. Authentication service

Authentication is to protect legal subscribers against the “intrusion” of fake, illegal

subscribers. Each registered user is assigned a subscriber number, Mobile Identification Number
(MIN) and an authentication key (A-KEY). The MIN and A-KEY are written into the subscriber’s
mobile phone by means of air activation service or special equipment. By means of SSD updating,
a Shared Secret Data (SSD) parameter is generated in both the AUC and the subscriber’s mobile

-375-
Chapter 9 ZXC10-HLR/AUC (V3.0)

phone, which are used for future authentication and encryption algorithm calculation. If VLR
visited supports SSD sharing, this SSD is also saved in VLR. The 128-bit SSD is divided into two
parts, which are respectively 64-bit SSD_A used for authentication calculation and the 64-bit
SSD_B for the encryption calculation.

The CDMA authentication principle is roughly the same as that of GSM system. VLR, AUC
or BSC sends a random number RAND to MS. MS in turn uses the internally-stored encryption
key SSD_A and authentication algorithm to calculate and obtain the result AUTH_MS, which will
be sent back to VLR or AUC. Then VLR or AUC uses the internally-stored encryption key SSD_A
and the same authentication algorithm to calculate and obtain the result AUTH_NET. If the two
results are the same after comparison, it is a legal MS, otherwise it is illegal. In practices, the
authentication service is somewhat different with that of the GSM system. The specific operation
is as follows:

1) In the GSM mobile communication system, AUC generates three parameter groups
(RAND, SRES, KC) used for authentication encryption in advance, and stores them in VLR for
direct access upon authentication. In the CDMA mobile communication system, authentication
parameters should be obtained by calculation for comparison in each authentication.

2) In the CDMA mobile communication system, there is an encryption key called as A key in
MS and AUC respectively. The encryption keys are kept in MS and AUC only instead of being
transmitted in the network. The encryption keys are not directly used for authentication. SSD (128
Bits, divided into SSD - A 64 bits and SSD - B 64 bits) is generated with a specific algorithm. MS
and AUC (or VLR) use SSD_A as a parameter of the authentication algorithm for authentication
purpose. This mechanism is known as a two-level privacy mechanism in some documents. The
SSD generation algorithm and the authentication algorithm are illustrated in Fig. 9-53

3) There are two authentication methods for CDMA, as described below:

A. The first method is that AUC or VLR generates RAND, which is sent to MS via the air
interface to instruct MS for authenticating. The process is called unique query;

B. The second one is that BS generates RAND, and transmits it to all MS of the BS via the
broadcast channel. Any MS can conduct authentication calculation with RAND. The
authentication result produced and RAND are sent to VLR or AUC during the access of network
for comparison of authentication.

Actually, the GSM system only provides the authentication process similar to the first
method.

-376-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

RANDSS D E SN

RANDS SD E SN A-key
56 32 64

S SD_Gener ation
Pr ocedure

S SD_A_NE W S SD_B _NE W

64 64

Schematic diagram for SSD generation algorithm↑

RAND_CHALLENGE ESN AUTH_DAT A SSD_AUTH

RAN D E SN MIN1 SSD_A

32 32 24 64

Auth_Signature
Procedure

AU TH_SIGNATURE

AUTHR
18

Fig. 9-53 Schematic diagram of authentication process

During the authentication, the message flow in which VLR requests HLR for authentication
is shown in Fig. 9-54.

-377-
Chapter 9 ZXC10-HLR/AUC (V3.0)

Fig. 9-54 Flow of VLR requesting authentication

Flow descriptions:

Step 1: VLR requests HLR/AUC to authenticate the subscriber;

Step 2: HLR/AUC sends an authentication response after authenticating the subscriber.

3. Encryption services

Encryption and decryption are implemented via the subscribers’ private long code mask
(CDMAPLCM). Normally, what the subscriber uses is the open long code mask calculated with
ESN of the subscriber. During the subscriber authentication, MS and HLR/AUC obtain subscriber
CDMAPLCM by calculating with CAVE algorithm. When the user requires encryption, the
network or mobile phone sends long code conversion requirements to convert the open long code
mask to CDMAPLCM. As no third party has access to the subscribers’ CDMAPLCM, it cannot
decode it correctly, or intercept conversation content, thus protecting the privacy of the
conversation content of the subscriber.

CDMAPLCM, as a parameter for AuthenticateRequest response, is transmitted to MSC/VLR

of the visited location via HLR/AUC. The signaling flow is same as the above.

9.5.2.2.7 Mobility call service

If the called subscriber is a mobile roaming subscriber, the MSC which the caller belongs to first
finds the HLR to which the called number belongs, and requests HLR to provide the route
information of the called number, HLR will ask the called subscriber’s VLR for a temporary local
directory number (TLDN). VLR assigns one TLDN to the called subscriber, and then sends it to
the caller’s MSC. This MSC sets up the links with the TLDN. The HLR handling process is shown
in Fig. 9-55.

-378-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

MSC HLR VLR

LocationRequest(invoke)
(a)

RoutingRequest(invoke)
(b)

RoutingRequest(result)
(c)

LocationRequest(result)
(d)

Fig. 9-55 Call processing service process

The process is described as follows:

STEP (a) the caller’s MSC requests HLR for the route information of the called mobile
subscriber;

STEP (b) HLR requests the current VLR of the called MS for the called subscriber’s TLDN;

STEP (c) VLR responds to the HLR request, and provides the TLDN to the called MS;

STEP (d) HLR provides the requested route information of the called MS to the MSC which
originates the call.

9.5.3 Supplementary services

This chapter will first present general explanations about the above-mentioned supplementary
services, which will be followed by detailed descriptions on how to implement these
supplementary services.

9.5.3.1 Supplementary services supported by the system

ZXC10-HLR/AUC (V3.0) supports the following types of supplementary services:

-379-
Chapter 9 ZXC10-HLR/AUC (V3.0)

9.5.3.1.1 Call forwarding supplementary services

Supplementary services of call forwarding include the following four types:

1. Call Forwarding Unconditional (CFU)

Call forwarding unconditional means that when this supplementary service of the mobile
subscriber is activated, all incoming calls to this subscriber will be unconditionally forwarded to a
third-party subscriber registered by this subscriber. The third party here might be a subscriber of
the mobile network, the public network, or the private network, or such an entity as the voice mail
box.

2. Call forwarding on busy (CFB)

With this service of a mobile subscriber is activated, all incoming calls to this mobile
subscriber when the subscriber is busy will be forwarded to a third-party subscriber registered by
this subscriber.

3. Call forwarding on no answer (CFNA)

No answer means that the called mobile subscriber does not hook off for a long time after the
MS rings. When the CFNA service is activated, incoming calls of the subscriber will be forwarded
to a third party if the mobile subscriber does not answer.

4. Call forwarding default (CFD)

CFD service forwards the incoming calls of the mobile subscriber to a third-party subscriber
when the mobile subscriber fails to respond or answer to a call or when he is unavailable (in a
blind area).

9.5.3.1.2 Call barring supplementary services

Call barring supplementary services include outgoing and incoming call barring services.

Outgoing call barring supplementary services include:

1. Subscriber PIN mobile access (SPINA)

When this service is activated, the subscriber will not be able to make calls on this MS unless
he can provide the correct PIN.

2. Subscriber PIN interception (SPINI)

With this service activated, when the subscriber dials a number meeting the predefined
conditions, such as local call, domestic call, international call etc., the corresponding PIN must be
input before the call can be continued.

-380-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

Incoming call barring services include:

1. PIN call acceptance (PCA)

The PCA service provides a call filtering function. When the MS that has subscribed for this
service acts as the called party, the calling party must input the correct PIN before the call can be
accepted.

2. Selective call acceptance (SCA)

The SCA service also provides a call filtering function. With this service is activated, the
subscriber can accept only calls from the numbers specified in the SCA filtration list, and all other
calls will be rejected.

3. Do-not-disturb (DND)

When this service is activated, the subscriber will be inaccessible to all incoming calls.

9.5.3.1.3 Number identification supplementary services

Number identification supplementary services include the following two types:

1) Calling number identification presentation (CNIP)

This service is of the called subscriber originated type. A subscriber who has applied for this
service can receive the caller’s number at the same time as he receives the call.

2) Calling number identification restriction (CNIR)

This service is of the caller initiated type, restricting the caller identification representation
for the called party.

9.5.3.1.4 Other supplementary services

1. Call waiting (CW)

When no channel is available for an incoming call, the called subscriber will be noticed and
the call will be put on waiting. The called subscriber can decide whether to answer the call or not.
Only one waiting call is acceptable at a time.

2. Conference call (CC)

This service enables conversation among multiple subscribers. With this service subscribed,
the subscriber can hold a telephone conference at any time as the controlling party. The controlling
party can add the number of the conference attendants by inputting telephone numbers one by one.
This type of communication is only suitable for the voice communication. Each subscriber keeps

-381-
Chapter 9 ZXC10-HLR/AUC (V3.0)

his/her original identity, and can get disconnected respectively or temporarily get disengaged from
the group call status.

3. Call transfer (CT)

During a two-party conversation, one of the subscribers can transfer the call to a third party
and disconnect himself, so that the other subscriber continues the conversation with the third
subscriber.

4. Three-way call (3WC)

This service enables the telephone conversation among three parties.

5. Preferential language (PL)

Through this service, the subscriber can select a prompt language suitable for him through the
network. Currently, two languages, Chinese and English, are provided for subscribers’ selection.
In the future, other languages can be added based on the actual situation for subscribers’ choice.

6. Remote service control (RSC)

By means of this service, the subscriber can perform certain operations, such as call
forwarding services, on other terminals (fixed telephone set or mobile phone).

7. Message waiting notification (MWN)

With the MWN service subscribed, when there is a voice message for an MWN subscriber,
the system will notify the subscriber.

8. Voice mail service (VMS)

This service enables the subscriber to retrieve his own mailbox message from the voice
mailbox system. ANSI664 specifies two operation methods:

1) The subscriber dials his own number.

2) The subscriber dials a short number.

The second method is recommended by the national standards for the subscriber’s
convenience.

9.5.3.2 Implementation of supplementary services

The ZXC10-HLR/AUC of the CDMA mobile communication system supports various
supplementary services. It can implement seven operations of supplementary services:

-382-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

authorization, de-authorization, registration, de-registration, activation, de-activation and

invocation. The following describes the above seven operations.

1. Authorization: An operation implemented by the service provider to make the service

available to the subscriber.

2. De-authorization: As opposed to authorization, it is an operation implemented by the

service provider to make the service unavailable to the subscriber

3. Registration: An operation implemented by the service provider or subscriber (mainly by

inputting necessary information) to make the service executable.

4. De-registration: An operation implemented by the service provider or subscriber to delete

the information input at the time of registration.

5. Activation: To make the subscriber enter the “Ready to provide service” status.

6. De-activation: As opposed to the activation operation, this operation cancels the

subscriber’s entering of the “Ready to provide service” status.

7. Invocation: The service execution process.

It should be noted that in such operations on supplementary services as authorization, de-

authorization and invocation are implemented internally by the service programs jointly with the
data base systems. Other operations are implemented through the call process, with the
corresponding program units shown in Fig. 9-56.

Registration unit of
supplementary services
Suppl ement ar y

De-registration unit of
servi ces

supplementary services

Activation unit of
supplementary services

Deactivation unit of
supplementary services

Fig. 9-56 Program units of supplementary services

-383-
Chapter 9 ZXC10-HLR/AUC (V3.0)

9.5.3.3 Processing of supplementary services

In the CDMA mobile communication system, various supplementary services are simplified. For
subscribers, operations of supplementary services are just like dialing a special number. For
example, call forwarding needs the subscriber to dial *FC + forwarding number; de-registration
needs the subscriber to dial *FC0, etc. The corresponding service flow is shown in Fig. 9-57.

VLR HLR

FeatureRequest(invoke) Step (a)

FeatureRequest(result) Step (b)

QualificationDirective(invoke) Step (c)

QualificationDirective(result) Step (d)

Fig. 9-57 Supplementary service operation flow

The process is described as follows:

Step 1: The MSC/VLR system at the visit location identifies that the subscriber intends to
perform supplementary service operation, and sends the supplementary service operation signaling
FeatureRequest to the subscriber’s HLR.

Step 2: HLR modifies the subscriber’s supplementary service information and returns
successful response.

Step 3: HLR requests VLR to modify the subscriber’s supplementary service information.

Step 4: VLR returns successful response to HLR.

-384-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

9.5.3.4 Intelligent services provided by ZTE’s CDMA mobile communication system

9.5.3.4.1 Brief introduction to WIN

The whole telecommunications network is developing towards an intelligent, broadband-based
and individualized network. The CDMA network is no exceptional. Along with the rapid
development of the mobile communications market and the arrival of the information era, the
subscribers are expecting the mobile service providers to provide a greater number of more
convenient services. The basic services and supplementary services that the CDMA mobile
communication system could offer have become far from satisfactory to mobile subscribers’
demand. In order to bring more profits to the service providers and provide more convenient,
flexible and cost-effective services, ZTE has duly rolled out the wireless intelligent network
(WIN) services.

WIN is a network where the intelligent network functional entities (e.g., SSF, SCF) are
introduced to the wireless network to implement the intelligent control over the wireless calls. It
completely separates services from controls, and therefore it can provide various telecom services
rapidly, conveniently, economically and flexibly. One of its distinct features is that it uses the
centralized service control points and database mode, without the need of modifying the software
system of every switch node, thus saving the time and investment and making it possible to
provide new services to the subscribers in a rapid and cost-effective way.

9.5.3.4.2 Intelligent services provided by ZTE’s CDMA mobile communication system

Using the well developed CDMA mobile communication system software/hardware platform,
ZTE embedded the SSP in WIN into ZXC10-MSC/VLR, so as to facilitate the service providers in
networking and provide perfect WIN services to the subscribers. The WIN services currently
implemented include:

Pre-paid charging (PPC) service

Wireless virtual private network (WVPN)

Advertisement (AD) service

Free-phone (FPH) service

The impending CDMA WIN Phase II and III services include:

AOC immediate charging

Location-based services and charging;

Enhanced call routing services.

-385-
Chapter 9 ZXC10-HLR/AUC (V3.0)

The system is designed to cater to the development trend of communications and satisfy the
requirements of more and more new services.

9.6 ZXC10-HLR/AUC networking and configuration

To facilitate capacity expansion, all CPMs, HSMs, and HDMs of the ZXC10-HLR/AUC system
employ a modularized structure. The number of modules can be selected according to the practical
requirements, and can be added conveniently and flexibly as required to accommodate 1.2 million
subscribers.

Here we briefly introduce the networking and configuration of ZXC10-HLR/AUC. For more
detailed information, please refer to the corresponding configuration guide.

9.6.1 CPM configuration

CPM is composed of one or multiple SS7 front-end processor(s) according to the practical
requirements.

1. A CPM composed of a single SS7 front-end processor can provide 32 SS7 links, and meet
the requirements of 200,000 subscribers.

2. With the increase of subscribers, more SS7 front-end processors will be needed. The
networking mode, with one SS7 front-end processors as the core which drives 1~5 other SS7
front-end processors and each (including the core front-end processor) is capable of providing SS7
link, thus meeting the requirements for larger capacity, as shown in Fig. 9-58.

Fig. 9-58 Networking diagram of CPM

-386-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

The composition of a 1,200,000-subscriber CPM is: one SS7 front-end processor as the core,
externally associated with five other SS7 front-end processors.

The following will describe the configuration of a single SS7 front-end processor. The SS7
front-end processor is a compact platform based on ZTE ZXJ10 digital SPC switch. A shelf is
needed for each SS7 front-end processor. .

A single rack has six layers. For a single SS7 front-end processor, the ZXC10-HLR/ AUC
system only uses one layer of them, as shown in Fig. 9-59.

Layer-6 BCTN

Fig. 9-59 Layout of a single SS7 front-end processor shelf

Fig. 9-60 shows the arrangement of the boards.

The broad configuration in the 6th layer (the control network layer) is as follows:

The DT boards can be added starting from Slot 26 to the left. Five DT boards are available,
each connected to four links.

As a pair of mutual-assistant communication boards, COMM1 and COMM2 are used for
MP-MP communication. If CPM is in a single-module structure, COMM1 and COMM2 should
not be used. COMM3 and COMM4 are also mutual-assistant, and used for the connection control
of the network boards and communication between the MP and DT (MP—SP).

COMM5 and COMM6 perform the SS7 functions. Each COMM board processes 16 SS7
links.

-387-
Chapter 9 ZXC10-HLR/AUC (V3.0)

Slot 16 is used for installing the MON board. If necessary, Slot 15 can be used to install the
PEPD board.

Slot17 and 18 hold the active/standby synchronous clock net boards (TNET).

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
P S M M C C C C C C P M T T D D D D D P B
6 W M P P O O O O O O E O N N T T T T T W C
R E M M M M M M P N E E R
B M M M M M M M D T T T
B
1 2 3 4 5 6 N
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

Fig. 9-60 Board layout

9.6.2 HSM configuration

The HSM is composed of multiple service processors, which occupy one or more racks. The rack
configuration is shown in Fig. 9-3.

Each rack can accommodate five service processors and two hubs.

The processing capability of each service processor is 120,000 subscribers, and its location in
the rack depends on the engineering requirements.

For the sake of the security and real-time performance of the system, at least two service

-388-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

processors are needed. And to ensure the system’s reliable operation, one more service processor
is actually configured than the designed quantity.

9.6.3 Database configuration

The database is composed of one or more nodes (HDM), each including two servers and one disk
array. The database supports multiple operating systems (such as Windows and UNIX). The large
commercial database system like Oracle, Sybase, Informix or Microsoft SQL Server can be
employed. The operating system and database system may depend on the subscriber’s
requirements, and Windows and Microsoft SQL Server database are recommended.

The HDM can be installed in two ways:

1. Separate installation

No rack is required. The database server and the disk chassis are placed separately and
connected via network cables.

2. Integrated installation

Every two servers and one disk chassis share a rack.

The typical configuration of the database is as follows:

1. 600,000 subscribers: two servers and one disk chassis.

2. 600,000~1,200,000 subscribers: four servers and two disk chassis. Two racks (if needed)
should be configured.

9.6.4 Equipment configuration of the operation & maintenance system

Usually, the operation & maintenance system includes two parts: one part is the switching-side
(MSC/HLR/SSP, HLR/AUC and SMC) OMC-S system maintenance part, and the other is the BS-
side (BSC and BTS) OMC-R system maintenance part. However, as far as an operation and
maintenance system is concerned, the two parts are not strictly separated. In fact, for the overall
system, the whole CDMA mobile communication system (including MSC/VLR/SSP, HLR/AUC,
SMC, BSC and BTS) is supposed to be controlled by a highly efficient operation and maintenance
system. Here, we separate them just for clearer description.

Fig. 9-61 shows the structure of the operation and maintenance system. (Note: The figure
only presents the MSC/VLR/SSP and HLR/AUC parts).

-389-
Chapter 9 ZXC10-HLR/AUC (V3.0)

Fig. 9-61 Schematic diagram of the operation and maintenance system

In the figure, we can see that the operation & maintenance of the MSC/VLR (containing the
SSP part) and HLR/AUC is composed of two parts: OMM (for local operation & maintenance)
and OMC (for centralized operation & maintenance). OMC and OMM work together to
implement management and maintenance on the whole CDMA system, and they are connected
with each other via the data communication network (DCN). In fact, in the ZTE’s mobile
communication system, the switching-side network management should also include that of the
SMC part, which is not presented in the figure, though.

9.6.4.1 OMM configuration

OMM is mainly composed of the application server, operation & maintenance console,
communication unit and printer.

9.6.4.2 OMC configuration

The OMC system works in Client/Server mode, and is composed of two servers, RAID, cluster

-390-
 Chapter 9 ZXC10-HLR/AUC (V3.0)

software and workstations. The two servers work in active/standby mode, and the RAID uses the
RAID5+1 mirror technology, thus ensuring the high reliability of the OMC system.

The two OMC servers work in the active/standby mode. They have their own machine names
and IP addresses, but externally they provide the same virtual machine name and IP address, and
provide services to the outside in this way. Their IP addresses will become invalid in the host state
and the virtual IP address will be used. The system can monitor in real time the faults in the host
system and the communication faults in the network adapter, and the changeover can
automatically occur to let the other server take over.

Exercise

1. What are the relevant interfaces and protocol standards for the HLR/AUC in the CDMA
cellular mobile communication system?

2. What are the main technical indices of ZXC10-HLR/AUC?

3. What are the main components and their functions of the software and hardware of the
ZXC10-HLR/AUC (V3.0)?

4. What are the main components and their functions of the SS7 of the ZXC10-HLR/AUC
(V3.0)?

5. What are the various service functions of the HLR/AUC?

6. What is the processing flow of the main mobile telecommunication services of the
HLR/AUC?

7. What are the configuration principles of the HSM and HDM?

8. What is the reliability assurance mechanism of the software and hardware of the
ZXC10-HLR/AUC (V3.0)?

9. Describe briefly the networking configuration of the ZXC10-HLR/AUC with a capacity

of 500,000 subscribers.

-391-
Chapter 10 CDMA Short Message Center (ZXSC100)

CDMA Short Message Center (ZXSC100)

9.7 Overview

9.7.1 Network Architecture of the CDMA Cellular Mobile Communications

System

The schematic diagram of the CDMA cellular mobile communication system is as shown in Fig.
10-1.

MS MSC SCP PSTN

ISDN
Um E PSPDN

Abis A B
BTS BSC MSC/SSP VLR

Q C D G

M N
SC SC HLR VLR

M N
M
SME SME
AUC

Fig. 10-1 Network architecture of the CDMA cellular mobile communications system

The description is given in Table 10-1.

-392-
 Chapter 10 CDMA Short Message Center (ZXSC100)

Table 10-1 Abbreviations

Abbreviation Full name

MSC Mobile Switching Center
VLR Visitor Location Register
HLR Home Location Register
SMC Short Message Center
SSP Service switching point
AUC Authentication Center
PSTN Public Switched Telephone Network
ISDN Integrated Service Digital Network
PSPDN Packet Service Public Digital Network
SME Short Message Entity
BTS Base Transceiver Station
BSC Base Station Controller
BS Base Station
MS Mobile Station

9.7.2 Main Interfaces Description

9.7.2.1 Interfaces between SMC and SME, and between SMCs (M interface)
SMPP is employed for the interface between SMC and SME.

ANSI-41E is employed for the interface between SMCs, and its functions are described as
follows:

For the origination short message received by SMC, if the destination MS is not the home
subscriber of the SMC, the SMC will forward the message to the home SMC of the destination
MS.

9.7.2.2 Interface between HLR and SMC (N interface)

ANSI-41E is employed for the interface standard. Its functions are described as follows:

When the SMC sends a short message to a subscriber, and there is no any address
information of the called subscriber, it is necessary to inquire about the route of the subscriber to

-393-
Chapter 10 CDMA Short Message Center (ZXSC100)

the HLR, after which can the short message be sent to the subscriber.

9.7.2.3 Interface between SMC and MSC (Q interface)

ANSI-41E is employed for the interface standard. Its functions are described as follows:

During the submission and reception of a short message, short message transfer needs to be
conducted between SMC and MSC. When the subscriber’s short message capability changes, the
MSC needs to notify SMC in time.

9.7.3 Technical Standards

The ZXSC100 Short Message Center of ZTE (“ZXSC100” for short hereinafter) is a CDMA-
oriented SMC which provides standard and open interfaces based on ANSI-41E and IS-637A
protocols, and is compatible with ANSI-41D. It supports the following protocols and standards:

1. GB191-90 Graphic Labels for Packing, Storage and Transportation

2. GB3047.1-82 Series of Basic Dimensions of Boards, Racks and Shelves

3. GB2423.1~4-81 Basic Specifications for Environmental Tests of Electric and Electronic

Products

4. GB4798.3-90 Fixed Usage of Electric and Electronic Products in Climate-protecting

Environment

5. YDN065-1997 The General Technical Specifications for Telephony Switching Equipment

by the Ministry of Posts and Telecommunications

6. GF001-9001 Chinese National Telephony Network SS7 Technical Specifications

7. YD/T 1031-1999 800 MHz CDMA Digital Cellular Mobile Communications Network
Signaling System Mobile Application Part (MAP) Technical Specifications

8. GF010-95 National SS7 Technical Specifications Signaling Connection Control Part

(SCCP)

9. YDN 068-1997 National SS7 Technical Specifications—Message Transfer Part (MTP)

10. YDN 066-1997 National SS7 Technical Specifications—Operation and Management

Application Part

-394-
 Chapter 10 CDMA Short Message Center (ZXSC100)

11. TIA/EIA/IS-41D Cellular Radio-Telecommunications Intersystem Operations

12. ANSI T1.114-1992 Signaling System NO.7 (SS7)–Transaction Capabilities Application

Part (TCAP)

13. TIA/EIA/IS-637A Short Message Services

14. TIA/EIA/IS-841 Network Support for MDN-Based Message Centers

15. TIA/EIA/IS-824 Generic Broadcast Teleservice Transport Capability: Network

Perspective

Oriented to the Expansion Short Message Entity (ESME), the ZXSC100 provides open
interfaces based on SMPP, supports SMPP V3.4, and is compatible with SMPP V3.3 downwards.

9.8 ZXSC100 Performance Indices

9.8.1 System Indices

System capacity: 4,320,000 BHSM. If the traffic model is BHCA = 0.6, it supports up to
7,200,000 subscriber lines.

Message handling capacity: 150/sec in single module mode; 1,200/sec in multi-module mode.

Message loss probability: P = 107

Information storage delay: = 1,000 ms (95% probability)

Number of SS7 links: 32 for single module mode and 256 for multi-module mode

Technical indices on cell broadcast:

Max. number of manageable MSCs: 100

Max. number of manageable cells (sectors): 20,000

Max. number of manageable distribution consoles: 100

Sending speed: send messages to 10 MSCs/sec simultaneously

Max. reservation term for cell broadcast short messages: 3 months

-395-
Chapter 10 CDMA Short Message Center (ZXSC100)

Cycle for cell broadcast short messages: 1 ~ 4,095 min

9.8.2 Transmission Indices

9.8.2.1 Error performances:

The average long-term Bit Error Rate (BER) is better than 1 × 10-9.

9.8.2.2 Bit integrity:

Bit sequence independence: In the 64 kbps channel, there is not forced restriction on the number
of the consistently transmitted binary “1s” or “0s” or any other binary code pattern.

Absolute group delay:

Mean value: 900 µs

The value within 95% probability: 1,500 µs

9.8.2.3 Synchronization indices

Clock synchronization: Stratum-2 clock class A

Minimum precision of the clock: ± 4 × 10-7

Traction range: ± 4 × 10-7

Maximum frequency offset: 10-9/day

Initial maximum frequency offset: 5 × 10-10

Clock work mode: Fast capture, tracing, holding and free running

Clock synchronous link interface requirements:

Incoming end signal jitter and wander: = 1.5 UI, 20~2,400 Hz

Outgoing end signal jitter and wander: = 1.5 UI, 20~10,000 Hz

= 0.2 UI, 18,000~100,000 Hz

-396-
 Chapter 10 CDMA Short Message Center (ZXSC100)

1 UI = 488 ns

9.8.2.4 Reliability indices

MTBF > 10 years

9.8.3 Rack Parameters

The following shows the parameters related to the racks of the components (including the SM
signaling gateway, the service server and the database) of the ZXSC100.

9.8.3.1 Short message signaling gateway

The parameters of the rack are as follows:

Dimensions: 2000 mm × 810 mm × 600 mm

(In the upward wiring mode, a cover should be added and the height will be 2,200 mm. The
width will be 870 mm when a side board is used.)

Weight: < 250 kg

Power supply: －48 VDC, tolerance: －57 V ~ -40 V

Power consumption: ≤ 500 W

9.8.3.2 Server
The service server, SMPP agent server, cell broadcast server, applications server and accounting
server are all installed in a rack. Parameters of the server rack is as follows:

Dimensions: 2,000 mm × 600 mm × 900 mm

Weight: 350 kg

Power supply: AC220 V ± 10%, 50 Hz ± 5%

Power consumption: ≤ 1500 W

-397-
Chapter 10 CDMA Short Message Center (ZXSC100)

9.9 Hardware Architecture of ZXSC100

The ZXSC100 provides the transmission of comparatively short messages between mobile
subscribers or between a mobile subscriber and various SMEs, such as voice mailboxes, integrated
information platforms and stock information sources.

The ZXSC100 developed and manufactured by ZTE Corporation fully takes into account the
high reliability, high utility of the system and consistency of data in its design process. The
deployment of flexible hierarchical of multi-module design facilitates the system expansion.

This chapter will introduce the related contents concerning the system hardware structure of
the ZXSC100.

9.9.1 System Overview

9.9.1.1 Location of ZXSC100 in the CDMA network

As an independent network unit in the CDMA network, ZXSC100 occupies one signaling point in
the SS7 network. As shown in Fig. 10-1, in the CDMA network system, the ZXSC100 is
connected to MSC with the Q interface via the SS7 network, to HLR with the N interface, while
the M interface is employed for the connection between the ZXSC100 and SMCs or SMEs.

9.9.1.2 System structure of ZXSC100

The ZXSC100 mainly comprises SS7 gateway, service server, SMPP agent, all kinds of ESMEs
and related operation and maintenance systems, and the modularized building block structure is
employed for various functional units, thus facilitating expansion of its capacity and functions.
And inside the system, the high-speed HUB is employed between functional modules for the
communication.

The system structure of the ZXSC100 is as shown in Fig. 10-2.

-398-
 Chapter 10 CDMA Short Message Center (ZXSC100)

ZXSC100
ESME Database
T CP/IP

Operation Service
X.25 SMPP Service Service OM M and handling
agent server server server maintenance
console console
ESM E

High speed Ethernet

Assisted Aut omat ed Information

operator Signaling oper at or
gateway platform
position posi ti on

SS7 link

CDMA network

Fig. 10-2 System structure of the independent ZXSC100

9.9.2 Hardware Structure

9.9.2.1 Basic structure of ZXSC100

The hardware system structure of the ZXSC100 is as shown in Fig. 10-3.

Mail server Information Other SMEs

Web server
platform

Service server

Database
OMM server
Operation & Service
Maintenance console handling
console
SMPP agent

TCP/IP Communication network (dual-network)

Assisted/automated
operator position

IW/GMSC ACD module

Voice Mailbox

E1

PLMN

Fig. 10-3 Hardware structure of the ZXSC100

-399-
Chapter 10 CDMA Short Message Center (ZXSC100)

The hierarchical and modularized design makes it convenient for the system installation and
capacity expansion. Let’s elaborate on each functional module included in the ZXSC100 and give
concise explanation for other functional modules related to the SMS system, such as ACD.

9.9.2.2 Short message signaling gateway

The SM signaling gateway is developed on the basis of the compact SS7 platform of ZXJ10V10.0,
and is responsible for SS7 handling. As the SS7 processing module of the ZXSC100, the gateway
provides SS7 link connection with such network entities as MSC and HLR, implements such SS7
functions as MTP, SCCP, TCAP and MAP, and provides interfaces to the service server. As the
interface between the SMC and the CDMA network, the SM signaling gateway exchanges
messages with the entities in the CDMA mobile switching network via the standard SS7, so as to
carry out short message services.

The fully distributed control structure is employed for the hardware design of the SM
signaling gateway, which can be performed by overlapping 1 ~ 8 modules depending on the
system capacity. The hardware structure of the SM signaling gateway is as shown in Fig. 10-4.

The SM signaling gateway comprises the following basic units:

1. Digital Trunk Unit (DTU):

It has a digital trunk interface unit (DTI) inside

2. Main Control Unit (CTLU), including:

The sub-unit of Module Processor (MP): the main processor sub-unit

Communication Board (COMM board)

The sub-unit of Peripheral Environment Parameter Detection (PEPD)

The sub-unit of Monitor Board (MON)

The sub-unit of SMEM: shared memory board

3. Digital switching network unit (NETU) (also known as T network unit), including:

TENT: synchronous clock switching network sub-unit

POWER B: the power supply board that supplies electricity for each unit

What follows is a representation of the hardware structure of each unit in the SM signaling
gateway.

-400-
 Chapter 10 CDMA Short Message Center (ZXSC100)

9.9.2.2.1 Digital Trunk Unit (DTU)

The DTU is an interface unit between mobile switching systems. It multiplexes the 32-
channel 64 kbps voice channel signals and signaling into 2048 kbps signals according to the PCM
TDM principle, so as to perform switching connection handling in the system.

The digital trunk is the interface device between the digital SPC switch system exchanges or
between the digital SPC switch system and the digital transmission device. Its major features are
as follows:

1. Line signal code pattern receiving, sending and converting: converting the input High
Density Bipolar Excess Three codes (HDB3 codes) or Alternate Mark Inversion codes (AMI
codes) into internal Non-return to Zero codes (NRZ codes) so as to access the T network. At the
same time, converting the internal NRZ codes into the HDB3 codes or AMI codes so as to be sent
to the transmission line during transmission.

Fig. 10-4 Module structure of the SM signaling gateway

2. Extracting of the frame synchronization clock: Namely, it identifies and extracts the
external reference clock from the input PCM code flow, and sends it to the synchronous timing
circuit. The clock is used as the frame synchronization parameter clock at the home terminal so as
to ensure synchronization with the incoming exchange.

3. Frame synchronization and multi-frame synchronization: Based on the extracted

synchronization reference, i.e. frame aligning signal, it implements frame or multi-frame
synchronization adjustment and avoids the asynchronization caused by delay.

4. Insert and extract signaling via TS16 to transmit/receive signaling.

5. Alarm detection: It detects transmission quality, such as error code rate, slip code metering,
out of frame, out of multi-frame, and trunk signal loss. Furthermore, it informs the maintenance
equipment of the detected fault signals and associated channel disconnection alarm signals for
manual processing.

Message exchange of the trunk unit CPU and the MP handling unit mainly refers to the
transfer of the service information and the fault information.

To implement the functions mentioned above and provide a seamless interface with the

-401-
Chapter 10 CDMA Short Message Center (ZXSC100)

switching network layer, DTU is composed of the following functional modules: digital trunk
interface unit, code rate conversion unit, control circuit, etc. The schematic diagram of DTU is as
shown in Fig. 10-5.

Fig. 10-5 Schematic diagram of digital trunk unit

Given below is the description to each of the functional modules.

9.9.2.2.1.1 Digital trunk interface unit

The functions of digital trunk interface units are as follows:

1. 2 Mbps PCM code flow input/output and HDB3/AMI code conversion;

2. Working in the channel associated signaling/common channel signaling mode;

3. Supporting the mobile communication of ISDN PRI subscribers;

4. The internal digital phase lock loop enables the synchronous clock to work in the three
modes: external reference synchronization, synchronization of frame synchronization signals and
free oscillation.

5. Offering self-loop test functions.

9.9.2.2.1.2 Code rate conversion unit

The code rate conversion unit performs the following functions:

1. Multiplexing four 2M rate PCM lines on a DT board into an 8M rate PCM line so as to
access to a plane on the T network, and simultaneously demultiplexing one 8M rate PCM line
from the T network into four 2M rate PCM lines so as to send them to four E1 interface units for
transmission;

-402-
 Chapter 10 CDMA Short Message Center (ZXSC100)

2. It communicates with the MP board through two communication TSs. The communication
contents are packed and unpacked through an HDLC protocol controller;

3. Self-loop test function. Extract one HW line (2 MHz for up link/8 MHz for down link)
from either of the two up/down link switching circuits to serve the self-loop test;

4. Providing ISDN protocol control.

9.9.2.2.1.3 Control circuit

The control circuit includes the main CPU, drive interface circuit and clock processing circuit,
performing the following functions:

1. The clock processing circuit mainly provides the trunk interface circuit with the 8 MHz, 2
MHz and 8 kHz clock references.

2. The driving interface circuit mainly performs matching with the input circuit of the T
network and enhances the anti-interference ability;

3. The main CPU acts as the processor of this sub-unit to control various parts and to make
alarming handling over the following faults:

1) Out of frame or out of multi-frame;

2) Alarming when error rate exceeds 10-4, and canceling alarm when it is lower than 10-4;

3) Slip code alarming, indicating the advancing and lagging of external/internal clocks;

4) Input signal loss, remote connection failure and emergency alarming.

When an alarming message is detected by the CPU, it is packed by HDLC and sent to the
uplink multiplexing circuit at a certain preset TS, for example, Tsb. After that, it is sent to the
COMM through the half-fixed connection Tsb of the T net, and then sent to the MP to inform the
maintenance terminal.

The digital trunk unit board can set clock selecting through jumpers and perform impedance
match of lines.

Channels of related alarming messages are shown in Fig. 10-6.

9.9.2.2.2 Main control unit

The main control unit includes the module processor (MP), communication board (COMM),
monitoring board (MON), peripheral environment parameter detection board (PEPD) and shared
memory board (SMEM).

-403-
Chapter 10 CDMA Short Message Center (ZXSC100)

Fig. 10-6 Illustrations of alarming message channels

9.9.2.2.2.1 Module processor (MP)

1. Basic structure of MP

MP consists of CPU, bus system, memory system, system controller, and I/O interface
equipment. It occupies four physical slots in the controlling layer BCTL. With powerful
processing capability and high speed, MP’s CPU is the Pentium II processor, with the main
frequency of 333MHz, and BUSI and Ethernet interfaces. A brief introduction is given on its
structure as follows.

1) CPU: Pentium II, with clock frequency of 333 MHz;

2) Bus system: Internally, the PCI bus/ISA bus is employed;

3) Memory system: It consists of high-speed CACHE memory, dynamic RAM (DRAM) and
floppy/hard disk memories;

4) System controller: It consists of DMA, Interrupt Controller (ITC), timing circuit and
logical array circuit (EPLD);

5) I/O interface equipment: It consists of an Ethernet controller, keyboard and mouse

interfaces, FDC interface, IDE interfaces (floppy/hard disk interfaces), asynchronous serial bus
interface UART and the BUSI bus interface of the MP unit.

2. Functions of MP:

As the core of the main control unit, the MP has the following major functions:

1) Control the connection of the switching network;

-404-
 Chapter 10 CDMA Short Message Center (ZXSC100)

2) In charge of the transmission of the background/foreground data and commands;

3) Implement the message communication with the peripheral processing units;

4) Control the active/standby status. The active/standby MPs (MP0 and MP1) obtain the
active/standby operation status by competition during the power-on resetting. The active/standby
switching works in four ways: switching with command, manual switching, switching with
resetting, and switching with fault;

5) Provide two 10M Ethernet interfaces, one for connecting the background terminal server,
while the other for expanding connections between the control layers.

6) Use the reference clock of the exchange system as the precise clock of the main board; set
node No.; enable/disable various functions, etc;

7) Other service functions: including the Watchdog function, 5ms timing interruption service,
timing counting service, configuration setting, introducing the reference clock of the exchange
system as the precise clock of the main board.

A further introduction to related functions of the BUSI bus and the switching controllers on
the MP board is given as follows:

1. BUSI bus

BUSI is the bus interface circuit of the MP unit. Its main function is to enhance the driving
capability of the MP unit over the backplane bus ISA, and perform active/standby switching of
Ethernet check functions.

BUSI includes the following functional units:

Bus drive: It mainly drives the backplane bus of the main control layer;

Bus controller: It performs parity check for the data bus, bus monitoring and disabling;

The MP receives interruption signals from six COMM boards and one MON board, as well as
the relay signals from DRAM, which are then sent to CPU after being concentrated by the
interruption controller.

2. Active/standby switching controller

The active/standby MPs obtain the active/standby status by competition during the power-on
resetting (the power-on resetting of MP is different from that of other active/standby equipment).

-405-
Chapter 10 CDMA Short Message Center (ZXSC100)

9.9.2.2.2.2 Communication board (COMM)

The main control layer mainly accommodates the COMM board as well as the module processing
units of MP0 and MP1. The COMM board is of great importance as it is not only the hub for the
communication between the MP and peripheral processing units, but also the second processing
layer of the SS7 signaling unit.

1. Relationship between the COMM and MP boards

The MP connects to various COMM boards through the backplane ISA bus. Both MP0 and
MP1 work in the active/standby mode, while COMM boards work in the load-sharing mode. A
COMM board must be connected to the MP through two independent and identical ISA buses as
shown in Fig. 10-7.

Fig. 10-7 Connections between COMMs and MP0/MP1

Where:

DPRAM: Dual-port RAM

MON: Monitoring board

PEPD: Peripheral environment parameter detection board

2. Working modes of COMM boards

Message sending: The MP writes the to-be-sent message to DPRAM, which is then extracted
by the related HDLC controller and converged into the switching chip in a certain frame format.
After being processed by the chip, the message is sent to the TNET by selecting an outgoing link.

Message receiving: The messages from the TNET are sent to the switching chip of the
COMM board via a certain downstream data link. After being processed by the switching chip on
a related HDLC controller, the messages are received by the MP.

During message receiving, the messages are forwarded to DPRAM to be checked by a related
HDLC controller. They are put into DPRAM after confirmation of the frame format, otherwise, re-
sending of messages is required. If messages are wrong under the check, the CPU in the COMM
board sends an interruption alarm to the MP.

Both the COMM board and the MP board have signals to apply for the interruption of the
opposite side. The COMM and MP during message switching notify each other in this very
interruption mode.

-406-
 Chapter 10 CDMA Short Message Center (ZXSC100)

The schematic diagram of the COMM board is as shown in Fig. 10-8:

Fig. 10-8 Schematic diagram for the COMM board

9.9.2.2.2.3 Monitoring board (MON)

All units in the ZXSC100 that can perform the self-monitoring and communicate with the MP
through the COMM board and semi-permanent connection switching can exchange with MP the
status and alarm information of various units. However, quite a few sub-units (plug-in units) still
have no such communication function (e.g., the POWERB sub-unit). In order to monitor these
sub-units, the system has specifically set the MON sub-unit plug-in board.

The MON board holds eight RS485 interfaces and two RS232 interfaces. Each RS485
interface can carry 32 monitored sub-units. The brief working flow of MON is as shown in Fig.
10-9.

Fig. 10-9 Working flow of MON

The master/slave working mode is employed between the MON board and the boards under
monitoring. The MON board works in the main control mode, which checks each sub-unit under
monitoring regularly. The controlled sub-units send the response data to MON while being
checked, that is, to send the local sub-unit status and alarm information to MON. The CPU of
MON makes judgment. If abnormal condition takes place, it sends an interrupt alarm to MP.

The MON board and MP board mutually send interruption request signals to exchange
information.

Data sent from the MP board to MON board is checked by the CPU on the MON board. If
any error is found out, the MP is required to re-send the data.

On the MON board, there are eight RS485 interfaces, which can monitor 256 objects at most,
covering all sub-units to be monitored by this system.

9.9.2.2.2.4 Peripheral environment parameter detection board (PEPD)

The PEPD board can process the secondary signals provided by the external sensors. It performs
real time monitoring on the physical parameters of the switch’s working environment such as

-407-
Chapter 10 CDMA Short Message Center (ZXSC100)

temperature, humidity, smog, infrared etc. and reports the results to MP. Once an abnormality is
detected, the alarm box will be started up instantly, so as to avoid unnecessary damages.

1. Measurement range of the PEPD board:

Temperature: 0 °C ~ 50 °C Precision: ± 0.5 °C

Humidity: 20 % ~ 100 % Precision: ± 3 %

Infrared: the maximum effective area: a 90° sector with a 15m radius (adjustable)

Smog: sensitivity 1 dB/m

Current: 100 µA

2. Working flow of the PEPD board

The working flow of the PEPD board is as shown in Fig. 10-10:

Fig. 10-10 Schematic diagram of the PEPD board

The PEPD board and the active/standby MP can send the interruption signals mutually. When
one of them writes data into the mailbox of the other, the latter will be interrupted immediately.

The environment monitoring principles are as follows:

1. Once there is smog detected by a smoke sensor, a current signal will be generated. The
current signal will be converted into a level signal inside the board and be sent to the CPU of the
PEPD board for relevant tests;

2. The temperature and moisture sensors modulate the variation of temperature and moisture
into the square wave varying in accordance with the frequency. The square wave is sent to the
CPU of the PEPD board for relevant tests.

3. An infrared sensor can detect the environment at any time. Once somebody approaches, the
infrared sensor can output a switch level signal to the CPU of the PEPD board for relevant tests.

9.9.2.2.2.5 Shared memory board (SMEM)

The SMEM board provides the simultaneously accessible 8kB double-port RAM and the
shared 2MB RAM for the active MP0/standby MP1. Meanwhile, it provides 1-bit parity check

-408-
 Chapter 10 CDMA Short Message Center (ZXSC100)

with the corresponding capacity, so as to guarantee correctness of the data. It can be employed by
MP as the message switching channel and for the data backup, which facilitates the quick
switchover between the active/standby MPs.

Which MP (active/standby) can access the 2MB SMEM at the same time is determined by
the hardware mediation mechanism of the SMEM board: Only MP with the SMEM control right
can access SMEM. The control right will be handed over immediately after access. When one
party has obtained the control right, while the other one tries accessing, it will receives a “BUSY”
signal. The party with control right will not be affected.

The 8kB dual-port RAM can be accessed by active/standby MP simultaneously. But when the
same address unit is accessed at the same time, the SMEM board will make the mediation with the
“BUSY” signal.

The SMEM board can set active/standby MP mailboxes through the 8 KB double-port RAM.
When party A sends a mail to party B’s mailbox, party B will receive an interruption signal sent by
party A. After party B takes away the mail, the interruption signal will be reset.

The schematic diagram of the SMEM board is as shown in Fig. 10-11.

Fig. 10-11 Schematic diagram of the SMEM board

9.9.2.2.3 Digital switching unit

The digital switching unit NETU (network unit, shorted for T-network unit) is composed of
TNETs (synchronous clock switching network sub-units).

9.9.2.2.3.1 Overall functions

In the ZXSC100, the switching module in the SM signaling gateway employs a compact structure,
which is mainly based on the ZXJ10V10.0, and makes use of the current control and management
mechanisms of the ZXJ10V10.0 for development. To make full use of the space in the shelf, and
ensure the structure compactness and the reasonable resource configuration, the TNET board is
designed to have the clock system and the switching network integrated.

The TNET board (synchronous clock switching network board) is a nonblocking full time
division switching network, with a maximum switching capacity of 4k × 4k time slots, capable of
providing not only the necessary 2 Mbps and 8 Mbps differential HWs, but also the 8 MHz and 8

-409-
Chapter 10 CDMA Short Message Center (ZXSC100)

kHz clocks needed by the multiple-level SP boards, as well as the 4 MHz and 8 kHz differential
clocks for communication. Its schematic diagram is as shown in Fig. 10-12.

256 kbit/s Switching

MP0 COMM network

256 kbit/s
256 kbit/s

Switching
MP1 COMM 256 kbit/s network

Fig. 10-12 Schematic diagram of the synchronous switching network unit

9.9.2.2.3.2 Synchronous clock of the TNET board

The synchronous clock functions in guaranteeing the accordance between the output data code rate
and the input data rate so as to avoid the loss of code rate slip resulting from asynchronization
during the data transmission and switching.

The synchronous clock has the following features:

1. Synchronization follows the master/slave synchronization mode

Providing four E8K synchronization reference clock input interfaces

The phase-locked circuit in the “loose coupling” mode works in the following four modes:

1) Fast capture;

2) Tracing;

3) Holding;

4) Free running.

2. The discontinuity of clock phase between two TNET boards is below 1/8UI cell.

3. Maintainability of clocks: OCXO provides the frequency adjustment button to adjust the
deviation of the central frequency caused by the aging quartz crystal.

-410-
 Chapter 10 CDMA Short Message Center (ZXSC100)

4. It has the manual switchover function of the clock reference and manual active/standby
switchover function, and the manual switchover of clock reference can be shielded via software.

5. It owns the critical alarm function with phase-lock loop frequency adjustment: General
alarms will be given when the intrinsic clock frequency deviates from the range controlled by the
phase-lock loop (control signals exceed 3/4 of the clock adjustment range) due to the aging clock
crystal.

6. Employing the 16-bits D/A converter, it has the serial data interface, voltage output,
holding monotony in the entire working range, with the ±1 LSB integration linearity. This
converter has integrated a precise voltage reference source internally, with extremely low noises.
The peripheral circuits of the D/A are simple, yet good in performance.

7. The TNET board can output 8 MHz (21-channel frame header signals of 8 MHz) and 16
MHz (1-channel frame header signal of 16 MHz) signals.

9.9.2.2.3.3 Switching network in TNET (T-network)

The switching network in TNET is a single T-structured, time-division and nonblocking switching
network with a capacity of 4k × 4k time slots and a PCM bus speed of 8 MHz, working in a dual-
input and single-output hot backup mode. The connection control of the T-network is performed
by MP via the HDLC link of the 256 kbps (4 × 64 kbps) super-channel by way of the COMM
board. The connection message is sent from MP to COMM, where the message is forwarded to the
active/standby switching network, to ensure that the connections of the active/standby switching
network are completely the same.

The switching network consists of four 2K × 2K nonblocking time division switching chips
with the switching function. These four chips constitute a 4 × 4 switching matrix, thus realizing 32
8 Mbps PCM buses. The chips need 16 MHz and 8 MHz clocks when they are in operation. Its
switching network is as shown in Fig. 10-13:

Fig. 10-13 Schematic diagram of the 4 × 4 switching matrix

Described below is a further introduction to the switching part.

1. Circuit communicating with the MP of the control layer

-411-
Chapter 10 CDMA Short Message Center (ZXSC100)

This part serves to communicate with the MP, so as to control connection of the time slot
switching network and manager the clock part. The physical layer of the switching part employs
the super channel (4 × 64 kbps) for transmission. The link layer works with the HDLC protocol.

2. Core CPU system

The switching network is an intelligent network that has a high requirement for the real-time
processing. To satisfy this requirement, this board employs two processors to control.

1) Employing a built-in CPU and working in a 16-bit data line mode. It receives connection
commands from MP, and then converts the commands into address codes, so as to perform
management over the switching network chip and the HDLC protocol control chip.

2) Employing a Single-Chip Microcomputer, connecting to 32K SRAM externally,

communicating with MP via the RS485 interface, realizing the control and management over the
clock part.

3. The clock generation and driving circuit

The clock part of this board generates two pairs of 16M, 8K clocks and 21 pairs of 8M, 8K
clocks. For a pair of 16M and 8K clocks and the other pair of 16M and 8K clocks from the peer
board, the active/standby status will select one (the clock of this board is for the active status, and
that of the peer board is for the standby status) for modules of this board (generate 4 MHz and 8
kHz clocks by EPLD after frequency division of 16 MHz and synchronization processing) and the
COMM board; then, the other pair of 16M and 8K clocks are sent to the peer board. 20 pairs of
8M and 8K clocks are provided to the SP-level board via the differential drive, while the other pair
of 8 M and 8 k clocks is provided to the peer board.

4. Alarm circuit

The control circuit implements the control over the outgoing/incoming HW lines.

When such phenomena as hardware failure, clock loss and frequency change occur to the
board, the CPU timed inquiry will get the information and give corresponding processing, at the
same time, the LED indication will be presented on the board.

5. Active/standby control circuits

There are two circumstances for the active/standby T-network board switchover control:

1) Both the boards are in the standby status during the power-on resetting, and then the CPU
will designate one as the active board after a judgment so as to avoid the power-on competition.

2) The active/standby status switchover at normal working conditions is determined as

follows:

-412-
 Chapter 10 CDMA Short Message Center (ZXSC100)

Manual switchover: The maintenance personnel implement the active/standby switchover

with man-machine commands. After the switchover, both active/standby indicators change
accordingly;

Switchover with fault: When the active network board fails, the CPU will send the
active/standby switchover command, and the active/standby indicators will change accordingly.

6. EPLD design

The EPLD consists of three chips:

One chip integrates the active/standby control alarm circuit, as well as the reference selection,
phase detection and control circuits of the clock system.

One chip integrates parallel/serial conversion logic, E8K signal detection and the multi-path
selection circuit;

While the last chip integrates logic circuits such as HDLC time sequence processing and
switching network slices.

7. The PCM bus interface and drive isolation circuit

This part of circuits mainly drive the PCM 8 Mbps buses that come into and go out of the
switching network board, and isolate them from the external signals.

9.9.2.2.4 The power supply board POWERB

POWERB powers the control layer, network layer, digital trunk layer and optical interface layer,
and its technical specifications are as follows:

DC input: – 48 V

DC output: + 5 V (60 A)

Efficiency: > 75%

Ripples: < 60 mV

Noise: < 500 mV

Surge current: < 14 A

The POWERB boards are used in parallel on a single layer with 1+1 backup, and are hot-
swappable. When the output voltage gets ±10% out of the nominal value, an alarm is given. When
the input is inverted or when the load is short-circuited, the EA fuse is reliably broken and there
exists the over-voltage protection. In the normal running status, temperature rise of the power

-413-
Chapter 10 CDMA Short Message Center (ZXSC100)

components of the power supply does not exceed 50 °C so as to ensure the safe operation. The
monitoring circuit serves only for monitoring but not control, so as to prevent wrong operations of
the CPU.

The schematic diagram of POWER B is as shown in Fig. 10-14.

Fig. 10-14 Schematic diagram of POWER B

–48V enters the POWERB board from the primary power supply. It first passes the common
mode inductor to suppress the common-mode noise, while the slow starting circuit makes the
input voltage slowly rise, taking about 0.4 ms buffer time to eliminate surges. After the low
frequency filter, the voltage signal arrives at the input terminal of the power module. Meanwhile,
the switch logic circuit generates the corresponding logic to start the module. After the module
starts to work, the output will be generated. The output becomes the power supply through the
high/low frequency filter and the isolation diode. The output voltage can be adjusted within a
certain range. Furthermore, it is sampled by the over-/under-voltage detection circuit for the
comparison and generation of over-/under-voltage logic. Such logic is identified and processed by
the monitoring circuit. The processing result is sent to the alarm circuit. Under the alarm status,
the power supply is cut off manually.

9.9.2.3 Service processing subsystem

The service processing subsystem of the ZXSC100 supports both the WINDOWS NT and UNIX
operating systems, which will be respectively described below in terms of their hardware
structures.

9.9.2.3.1 Service processing hardware structure under the WINDOWS NT platform

On the WINDOWS NT platform, the cluster server mode is employed for the service processing
subsystem of the ZXSC100 as shown in Fig. 10-15. One service server node includes two hosts
(server 1, server 2) and one shared redundancy disk array (disk chassis). Each host is inserted with
an SCSI adapter card, and the disk cabinet provides two SCSI interfaces, therefore, each host is
connected with the disk chassis via the SCSI bus. In addition, each server is also equipped with
three Ethernet cards (Ethernet card 1, 2 and 3). The integrated network card on the server (i.e.

-414-
 Chapter 10 CDMA Short Message Center (ZXSC100)

Ethernet card 1) serves as the heartbeat line between servers, while the other two cards are
respectively connected to different HUBs for mutual backup, thus forming a dual-network
structure, and enhancing the system reliability.

Fig. 10-15 The structure of cluster servers

To provide the high reliability of the service server and the database, the mutual backup mode
is employed for the two hosts in the service server node of the ZXSC100. With the increase of
subscriber capacity and processing capability of the ZXSC100, the smooth expansion can be
enabled by upgrading the service server host or by adding service server nodes, so as to improve
the service processing capability of the SMC.

To guarantee the safe and reliable running of the database system, and provide fast access of
subscriber data, the service servers in the ZXSC100 are high-end servers. This system supports
one to four PIII CPUs with a master frequency as high as 933 MHz, and a memory of 512 MB to 2
GB.

The database system works in the Cluster technology, shared disk array mode, and the large-
sized commercial database system Microsoft SQL Server is adopted.

Under the normal circumstances, one host in the service server node of the ZXSC100 serves
as an active host, for normal service processing, while the other one serves as the standby host
without processing services. They have different IP addresses, and only the active host can access
the disk array. And in abnormal cases (such as collapse of the active host), the system can still run
normally since the IP address and disk array of the active host will be taken over by the standby
host.

In addition, the following measures are taken in the database of the ZXSC100 to guarantee
the data security and reliability:

1. The synchronous mirror mode and the stripping technology are employed for the storage of
the data in the disk.

2. All operations at the service handling console are recorded in the log form for easier
operation record query and convenient recovery if any wrong operation is detected.

3. Over the access interface, the operations of the service handling console and the
maintenance console are separated from the operations of SMS processing. The access interface
physical nodes are different, so are the database subscribers. Thus, no operation of the service
handling console and the maintenance console will affect the operations of the SMS server on the
database, and each part can process data only within an authorized scope.

-415-
Chapter 10 CDMA Short Message Center (ZXSC100)

4. Flexible and powerful management maintenance tools. The maintenance console has not
only powerful functions, but also flexible configurations. It provides multiple database
management and maintenance functions, such as remote access, operation log management,
operation authority management, backup and recovery.

9.9.2.3.2 Service processing hardware structure under the UNIX platform

Under the UNIX platform, the service processing and the database are separated from each other
in the service processing subsystem of the ZXSC100. The UNIX high-performance mini
commercial computer and Oracle large-sized commercial database are employed for the database.
The PC server is employed for the service server module, which is generally configured with the
dual-CPU (PIII933 and above), 512M memory and 100M Ethernet card. The service server serves
as an Oracle client terminal to access the Oracle client terminal.

To guarantee reliable system running, the mini computer of the database still employs the
Cluster structure (dual system + disk array mode), while the service server employs the
active/standby working mode of single-node dual system, or N+1 backup mode of the whole
system. The so-called N+1 backup means that N* service servers (N* nodes) work simultaneously,
and one standby server is equipped in the on-line backup mode. Once any error occurs in a certain
working service server, the server in the standby status will immediately take over the task, so as
to guarantee the normal and reliable operation of the system.

9.9.2.4 SMPP agent

The SMPP agent is used to maintain the communications link connecting to the ESME, perform
conversion between SMPP standard messages and internal messages of the system, provide open
interfaces to access the SMC for the ESME, and support multiple access modes based on the
TCP/IP protocol, such as DDN, X.25 and E1, etc.

By accessing SMEs of different functions, the SMC can provide various kinds of value-added
services.

Currently, apart from providing the open interface, and allowing the access of ESME from
other manufacturers via the SMPP agent, the ZXSC100 also provides some commonly used
accessory ESMEs to complete some common value-added services, such as assisted operator
position, automated operator position, automatic integrated information platform, dunning
platform and voice mailbox.

In the ZXSC100, the high-performance PC server is employed for the SMPP agent, which
can be configured as a dual-CPU system, thus ensuring reliability.

Besides, the SMPP agent can integrate the functions of interworking and sharing gateway, so
as to enable the short message communication between GSM networks and CDMA networks, and

-416-
 Chapter 10 CDMA Short Message Center (ZXSC100)

sharing of all kinds of ESME services.

9.9.2.5 ESME
Currently, the ZXSC100 provides the following ESMEs: assisted operator position, automated
operator position, automatic integrated information platform, dunning platform, voice mailbox,
etc.

9.9.2.5.1 Assisted operator position for short messages

The assisted operator position system is composed of two parts: intelligent switching module
(ISM) and position. ISM takes the ZXJ10V10.0 as the hardware platform, providing the call
connection management and queuing management. Through controlling the traffic control in ISM
with the CTI technology, CTI server enables incoming/outgoing calls, queuing, indicating
idle/busy, call forwarding, three party call service, monitoring, etc, and provides automatic
connection services.

9.9.2.5.2 Automated operator position for short messages

The automated operator position for short messages, provided by ISM, completes automatic
DTMF voice response, and performs delivery of short messages.

9.9.2.5.3 Integrated information platform for short messages

The integrated information platform obtains information from the information source, accepts
query short message sent by subscribers from the SMC, and shapes the query result into short
messages, which will then be sent to subscribers via the SMC. The integrated information platform
supports query of such information as weather, stocks, news, airlines, and gives alarms on the ups
and downs of stocks. The structure of the integrated platform for short messages is as shown in
Fig. 10-16.

-417-
Chapter 10 CDMA Short Message Center (ZXSC100)

Fig. 10-16 Structure of the integrated information platform

9.9.2.5.4 Automatic dunning platform

The automatic dunning platform of the ZXSC100 is used to process the subscriber dunning data
provided by the carriers, and then create short messages for dunning, which will be sent to the
SMC via the SMPP interface, and further to the subscriber’s mobile phone, and notifies mobile
subscribers of dunning or payment. Subscriber payment data are provided by the accounting
center in a specified format via the FTP or the database mode, and processed by the dunning
platform at a specified time.

9.9.2.6 Operation & maintenance module

The operation and maintenance module (OMM) is used for the management on various modules
of the SMC, including three major parts, i.e., system analysis, system maintenance and signaling
maintenance, to provide such functions as authority management, data configuration, security
management, performance statistics, fault management, diagnosis testing, signaling tracing,
version management, file management, service observation, clock management, and database
management.

OMM system is divided into multiple modules according to the functions, and each module is
divided into the foreground and background sub-modules, thus emphasizing the independence of
each module and the universality of the interfaces between modules, so as to adapt to system
structure changes and the function increases. Its schematic diagram is as shown in Fig. 10-17.

-418-
 Chapter 10 CDMA Short Message Center (ZXSC100)

Foreground system

TCP/IP network

Printer Router
Operation terminal
OMM server
Background system

Fig. 10-17 Schematic diagram of OMM

The client/server structure is employed for the operation and maintenance module, so as to
provide strict control over data integrity, management and security, perform centralized storage of
data, and enable the administrators to perform centralized data backup and regular maintenance,
and expand easily. If the system capacity and load are large, multiple servers and operation
terminals can be configured. It works locally in a LAN, which is connected via a router to a WAN,
to perform remote access.

The OMM parts perform centralized management and maintenance over the ZXSC100,
connects to the network management center in multiple modes (DDN, X.25, and E1, etc.),
supports the query, setting, modification, cancellation and report requesting of the provincial
network management center (or possibly the local network management center).

The system also provides remote handling access interface, facilitates the integration of the
operation system of the carriers and the SMC system of ZTE.

ZTE Corporation can provide the centralized network management from the switch
(including such network entities as MSC/VLR, HLR/AUC, and SMC at the switching side) to
base stations (including such network entities as BSC and BTS etc., at the base station side).

9.9.3 Hardware reliability redundancy design

The redundancy design is a main means employed to improve hardware reliability, and it is
adopted for all the key parts of the ZXSC100.

-419-
Chapter 10 CDMA Short Message Center (ZXSC100)

9.9.3.1 Module processor (MP)

The Module Processor (MP) in the signaling gateway of the ZXSC100 is designed to work in the
active/standby mode. One MP is in active status while the other is standby. The active MP
processes all services, while the standby one remains in the hot-backup status. The standby MP
scans the running status of the active MP every 10 ms, when it finds that the running status of the
MP is abnormal, it will perform immediate changeover. After successful changeover, the original
standby MP becomes the active one, and takes over all the service processing tasks.

To guarantee the correctness and continuity of service processing after MP changeover, the
data of the standby MP should be synchronized with those of the active MP. The synchronization
process falls into two stages: startup and running. When the standby MP starts, it performs system
configuration data synchronization with the active MP. This synchronization process is under the
control of the database application process. After the standby MP enters the running status, all
processes in the standby MP will perform regular inter-process data synchronization with the same
processes in the active MP.

The ZXSC100 provides multiple MP changeover modes: manual changeover, fault

changeover, cyclic changeover and man-machine command changeover.

When the MP fails, the system notifies the maintenance personnel with graphic icons and in
the audible and visual mode so as to replace the failing MP in time.

9.9.3.2 TNET switching network

The TNET switching network is composed of two switching network boards, working in the
active/standby mode. The active/standby status of these two switching network boards is
controlled by MP. When the active TNET switching network board fails, MP will detect this
immediately, and change the standby TNET switching network board into active.

When the TNET switching network fails, the system notifies the maintenance personnel with
graphic icons and in the audible and visual modes so as to replace the failing TNET switching
network board in time.

9.9.3.3 Drive board of TNET switching network

The drive boards of the SP level TNET switching network work in the active/standby mode. The
standby driving board monitors the status of the active drive board all the time. When the active
drive board breaks down, the standby one will immediately detect this, and change itself over into
the active status.

-420-
 Chapter 10 CDMA Short Message Center (ZXSC100)

9.9.3.4 Main processor network card

Two network cards are available in each module processor, working in the active/standby mode. In
case of no data package received by the active network card within 10 sec, the active network card
will be turned off, and the standby one will be started.

9.9.3.5 COMM
To make the intra-module communication of the SMC system more reliable, the hardware is
connected in dual-backup mode, and each SP is connected to a pair of communication boards via
the 64kbps HDLC link. To speed up the link switchover in case of failure, all the links between the
same SP and the pair of load-sharing communication boards should be established beforehand.
Which link to be selected for the communication is determined by the active MP. When two links
are set up successfully, the active MP will use the priority method in link selection in order to
balance the loads of this pair of load-sharing communication boards. The rule for this is, thelinks
on the communication board in the left board position will be preferentially selected for the even
numbered channel on the communication board, and the links on the communication board in the
right board position will be preferentially selected for the odd numbered channel. If the selected
link fails, the MP will select the normal link on the other communication board.

To make the inter-module communication of the SMC system more reliable, the hardware is
connected in dual-backup mode, and each module is connected to a pair of communication boards
via the 64 kbps HDLC link. To speed up the link switchover in case of failure, all the links
between the same SP and the pair of load-sharing communication boards should be established
beforehand. As for which link is selected, it is up to the active MP. When both links have been
successfully established, the active MP will select the link on the left COMM board. If the selected
link fails, the MP will select the normal link on the other COMM board.

9.9.3.6 Power supply

The serial dual-power mode for power supply is employed for each layer of shelf of the ZXSC100,
when one power supply fails, normal power supply can still be guaranteed, and the failure of the
power supply will be reported to the maintenance personnel in graphic interfaces or audible and
visual mode, so as to replace the failed power supply in time.

9.9.3.7 Service server

Under the WINDOWS NT platform, the service server in the ZXSC100 uses such modes as dual-
computer system hot backup and redundancy disk array etc to guarantee the reliability of the
service server. The dual-computer system technology is based on the CLUSTER architecture. The
purpose of the CLUSTER technology is to improve the system’s reliability, expandability and the

-421-
Chapter 10 CDMA Short Message Center (ZXSC100)

resistance against disaster. One cluster includes multiple servers with the saving space for shared
data. When one server fails, its application programs will be taken over automatically by other
servers.

In the dual-computer system, each has its own name and IP address. They provide a common
virtual computer name and IP address for the outside, via which the services are provided. Their
own IP addresses will become invalid in the host status.

Under UNIX platform, the service processing and the database are separated from each other
in the service server of the ZXSC100 .The service processing server can work in the N+1 mode,
normally, the N servers share the work load, while one service processing server is in the hot-
backup status. When the running server fails, the backup service processor will immediately take
over all the running tasks on the failed service server. The database is stored in the mini computer,
which works in the dual system and disk array mode, and is conducive to the security of the stored
data.

9.10 ZXSC100 Software Structure

9.10.1 Software System

The software system of the ZXSC100 is of a hierarchical structure and a modular design in strict
accordance with the software engineering specifications. This chapter will elaborate the software
architecture of the ZXSC100.

The ZXSC100 has a multi-module building-block software structure, which is as shown in

Fig. 10-18.

-422-
 Chapter 10 CDMA Short Message Center (ZXSC100)

SMPP access
Service

Operating & maintenance

subsystem
processing

subsystem
subsystem MAP access
subsystem

Database subsystem

Operation support subsystem

Fig. 10-18 ZXSC100 software architecture

The software structure of the ZXSC100 comprises six parts: operation support subsystem,
database subsystem, service processing subsystem, MAP access subsystem, SMPP access
subsystem, and operation and maintenance subsystem.

Functions of each subsystem will be briefed in the following.

9.10.2 Operation Support Subsystem

The position of the operation support subsystem in the ZXSC100 is as shown in Fig. 10-19.

The Fig. 10-19 shows that the operation support subsystem, which is located above the real-
time operation system to implements process dispatch timing, system control, file management
and communication.

-423-
Chapter 10 CDMA Short Message Center (ZXSC100)

Service Operation &

SS7 Database processing maintenance
subsystem system subsystem subsystem

Operation support subsystem

System control File management

P rocess dispatch timing

Communication

Real time operating system

Hardware

Fig. 10-19 System structure of ZXSC100

9.10.2.1 Process dispatch timing

The process dispatch timing system is subdivided into the process dispatch system and the timing
system.

The process dispatch systems reside on the main processor (MP), the service server and the
SMPP agent server in the ZXSC100. These systems provide the process-oriented development
platform based on the message drive under the multi-task environment, implement memory
management and memory error detection, and enable the synchronous and asynchronous messages
to be sent between the processes. Combined with the communication system, the process dispatch
system can control and maintain the message transmitting and addressing through the whole
network.

The process dispatch system can monitor the system operation and restore the system from
faults. To be specific, it can monitor the usage of the CPU and the important system resources as
well as the over-frequent operation and the deadloop of the processes. In addition, it can monitor
the abnormal interruption during the process operation and enable the restoration.

-424-
 Chapter 10 CDMA Short Message Center (ZXSC100)

Besides, the process dispatch system can provide process-oriented debugging.

The timing system can provide timing for 20,000 pieces of software for a process, including
the relative software timing and absolute software timing. Even with extremely frequent settings
and clearings of the timer, it seizes only minimum CPU resources.

The timing system provides accurate software clocks by introducing the external high-
precision clock reference.

9.10.2.2 System control

9.10.2.2.1 System control in the SM signaling gateway

The SM signaling gateway is developed on the basis of the ZXJ10V10.0 switch platform, and is
responsible for processing the SS7 signaling. As the interface between the SMC and the CDMA
network, the SM signaling gateway exchanges messages with other entities in the CDMA mobile
switching network via the standard SS7, so as to provide the short message services.

The SM signaling gateway comprises the following main functional modules: MTP3, SCCP
and TCAP processes of SS7, TM process, MAP process, MD process, and operation and
maintenance foreground process.

The configuration data of the SM signaling gateway include signaling point configuration,
office configuration, link configuration, etc. The SM signaling gateway can support eight
signaling points at the same time.

The communication between the SM signaling gateway and the service processing node is
enabled through the internal messages on TCP/IP.

The control system controls and coordinates the startup process of the parts of the SM
signaling gateway. The system is started through the following steps: automatic recognition of the
hardware environment, system initialization, loading the data of the SM signaling gateway,
starting the file management system, starting the database system, starting the alarming system,
and finally starting the service processing system and signaling processing system.

The system control part controls the MP man-machine command changeover, MP fault
changeover, MP manual panel changeover, periodic changeover, interruption changeover of the
foreground and the background communication, notifies and coordinates the changeover
processing of each application process.

The system control part monitors the running status of the peripheral processing unit (PP),
processes the signals sent from the PPs, and detects the abnormalities occurring to the PPs. When
a PP fails, it notifies the database to block the related resources, and notifies the service processing

-425-
Chapter 10 CDMA Short Message Center (ZXSC100)

process for troubleshooting and releases the related resources. After the peripheral processor
returns to normal, the database resource is unblocked.

The system control is responsible for the active/standby status control and the active/standby
changeover of the PP.

9.10.2.2.2 System control in the service server

As the core processing component of the SMC, the service server processes the short message
service requests from the SM signaling gateway and the SMPP agent, and completes such core
service functions as reception, saving, forwarding, retry, query and deletion of short messages.

The service processing process completes the major service processing, the MD process is
responsible for the inter-module link detection and the service message distribution, the
configuration process modifies the configuration data, while the operation and maintenance
process completes the collection of the foreground data and their delivery to the background.

The control system controls and coordinates the startup process of the service server and the
short message agent server. The system is started through the following steps: system
initialization, loading the related configuration data for the service server and the short message
agent server, startup of the file management, and startup of the service processing at last.

The system control maintains the clocks of the service server, and ensures their
synchronization with the clocks of the OMM.

9.10.2.3 Internal communication system

The network structure of the ZXSC100 is as shown in Fig. 10-20:

-426-
 Chapter 10 CDMA Short Message Center (ZXSC100)

Short message gateway

PP
64kbit/s
Short message Intra-module communication 64kbit/s
Service server
gateway Inter-module
communication MP
iRMX communication iRMX communication NT communication
system system system
4× 64kbit/s

Ethernet TCP/IP

NT communication NT communication NT communication NT communication

system
system system system
OMM server OMM client ESME SMPP agent

Operation & maintenance component

Fig. 10-20 Network structure of ZXSC100

The Fig. 10-20 illustrates that the communication system consists of the inter-module
communication, intra-module communication, communication between the foreground and the
background, and communication between the active and standby MPs, which are described
respectively as follows.

9.10.2.3.1 Inter-module communication

The inter-module communication is responsible for the error-free message transmission between
two SM signaling gateways. The physical layer of the inter-module communication employs the
HDLC link with the rate of 4×64 kbps. The data link layer performs the error and flow control in
compliance with the 12-frame sliding window protocol, so as to reduce the message transmission
delay and improve the channel’s utilization ratio and the message throughput. The network layer
fulfills such functions as the disassembly, reassembly and forwarding of the messages as well as
the selection and the switching of the links.

9.10.2.3.2 Intra-module communication

The intra-module communication provides error-free message transmission channels between MP
and the peripheral servers. The physical layer of the intra-module communication employs the
HDLC link at the rate of 64 kbps. The data link layer follows the stop-and-wait protocol, with its
link control in the active/standby triple handshaking mode. The network layer is responsible for
such functions as the packing and the unpacking of the messages as well as the selection and the
switching of the links.

The intra-module communication has set enough buffer arrays on the network layer and the

-427-
Chapter 10 CDMA Short Message Center (ZXSC100)

data link layer so as to handle short-time message peaks.

9.10.2.3.3 Communication between the foreground and the background

The foreground and background communication is responsible for the error-free message
transmission between the SM signaling gateway, the service server and the OMM. It adopts the
standard TCP/IP protocol. The data link layer is the Ethernet.

The communication system on the service server is responsible for receiving the messages
from the other nodes on the network and submitting the received messages to the higher layer
applications. In the meantime, the communication module transmits to the designation the
messages sent by the higher layer applications to the other network nodes. The communication
system is responsible for the communication between the service server and other components
such as the SM signaling gateway, the database, the OMM, etc.

The communication programs in the database and the OMM provide transparent
communication services for each application, which exchanges information with the
communication programs by invoking the dynamic connection database.

9.10.2.3.4 Active/standby communication

In the ZXSC100, the active and standby MPs in the SM signaling gateway communicate via the
SMEM board. The SMEM board provides the dual-port RAM accessible to both the active and
standby MPs, with minimum error possibility. So the control of active/standby communication
does not adopt any standard link layer protocol, but the traffic and errors should be properly
processed.

9.10.2.4 File management system

The file operation enables write/read of processes. The file management system locates in the
lower-priority tasks in the system. It can be preempted by other higher-priority tasks so as to
prevent the low speed I/O operations from affecting the system’s real-time response.

For the access requests of concurrent files with multiple processes, the file system puts them
in a queue based on the “first come, first served” principle, in order to achieve mutual exclusion of
the file operations.

The file system provides the typical file management functions such as file listing, file
copying, file renaming, and file deleting between MPs, between active/standby MPs, service
processors in the switch foreground network as well as between various terminals in the
background maintenance network.

-428-
 Chapter 10 CDMA Short Message Center (ZXSC100)

9.10.3 SS7 Subsystem

For applications in a multi-brand environment, all functional entities of the CDMA system are
connected through the standard SS7 network. The SMC exchanges information with other
functional entities (MSC, HLR) of the CDMA system through the SS7 network. This section gives
a detailed description of the SS7 of the ZXSC100.

9.10.3.1 Overview
The common-channel signaling processing of each component in the ZXC100 takes the semi-
permanent connection mode to connect the signaling to the switching network.

The SS7 physical layers of the ZXSC100 are distributed between the MP and the
communication board (COMM). The link layer protocol is implemented by HDLC in the COMM,
and the third network layer functions are performed via the MP and the switching network.

The following will discuss the SS7 in detail.

9.10.3.2 Basic mode of SS7

The mode of the SS7 is as shown in Fig. 10-21.

BSSAP BSS
OMAP MAP INAP DTAP
OSI-7 application layer BSSMAP OMAP
ISUP TUP

TCAP

OSI-6 presentation layer

OSI-5 session layer ISP
OSI-4 transmission layer

OSI-3 network layer SCCP

L3 MTP-3

OSI-2 data link layer L2

MTP-2

OSI-1 physical layer L1

MTP-1

OSI-0 medium layer SS7 system structure

Fig. 10-21 SS7 mode

-429-
Chapter 10 CDMA Short Message Center (ZXSC100)

At present, the SS7 system is divided into four levels. MTP and SCCP belong to the lowest
three levels, corresponding respectively to the physical layer, data link layer and network layer in
the OSI model. Each application entity is a functional unit concurrent in the fourth level and
corresponds to the application layer in the OSI model. In the figure, the ISP enclosed in the broken
line box corresponds to the layers 4~6 of OSI, which are not defined yet.

In the SM signaling gateway, the SS7 signaling mode is divided according to specifications
into the following several function blocks:

1. Message transfer part (MTP);

2. Signaling connection control part (SCCP);

3. Transaction capability application part (TCAP);

4. Mobile application part (MAP).

9.10.3.2.1 MTP
MTP is further divided into MTP1, MTP2 and MTP3, corresponding respectively to layers 1, 2,
and 3 in the 7-layer protocol.

MTP1, at data link level equivalent to L1 of OSI—physical layer, is mainly a two-way data
transfer channel comprising the digital transfer channel and signal terminal equipment. The basic
rate of the digital transfer channel is 64 kbps.

MTP2 is the signal link level, equivalent to L2—link function level in OSI. This level
provides signal links for reliable signal message transfer between two directly connected signal
points on the COMM board of the SM signaling gateway. Its major functions are: Signal unit
delimiting and locating, error check and correction signal link monitoring and traffic control.

MTP3 is the signal network function level. Together with the extended function level SCCP,
it is called the OSI L3 function level. The main functions of this layer include signal message
processing and signal network management.

The signal message processing mainly implements message routing, message identification
and message distribution.

The signal network management mainly includes the management over signal traffic, signal
links and signal routing.

The signal traffic management mainly functions to perform the message transfer and traffic
control in case of fault and congestion. The signal link management mainly functions to perform
effective management over the links when the signals are recovered, enabled and disabled in the
signal network. The signal route management mainly functions to exchange the information on the

-430-
 Chapter 10 CDMA Short Message Center (ZXSC100)

signal routes reliably, including the functions of enabling, restriction and transferring.

9.10.3.2.2 SCCP
As the MTP layer addressing is restricted to only inter-node transfer, merely performing the
connectionless message transfer, it can provide neither directional connection services nor global
addressing, thus another SCCP functional layer is added to MTP3. SCCP is a function supplement
to MTP, capable of providing MTP with connection-oriented functions. Besides, the SCCP can
also provide GT function, which translates GT into DPC+SSN (DPC stands for Destination Point
Code and SSN for Sub-System Number for identifying local SCCP subscribers) at the message
source point or at STP.

9.10.3.2.3 TCAP
The TCAP is an intermediate layer between the service layer and SCCP, but it belongs to the 7 th
layer of the OSI 7-layer protocol. The application layer supported by TCAP includes three parts,
the OMAP, MAP and INAP. The TCAP has the application layer specifications and functions, but
without the specifications and functions of layers 4~6.

In order to control the operations and sessions, the TCAP itself is subdivided into two
sublayers, the component sublayer (CSL) and the transaction sublayer (TSL), as described below:

1. TSL

1) Management of signaling communication between local and remote transaction

subscribers;

2) The only user of the transaction sublayer is the component sublayer;

3) The start/end sequence of the bi-directional information exchanging between the two TC
users is controlled and released by the local layer.

2. CSL

1) Error check and dialogue distribution of the operation management component;

2) Setting up a status diagram for each originating subscriber.

The SS7 of the CDMA system differs from that of the GSM system mainly in the different
standards for the transaction capability application part (TCAP). CDMA employs ANSI TCAP,
with the standard of ANSI T1.114-1988 Signaling System Number7 (SS7)-Transaction
Capabilities Application Part (TCAP), while GSM employs the Chinese TCAP of ITU TCAP
standard. ANSI TCAP employs the Transaction ID to mark a connection, while ITU TCAP
employs the Dialogue ID (DID) to mark a dialogue.

-431-
Chapter 10 CDMA Short Message Center (ZXSC100)

9.10.3.2.4 MAP application layer

The Mobile Application Part (MAP) is similar to that of GSM in its functions, located in the upper
layer of TCAP in the OSI reference model, and adopts the connectionless mode of SCCP alone.
The standard MAP protocol is employed for setting up dialogues among the SM signaling gateway
of the SMC and MSC/VLR and HLR, so as to transfer messages.

In the ZXSC100, MAP includes the following signaling processes:

1. MS originating short messages;

2. MS terminating short messages;

3. Short message notification.

9.10.3.3 SS7 message format

The SS7 uses different-length messages to transmit signaling. There are three types of signal units
in SS7: message signal unit (MSU), link status signal unit (LSSU) and fill-in signal unit (FISU).
MSU is the signal unit that practically carries messages. LSSU is the signal unit that transmits
network link status. FISU does not contain any information and is used to send a null signal to the
opposite side when the network node has no information to send. Its function is to enable the
signaling link to remain in a communicating status and at the same time to acknowledge that the
message sent from the opposite side is received. The formats of the three types of signal units
MSU, LSSU and FISU are shown as follows.

1. MSU: message signal unit.

The MSU format is as shown in Fig. 10-22.

Fig. 10-22 MSU format

2. LSSU: link status signal unit

-432-
 Chapter 10 CDMA Short Message Center (ZXSC100)

The LSSU format is as shown in Fig. 10-23.

Fig. 10-23 Message format of LSSU

3 FISU: fill-in signal unit

The FISU format is as shown in Fig. 10-24.

Fig. 10-24 Message format of FISU

Where:

BIB:Back Unit Indicating Bit

BSN: Back Unit Sequence Number

CK: Check bits

-433-
Chapter 10 CDMA Short Message Center (ZXSC100)

F: Flag

FIB: Forward Unit Indicating Bit

LI: Length Indication

SF: State Field

SI: Service Indication

SIF: Signal Information Field

9.10.3.4 Physical platform of ZXSC100 system signaling

The three layers of protocols MTP1, MTP2 and MTP3+SCCP of SS7 correspond respectively to
MP, COMM, and T network and its related software in ZXSC100.

The MTP1 (L1) layer physical platform is located in MP-COMM. The HDLC protocol of
each pair of COMM boards can provide signaling channels with up to 32 TSs. The COMM
signaling information is sent via the semi-permanent (fixed) connection in the TNET to a
corresponding link (DT interface), as shown in Fig. 10-25.

The two HDLC cables in COMM can be sent at different moments by selecting different TSs
to different links for the purpose of simultaneous processing. COMM1 and COMM2 connections
are in the traffic load-sharing multiplexing mode, and the module processors are in the
active/standby multiplexing mode.

The signaling physical platform of the ZXSC100 is located in the same TNET network
module as the channel connections through the semi-permanent connection, therefore it is easier
for link fault detection and signaling channel detection. Besides, the COMM communication
program of the ZXSC100 is written to/read from all COMM boards.

-434-
 Chapter 10 CDMA Short Message Center (ZXSC100)

应TUP
DT 用ISUP
(PRI) 实
INAP
L3 体
MAP
TNET
Network

COMM 1 COMM 2

HDLC HDLC

L2/L1

MP0 MP1

Fig. 10-25 Signaling physical platform of the system

The processing of the third layer of SS7 for the ZXSC100 is as shown in Fig. 10-26, where
B03 is supposed as the function of the third-layer MTP3.

TUP→COMM

COMM→TUP

-435-
Chapter 10 CDMA Short Message Center (ZXSC100)

Fig. 10-26 Schematic diagram of the communication process

In the figure, TUP represents only the MP process of sending/receiving messages to and from
COMM. In the ZXSC100, DPRAM communication is implemented in the interruption mode.

9.10.3.5 SCCP
The signaling connection control part is simplified as SCCP. In the hierarchical structure of the
SS7 mode, it belongs to the MTP user part, and provides MTP with the global code-based routes
and routing function. This enables it to transmit various types of information unrelated to the
circuits and other types of information between the switching offices and specialized centers in the
telecom network through the SS7 signal network, and set up connectionless or connection-oriented
services. If the data that the user wants to transmit exceeds the MTP limit, SCCP will provide the
necessary functions of segmentation and re-assembly.

9.10.3.5.1 SCCP location in the system

The SCCP is under the TCAP layer in the signaling system of ZXSC100, as is shown in Fig. 10-
27.

Fig. 10-27 Location of the SCCP

9.10.3.5.2 Functions of SCCP in the system

In ZXSC100, the SCCP has the following functions:

1. Setting up logical signaling relationships in the SS7 network;

2. Able to transmit signaling data units regardless of whether logical signaling connections

-436-
 Chapter 10 CDMA Short Message Center (ZXSC100)

are set up or not;

3. Performing global code-based routing functions;

4. Providing basic connectionless services, sequential connectionless services, basic

connection-oriented services and connection-oriented flow control services.

9.10.3.5.3 Module structure and the functions of SCCP

The SCCP functional module is as shown in Fig. 10-28.

SCCP can provide two types of services, namely, connectionless services and connection-
oriented services.

1. Connectionless services

The connectionless service is practically the datagram in the packet switching, that is, to send
signaling messages without a connection being set up beforehand. Here, the sent data messages
are taken as independent messages and sent to the destination signaling point (DPC) in the route
numbering labels. In basic connectionless services, all messages are independently transmitted and
are irrelevant to each other. So messages can not be ensured of being sent to the destination
signaling point in the transmission sequence. In the sequenced connectionless services, the data
message from the same information is attached with the same signaling link selection field, so as
to guarantee that these data will be transmitted via the same signaling link and thus to the
destination SP in the transmission sequence. Each time the data is sent by a connectionless service, a
re-routing is required.

The specific operation is as follows:

An SCCP subscriber at the originating node sends out N_unit data request primitives to
request the connectionless data transfer services. Then, the SCCP route control and MTP is used to
send the unit data message to the called address specified in the unit data request primitives.

-437-
Chapter 10 CDMA Short Message Center (ZXSC100)

SCCP subscriber MTP

Connection-oriented
message
SCCP connection
-oriented Routing error
N_transfer primitive transfer control
SCCP routing
control module MTP_transfer
Connectionless (SCRC) primitive
message
N_transfer primitive SCCP connectionless
transfer control
Routing error
module (SCLC)

Receive the messages

S S S S S sent to the unavailable
O O S S S subsystem of this node
R G A P T

Sccp management control module

N_management primitive (SCMG)
MTP_management
primitive

SCCP functional module structure

Fig. 10-28 SCCP functional module structure

When the unit data message cannot be sent to the destination point, the Unit Data Service
(UDTS) message will be sent to the originating point; when the destination node receives UDTS
message, it sends N_unit data indication primitive; when SCRC cannot send the unit data or
UDTS message, it will send one UDTS message to the address of the caller or call N_notice
indication primitives.

If the data length in the N_unit data request primitive is longer than X (temporarily set as
200), the UDT message can not send so many data. So, the data must be divided into several
segments with shorter lengths, and each segment is sent by one XUDT message. Accordingly,
when SCCP receives an XUDT message, the divided data must be reassembled to form one
N_unit data indicating primitive, and then sent to the SCCP subscriber. This process is called
Segmentation/Reassembly.

The transmission process of the connectionless services is as shown in Fig. 10-29:

-438-
 Chapter 10 CDMA Short Message Center (ZXSC100)

Fig. 10-29 Connectionless service transmission process

2. Connection-oriented services

The connection-oriented service is actually the virtual circuit in the packet circuit, that is, it is
necessary to set up logic connections before data transmission. In the basic connection-oriented
services, no data message carries a serial number, so neither sequence control nor flow control can
be implemented. In the connection-oriented flow control service, however, sequence control and
flow control can be performed.

The connection-oriented services can be further subdivided into temporary signaling

connection and permanent signaling connection. The establishment of the temporary signaling
connection should be started and controlled by the SCCP subscribers, which is similar to the
connection of telephone dialing. The permanent signaling is established and released by the local
(or remote) O&M function or the node management function, which provides the SCCP
subscribers with semi-permanent connection similar to the leased telephone lines.

The connection-oriented transmission process is as shown in Fig. 10-30.

The connection-oriented transmission process includes:

1. Connection establishment process

When the SCCP function of the originating node receives a signaling connection request
N_ConnectReq, it analyzes the called address, so as to identify the destination node to which the
established signaling connection will be sent. If the destination node is not a local node, SCCP will
perform MTP functions to send a Connection Request (CR) message to the destination signaling
point.

When the SCCP of the destination node receives a CR message, it sends N_ConnectInd
primitives to the subscriber. If the subscriber agrees to establish a connection, an N_ConnectRes
primitive will be called, and SCCP will send a Connection Confirmation (CC) message to the

-439-
Chapter 10 CDMA Short Message Center (ZXSC100)

originating node. If he does not agree, an N_ConnectReq primitive will be called, and SCCP will
send a Connection Refuse (CREF) message to the originating node.

Node 1 Node 2

SCCP1 SCCP2
Connection request

Connection confirmation

Data

Data

Connection release
(RLSD)
Release completion
(RLC)

Fig. 10-30 Connection-oriented transmission process

During this course, it is also required to perform negotiation on the protocol types and the
credit volume of the flow control. And the SCCPs at the originating node, destination node and the
midway mode are all required to record the necessary information on this signaling connection, so
as to set up the logical signaling connection link.

The setup and rejection process of signaling connection is as shown in Fig. 10-31.

SCCP User SCCP user

N_ConnectRes N_ConnectInd
N_ConnectReq N_ConnectCon
CC CC
SCCP SCCP SCCP
CR CR

Rejection of the signaling connection setup

SCCP User SCCP User

N_ConnectReq N_ConnectInd N_ConnectReq N_ConnectInd

CREF CREF
SCCP SCCP SCCP
CR CR

Rejection of the signaling connection setup

Fig. 10-31 Setup and rejection process of signaling connection

-440-
 Chapter 10 CDMA Short Message Center (ZXSC100)

2. Data transfer process

The data transfer functions ensure that the subscriber data are transferred in temporary
signaling connections. The functions provided here include segmenting and reassembling, flow
control, inactivity control and accelerated data transfer.

Segmenting and reassembling are to segment subscriber data if the length is longer than 255
octets, insert them into the data parameters of DT1 or DT2, then reassemble them with the multi-
data indicating codes (M bits) at the receiving end.

Flow control means to control message flow with a sliding window when the protocol is the
flow control connection-oriented service.

The purpose of inactivity control is to prevent:

1) Loss of “connection confirmation” during the connection setup;

2) Unnoticed termination of the connection segments during data transfer;

3) Inconsistency of the connection data held at both ends of one connection.

Whenever the connection section sends a message, the inactivity controller for sending
should be reset; when the timing of the inactivity control timer expires, the connection release
process should be started.

Data transfer acceleration occurs when the protocol type is the flow control connection-
oriented service, and the transferred data amount up to a maximum of 32 octets, with a high rate
requirement (neither controlled by flow, nor providing segmenting and reassembling functions).

3. Connection release process

In order to start and terminate the connection release, two kinds of information are needed:
the released message (RLSD) and release completion message (RLC). The release process can be
initiated by the SCCP users or by SCCPs. Besides the release of the logical links and local
references, the release process should also be able to freeze the local references, in order to
prevent the startup of processes unsuitable for the present connection due to the reception of
messages related to the established connections.

4. Restoration process

The purpose of the restoration process is to re-initialize the connection segment, to reject data
messages, data confirmation messages, accelerated data messages and accelerated data confirming
messages, to set the sending sequence number P (S) to 0 and to restore the window value to the
original value.

-441-
Chapter 10 CDMA Short Message Center (ZXSC100)

9.10.3.5.4 SCCP management functions

The SCCP management function (SCMG) is to re-select signaling routes or restrict signaling
traffic when failure or congestion occurs at SP or the SP subsystem so as to ensure normal
signaling network performance. The subsystem here actually refers to an SCCP user. The SCCP
management process stipulates that the signaling points or subsystems should both be configured
as active/standby dual systems, and assume that they work in the active-control mode. That is, the
standby system is started only when the active system breaks down. And once the fault is
removed, it is immediately changed over to the active system.

The SCCP management function is applicable to connectionless services and connection-

oriented services.

It can be divided into two sub-functions according to its management objects:

1. SP status management: It serves to modify the SCCP address translation table and the node
or subsystem status according to the signaling point code provided by MTP, so that the subscriber
can take measures to re-send or reduce the signaling messages sent by the related SP.

2. Subsystem status management: It serves to modify the SCCP translation table, update the
status labels and perform the changeover and changeback of signaling information between the
active/standby subsystems according to the received information about the subsystem failure, exit
and recovery.

9.10.3.6 Services and management functions used in the system

In the SS7 system of the ZXSC100, the only subscriber of the SCCP is the TCAP. Messages are
transferred between the two by the N_UNITDATA primitive. The subscriber data can reach 3200
bytes. Those with a length of over 200 bytes can be transferred in the segmenting/reassembling
mode. The SCCP implements address translation and route selection of global codes in the
message, so as to provide network support to the TCAP and upper layer subscribers.

9.10.3.7 TCAP
The transaction Capability Application Part is abbreviated as the TCAP. In the hierarchical
structure of the SS7, it belongs to the subscriber part of the SCCP, and mainly targets to provide
unified support for the information interaction of all kinds of application services in the network
environment, to transmit the address translation information, the subscriber data information, the
charging or management information and other information irrelevant to the circuit between the
switching nodes and the controlling nodes. The TCAP signaling process is the handling and
control procedure over operations and sessions.

In the ZXSC100, the TCAP supports a unique subscriber―MAP.

-442-
 Chapter 10 CDMA Short Message Center (ZXSC100)

9.10.3.7.1 TCAP hierarchical structure and functions

The hierarchical structure of TCAP is as shown in Fig. 10-32:

Fig. 10-32 TCAP hierarchical structure

Where:

CSL—operation management

TSL—session management

The CSL and TC-user interface through TCprimitives

CSL and TSL interface through TRprimitives

For the control over operations and sessions, the TCAP is subdivided into two parts,
transaction management and component management.

9.10.3.7.2 Transaction Capability Application Part Sub-Layer (TCAPTSL)

The TCAPTSL is to manage the signaling communications process (i.e., transaction) between the
local TCAPTSL subscribers and remote TCAPTSL subscribers. The TCAPTSL subscriber is a
TR-subscriber, and the sole TR-subscriber at present is the TCAPCSL. Communication between
peer TCAPCSLs is performed between peer TC-users, called a session. Therefore, in the current

-443-
Chapter 10 CDMA Short Message Center (ZXSC100)

definition of the TCAP protocol, the transaction is completely equivalent to the session, with one
corresponding to the other.

To complete the signaling process of one application service, two TCusers make a two-way
exchange of a series of TCAP messages. The start, end, sequence and message content of message
exchange are all controlled and explained by the TCusers. The TCAPTSL manages the starting,
holding and termination of the session, including detection and handling of abnormalities. The
protocol process is applicable to sessions of any application services.

9.10.3.7.3 Transaction Capacity Application Part Component Sub-layer (TCAPCSL)

The main functions of the TCAPCSL include operation management, component error detection
and session component assignment.

In normal cases, one operation means the TC-user initiates an invoking request, and the
TCAPCSL sets up a status diagram for each operation, so as to perform the operation
management.

Component errors include the protocol error and response timeout. The protocol error is that
the component types received at the TCAPCSL don’t comply with the expectation of the operation
status diagram, or that the component format has syntax error or cannot be identified. The
response timeout means the timeout of various operation timers.

The TCAPCSL allocates session components through its management of session identity.

9.10.3.7.4 Function classification

The TCAP hierarchical module structure is as shown in Fig. 10-33.

Where:

The CHA module on the TCAPCSL is to handle components, perform the interactions of TC
component handling primitives between the TCAP and the TCuser, and manage each operation
invoking. The DHA module on the TCAPCSL serves to handle sessions. It mainly performs the
interaction of TC session handling primitives between the TCAP and the TC-user, as well as
assignment of session components.

-444-
 Chapter 10 CDMA Short Message Center (ZXSC100)

TC-user TC-Primitive

CHA
DHA
CCO
ISM
CSL

TR-Primitive

TSL
TCAP

N-Primitive

SCCP

Fig. 10-33 TCAP hierarchical module functions

When the TCAPCSL receives the normal session processing TC request primitive from the
TC-user, the DHA module will request the component part contained in that session from the CHA
module. When the TCAPCSL receives an abnormal session processing TC request primitive, the
DHA module will transmit a session termination indication to the CHA module to make the CHA
module terminate all the unfinished operations contained in that session. When the TCAPCSL
receives the TR indication primitive, the DHA module will transmit all the components contained
in the received session to the CHA module to check the components’ syntax and their operation
status.

The ISM in the CHA module is the operation invoking finite state machine. The TCAPCSL
that initiates the operation request node manages all operations accordingly.

The CCO module in the CHA module is a component coordinating module. Each session
corresponds to one CCO module, generating the components to be sent by the TCuser as well as
assigning the components contained in the received session to the ISM for further check. When the
ISM detects any component error, it starts the rejecting mechanism.

9.10.3.7.5 TCAP component operation handling process

1. Basic handling process

A successful operation processing is as shown in Fig. 10-34. In the diagram, I in the bracket
is an operation invoking identity. If the operation fails, Subscriber 2 will send a Return Error (RE)
component and the corresponding TC primitive should be TC-U-RROR.

The operation invoking identity in the component is dynamically allocated by the TC-user
when it initiates an operation request. There can be multiple operations performed at the remote
end at any moment. Each operation invoking identity corresponds to one component status

-445-
Chapter 10 CDMA Short Message Center (ZXSC100)

diagram. The opposite node only responds to this operation without interfering with the operation
status management. The component status diagram is managed by the process TCAPISM, and
returns to the idle state after the operation procedure is completed. Meanwhile, the operation
identity is released. After the release, it must be frozen for a period of time before being re-used.
The freezing method is specified by the TC-user.

T C u s er 1 C S L1 CS L2 T C u s er 2

T C －INVOKE R eq u es t IN V( I ) C o m p o n en t T C － INVOKE In d i c at i o n

T C－R － NL In d i c at i o n RRNL(I) C o m p o n en t T C －R －NL R eq u es t

T C －R － L In d i ca t i o n
RRL(I) C o m p o n en t T C －R －L R eq u es t

Fig. 10-34 A successful operation handling process

The TCAP allows two nodes to send operation requests to each other during an application
service session. Thus, the destination will send an operation request for information to the opposite
end. The second operation invoking component has its own operation invoking identity assigned
by the destination TC-user. But this component must still return the identity of the first operation
to the opposite end, called an “associated operation identity”, so as to show that the invoking of
the second operation is requested for executing the first operation.

Fig. 10-35 shows the handling process of an associated operation. Where, Subscriber 1 firstly
initiates a test request to Subscriber 2 with the test operation identity as 1. The test has multiple
test conditions for selection, which are preset at Subscriber 1.After receiving the request,
Subscriber 2 sends a request for test condition selection inversely to Subscriber 1. The invoking
component operation identity is 2 and the associated operation identity is 1. Upon the request,
Subscriber 1 sends the selected test conditions and Subscriber 2 completes this test.

2. Abnormality handling process

The processes for handling several abnormal cases are described as follows:

1) Timeout handling

-446-
 Chapter 10 CDMA Short Message Center (ZXSC100)

After each operation invoking component is sent, the TCAPCSL (process TCAPISM) will
start a related timer. If no response from the opposite side is received within a defined period, this
TCAPCSL will cancel the operation (the component status diagram returns to idle). Meanwhile, it
will notify the TC-user by using the TCLCANCEL indication primitive. At any time, if the TC-
user wants to cancel an operation under execution, it can notify the TCAPCSL by using the TC-U-
CANCEL request primitive. What is canceled is only a partial process inside the node, without
sending any component notice to the opposite end. If a response is received from the opposite end
after the cancellation, it will be regarded as an illegal message by the TCAPCSL and rejected.

Fig. 10-35 Handling process of associated operation

2) Illegal component handling

An illegal component is one that has format errors or inconsistency between types and status
diagrams, or is not identifiable. Once this type of components is received, the TCAPCSL will
perform the rejection process, generate and store a rejection component (RJ) for sending, notify
the TC-user via the TC-L-REJECT indication primitive, and inform the subscriber of the cause.
The handling of this process is performed in the process TCAPCSL0.

If a subscriber finds the component semantic wrong or not in compliance with the application
service specifications, the TCUREJECT primitive can also be used to send the rejecting
component. After the opposite end gets this component, it will use the TC UREJECT indication
primitive to notify its subscriber. The TCAP of the receiving party determines whether this
rejection is done by the opposite subscriber or the opposite TCAP according to the problem code
in the component.

If a TCAP message contains multiple components and one is rejected, all the subsequent

-447-
Chapter 10 CDMA Short Message Center (ZXSC100)

components will be aborted. For the segmented and transferred return result, any component
rejection means the whole return result rejection.

Even if the operation invoking identity in an illegal component is unrecognizable or is an

illegal number that is not assigned, the above rejection process should be executed. The only
exception is that the received illegal component itself is a rejected component. Here, the
TCAPCSL needs only to notify its own subscriber instead of sending any new rejecting
component to the opposite end.

3) Other abnormal cases

Here it means the component loss, repetition or wrong sequence. For the TCAP, such cases
hardly occur, so protocols may not take these into consideration. Otherwise, it will result in an
unnecessary increase of the overhead and the degradation of real-time performance. If these cases
occur very frequently for a certain application, the connection-oriented network layer service
should be applied. If the information of a certain protocol, such as billing information, is
extremely important, the application protocol should take measures to ensure a high reliability of
the information.

It is known from the operation process that for the TCAP, the component loss is usually
presented as operation response timeout. Generally the Component repetition and wrong sequence
are impossible to be detected, unless it is the last returned result component (RRL). In this case,
the TCAPCSL will refuse to process it.

9.10.3.7.6 Session handling process of TCAP

1. Basic handling process

In a signaling process, the session interaction takes place between two peer entities. There are
two types of sessions, namely non-structured and structured sessions. The former one has only one
message, which doesn’t need management, while the latter must be granted with the transaction
identity, so as to differentiate the different sessions. Assignment and management of transaction
identities are implemented in the process TCAPTSL.

A basic structured session process includes three stages: session start, holding and end. Here
we just focus on the end mode of a session: basic mode and reserved mode.

1) Basic mode

The subscriber sends the TREND request primitive to the TCAPTSL. The primitive
termination type parameter indicates that it is a basic end. After the TCAPTSL receives this
request, it sends an end message to the opposite end and all components originally stored that
belong to this session are sent together with this message. After the receiving end gets this END
message and transfers it to the subscriber, it will abort all components of this session that are yet

-448-
 Chapter 10 CDMA Short Message Center (ZXSC100)

not sent out.

2) Reserved mode

This mode indicates that the application entity itself knows when to end the session. When
the application signaling protocol runs to a designated point, the subscriber sends a TR-END
request primitive to the TCAPTSL, in which the termination type parameter indicates that it is a
reserved end. Here, the TCAPTSL will not send any END message to the opposite end and the
TCAPTSL will abort all components of the session that is not sent out. Correspondingly, the
opposite subscriber also knows when this session should end and will end this session in the
reserved mode.

In whatever mode the session is ended, after the TCAP receives a corresponding primitive
request or indicator, it will recover the transaction status diagram and all status diagrams
belonging to the session to idle status, without checking whether the operation request has
received the final return result.

2. Abnormality handling

Abnormal cases include:

1) Receiving one message with unobtainable destination transaction identity (unrecognizable

or unavailable) or an illegal number that is not yet assigned;

2) Receiving one message with a legal destination, but the message type is not consistent
with the transaction status diagram. In this case, the receiving end (process TCAPCSL) will
process it according to the source end transaction identity;

3) If the source end transaction identity cannot be obtained, then this message is aborted,
without being handled at all. That is to say, neither the aborted message is sent, nor is the
transaction ended;

4) If the source end transaction identity is available, then an aborting message is generated,
showing the protocol aborting reason (PABORT), to be sent to the source end. After receiving this
message, if the source end checks and finds that this identity is actually assigned, it ends this
transaction.

In whatever cases, the whole wrong TCAP message should be aborted.

After the opposite end receives the aborted message, its TCAPTSL will do the following:

1) If the aborted message contains the “subscriber aborting information”, it will use the TRU-
ABORT primitive to notify the subscriber;

2) If the aborted message contains the “protocol aborting” reason, it will use the TRPABORT

-449-
Chapter 10 CDMA Short Message Center (ZXSC100)

primitive to notify the subscriber.

In the above two cases, all of the messages that are not sent out should be aborted and the
transaction status diagram returns idle.

9.10.4 SMPP Access Module

The SMPP access module provides a standard SMPP protocol interface for the ZXSC100, and all
kinds of ESMEs can access the SMC via the SMPP access module.

The SMPP agent maintains the communications link connecting with the ESME, performs
conversion between the SMPP standard messages and internal messages of the system, provides
the open interfaces for the ESME to access to the SMC, and supports multiple access modes based
on the TCP/IP protocol, X.25, etc. It can access the ESMEs of the GSM-SMC and CDMA-SMC,
including: 1258 assisted operator position, 1259 automated operator position, voice mailbox,
information platform, WEB server and mobile bank. With the SMEs of different functions, various
value-added services can be provided.

In the ZXSC100, the SMPP access module mainly fulfills the following functions:

1. Supporting message distribution to the multi-service server node;

2. Overload protection mechanism;

3. Tracing the signaling of the SMPP standard messages;

4. Establishing communications links with the ESMEs (TCP/IP protocol or X.25 protocol);

5. Checking the link connection/disconnection status;

6. Message transfer between the ESME and the short message processing module;

7. Rejecting illegal operation request from an ESME.

At the same time, short messages can be delivered between the mobile subscribers of the
CDMA network and GSM network by adding ZXSC100-GW interworking and sharing gateway
software, and the same expansion short message source can be shared.

-450-
 Chapter 10 CDMA Short Message Center (ZXSC100)

9.10.5 Service Server

9.10.5.1 Structure overview of service server software

The service handling subsystem comprises the short message service processing module (short
message SPM), MAP access module and SMPP access module. Its simplified illustration is as
shown in Fig. 10-36.

Fig. 10-36 Structure of the service handling subsystem

9.10.5.1.1 Short message SPM

As the core for the service processing subsystem, the short message SPM mainly performs the
reception and storage of the short messages, parameter conversion, forwarding retry and
subscriber check. The module exchanges short messages with the MS in the CDMA network via
the MAP access module, and sends and receives the short messages of ESME via the SMPP access
module.

9.10.5.1.2 Transfer module (TM)

As a part of the MAP access module, the transfer module (TM) is not an independent module as
divided by the standard protocol. However, as it performs comparatively independent functions, it
is separated from the software module. Its major function is to manage the sessions between the
application layers, and is applied in the lower layer of MSP in the CDMA system, so as to connect
mobile application and SS7.

The TM is located in the system software distribution diagram as shown in Fig. 10-37.

When the TM receives the messages from the MAP, the parameters in the TC primitive will
be filled in according to the information in the message, so as to send the message to the TCAP.

-451-
Chapter 10 CDMA Short Message Center (ZXSC100)

Likewise, when the TM receives the messages from the TCAP, the parameters in the MAP
primitive will be filled in according to the information in the message, so as to send the MAP
message to the application layer. The MAP messages and TCAP messages are divided into the
MAP service messages and TC component primitives, and the session management will be
performed via the session ID in the message.

Fig. 10-37 Distribution of TM locations

9.10.5.2 Service flow

9.10.5.2.1 Submission of short messages

1. Direct submission of the short messages by MS

When receiving a short message submission request from the SM signaling gateway, the
SMC first decodes the short message content, then performs the authority check according to the
setting of the operator: checks whether the origination or destination subscriber is the home
subscriber of the SMC, whether it was registered in the SMC and whether the CUG restriction
exists. If the check passes and the destination subscriber is not the home subscriber of the SMC,
this short message will be saved in the database and then forwarded to the home SMC of the
destination subscriber. The SMC will record the forward results and inform the submitter of the
results. If the check passes and the called subscriber has registered in the SMC, this short message
will be saved in the database. The SMC will inform the submitter that the submission is
successful. It will also decide whether to send the short message immediately or later according to
the resource conditions, message request (whether to be sent regularly) and the current short
message status of the destination subscriber.

2. Forwarding short messages by other SMCs

-452-
 Chapter 10 CDMA Short Message Center (ZXSC100)

For a short message from other SMCs of the CDMA network, the SMC will decode it first
and performs the authority check according to the setting of the operator: check whether the
destination subscriber is the home subscriber of the SMC, whether it has registered in the SMC
and whether the CUG restriction exists.

If the check passes, the short message will be saved in the database, and the SMC will be
notified of the successful forwarding. Afterwards, it will be determined whether to send short
messages immediately or later according to the resources status, message request (whether to be
sent regularly) and the current short message status of the destination subscriber.

3. Short message submission by ESME

For a short message from such ESMEs as the assisted operator position and voice mailbox,
the SMC will check whether its destination address is a distribution list, whether each called
subscriber has registered in the SMC (depending on the operator). Then the SMC will save the
short message in the database and decide whether to forward it to other SMCs according to the
home of the destination subscriber. It will also decide whether to send the short message
immediately or later according to the resource conditions, message request (whether to be send
regularly) and the current status of the destination subscriber.

9.10.5.2.2 Delivery of short messages

At some specified moments, the system will get unsuccessfully delivered short messages from the
database, perform coding process, and send them to the MAP process of the SM signaling
gateway.

For those delivery responses from the CDMA network, the system will perform the following
processing:

1. If the delivery is successful, go on delivering other to-be-delivered messages of the

subscriber (including the messages to be retransmitted);

2. If the delivery fails, start the retransmission mechanism, decide whether to retransmit the
message according to the failure cause, as well as insert the short message into the timed queue
during retransmission;

3. If the short message requires an acknowledgement (status report), generate a short message
of status report according to success or failure of the delivery and the type of the source
subscriber, and send the message like the source message to the origination subscriber.

9.10.5.2.3 MS command processing

For the MS deletion request from the MAP process of the SM signaling gateway, the system will
find the corresponding short message according to the message ID, and check the delivery status

-453-
Chapter 10 CDMA Short Message Center (ZXSC100)

of the short message. If the message has not been successfully delivered, the system will delete it
without delivery again; if it has been delivered successfully, the system will refuse to delete it.

9.10.5.2.4 ESME login management

The detailed flow for the ESME login management is as follows:

1. The configuration background sets up such information as the name (e.g., assisted operator
position) of each ESME, the System_ID, the password, the attribute (e.g., a certain service
authority corresponding to the information of opening account subscriber) used for login, priority
and the allowable service flow;

2. The service server judges the type of ESME according to the System_type used for ESME
login, retrieves the subscriber information for opening account, and performs authentication;

3. The SMPP Agent judges the type of ESME according to the System_type used for ESME
login, makes statistics of the service flow, and imposes restriction when the permitted flow is
exceeded;

4. The service handling console can, according to the configuration, display service types of
all the existing ESMEs on the subscriber service handling interface, and provide them to the
subscribers for selection of the services they need.

9.10.5.2.5 ESME command handling

For such requests of the ESME as subscriber inquiry, message leaving, short message deletion,
substitution and inquiry, the system will perform corresponding processing via the operations such
as database query and modification.

9.10.5.3 Resources management

Service server uses the timed queues to save the related subscriber numbers and time information
during the processing of timed short messages, retrying short messages and alarm calls: When the
subscriber has the timed short message, the preset delivery time of the timed short message will be
saved in the timed queue; When the subscriber need to retry regularly, the preset retrying time will
be saved in the timed queue; When there is an alarm call service for the subscriber, the alarm call
time will be saved in the timed queue.

When there are too many subscribers, the timed queue must be long enough, however, long
queues will lead to rather slow insertion and deletion operations. Therefore, the system employs a
fast index for the timed queue to reduce the time for operation.

The service server uses the process data area to save the message temporarily during the
following processing: waiting responses for the CDMA MS termination call, CDMA MS

-454-
 Chapter 10 CDMA Short Message Center (ZXSC100)

forwarding, and sending messages from MS to ESME, so as to ensure the concurrency and
continuity of the processing.

9.10.5.4 Process division

Service server contains the following processes: service handling process, MD process, database
process and thread, operation and maintenance process, etc.

9.10.5.4.1 Service handling process

The service handling process is:

Responsible for the delivery of short messages from MS or ESME to MS, and query,
substitution and deletion of short messages sent to MS.

Responsible for the ESME login management, link check, short messages sending from the
MS to ESME, ESME inquiry about subscribers, setup of message, password modification, etc.

9.10.5.4.2 MD process
To improve the handling capability, multiple modules of the service server can cooperate to share
the load and backup each other, various modules are responsible for short messages of different
destination subscriber scopes, which can be flexibly configured. The MD process maintains the
subscriber scope table of the service server, the link status table and the link status table of the SM
signaling gateway, and provides the basis for the service handling process to forward short
messages.

The MD process of the service server uses the MIN and MDN number scope tables to
manage the CDMA subscriber scopes. The MDs of the SM signaling gateway and the SMPP agent
are similar to the MD process of the service server, which makes use of the existing MIN and
MDN number scope tables to manage the CDMA subscriber scope.

An originating short message involves two subscribers: source subscriber and destination
subscriber. They may be located in different subscriber scopes of the same service server.
Therefore, the following method is employed: The SM signaling gateway transfers the originating
short message to the service server module where the source subscriber is located, then the module
analyzes the destination subscriber number. That is to say, if the message is sent to an ESME, it
will be processed directly in the module; if the message is sent to an MS, after the authentication
on the source subscriber, it will be sent to the service server module where the destination
subscriber is located. The modules will deliver the message and return the response of the
originating short message to the gateway.

-455-
Chapter 10 CDMA Short Message Center (ZXSC100)

9.10.5.4.3 Database process and thread

The database process and thread perform such functions as the database access, detection of
unchangeable records in the memory database, database monitoring and memory database
synchronization.

9.10.5.4.4 Operation and maintenance process

The operation and maintenance process is a foreground process including such operation and
maintenance subsystems as data configuration, file management, version management, signaling
tracing, service observation, fault management, performance statistics and charging.

9.10.5.5 Queue management

The ZXSC100 provides such services as short message timed delivery, timed retry, and subscriber
alarm call, etc., and they all need to perform the corresponding handling at a specified time. The
service server uses a universal timed queue to save related subscriber numbers and time
information during the processing of timed short messages, retrying short messages and alarm
calls: When there is a timed short message for a subscriber, the earliest preset delivery time of the
timed short message will be saved in the timed queue. When the subscriber needs to retry
regularly, the preset retrying time will be saved in the timed queue. When there is an alarm call
service for the subscriber, the earliest alarm call time will be saved in the timed queue.

When there are too many subscribers, the timed queue must be long enough, however, long
queues will lead to rather slow insertion and deletion operations. Because the processing rate for
the timed queue is related to the processing capability of the system, the ZXSC100 employs a fast
index method for the timed queue to reduce the operation time.

9.10.5.6 Service multi-module sharing

To better serve the CDMA network operators and improve the network efficiency, ZTE
Corporation completely upgrades its software system structure, as a result, the service server can
use multiple modules to share the loads simultaneously, and coordinate their work in mutual
backup mode. Various modules are responsible for processing the short messages within different
destination subscriber scopes, and can flexibly configure subscriber scopes, which is quite
important for operators to sharpen their market competition edges.

In the following, we’ll elaborate the short message service processing in the CDMA network
system.

Similarly, the SM signaling gateway and SMPP agent in the ZXSC100 also employ the
service load sharing and multiple modules coordination, so as to endow the network system with
high processing capability and stable running.

-456-
 Chapter 10 CDMA Short Message Center (ZXSC100)

Specifically, the SM signaling gateway can share services equally according to the services.
The service amount of the SMPP agent approximately equals to the sum of the services of the
ESME to which the SMPP agent is connected. By assigning all the ESMEs with equal services to
each SMPP agent module, the service loads of the SMPP agent can be effectively shared.

Because of the characteristics of the short message services, there is some relevancy between
the messages sent first and later for the same destination subscriber (e.g., it is impossible to send
two short messages to the same subscriber at the same time; the message with higher priority will
be sent first; and continuous delivery of the short messages). Therefore, the short messages of the
same destination subscriber must be processed within the same service server module. As a result,
various modules of the service server will shoulder short message services according to different
subscriber scopes. An example is given in Fig. 10-38 for load sharing of multiple modules (service
server module).

Service server (Module 1)

Subscriber scope
CDMA short message handling 8613305110000~8613305119999
process 8613305120000~8613305129999
…………

Short message Service server (Module 2)

Subscriber scope
CDMA short message handling 8613305210000~8613305219999
gateway
process 8613305220000~8613305229999
…………

SMPP agent
Service server (Module 3)
Subscriber scope
CDMA short message handling 8613306110000~8613306119999
process 8613306120000~8613306129999
…………

Fig. 10-38 Multi-module service sharing of the service server

The subscriber scopes of various service server modules are configured by the operation and
maintenance background, and shall be timely and accurately synchronized to such parts as the
service server, gateway and SMPP agent, so as to correctly deliver the service messages.

When the ZXSC100 is used on the UNIX platform, and the service server is backed up in the
N+1 mode, the MD processes of the service server, the signaling gateway and the SMPP agent
will deliver hand-shaking messages among them, so as to check whether various service servers

-457-
Chapter 10 CDMA Short Message Center (ZXSC100)

are running normally or not. If certain active service server node is found not able to shake hands
correctly, it will be considered faulty. At the time, all the other remaining parts working normally
will transfer the subscriber scope that the faulty node is responsible for the standby service server
node, i.e. the standby node will take over all the services of the faulty node, thus becoming the
active node. After its recovery, the faulty node will become the standby node.

9.10.5.7 Message interchange between the service server and the gateway
In the case of multiple modules of the service server, when the SM signaling gateway receives a
short message originating request (SMDPP) or short message notification (SMSNOT) from the
CDMA mobile network, it will send the messages to the correct service processing module
according to the subscriber’s number scope.

An originating short message involves two subscribers: source subscriber and destination
subscriber. They may be located in different subscriber scopes of the same service server.
Therefore, the following method is employed: the SM signaling gateway transfers the originating
short message to the service server module where the source subscriber is located, then the module
analyzes the destination subscriber number. If the message is sent to an ESME, it will be
processed directly in the module. If the message is sent to an MS, after authentication on the
source subscriber, it will be sent to the service server module where the destination subscriber is
located. The modules will deliver the message and return originating response of the short
message to the gateway.

In ZTE CDMA short message center system, the interaction of the major processes and
messages between the service server and the SM signaling gateway is illustrated in Fig. 10-39
below.

Short message signal gateway

Internal Service server
message
MAP Process Service handling
process

Standard TM Process
message Link check
MD
SS7 Process MD Process

System support System support

Fig. 10-39 Message interchange between the service server and the gateway

In the SM signaling gateway, the MAP process handles services and interacts with the service
server via the internal messages; the SS7 handling process group provides standard SS7, and
interchanges messages with other entities in the CDMA network; the TM process converts the
messages between the MAP process and the SS7 process. The MAP process in the SM signaling

-458-
 Chapter 10 CDMA Short Message Center (ZXSC100)

gateway and the service process of the service server deliver internal messages between
themselves.

To support multi-module network, a new MD process should be added within the SM

signaling gateway and the service server. It has the following two functions: checks whether the
opposite module is running normally by delivering link detection information mutually (hand
shaking messages); manages number scope configurations and provides function interfaces for
upper layer service process, so as to enable the MAP process and the service handling process to
choose the correct destination processing modules.

In the case of multiple modules, in order to ensure the processing efficiency of the system, a
new message delivery process will not be used to forward messages in unification. Instead, the
MAP process and the service handling process of the service server of the SM signaling gateway
directly select the correct opposite module, so as to directly deliver the messages to the
corresponding process of the opposite module. The relevant mechanism supporting this kind of
message distribution is as shown in Fig. 10-40.

When the SM signaling gateway is started, the MD process will interchange messages with
the MD process of the service server, so as to acquire the subscriber scope configurations of
various service server modules, and set up two datasheets in the memory: the subscriber scope
configuration table of the service server and the status table of the service server.

During the system running, the MD process regularly sends hand-shaking messages to the
MD process of the service server, detects the status of the service server and maintains the status
table of the service server. Besides, the MD process is responsible for the maintenance of the
scope configuration table of the service server, if the configuration information of the subscriber
scope is modified by the configuration background of the system, the system will notify the MD
process, which will then modify the configuration table of the service server.

-459-
Chapter 10 CDMA Short Message Center (ZXSC100)

Short message signal gateway Service server

Short message handling

MAP handling process process

Retrieve Retrieve

Subscriber scope configuration table Status table of the service Gateway status table
of the service server server Module Status Traffic
Module Process Subscriber Module No.
No. No. Status
scope No. Normal/abno
Normal/congestion/ 2 rmal
140 180 140 abnormal Normal/abno
Normal/congestion/ 3 rmal
141 180 141 abnormal
……
…… ……
Maintenance Maintenance

MD process MD process

Configuration database

Fig. 10-40 Message distribution mechanism between the service server and the gateway

Upon receiving the originating messages of short message or notifications, with the interface
provided by the MD process, the MAP handling process retrieves the subscriber scope
configuration table of the service server and the status table of the service server, and determines
to which service server module the messages will be sent.

The “process number” data will be reserved in the subscriber scope configuration table of the
service server. It will be used for later expansion of the service server into the multi-service
process.

In the service server, the MD process reads the public configuration database when the
system is started, and establishes three tables with the configuration information: two of the three
tables are the same as those of the gateway, i.e. the subscriber scope configuration table of the
service server and the status table of the service server (because the service messages should be
sent mutually between the service server modules), the other table is the status table of the
gateway which records the status of all modules. During the system running, the MD process
regularly sends hand-shaking messages to the MD process of the gateway, so as to check the status
of the gateway, and maintain the status table of the gateway.

To balance the service loads of various modules of the SM signaling gateway, when

-460-
 Chapter 10 CDMA Short Message Center (ZXSC100)

delivering the short messages, it is necessary for the service server to understand the size of the
existing traffic of various gateway modules, and then send terminating messages to the gateway
module with the minimum traffic. The following methods should be used:

In the gateway status table of the service server, add “traffic” data entry to record the service
loads of various gateway modules. The hand-shaking messages that sent from the gateway MD
process to the service server MD process contain the occupied number of the gateway process data
area. The data is saved in the gateway status table and can roughly reflect the gateway traffic.
When the short message handling process of the service server delivers short messages, it will first
retrieve the gateway status table via the function interface provided by the MD process to find the
gateway module number of the minimum traffic, increase the traffic by 1, and deliver short
messages to the module afterwards. When the MD process receives the hand-shaking messages
next time, the traffic of various modules will be reconfigured.

If the messages received from a certain service server module cannot be processed in time,
notify the gateway module via the hand shaking message, configure the status of the module in the
service server status table as congestion via the MD process, as a result, when the MAP handling
process receives the originating short messages, the messages will not be submitted to the module,
instead, the congestion failure is returned directly. When the service server module is no longer
congested, the module in the service server status table will be reverted to the normal status via the
hand-shaking messages.

9.10.5.8 Congestion control function

Service processing messages can enter the service server in several directions, for example, SM
signaling gateway and SMPP agent. Therefore, the congestion control function must be introduced
for the service server to avoid untimely processing of the sudden increase of short message flow of
the service server, which may cause breakdown of the computer due to accumulation of short
messages.

The overload control system has a distributed web structure, including peripheral modules
(e.g., SM signaling gateway, SMPP agent) and all the service server modules. The message flow
check and control will be performed on each module, while the control thresholds for message
flow control will be only used on various service server modules. The service server module
interacts with various peripheral modules via the MD process, and concentrates the interaction
results to the service server module, dynamically determines the thresholds via special
calculations, afterwards, the thresholds determined by the service server module will be
transferred to various related modules via the MD process.

The control over message flow by various modules is based on the control threshold provided
by the service server module. It counts the received messages within the time set by the timer. If
the result exceeds the control threshold, the new messages will be discarded, or the failing

-461-
Chapter 10 CDMA Short Message Center (ZXSC100)

responses resulting from busy system will be returned. If the result is within the threshold and the
time is not due, the new message will pass.

9.10.6 Database Subsystem.

The database subsystem consists of two parts:

1. System management database: stored on the OMM Server;

2. Subscriber database and short message database: When WINDOWS NT is used as the core
service processing platform, the relevant data is stored in the RAID system of the service server;
when UNIX is used as the platform, then the relevant data is stored in the mini-computer system
(dual system plus the disk array). The data storage is as shown in Fig. 10-41.

9.10.6.1 System management database

The system management database on the OMM server holds various basic data necessary for
system operation, e.g., structure configuration of the system.

The operation & maintenance center governs the system management database via the
maintenance console, so as to manage and configure system settings, and send the newly-
configured data to various parts of the system.

OMM server
System maintenance Maintenance
Service processing service module console
module 1

Service handling
Service processing
console 1
module 2
System management Service handling
database
。。。

console 2
。。。

Service processing
module n Service handling Service handling
module console n

SCDB SCDB
...

Fig. 10-41 Structure of the database subsystem

-462-
 Chapter 10 CDMA Short Message Center (ZXSC100)

The service handling console completes the its account management via the service handling
module and the system management database (such as the account generation, cancellation and
barring).

9.10.6.2 Subscriber short message database (SCDB)

9.10.6.2.1 Database functions

The subscriber database, as the central database storing the basic subscriber information, service
authority information and short messages, performs the following functions:

1. Storage and management of subscriber information and system configuration information;

2. Storage and management of subscriber short message data;

3. Providing corresponding operation authorities to different users to implement data security

management;

4. Providing reliable data protection, together with data dump and recovery.

9.10.6.2.2 Database contents

All the databases and logs of SCDB are set up on the RAID equipment of the WINDOWS NT
platform or the UNIX platform. To avoid tampering the performance of the database, and to
independently back up databases and logs, the system will set the databases and logs on different
physical equipment.

The SCDB of the ZXSC100 saves the subscriber configuration data and short message
service data, which will be respectively introduced as follows.

1. Configuration data

Including the node module configuration data, subscriber scope configuration data,
configuration data of the service server module, configuration information of the SMC,
configuration data for the subscriber mode, data in the message resending mode, ESME
configuration information, and virtual SMSC data, etc.

2. Service data

Including the basic subscriber information, authority information, short message data,
destination subscriber index data, distribution table data, Closed User group (CUG) information,
etc.

-463-
Chapter 10 CDMA Short Message Center (ZXSC100)

9.10.6.3 Data security

9.10.6.3.1 Use of the RAID technology

The ZXSC100 selects RAID (Redundant Arrays of Inexpensive Disks) to serve as the system’s
storage equipment, and all the important data needed by the ZXSC100 shall be saved in the disk
array.

The ZXSC100 database system employs a client/server structure, demanding good efficiency
and stable reliability of the system, thus the disk system with high cost performance ratio is
preferred.

The RAID technology employs the disk array to maximize the disk performance and the data
validity. Through distributing data onto the RAID, the read/write operation and the data validity
are both improved. Furthermore, the increase of the read/write performance is implemented
through multiple magnetic heads accessing multiple disks at the same time with high throughput
rate; and the improvement of the data validity is due to the redundant storage of data.

Integrating the disk mirroring, stripping and parity check technologies, the RAID technology
improves the data storage technology.

The disk mirroring technology: to store the same data on two independent disks in the array.
This one-to-one redundancy mode enhances the data validity and the security. If one of the disks
doesn’t work, the other one with exactly the same data can be immediately put into operation.

The stripping technology: to distribute data on multiple disks. In this way, all disks in the disk
array can be in the simultaneous use in the operation, thus greatly improving the disk performance.

The parity check technology: to store the data parity check information on an independent
disk or a partition of each disk at the time of distributing data onto multiple disks in a strip shape.
If the data fails, the information can be used to re-establish the data.

Typically, the RAID works in six modes of 0, 1, 2, 3, 4 and 5 by different functions. At

present, the databases of the ZXSC100 generally employ the RAID 0+1 or the RAID 5 mode to
store and manage data.

9.10.6.3.2 Establishment of accounts and allocation of authorities

To ensure the data security, only the system administrator or the authorized user can log in to the
server to update data or change the login password as well.

Three types of users can log in to the server: system administrator, service handling console
operators and service server users.

1. System administrator

-464-
 Chapter 10 CDMA Short Message Center (ZXSC100)

The administrator has all the operation authorities over the database. To ensure the system
security, the system administrator account can be used only when installation and setup of
database equipment and databases, accounts setup by the system administrator, authority
allocation, system maintenance, data dump and recovery.

2. Service handling console operator

An account assigned to the service handling console operator. This account only has the
read/write authority over related tables and is created during installation of the background
database system.

3. Service server user

Used when the interface process of the service server accesses the database.

9.10.6.4 Interfaces between the database and service handling subsystem

The database subsystem provides the service server subsystem with the following interfaces:

1. Interface for access to short message data (access, insertion and modification);

2. Subscriber data interface (access and modification);

3. Index table data interface for the MS destination subscriber (access, modification and
insertion);

4. Interface for access to the distribution table data;

5. Interface for access to the SME data;

6. Interface for access to the configuration data;

7. Interface for access to the re-sending mode data;

8. Interface for access to the predefined short message data.

9.10.7 Operation & Maintenance Subsystem

9.10.7.1 System structure

The operation & maintenance subsystem is, in terms of software structure, divided into the
foreground module, server module and client module, where the server module undertakes the

-465-
Chapter 10 CDMA Short Message Center (ZXSC100)

message forwarding and data storage between each NE and client, making it the core of the
subsystem. The Client/Server structure can provide strict control over the data integrity,
management, and security. Since the data is stored in the centralized mode, the administrator is
able to implement the centralized data backup and regular maintenance. It works locally in a LAN,
which is connected via a router to a WAN, to perform remote access.

The structure of the operation & maintenance subsystem is as shown in Fig. 10-42.

9.10.7.1.1 Foreground module

Working in the main processors of the signaling gateway, service server, and SMPP agent, the
foreground module of the operation & maintenance subsystem provides the subsystem with
interfaces to access various parts and collects their statistic information, fault information and
other information.

9.10.7.1.2 Server module

The server module of the operation & maintenance subsystem runs on the OMM server to
perform management over various operation and maintenance consoles and the foreground, as
well as the storage of statistics, fault information, and other operation and maintenance
information.

M SC/VLR foreground HLR/AUC foreground SC foreground

Server

Client Client

Background subsystem

Fig. 10-42 Structure of the operation & maintenance subsystem

-466-
 Chapter 10 CDMA Short Message Center (ZXSC100)

9.10.7.1.3 Client module

The client module of the operation & maintenance subsystem runs on the operation and
maintenance console (i.e., the client), and is the man-machine interface between the operation &
maintenance system and operators, which can perform such operations as setup of the operation
and maintenance functions, data display and query of historic information.

9.10.7.2 System maintenance functions

The ZXSC100 provides abundant system maintenance means, and now we’ll take a closer look
into the authority management, charging management, performance statistics, fault management,
configuration management, log management and service handling console system.

9.10.7.2.1 Authority management

In order to guarantee security of the ZXSC100, prevent the malicious destruction, restrict the
unauthorized access or wrong access, and control the operation authority of each operator, the
whole system has to be put under systematic management.

For this requirement, the authority management is set up in the operation & maintenance
system of the ZXSC100. The authority management system is used to manage the operation
authorities of operators, which can set different operator types for different users; as a result,
different users will own different operator identities with different authorities, so as to perform
corresponding operation and maintenance to the short message system.

In the authority management system, operators are divided into two categories, i.e., built-in
and customized:

The built-in operator is the system administrator, who is automatically generated during the
initial installation of the ZXSC100 Maintenance System, the administrator has the highest
authority, can execute all the functions of the whole short message system, and cannot be deleted.

The customized one is an ordinary operator, who is set up by the system administrator, and
his operation authority on the background system is defined by the system administrator. Ordinary
operators can be grouped with different authorities such as data maintenance operators and
console operators.

9.10.7.2.2 Charging management

The ZXSC100 generates two types of standard bills, and the charging system is responsible for
collection, sorting and storage of bills, and able to send them to the billing center according to the
standard FTAM specifications.

According to the submission and transfer of short messages, the short message system will

-467-
Chapter 10 CDMA Short Message Center (ZXSC100)

respectively generate two types of bills, namely SMS-MO-in SMC and SMS-MT-in SMC.

The charging information carried by the standard bills of the ZXSC100 includes the bill type,
calling number, called number, SMC number, short message length, short message priority, short
message ID, return ID, and SME category.

9.10.7.2.3 Performance statistics

Through statistics and measurement of some system performance parameters (e.g., all kinds of
resources in the system), the performance of the short message system can be given for the
operator’s reference.

The maintenance terminal of the ZXSC100 can define the performance statistics and
measurement functions flexibly. The performance statistics and measurement include the start/end
time, days of duration, statistics and measurement object set, and the granularity period.

The performance statistics and measurement functions of the ZXSC100 include the MS
subscriber measurement, SME measurement, forwarding retry, subscriber group measurement,
comprehensive measurement, terminating short message failure type measurement and SMC
processing failure type measurement.

1. MS subscriber measurement

Measurement of originating times by MS subscribers, successful originating times by MS

subscribers, terminating times by MS subscribers, successful terminating times by MS subscribers,
times of mobile subscribers to mobile subscribers, and successful times of mobile subscribers to
mobile subscribers. This measurement data can be counted according to the areas the MS
subscribers belong to, so as to help operators understand the area distribution of service loads.

2. ESME measurement

Measurement of times of short messages submitted by all types of ESMEs, times of

successful submissions by ESME, times of short messages received by ESME, times of successful
receptions by ESME, etc. The measurement results can be sorted according to ESME types, so as
to help the understanding of various services.

3. Forwarding retry

Measurement of Alert notification times, Alert notification retransmission times, forwarding

times by the SMC, successful forwarding times, retransmission times by the SMC, successful
retransmission times, and successful retransmission times (1~10 times), etc.

4. Measurement of subscriber group

Measurement of subscriber group originating times, successful subscriber group originating

-468-
 Chapter 10 CDMA Short Message Center (ZXSC100)

times, CUG user originating times, terminating times and successful times, etc.

5. Comprehensive measurement

Measurement of successful submission times, failed submission times, times of all the short
message services, times of notification services of the voice mailbox, etc.

6. Type measurement of failed short message terminating call

Measurement of no response timeout failure times, failure times due to no storage capacity in
MSs, failure times due to no this number for the HLR, failure times due to call barring, failure
times due to no provision of short message services, failure times due to defaulting subscribers,
failure times due to no support on short messages by MS, failure times due to MS fault, failure
times due to no support on short messages by the network, failure times due to parameter error,
failure times due to delivery to illegal equipment, temporary delivery failure times, permanent
delivery failure times, etc.

7. SMC processing failure type measurement

Measurement of failure times due to SMC congestion, failure times due to SMC fault, failure
times due to invalid SME address, failure times due to short message validity timeout, database
failure times, etc.

9.10.7.2.4 Fault management

The alarm in extensive definition includes ordinary notification and severe alarm. The former only
indicates that there is unrepeatable or instant fault during SMC running, while the latter will last
for some time until the fault is removed. In the following, the “severe alarm” will be abbreviated
as “alarm”.

According to characteristics, alarms fall into four levels: critical, severe, major and minor,
which can be indicated by audible and visual means, facilitate timely and accurate understanding
of the system status, and maintenance and check.

The fault management system of the ZXSC100 includes the fault management on the
operation of the SM signaling gateway and the service server. The service server is the core
module for service processing of the ZXSC100, and the SM signaling gateway is the interface
module for interconnection between the ZXSC100 and the CDMA network. Therefore, high
reliability must be guaranteed for the SM signaling gateway and the service server. The fault
management system of the ZXSC100 provides the monitoring mechanism for the running status of
the SM signaling gateway and the service server.

9.10.7.2.5 Configuration management

The configuration management system of the ZXSC100 includes the service configuration and

-469-
Chapter 10 CDMA Short Message Center (ZXSC100)

signaling data configuration.

Service configuration processes the configuration and management related to short message
services. In the SMC system, different processing modules provide different service functions,
while the realization of different functional modules depends on physical and logical information
structure, and the management on the information structure forms the configuration management
system of short message services. So, it is a simple data processing application for data record,
modification and deletion. The service configuration management system of the ZXSC100 mainly
manages information structure data closely related to short message services such as distribution
table, CUG, predefined short messages, SMEs, virtual SMC, parameters of SMC, retry mode, and
subscriber configuration, etc. The configuration data of the service configuration management
system is stored in the OMM server, and is synchronized to various service processing nodes
periodically.

Signaling data configuration management is responsible for the related SS7 data of the
configuration system, including the signaling point between this office and the adjacent office, the
signaling link between this office and the adjacent office, GT (Global Title) translation, etc.

9.10.7.2.6 Log management

To facilitate the office’s better operation and management on the SMC, the ZXSC100 provides a
log viewer, which can manage and maintain the user operation records.

Operators’ operations on the ZXSC100 are recorded automatically in a certain mode, so as to

facilitate query by operators in certain circumstances. The log files are stored in the server, which
can be viewed by the corresponding terminals.

9.10.7.2.7 Service handling console system

The service handling console is a man-machine operation desk in the ZXSC100, to manage the
subscriber information, including the addition of short message subscribers, as well as query,
modification, deletion of subscriber information and the support for batch of subscribers’ accounts
opening and retrieval in batches.

The service handling console is designed to provide a friendly operation platform for users.
Operators can perform various operations for mobile subscribers via all the functions provided by
the service handling console. The service handling console can be either located at the near end or
the far end to access the system through different communication modes (TCP/IP, X.25, DDN, E1,
etc).

The service handling console of the ZXSC100 mainly provides the following functions:

1. Adding new short message subscribers, so as to implement immediate access to the

network upon purchasing the mobile phone;

-470-
 Chapter 10 CDMA Short Message Center (ZXSC100)

2. Querying short message subscriber information;

3. Modifying the authority information of short message subscribers, so as to add and delete
service items;

4. Deleting short message subscriber;

5. Account opening and retrieval of subscribers in batches;

6. Providing abundant help information;

7. Realizing a variety of connection modes for the service handling console.

9.10.8 Cell Broadcast Short Message System

In the text above, we described the software structure of the ZXSC100 (point-to-point part). Now,
we shall describe the software structure of cell broadcast short message system of the ZXSC100.

9.10.8.1 Structure of the cell broadcast system

The ZXSC100 cell broadcast short message system comprises the announcement station,
management station, control module, CBC (Cell Broadcast Center) signaling gateway. The system
architecture is as shown in Fig. 10-43.

Fig. 10-43 Structure of the ZTE cell broadcast short message system

Generally, the CBC control module can be configured in two modes: independent
configuration (stand-alone server or dual-system plus RAID) and built-in configuration (integrated

-471-
Chapter 10 CDMA Short Message Center (ZXSC100)

into the OMM server of the ZXSC100). CBC management console can be either independently
configured or integrated into the ZXSC100 operation & maintenance console. The CBC
announcement station is typically independently configured, also it can be located at the far end.
However, the CBC signaling gateway is generally integrated into the SM signaling gateway.

The ZTE cell broadcast short message system can support remote operations in TCP/IP, X.25,
DDN, E1, PSTN and ISDN modes, and its network diagram is as shown in Fig. 10-44.

In Fig. 10-44, the external communications gateway provides interfaces for the remote
announcement station, generally the gateway is configured on the OMM server. The router mainly
provides the Remote Access Service (RAS), and this system can support up to 100 remote
announcement stations.

9.10.8.2 Functions of the cell broadcast module

9.10.8.2.1 Announcement station

The announcement station mainly provides a platform for announcement of cell broadcast
short messages. The functions are described below:

Login: a user must enter a password for login. The function is used to prevent unauthorized
users from access;

Fig. 10-44 Structure of the ZTE CDMA cell broadcast short message network

Message announcement: to announce all kinds of cell broadcast short messages;

-472-
 Chapter 10 CDMA Short Message Center (ZXSC100)

Message query: to query the cell broadcast short messages of a certain type and in a certain
processing status within a certain time segment of a subscriber;

Subscriber statistics report: to make statistics of the delivery times of all types of cell
broadcast short messages within a certain time segment;

Data synchronization: to maintain synchronization of the cell broadcast short message data
and related configuration information together with the control module and the management
console;

Operation log: to record the operations performed by the announcement station within
specified time for further query.

9.10.8.2.2 Management console

The management console provides a management platform for the cell broadcast short message
system. Its functions are summarized as below:

Subscriber management: to add and delete users, and to manage user status information
(including user authority and user configuration);

Public configuration: to manage various public information (including MSC and CELL
information), and to add, delete and modify cell broadcast message types and configuration
information;

Message management: to manage detailed records about various ongoing operations and
related parameters;

Data synchronization: its functions are the same as those of the announcement station;

Statistics report: to make statistics of the delivery times of all types of cell broadcast short
messages announced within a certain time segment of a cell by a subscriber;

Operation log: to record the operations performed by the management console within
specified time for further query.

9.10.8.2.3 Control module

The control module is to support the functions implemented by the announcement station and the
management console. The control module includes the CBC control process and the database.

The CBC control process provides the CBC management console and the announcement
station with interfaces to access the database; and the database saves information related to the cell
broadcast messages, to provide the CBC control process with the access interface.

-473-
Chapter 10 CDMA Short Message Center (ZXSC100)

9.10.8.3 Charging of the cell broadcast

The ZXSC100 cell broadcast short message system supports message announcer-oriented
charging. The charging mode falls into charging by rented channels and charging by flow.

9.10.8.3.1 Charging by the rented channel

The subscribers announcing broadcast information can lease a time segment in a certain area and a
channel (message type), and are charged according to the maximum message flow predefined.
Fixed rate is employed for this mode. The charging modes are listed in Table 10-2.

Table 10-2 Reference for cell broadcast charging modes

Charging by the Announcement coverage

rented channel The whole city Large cell Small cell
Long term X yuan/ month X yuan/ month X yuan/ month
X yuan/ year X yuan/ year X yuan/ year
Short term X yuan/ day X yuan/ day X yuan/ day

9.10.8.3.2 Charging by the flow

The subscribers to announce cell broadcast information should first open an account in the cell
broadcast SMC, and apply for period of validity, message scope that can be announced, channels
(message types) and the maximum flow. The charge for each day or each month will be collected
according to the actual flow.

9.10.9 Characteristics of the ZXSC100 System

The ZXSC100 has the following characteristics.

9.10.9.1 Powerful system processing capability

The advanced technology ensures a huge short message processing capacity: for single module,
150 messages/sec; for multiple modules, 1,200 messages/sec.

9.10.9.1.1 Service server

High-end servers with high performance are used. By analysis, the database is a bottleneck
affecting the processing capability of the short message system, and the ZXSC100 speeds up

-474-
 Chapter 10 CDMA Short Message Center (ZXSC100)

access to the database with its unique memory database technology.

9.10.9.1.2 Short message signaling gateway

The gateway is built on the compact SS7 platform of the ZXJ10V10.0 SPC switch, and can
provide reliable signaling functions and powerful capability for MAP processing. The ZXSC100
supports up to 256 SS7 links with full configuration, and provides advanced 2M signaling links.

9.10.9.1.3 High-speed Ethernet

The high-speed switching Ethernet is used as the communications network among various nodes
of the SM signaling gateway, the service server, the SMPP agent, the OMM server, the
maintenance console and the service handling console.

9.10.9.2 Support for a variety of open standards

1. Supporting interworking with the CDMA network over the standard CDMA MAP signaling (IS-
41E protocol);

2. TCP/IP is used for the system for communications, which makes the system easy to
integrate with other manufacturers’ products;

3. Supporting SMPP, and interconnection with other ESME equipment over such protocols as
TCP/IP and X.25;

4. Supporting protocols defined by other manufacturers such as OCL protocol;

5. Supporting interconnection with the network management center and the billing center in
such modes as X.25, DDN and E1;

6. Supporting FTAM procedures for bill transmission of the billing center.

9.10.9.3 Abundant short message service functions

The ZXSC100 supports service functions listed below:

1. Basic short message services;

2. Value-added short message services;

3. Extended short message services;

4. Support of SMPP;

-475-
Chapter 10 CDMA Short Message Center (ZXSC100)

5. Abundant ESME solutions.

9.10.10 Software Reliability Design

The ZXSC100 employs the following methods to improve the software reliability.

9.10.10.1 Hierarchical and modularized design

The software system of the ZXSC100 can be divided into the following subsystems:

1. Operation support subsystem;

2. Database subsystem;

3. Signaling subsystem;

4. Service control subsystem;

5 Operation and maintenance subsystem.

These subsystems are independent of each other in a hierarchical structure, as shown in Fig.
10-45.

Fig. 10-45 Structure of the software system of the ZXSC100

The operation support system is a virtual machine as the result of the first expansion of the
hardware platform. Later, each time a subsystem layer is added, an expansion is performed on the
hardware platform so as to form a new virtual machine. Therefore, as long as the lower layer

-476-
 Chapter 10 CDMA Short Message Center (ZXSC100)

modules are designed properly, the upper layer modules will be easily designed, thus the system
reliability is enhanced.

According to the high cohesion and low coupling principle, each subsystem can be further
divided into multiple functional modules so as to improve the system reliability.

9.10.10.2 System operation monitoring and logs

The operation support subsystem provides the operation monitoring function. It can detect such
faults timely as too-frequent process operation, process endless loop, interruption 12 and
interruption 13, and provide automatic recovery of failures. When the system becomes abnormal,
the on-site operation data will be recorded into the log files on the disk. Data in the log files can
help R&D personnel with quick troubleshooting, so as to enhance system reliability.

Various modules of the operation and maintenance subsystem will write the abnormal cases
detected during the system operation into the log database. By querying the log database,
maintenance personnel can timely detect and remove faults.

9.10.10.3 Resource management

9.10.10.3.1 Memory resource management

The software system of the ZXSC100 employs two modes to avoid memory exhaustion. The first
mode is the static memory distribution, suitable for cases where the memory needed is fixed. The
specific method is to define the global array in the program. The second mode is the dynamic
memory distribution during the system initialization, suitable for cases where the memory needed
is not fixed. These two modes avoid the dynamic memory distribution during the system operation
to keep the memory resources from being used up, so as to raise the system reliability.

9.10.10.3.2 Data area resource management

When delivering short messages, the system will first apply for a process data area to save the
relevant information. After receiving a response for the delivery, the system will process the
messages according to the saved information. After processing, the process data area will be
released. However, if the system fails to receive any delivery response message for some reasons,
this process data area will be seized for a long term, causing a decrease in available system
resources and finally the system will use up all the process data areas. Thus, normal service
processing is no longer possible.

To avoid the above phenomena, the system records the time when each process data area is
seized, and queues all the seized data areas according to the seizure time (in the link table mode).
Then, it regularly checks the seizure time of the earliest-seized process data area. If the interval
between this time and the current time has exceeded a certain threshold, it can be regarded that

-477-
Chapter 10 CDMA Short Message Center (ZXSC100)

messages stored in this process data area are lost, so that the system will release this process data
area.

9.10.10.4 Prevention from pointer out of range and stack overflow

Each process in the system has its own stack with invariable size. The local variables defined in
the process function seize the address space of the stack. Too many local variables will lead to the
stack overflow, i.e. interruption 12. To avoid this, generally no long local variables are defined in
the process function, instead they are defined as global variables. This method above reduces the
stack overflow possibility and enhances system reliability.

When the system receives a message from the bottom layer, including such parameters as
message event No., message pointer, and message length, then the message pointer points to the
memory space that contains this message, and the message length indicates the size of this
memory space. The system will directly access the message according to the message pointer. If
the message length is shorter than expected, then the pointer out of range may occur when the
system accesses the memory area containing the message; the occurrence may cause the system
crash.

To avoid this, the system will first detect the message length to see if it is shorter than
expected when it receives a message. If it is, the system will reject this message and regard it error.
Otherwise, normal processing will be conducted.

9.10.10.5 Over-load control

The ZXSC100 software employs the message congestion control method.

The service server of the ZXSC100 is responsible for centralized processing of such request
messages from the SM signaling gateway and SMPP agent as the short message submission,
query, substitution, deletion, subscriber query, message leaving and password modification. If
there is too much traffic and the processing capability is limited, then the service server will be
unable to process the messages timely, thus leading to mass accumulation of messages to be
processed at the bottom support system. As the result, on one hand, accumulated messages may be
processed after a very long time, while the message sender may regard the timeout occurs and the
processing by the service server is invalid; on the other hand, the bottom support system will
discard some messages for limited storage space. If the short message delivery response is
discarded, the system will think the message delivery failed and begin to retry unnecessarily.

To solve this problem, the system provides the congestion control function. When it is found
that messages have accumulated to a certain extent, some messages will be selected for direct
rejection without processing, the rejection reason is “system congestion” and the rejected objects
are those messages consuming a long time for processing, for example, submission of short

-478-
 Chapter 10 CDMA Short Message Center (ZXSC100)

message. With the method, the system processing can be sped up, so as to reduce message
accumulation and improve the system reliability. The service processing of the SMC system is
mainly based on the “request-response” mode, if the external service request load exceeds the
system’s capacity, then loss of messages and failure of services will occur as a common aftermath,
and system breakdown will occur as a severe aftermath. Therefore, the service server of the
ZXSC100 provides an overload protection mechanism, that is, partial service requests in the
overload status will be directly rejected.

9.10.10.6 Fault-tolerance processing

9.10.10.6.1 Recovery of service queues

There is a timed queue in the service server of the ZXSC100, and it is key to the timed delivery
and resending of short messages, as well as the wake-up services. To improve the system
processing speed, the timed queue is saved in the memory. If the system is restarted because of
faults, switchover, etc., the queue will be lost.

To ensure normal running of the system after restarting, the system will first view the short
message index table of all the destination subscribers (the table is saved in the database), retrieve
the related data and reestablish the timed queue. The method is as follows: If the destination
subscriber is found that there exists new short messages to be sent, then a short timing period will
be set, and this subscriber will be added to the timed queue; if the destination subscriber is found
that there exists short messages failed to be sent, then the resending time will be determined
according to the subscriber configuration, and the subscriber will be added to the timed queue; if
the destination subscriber is found that there exists short messages to be sent on a timed basis, then
this subscriber and the timing period will be added to the timed queue.

9.10.10.6.2 Timer protection

In consideration of service processing, the system will use some timers provided by the bottom
support software, so as to regularly monitor the system resources and process the service queue.
Owing to the characteristics of the bottom support software, the system will have to reset the timer
each time the timer message arrives. If the timer fails to be set up, or the timed message is lost,
then the timing system will be no longer in service.

To deal with this problem, the system: sets a timer with a longer timing period to regularly
detect timers with shorter timing period; sets a global flag with a value of 0 as default; when the
timing message of the shorter timer arrives, this flag will be added with 1; when the timing
message of the longer timer arrives, this flag will be checked first; if it is 0, indicating that this
shorter timer has been lost, which can be reset; if it is not 0, indicating that the shorter timer still
works, and the flag will be cleared for next check.

-479-
Chapter 10 CDMA Short Message Center (ZXSC100)

9.10.10.6.3 Timeout check on the destination subscriber status

The current processing status of this subscriber is saved in the destination subscriber short
message index table, including idle, waiting to deliver, and delivering. The “delivering” means the
short message is being delivered to the subscriber without any response. When the subscriber is in
the “delivering” status, no other short messages can be delivered to the subscriber. Only after
receiving the delivery response, can the subscriber status be changed, and can other short
messages be delivered. .If the delivery response is lost, then the subscriber is always in the
“delivering” status, and it is impossible to deliver other short messages.

Therefore, the system employs the following measures: in the destination subscriber short
message index table, record the time of subscriber status change. When there is any new message
being submitted, the system first checks the destination subscriber short message index table. If
the subscriber is found to be in the “delivering” status, while the delivery time has exceeded the
reasonable scope from the current time, then it is regarded that the delivery response for the
subscriber is lost, and the system can deliver the new message.

9.10.10.7 Monitoring program

The OMM server employs the software watchdog to monitor the running of various server
program. The software watchdog periodically sends handshake messages to each server program.
If the server program does not return any response, then the software watchdog regards it as faulty,
and disables the server program process and restarts the program.

9.10.10.8 Data reliability

9.10.10.8.1 Data access

When different subsystems in the system access such information as subscriber data and short
message data of the SMC, different authorities will be allocated according to special requirements,
and subscribers cannot perform operations out of their authorities, thus the system data can be
protected.

9.10.10.8.2 Data storage

Important data, such as subscriber service information and short message information of the
ZXSC100 are stored on disks and managed with mature and reliable commercial database
systems. They can be backed up to tape drives or optical disks. Then even if data loss occurs due
to system failure, you can restore the data from the last backup.

9.10.10.8.3 Data processing

During the data processing, the commercial database transaction mechanism is used to put related
processing into the same transaction so as to ensure that the processing of associated data will not

-480-
 Chapter 10 CDMA Short Message Center (ZXSC100)

damage the data integrity and consistency. By locking records, you can ensure the record
consistency during modification or deletion of the same record performed by multiple processing
processes.

9.10.10.8.4 Excellent programming style

Before the programming starts, both general and detailed designing of the system should be
provided. An SDL drawing should be worked out according to the processing flow, and
programming is conducted according to this SDL structure. The program should be in accordance
with the designing descriptions so as to satisfy the design requirements.

The programming of all the internal modules strictly sticks to the standard programming
specifications. Make sure that the programming styles are all the same to facilitate reading and
maintenance. The intra-structure of the module is also organized according to the hierarchical
mode; thus associations between subsystems are reduced. All global and local variables are named
in a uniform mode. Inside the program, all input abnormalities can be judged. And with the
judgement message worked out and the alarm processed, the interfaces are ensured to be correct
and the errors can be traced.

9.11 ZXSC100 Service Functions

The ZXSC100 can provide the subscribers with plentiful SMSs, which generally fall into three
categories: basic service functions, expanded service functions and system maintenance functions.
Meanwhile, the ZXSC100 also provides ZXSC100-GW, the interworking and shared gateway for
the CDMA-SMC and GSM-SMC.

The ZXSC100 fully supports CDMA point-to-point SMS and cell broadcast service, and
enables expanded service functions based on basic service functions. Therefore, abundant SMSs
and value-added services can be provided for CDMA subscribers.

9.11.1 ZXSC100 Supported Services

Basic services supported by the ZXSC100 are:

1. MO (MS originated) SMS

Short messages are submitted to SMC from MS.

2. MT (MS terminated) SMS

Short messages are sent to MS from SMC.

-481-
Chapter 10 CDMA Short Message Center (ZXSC100)

3. Voice mailbox announcement service with the coordination of the voice mailbox

If any new message is found in the voice mailbox, the mobile subscriber will be informed by
a short message.

4. Chinese SMS

The Chinese SMS originated and terminated by MS is supported.

5. Manual-connected and auto-connected SMSs

The SMC is equipped with manual/auto connection system, so as to provide the SMSs of
assisted operator position/automated operator position.

6. Timing message sending

Subscribers are allowed to set an exact time for short message submission, and the SMC will
send this message to MS at the set time.

7. Cell broadcast service

Short messages can be sent to all MSs in the same cell.

8. Short message interworking and shared gateway

The ZXSC100-GW, an independent interworking and shared gateway, connects to GSM and
CDMA networks, so as to perform resource sharing and information interworking of both
networks.

9. Service development interface

The ZXSC100 provides external service development interfaces for the development of new
value-added services in light of subscribers’ requirements.

9.11.2 Basic service functions

The ZXSC100 can provide various functions as the basic point-to-point short message services.
These services include short message storage and query, short message submitting and forwarding,
subscriber authority verification, acknowledgement of message sending, short message priority
management, short message expiration management, re-forwarding attempts, short message
deletion and replacement, Chinese short message, virtual SMC (VSMC), assisted operator position
connection and auto connection, etc.

-482-
 Chapter 10 CDMA Short Message Center (ZXSC100)

9.11.2.1 Short message storage and query

During the valid period, the ZXSC1000 ensures that the submitted short message data will be
saved (item by item) till they are successfully sent.

Data stored in the ZXSC100 include:

1. Source address (MDN of a source MS subscriber or source SME address);

2. Destination address (MDN of a destination MS subscriber or destination SME address);

3. Telecommunication service types (voice mailbox notification, paging and messages) of

short messages, and language types;

4. The set time for short message sending (if it is the timing message sending);

5. Contents and lengths of short messages;

6. The short message time marks, priority level, validity period, acknowledgement flag, etc.;

7. Service types (the information source is MO, voice mailbox or other applications);

8. Charging information, sending statuses, sending attempts, causes of failures and other
information of each short message.

The ZXSC100 provides two methods to query short message data of subscribers:

1. Operators can view the stored messages via a short message data observation tool at the
operation and maintenance background;

2. Mobile subscribers can query the details of related short messages through the ESMEs
such as the assisted operation position or automated operator position.

9.11.2.2 Short message submitting and forwarding

The ZXSC100 supports the functions of short message submitting and forwarding. Both the MS
and ESME can serve as the submitter or receiver of short messages.

9.11.2.2.1 Short message submitting (MS is the receiver)

After an MS or ESME submits short messages to the ZXSC100, the ZXSC100 will check the
validity of the short messages first (including the validity, message format, etc. of both the
originating and receiving subscribers). If the message is confirmed to be valid, its content will be
saved in the database. And then, a unique ID number is assigned to this message, and the MDN of
the destination subscriber is listed in the waiting queue (if the sender requires timed sending of the

-483-
Chapter 10 CDMA Short Message Center (ZXSC100)

message, the ID of the message will be put in the timed queue). Finally, an acknowledgement will
be returned to the sender. If the short message is invalid (for instance, the originating mobile
subscriber has not registered in SMC), the sender will receive a message indicating submitting
failure, with the causes attached.

9.11.2.2.2 Short message forwarding (the receiver here are MSs or other SMCs)
The ZXSC100 detects the system resource status (including process data area) at any time. If there
is idle resource detected, an MDN of the subscriber will be taken from the waiting queue.
Furthermore, if the subscriber is the registered subscriber in the SMC, a short message sent to the
subscriber will be taken from the database, and sent to the CDMA network later. If more than one
short message in the database are waiting to be sent to this subscriber, they will be sent in the
“multi-short message” mode in the system.

On the other hand, if the MS doesn’t belong to this SMC, the SMC can search and locate the
home SMC of this MS according to its MIN or IMSI, and then submit the short message to the
home SMC of this MS.

As for the messages required to be sent at specified time, the system checks the timing
message queue regularly, and the destination number will be put into the waiting queue at the
specified time, waiting to be sent.

Through the waiting queue system, it is ensured that the ZXSC100 sends only one message to
an MS at a time.

9.11.2.2.3 Short message submitting and forwarding (from MS to ESME)

After receiving the short message from an MS, the ZXSC100 will first check the validity of the
message (including the authority of the sender, and the message format), then, after the message is
confirmed to be valid, check whether the destination ESME has logged in the SMC. If not, the
system will return the message for submitting failure; if ESME has logged in, the system will
forward the message to the ESME, and then return an acknowledgement message to the sender
after receiving the acknowledgement from ESME.

9.11.2.2.4 Inter-ESME message forwarding

To enable the cooperative work of multiple ESMEs (such as assistant operator position IOD), the
ZXSC100 supports direct message sending from one ESME to other ESMEs. After receiving the
short message from ESME, the ZXSC100 will first check the validity of the message (including
the authority of the sender, and the message format), then, after the message is confirmed to be
valid, check whether the destination ESME has logged in the SMC. If not, the system will return
the submission failure message to the originating ESME; if yes, the system will forward the
message to the ESME, and then return an acknowledgement message to the originating ESME
after receiving the acknowledgement from the destination ESME.

-484-
 Chapter 10 CDMA Short Message Center (ZXSC100)

9.11.2.3 Subscriber authority verification capability

In terms of the MO short messages, the ZXSC100 checks the mobile subscriber who originates the
short message, to judge whether he has registered in the SMC, whether he has the authority to
send short messages, and whether he is a user of closed user group (CUG). An MS will not be able
to submit short messages successfully unless it has the authority to send short messages and no
CUG restriction exists.

As for the ESME, only after it has registered in the SMC configuration station, can it log in;
and when logging in, the ESME should enter the password for the authentication purpose.

As for a short message sent to the MS, the ZXSC100 can (to be determined by the
configurations) check its receiver mobile subscriber, to judge whether he has registered in the
SMC, whether it has the authority to receive short messages, and whether any CUG restriction
exists. If the destination subscriber has no authority to receive short messages, or CUG restriction
exists, the SMC will return a submission failure message to the sender.

9.11.2.4 Short message sending acknowledgement (status report)

The successful submission of short messages only indicates that the SMC has received this
message and prepared for forwarding the message, instead of ensuring that the subscriber has
received or will surly be able to receive the message. However, the short message sender always
expects to know whether the short message has been delivered to the destination subscriber.
Therefore, the ZXSC100 can, according to the short message submitted by the subscriber, set to
inform the mobile subscriber of the message sending results (the sending status) in the form of a
new short message after the message sending attempt.

9.11.2.5 Message priority management

The ZXSC100 can process the messages of four different priority levels.

They are respectively the L0, L1, L2, and L3, corresponding to “Normal”, “Interactive”,
“Urgent”, and “Emergent”. The system processes the short messages according to the different
priority levels of the messages.

In accordance with the general principle: the short messages are sequenced in light of their
priority levels, and the short messages with higher levels can be processed first.

9.11.2.6 Validity period management of short message

Every short message has a validity period, and it is probably meaningless to send a message out of
this period.

-485-
Chapter 10 CDMA Short Message Center (ZXSC100)

When submitting a short message, the originator (MS or ESME) can set a valid duration as
required for the message forwarding attempts. The SMC will stop the sending attempts if time is
out, and create a status report (permanent sending failure) according to the settings made by the
originator.

If no validity period is specified by the originator, a reasonable default value will be used by
the SMC. If the validity period required by the sender is so long that it exceeds the designing
capability of the SMC, the SMC will set the valid period as the longest allowable period of the
system. Both the default and the longest period of validity can be set flexibly through the
operation and maintenance terminals by operators.

The ZXSC100 clears the short messages out of validity period regularly, regardless whether
they are successfully delivered or not.

9.11.2.7 Re-forwarding attempt

The short message sending from the SMC might fail due to MS power-off, short message storage
area being full, etc.

The ZXSC100 performs two kinds of re-forwarding attempts for the short messages that are
not sent successfully:

1. To forward short messages when the PLMN notifies that MS has been activated and is able
to receive short messages;

2. Automatic re-forwarding. For each sending failure, select different re-forwarding modes
according to different failure causes, and forward again at a certain interval. Subscribers are
allowed to select the re-trying modes for each MS (including the level of re-trying, intervals of re-
trying and the times of re-trying), which are predefined by operators.

9.11.2.8 Short message deletion and replacement

The ZXSC100 supports ESME to delete or replace the short messages that fail to be delivered.

9.11.2.9 Supporting Chinese SMSs

1. The Chinese code plan of the ZXSC100 conforms to CDMA specifications, and supports the
new short message coding plan: UCS2 (16bit) – GB13000;

2. The assisted operator position supports the Chinese characters of the GB13000 CJK part;

3. The ZXSC100 supports the transparent transmission of Chinese SMSs from MS to MS;

-486-
 Chapter 10 CDMA Short Message Center (ZXSC100)

4. The ZXSC100 supports the Chinese SMSs in manual connection mode.

9.11.2.10 VSMC
The ZXSC100 supports the VSMC function, by which one SMC provides services for multiple
mobile local networks, so as to meet the requirements of networking at the preliminary stage
(when the short message traffic is low).

A physical SMC comprises multiple VSMCs logically, occupies multiple numbers that are
distributed as per actual conditions. The number allocation and subscriber management
(subscription and service handling, etc) of each VSMC are independent of each other. Each mobile
subscriber enjoys the SMS by using the unique number allocated to him.

The ZXSC100 can, as necessary, restrict the ESME to send short messages only to the
subscribers belonging to a specific VSMC; or, restrict the MS to send short messages only to
subscribers belonging to the same VSMC, thus realizing “independence” in real sense.

9.11.2.11 Assisted operator position

The ZXSC100 sets an assisted operator position to provide manual connection for the MT SMS.

The ZXSC100 is equipped with the subscriber mobile equipment database to save such
information as whether subscriber equipment supports SMS, or whether it supports the Chinese
SMS, etc. During the sending of Chinese short messages, the assisted operator position queries the
database to judge whether the subscriber mobile equipment is able to normally receive
information, so as to avoid illegible codes from appearing in the non-Chinese mobile sets.

The assisted operator position of the ZXSC100 has an embedded interface with ACD
(Automatic Call Distribution) to perform such functions as hook-off, hook-on, presenting,
absence, etc.

9.11.2.12 Automated operator position

The automated operator position of the ZXSC100 is connected with the PSTN to perform the
automated connection function. During automatic connection, the SMC will operate in the
following ways:

1. To check the validity of the SMS subscriber according to his automated connection
number, and determine the subsequent signal processing accordingly;

2. After the connection between the caller and SMC is established, the SMC should be able to
support DTMF session service, which includes PLMN and PSTN subscribers accessing in the

-487-
Chapter 10 CDMA Short Message Center (ZXSC100)

form of DTMF signals, and selecting the pre-defined messages;.

3. To send the caller’s number as a short message to the destination subscriber.

9.11.2.13 Cell broadcast

Cell broadcast is one of the major services provided by the CDMA mobile switching network,
mainly used to send messages to subscribers in a specific area. The information sent over networks
can be: the international/national news, business/financial news, sports news, entertainment news,
sci-tech news, breaking news, advertisements, emergency broadcasting, management messages,
maintenance messages, weather forecast, regional road conditions reports, local flight schedule,
transportation information, hotel information, retail catalogs, job information,
medicine/health/hospital information, stocks information, etc.

The following services are available at the first stage of the ZXSC100 cell broadcast short
message system:

1. Periodical sending of cell-broadcast short messages controlled by MSC;

2. Periodical sending of cell-broadcast short messages controlled by SMC;

3. Deletion of single piece of cell-broadcast short message that has been sent to MSC;

4. Batch deletion of cell-broadcast short messages that have been sent to MSC;

5. Query of results of cell-broadcast short message sending.

9.11.2.13.1 Supporting periodical sending of cell-broadcast short messages controlled by MSC

When the periodic sending of the cell-broadcast SMS is controlled by MSC, the service processing
flow is as follows: first, messages are sent from SMC to multiple MSCs one by one, from which
messages are then sent to MSs in the respective service area.

In this event, SMC sends messages to MSCs only once, and together with the messages, the
predefined cell-broadcasting SM parameters are also sent to MSCs, such as the broadcast duration,
repeated broadcasting frequencies, etc. The MSCs save the contents of messages, and send them to
MSs periodically within the specified time. After MSC receives the cell-broadcast short message
sent from SMC, an acknowledgement will be returned.

For the ZXSC100, the period for sending cell-broadcast short messages and the preset
broadcasting time can be set through the cell-broadcast announcement console. The procedures
below is the same.

-488-
 Chapter 10 CDMA Short Message Center (ZXSC100)

9.11.2.13.2 Supporting periodical sending of cell-broadcast short messages controlled by MSC

When the periodic sending of cell-broadcast messages are controlled by SMC, the service
processing flow is as follows: the messages are sent periodically from SMC to the MSCs one by
one, from with messages are then sent to MSs in respective service area. After MSC receives the
cell-broadcast short messages from the SMC, an acknowledgement will be returned.

In this event, the SMC will not send the parameters to MSCs, such as the broadcast duration,
repeated broadcasting frequencies, etc, and all contents of cell-broadcast short messages are saved
in the SMC instead of MSC.

9.11.2.13.3 Supporting the deletion of single piece of cell-broadcast short messages sent to
MSC
As for the cell-broadcast short messages having been sent to MSCs from the SMC, the SMC can
require the MSC to delete a piece of cell-broadcast message in a certain information source by
sending a “single-message deletion” command. MSC will delete the corresponding message soon
after it receives the command, meanwhile, and then an acknowledgement will be returned to the
SMC.

9.11.2.13.4 Supporting batch deletion of short messages sent to MSC

For the cell-broadcast short messages having been sent to MSCs from the SMC, the SMC can
require the MSC to delete a batch of cell-broadcast messages by sending a “batch message
deletion” command. MSC will delete a certain batch of cell-broadcast messages soon after it
receives the command, meanwhile, and then an acknowledgement will be returned to the SMC.

These short messages may include a certain type of cell-broadcast short messages from a
certain information source.

9.11.2.13.5 Supporting query of cell-broadcast short message sending results

The cell-broadcast short message system supports the man-machine interface of the O&M system
of the ZXSC100 for users to query information, so that users can query the results (failed or
successful) of cell-broadcast short message sending.

9.11.3 Expended service functions

Besides the basic functions, the ZXSC100 also provides rich expanded service functions,
facilitating operators to provide value-added services. These expanded service functions include:
distribution list function, CUG function, timed call service, owner service function, Internet
service, mail notification service, fee query service, stocks service and integrated service
information station, etc.

-489-
Chapter 10 CDMA Short Message Center (ZXSC100)

9.11.3.1 Distribution List

The ZXSC100 provides the Distribution List function.

With the application of the ZXSC100, operators can set the distribution lists, each of which
includes a certain number of MS subscribers. Assisted operator positions and other ESMEs can
submit short messages with the distribution list as the destination address, from which the
messages are distributed to each MS subscriber.

9.11.3.2 CUG function

The closed user group (CUG) is a logic group, and members of the same CUG are allowed to
receive or send messages, but neither the outgoing messages to other groups or incoming
messages from other groups are allowed. The ZXSC100 supports the sending/receiving and
restriction of CUG users.

9.11.3.3 Timed call function

The ZXSC100 is set to send short messages at a preset time according to subscribers’
requirements.

9.11.3.4 Owner service function

The ZXSC100 provides multiple owner service for the registered subscribers, and the owner is
required to enter password for the activation of these services.

Message leaving of owners: record the important messages left by owners, which are
available for message senders to query. It is equivalent to bulletin board in terms of functions.

Short message query: when it is impossible to use the mobile phone, an owner can query his
latest short messages (several pieces) by using ESME.

Alarm call function: owners can set timed alarm call in his mobile phone, which can give
alarms for multiple times like an alarm clock.

Owner password modification: it is possible to modify owner’s password through ESME at

any time as per owner’s requirements.

9.11.3.5 All-subscriber broadcast function

The ZXSC100 system can send short messages with the same contents to a group of subscribers.
This function is mainly used by operators to send information (notifications, greetings,

-490-
 Chapter 10 CDMA Short Message Center (ZXSC100)

advertisement, etc.) to lots of subscribers. This group of subscribers can be: all the subscribers
registered in the local SMC, all the registered subscribers under a VSMC, all the registered
subscribers in certain number segment, or any batch of subscribers selected randomly by the
operators.

Short messages can be sent to subscribers by both all-subscriber broadcast and cell broadcast,
with different application purposes. The major differences are listed in Table 10-3.

Table 10-3 Difference between all-subscriber broadcast and cell broadcast

services

All-subscriber broadcast Cell broadcast

Method Occupy a large amount of network Occupy a small amount of network
signaling and control channel resources in signaling and control channel
point-to-point short message mode resources in cell-broadcast short
message mode
Roaming Subscribers roaming to non-local areas can Subscribers roaming into local areas
supported still receive short messages can receive short messages
Receiving Subscribers can receive the short messages Subscribers have to start the cell
mode without making any setting; passive broadcast function before receiving
receiving the short message; active selection
Sending The exact quantity and the phone numbers It is impossible to know the quantity
results of subscribers having received the short of receiving subscribers.
messages can be obtained.

9.11.3.6 Supporting Internet services

The ZXSC100 provides the SMPP interface, supporting the Internet services.

1. Sending short messages via WEB

The ZXSC100 provides the public Internet websites of operators, so that subscribers can send
short messages through accessing the Internet.

2. Querying short messages via WEB

Subscribers can query the related information of SMC by browsing the Internet, including the
information, such as the number of short messages not sent, the number of short messages sent,
etc.

3. Web subscription integrated information station service

-491-
Chapter 10 CDMA Short Message Center (ZXSC100)

Subscribers can subscribe for the required integrated service information, including fee query,
weather forecast query, stocks information query, news and broadcast, etc.

4. Sending e-mails via MS

MSs submit e-mails to SMCs, where they are forwarded to subscribers through E-mail
servers.

5. Redundancy of e-mail short message sending

During subscription defining, the SM subscribers can register to use e-mail as the redundancy
mode for sending short messages. If SMC fails to forward short messages to the subscribers, the e-
mail server will be used to forward messages in the form of e-mails.

9.11.3.7 Mail notification service

If a subscriber has new voice mails, fax mails, or e-mails, the mail notification system will
automatically generate a short message submitted to MSC so that it will be forwarded to the
subscriber, notifying him of new mails. The ZXSC100 also supports the notification modes of
information service products of other manufacturers, including voice mails, fax mails, e-mails, etc.

9.11.3.8 Dunning service

For the defaulting subscribers, the fee query system will automatically generate a dunning short
message to MSC, which will be forwarded to the subscriber, reminding him to pay in time.

9.11.3.9 Stocks service

1. Stock market query

Through the SMS resource system, subscribers can query the individual stock information
and stock index information. After the MS submits a short message with the agreed code, SMC
will transmit this short message transparently to the short message consultation platform sub-
system for processing. Later on, subscribers will obtain the real-time market information, and
know about the latest trend of the stocks market.

2. Real-time stock up/down alarm

Through the SMS consultation system, subscribers can preset the prices of buying or selling a
stock. If the market price arrives at the preset price, subscribers will receive the indication
information. In this way, subscribers can grasp with ease the situations of the stocks selected for
an appropriate investment opportunity.

-492-
 Chapter 10 CDMA Short Message Center (ZXSC100)

9.11.3.10 Integrated information station

The ZXSC100 supports public information services.

1. Fee query

The mobile subscriber can dial SMC assisted or automated operator positions, in order to
acquire the fee information through short messages. The SMC submits corresponding commands
via its interface with the fee query system, where the results of query are sent to SMC in the form
of a short message, and then forwarded to the subscriber.

2. Fee notification

The fee query system provides fee notification function as required by subscribers. After the
payment information of the current month is generated, the fee query system will generate a piece
of short message about the charge information automatically forwarded to the subscriber.

3. MO query service information

Short message subscribers are allowed to send short messages in particular forms to SMC,
and select the type and time of service information query. SMC is responsible for interpreting the
short messages, and returning the public information.

4. MO subscription service information

SMC subscribers send specific short messages to SMC, and select the information type and
sending time of the subscribed service information. The SMC interprets these short messages,
records subscription information, and sends the service information according to subscribers’
setting.

5. Auto/manual query or subscription of service information

Short message subscribers can also perform the subscription or query of service information
through dialing the automated or assisted operator positions. The information type is subject to the
local information sources, which include weather reports, stock information, flight schedules, film
information, news, advertisement, etc.

9.11.3.11 Value-added services

SMC can provide various value-added services through connecting to specific ESMEs.

-493-
Chapter 10 CDMA Short Message Center (ZXSC100)

9.11.4 Service processing flow

9.11.4.1 Overview
The service processing of the ZXSC100 is mainly implemented jointly by the service server, SM
signaling gateway, and the SMPP agent. The SM signaling gateway is responsible for connecting
SMC with the CDMA network; the SMPP agent for connecting the ESME with the SMC, and the
service server for the integrated processing of the short message service, thus fulfilling the
respective functions mentioned in the above section.

In this section, we will describe the service processing module and its processing flow on the
service server.

9.11.4.1.1 Module structure

The service processing module implements such functions as ESME login management, MS
information query, left messages, password modification, sending short messages to MS and SME,
handling the short messages submitted by MSs and ESME, waiting for sending queues, timed
sending queues and re-sending user queue management.

The software structure of the service server is shown in Fig.10-46.

Service processing Database interface

module unit

OMM

SMPP Database
agent management
module

Supporting subsystem (scheduling, timing and communication)

Invoking
message transfer

Fig. 10-46 Software structure of the service server

The service server software includes the following modules:

1. Database management module: Managing all kinds of data by using the SQL Server or
Oracle database.

-494-
 Chapter 10 CDMA Short Message Center (ZXSC100)

2. Service processing module: Processing the messages from the SMPP agent and SM
signaling gateway, and distributing the short messages to SMPP and SM signaling gateway.

3. Database interface unit: Providing data operation functions for the service processing unit.

4. SMPP agent: Providing SMPP for the service processing unit so as to connect to the
ESME. It can be set as an exterior independent entity.

5. OMM: Providing foreground operation and maintenance functions.

6. Supporting subsystem: Providing various module units with such functions as scheduling,
timing, communications, etc.

Regarding the functions, the service processing module can be classified as the message
submission sub-module, short message distribution sub-module, short message query sub-module,
short message deletion sub-module, short message replacement sub-module, MS command
processing sub-module, MS information processing sub-module, SME login management sub-
module and resource management sub-module. Its structure is shown in Fig. 10-47.

Fig. 10-47 The structure of the service processing module

9.11.4.1.2 Short message submission sub-module

The short message submission sub-module processes three types of messages: messages submitted
from the SM signaling gateway, messages submitted from the SMPP agent, and messages with

-495-
Chapter 10 CDMA Short Message Center (ZXSC100)

multiple destinations submitted from the SMPP agent.

The short message submission sub-module handles the three types of messages in the
following way:

1. Messages submitted from the SM signaling gateway

The short message originated by an MS is sent to the service processing module via the SM
signaling gateway. After receiving this short message, the short message submission sub-module
first checks whether the message is beyond the system processing threshold. If it is,, the short
message submission sub-module will reject this message and return the failure cause: system
congestion.

If the message does not exceed the system processing threshold, then according to the
operator’s requirements, the short message submission sub-module will check whether the caller
and called subscriber have registered in the local SMC, whether they are restricted from sending
sort messages, whether they are listed in the black list or gray list, and whether the originating
party uses the correct SMC number. It also checks the CUG service to make sure whether there is
any CUG restriction for this subscriber. If all the checks are passed, this short message will be
stored in the database, and inserted into the waiting queue for sending. Otherwise, it will be
rejected.

The processing flow of the short message submitted by MS is shown in Fig. 10-48.

2. Messages submitted from the SMPP agent

The short message submitted from an ESME (such as the assisted operator position and voice
mailbox, etc) is sent to the service processing module via the SMPP agent. After receiving this
short message, the short message submission sub-module first also checks whether it is beyond the
system processing threshold. If it is , this message will be rejected. Otherwise, the short message
submission sub-module will check whether the ESME has logged in and has the rights to submit
short messages, whether the destination subscriber has registered in this SMC, and whether there
is any restriction from the SMS and whether the subscriber is listed in the black list or gray list. If
all the above checks are passed, this short message will be stored in the database, and inserted into
the waiting queue to be sent (if the message is required to be sent at a preset time, it will be
inserted into the timed queue). If the subscriber has not registered in the local SMC, the SMC in
which the called subscriber has registered will be searched according to his MDN, and then the
message will be sent to this SMC; otherwise, it will be rejected.

-496-
 Chapter 10 CDMA Short Message Center (ZXSC100)

submitted by MS

Y
Whether it is beyond the
congestion threshold

Whether the caller or N

called subscriber has
registered

Y
Generating
Whether the caller or Y alarm
called subscriber are in the information
black list

N
Generating
Whether the caller or Y alarm
called subscriber are in the information
gray list

Whether there is any CUG Y

restriction for the caller or Rejecting
called subscriber

N
Saving the short message
Inserting the message into the waiting queue

Fig. 10-48 Processing flow of the short message submitted by MS

The processing flow of the short message submitted from ESME is shown in Fig. 10-49.

-497-
Chapter 10 CDMA Short Message Center (ZXSC100)

Receiving the short message submitted from ESME

Whether it is beyond the Y

congestion threshold

Whether the ESME has N

logged on in the form of
submission

Sending to SMC of
the destination
subscriber
Whether the called N
subscriber has registered

information

Generating
Whether the called Y

alarm
subscriber is in the black
list

N
Generating
alarm
Whether the called Y information
subscriber is in the gray
list

Y Whether this message is

required to be sent in the
preset time.

N
Saving the short messages Saving the short messages Rejecting
Inserting it into the timed sending queue Inserting the message into the queue
waiting to be sent

Fig. 10-49 Processing flow of the short message submitted from ESME

3. Short messages with multiple destinations submitted from the SMPP agent

The ZXSC100 provides the Distribution List function, through which MSs can define a
distribution list as required and include multiple MSs in it. ESME can submit a short message with
the distribution list as the destination addresses. As a result, the submitted message will be sent to
all subscribers in the distribution list. Regarding the handling of respective subscribers in the list,
it is the same as processing the short message to a single MS from ESME.

The processing flow of the short message with multiple destinations submitted from ESME is
shown in Fig. 10-50.

-498-
 Chapter 10 CDMA Short Message Center (ZXSC100)

Receiving a short message with multiple destinations submitted form ESME

Whether it is beyond the Y

congestion threshold

Whether ESME has logged N

on in the form of
submission

Whether all subscribers in Y Completed

the distribution list have
been handled

N
Picking up a subscribe to be handled from the distribution list

Submitting the short message to this subscriber Rejecting

Fig. 10-50 Processing flow of the short messages with multiple destinations submitted from
ESME

9.11.4.1.3 Short message distribution sub-module

Forwarding short messages is the most basic and important function of SMC. After receiving the
short message submitted by MS or ESME, SMC will deliver this message to the destination at a
proper time according to the conditions of this message as well as the system resources, and
handle the delivery result properly.

1. Distribution to MSs

The short message distribution sub-module will send short messages to the MSs on the GSM
network side at a specific time (instant sending time, timed sending time and resending time)
according to the short messages submitted.

1) For the short messages in the waiting queue, the system will regularly check the resource
conditions (including session resources of MAP and resources in the process data area, etc.). When
there is no idle resource, the system can’t send short messages. When idle resources are detected,
the system will pick up this message from the waiting queue and send it to the SM signaling
gateway, which will deliver this short message to the mobile station. Its processing flow is shown
in Fig. 10-51.

-499-
Chapter 10 CDMA Short Message Center (ZXSC100)

Checking the system resource conditions regularly

Whether there is any idle N Delay

resource

Y
Checking the waiting queue to be sent

there is any short message to N

be sent

Y
Picking up a waiting message
and send it to SMS-IW/GMSC

Fig. 10-51 Distribution processing flow of the waiting queue

2) This system regularly checks the short messages in the timed queue. When the sending
time is due, this message will be picked up from the timed queue, and inserted into the waiting
queue for sending. Its process is shown in Fig. 10-52.

Checking the timed sending queue regularly

Whether there is any message that is N Delay

due to be sent

Y
Picking up a message from the timed queue
Inserting it into the waiting queue to be sent

Fig. 10-52 Distribution processing flow of the timed queue

3) After the short message has been sent to the SM signaling gateway, the system will receive
the distribution response from the CDMA network side, indicating whether the mobile subscriber

-500-
 Chapter 10 CDMA Short Message Center (ZXSC100)

has received this message. If the message is sent successfully, the system will continue to send
other short messages (if any) to this destination subscriber in the MMS mode (multiple short
messages are sent continuously); If the message sending fails, the message can be inserted into the
re-sending queue according to the retransmission mechanism, waiting for retry. The system will
also send a sending status report (acknowledgement) as required by the short message originating
party .Its process is shown in Fig. 10-53.

Receiving the distribution response of short messages from SMS-IW/GMSC

Whether the results are to be Failure

sent

success

N Whether there are other Whether this message needs to be

messages waiting to be sent to resent
this destination subscriber
N
Y Y
Sending this short message in the MMS mode Inserting this message into the retry queue

N Whether the sending party

requires acknowledgement

Y
Generating the status report message and inserting it inot the waiting queue

Completed

Fig. 10-53 Processing flow of the distribution response

4) If a short message in the resending queue meets one of the following conditions, the
system will pick it up from the resending queue, and insert it into the waiting queue for sending.

A. The system receives SMS Notification from the CDMA network side, indicating the MS
can receive short messages at this moment;.

B. The preset resending time is due.

2. Distribution to ESME

Due to the particularity of ESME, no retry mechanism is used in the system, and the instant
sending mode is used in the short message distribution sub-module for the short messages which
are sent to it. If the destination ESME hasn’t logged in to the SMC yet, then the system will return
the message of submission failure to the sending party. If the ESME has logged in properly, the
SMC will forward this message to this ESME, and return an acknowledgement message to the
sending party upon receiving the acknowledgement message from the ESME. Its process is shown
in Fig. 10-54.

-501-
Chapter 10 CDMA Short Message Center (ZXSC100)

Receiving a short message sent to the ESME

Whether the ESME has logged in N

properly

Y
Forwarding this message to the ESME

Receiving the distribution response from the ESME

failure
Whether the results are to be sent

Success
Returning the receiving message to the sending party Return the rejecting message to the
sending party

Fig. 10-54 Processing flow distributed to ESME

9.11.4.1.4 Short message query sub-module

Each short message sent to MS will be saved in the system database for a certain period, including
contents of detailed information of the short message as well as the sending result. The subscriber
can query the status information of the submitted short message via the ESME, including the
current processing status (not sent yet, successfully sent, sending failure and waiting to be resent,
etc.), last sending time, causes of last sending failure, etc. In the mean time, the specific
information of the submitted short messages can also be queried, including such parameters as
message contents, validity period and arrival time.

If the ESME requests no status report when submitting the short message, the processing
status of the submitted short message can be obtained through the query function.

When querying a short message, the ESME is required to provide the ID of the short message
so as to identify this specific short message; meantime, it is also required to provide the
originating party’s address of this short message for verification. The processing flow of short
message query is shown in Fig. 10-55.

-502-
 Chapter 10 CDMA Short Message Center (ZXSC100)

Receiving the short message query request from the ESME

Whether the ESME has logged in N

properly

Y
Whether there is such a message N

Y
Verifying the source address

Whether the source address is N

consistent

Y
N Whether the detailed contents need to
be queried

Y
Returning the message processing status Returning the message contents and Query rejected / Query failure
processing status

Fig. 10-55 Processing flow of short message query

9.11.4.1.5 Short message deletion sub-module

For the short message that hasn’t been sent (e.g. the timed message whose preset sending time is
not due), and the short message that is sent unsuccessfully and waiting for retry, the system
provides the deletion function for the ESME, so as to cancel the sending of this message.

The ESME can delete one or multiple short messages that have been submitted but not sent
yet. It can delete either a specific short message, or all the short messages from a specific source
subscriber to be sent to a specific destination subscriber. r.

When deleting a short message, the ESME is required to provide the addresses of both the
originating party and the receiving party. If the short message ID is provided at the same time, the
system will pick up this message from the database, check its source and destination addresses,
and confirm that this message has not been successfully sent. And then, this message will be
deleted from the waiting queue (or timed sending queue, or resending queue). If the short message
ID is not included in the deletion request, the system will check all short messages which were not
successfully sent to this destination, pick up the short message that matches the address of the
sending party, and delete it from the corresponding sending queue. The processing flow of short
message deletion is shown in Fig. 10-56.

-503-
Chapter 10 CDMA Short Message Center (ZXSC100)

Receiving the request for short message deletion from the ESME

Whether the ESME has logged in N

properly

Y
N Whether the ESME provides the
message ID

Y
Searching all short messages which were
unsuccessfully sent to the destination address Whether there is any such N
message

Y
Checking the source and destination addresses
Whether there is any message
matching with the source address
N
Y Whether the source and destination N
addresses are consistent
Deleting this message from the sending queue

Y
N Whether the search is Whether the message has been Y
completed sent successfully

Y N
Deletion completed Deleting this message from the sending Deletion rejected / Deletion failure
queue

Fig. 10-56 Processing flow of short message deletion

9.11.4.1.6 Short message replacement sub-module

For the short message that hasn’t been successfully sent, the system provides the replacement
function for ESME, in addition to the deletion function. The replaceable items include: timed
sending time, validity period, acknowledgement request flag, message contents, etc.

When replacing a short message, the ESME is also required to provide the ID of a short
message so as to identify the specific short message; meantime, the originating address of this
short message must also be provided for check. The processing flow of short message replacement
is shown in Fig. 10-57.

-504-
 Chapter 10 CDMA Short Message Center (ZXSC100)

Receiving the request for short message replacement from the ESME

Whether the ESME has logged in N

properly

Y
Whether there is any such message N

Y
Checking the source address

Whether the source address is N

consistent

Y
Whether the message has been sent Y
successfully

N
Deleting it from the sending queue

Replacing the message contents

Reinserting it into the sending queue

Replacement completed
Replacement rejected / Replacement

failure

Fig. 10-57 Processing flow of short message replacement

9.11.4.1.7 MS command processing sub-module

In addition to delete the submitted short messages through the ESME, the mobile subscriber can
also delete the short messages already submitted by submitting a “Cancellation request” (it can be
regarded as a short message in a special format) .In this short message, MS is required to provide
the message reference number used when this message was submitted, to indicate the specific
message.

If the submitted short message has not been successfully sent, the MS can make a request for
deletion of this message. The MSC system will delete this message from the sending queue
without resending it.

9.11.4.1.8 MS information processing sub-module

The detailed information of all registered MSs, including the user name, address, password, left
messages, mobile equipment information, etc., is saved in the database of the ZXSC100, With the
information, the system provides some functions of information query and owner service.

1 MS information query

-505-
Chapter 10 CDMA Short Message Center (ZXSC100)

For a specific MDN number, the ESME can obtain the following information with the query
command: whether this number belongs to a registered subscriber, whether the mobile phone of
the MS supports receiving short messages in Chinese, and whether there is any left message of this
MS , etc. In this way, it will be more convenient for the ESME to make further processing. For
example: the ESME can refuse to send short messages to the unregistered MSs, and prevent from
sending short messages in Chinese to the mobile phone only supporting English (because this will
cause illegible codes).

2. Message leaving of the MS

Message leaving of the MS is a kind of announcement information, e.g. “I’m away on

business trip”, “Do not send short messages after 21:00 p.m.’’, etc. If any other person intends to
send short messages to this MS via ESME, he can check the left message of this MS first, so as to
decide whether to send short messages or not. If he changes his mind and doesn’t want to send the
message, he can cancel the short message that he intended to send before. MS can set the left
messages through the ESME.

3 MS short message query

When MS cannot query the short messages that are sent to him with his mobile phone for
some reason, ZXSC100 SMC provides the function of querying short messages through the
ESME, with which the MS can query a number of the latest short messages sent to him at one
time, including the successfully sent and unsuccessfully sent messages. After query, MS can also
decide whether to delete those unsuccessfully sent short messages without further sending them.

4. MS alarm call

The ZXSC100 system provides the MS with a timed sending function of a special short
message, which includes a fixed indication content and will be sent for multiple times at the preset
time (with a short interval between two times). It won’t be resent even in case of sending failure.
This function is equivalent to an alarm clock, and is only provided to the mobile phone owner. The
processing flow of the alarm call is shown in Fig.10-58.

-506-
 Chapter 10 CDMA Short Message Center (ZXSC100)

The MS sets multiple alarm call moments

Inserting the alarm call message into the timed queue

at the nearest alarm moment

Whether the alarm moment is due N

Delay

Y
n=0

Sending the alarm short message for the nth time

Whether this alarm call has been N

completed n=n+1

Y Delay by m seconds
Y Whether there are other alarm
moments

N
Alarm call completed

Fig.10-58 Processing flow of the alarm call

5. MS password verification and modification

MS announcement, short message query and alarm calls are services specially provided for
mobile phone owners. To ensure that only the owners have corresponding rights to access, the
ZXSC100 provides the password confirmation mechanism for MSs. The owner’s password is
required either to write an announcement, or to query short messages, or to set an alarm call. Any
corresponding operation will be prohibited if the password is incorrect.

The system also provides the MS password modification function through the ESME. At this
time, the MS is required to provide the correct old password as well.

9.11.4.1.9 SME login management sub-module

The ZXSC100 provides external SMPP interfaces for the convenience of the access of ESME,
thus to provide plentiful value-added services. In order to ensure the system must manage the
ESME that are logged in, so as to prevent from illegal ESME accessing.

Before executing such operations as submitting and querying short messages, ESME must
first successfully log in to the SMC. Its login process is shown in Fig. 10-59.

-507-
Chapter 10 CDMA Short Message Center (ZXSC100)

Receiving the login request from the ESME

Whether the System_id has been N

registered

Y
Whether the System_type is correct N

Y
Whether the Password is correct N

Y
Whether it is supported by the N
version

Y
Recording the ESME login information

Login rejected / Login failure

ESME login is successful

Fig. 10-59 Processing flow of ESME login

9.11.4.1.10 Resource management sub-module

As stated above, the ZXSC100 has a timed queue resource, which plays a very important role
during the process of short message sending. By inserting into, picking up, querying and deleting
from this queue, the system can send and resend the short messages.

Since the timed queue is a link queue arranged in the time sequence, it’s relatively difficult to
operate. Here we take insertion into the timed queue as an example to illustrate its processing
flow, as shown in Fig. 10-60.

-508-
 Chapter 10 CDMA Short Message Center (ZXSC100)

Checking the head of the timed queue

Recording the insertion at the head

N Whether it is later than the
of the queue first record

Y
n=2

Whether it is later than the nth N Recording the insertion before the
record nth record

Y
n=n+1

N Whether it is the end of the

queue

Y
Recording the insertion at the end of the queue

Insertion completed

Fig. 10-60 Insertion flow of the timed queue

9.11.4.2 MAP service process

The ZXSC100 is an independent entity, which cannot provide short messages services for MS
subscribers unless it can access the CDMA network, and cooperates with the HLR and MSC and
other entities. The interface function between the ZXSC100 and CDMA networks is provided via
the SM signaling gateway, which performs signaling interaction with other entities in CDMA
networks on the basis of the standard MAP signaling, implementing the standard MAP signaling
flow. These signaling flows include: Signaling flow of MS sending short messages to the SMC,
signaling flow of MS receiving short messages from the SMC, and signaling flow of the
HLR/MSC notifying the SMC that the MS can receive short messages.

9.11.4.2.1 Signaling flow of MS sending short messages

The SMC can receive short messages from a CDMA MS, and forward them to the destination
SME. The destination SME can be either the visitor MSC or the home SMC of the MS that
receives the short messages.

The signaling flow of MS sending short messages to the SMC is as shown in Fig. 10-61.

-509-
Chapter 10 CDMA Short Message Center (ZXSC100)

Originator Destination

MS-MSE MSC SMC SME

Sending short messages

a
SMDPP
b
smdpp（ACK）
c
Acknowledging
d
SMDPP
e
smdpp（ACK）
f

M S sending short messages

Fig. 10-61 Processing flow of MS sending short messages

Notes:

a. The MS creates a short message, and sends it to the MSC via the air interface.

b. The MSC converts the short messages sent over via the air interface into SMDPP
messages, and then sends them to the home SMC of MS.

c. The SMC sends an smdpp message to the MSC, acknowledging the receiving of the short
message. The smdpp message also includes the data to be returned if there is any.

d. The MSC converts the smdpp message into the acknowledgement message of the air
interface and sends it to MS.

e. The SMC sends an SMDPP message to the destination SME.

f. The destination SME sends an smdpp message to SMC, acknowledging the receipt of the
short message. The smdpp message also includes the data to be returned if there is any.

The MS successfully submits the short messages to the SMC, and then starts the next
processing step of the SMC forwarding short messages to the MS.

9.11.4.2.2 Signaling flow of MS receiving short messages

The SMC forwards the short messages submitted by SME to the CDMA MS.

-510-
 Chapter 10 CDMA Short Message Center (ZXSC100)

The originating SME can be either the visitor MSC or the home SMC of the MS that
originates the short messages.

The signaling flow of the MS receiving short messages is as shown in Fig. 10-62.

Destination
The visitor system of destination MS The home system o f destination MS Originator

M S-SM E
M SC VLR HLR SM C SM E

Accessing

a
REGNOT （ SMSADDR ）

b
REGNOT （ SMSADDR ）

c
regnot

d
regnot

e f
SMDP P

g
SMSREQ （MIN ）

h
SMSREQ （ MIN ， ESN ）

I
SMSREQ （ MIN ， ESN ）

j
Smsreq(S MSADDR )

Smsreq (SMSADDR ) k
l

Smsreq(S MSADDR )
m

SMDP P
n

Sending short
messages
o

Acknowledging
p

Smdpp （ACK ）
q

Fig. 10-62 Signaling flow of MS receiving short message

Notes:

a. The MS that supports the short message function accesses the system through registration

-511-
Chapter 10 CDMA Short Message Center (ZXSC100)

or other methods.

b. The MSC sends REGNOT message to VLR, notifying it of MS address.

c. VLR forwards REGNOT message to HLR.

d. HLR makes records of the SMS address of this mobile station and sends REGNOT
message to VLR, which includes the service item list of the subscriber.

e. VLR sends regnot message to the service MSC.

f. The SMC receives an SMDPP request, requesting sending SMS message to MS.

g. The SMC sends an smdpp message to acknowledge the received information.

h. If the SMC doesn’t know the current temporary address or MS status of SMS, execute
steps h~m. The SMC sends an SMSREQ to HLR, requesting SME address.

i. If HLR doesn’t know the current temporary address or MS status of SMS, execute steps i~l.
HLR sends SMSREQ to VLR, requesting SME address.

j. VLR forwards SMSREQ to the service MSC, requesting SME address.

k. The MSC sends smsreq, in which the temporary SMS routing address of the served MS is
included.

l. VLR forwards smsreq to HLR.

m. HLR forwards smsreq to the SMC.

n. The destination SMC uses SME temporary routing address to forward the SMDPP to the
destination SME.

o. Via the air interface, the MSC sends the short messages to the destination MS.

p. The destination SME sends the response, acknowledging the receiving of the short
message. The SMS data can be included in the acknowledgement if there is any returned data.

q. The MSC translates the acknowledgement in the air interface into smdpp positive
acknowledgement, and sends it to the SMC. If the returned data is available in step p, an SMS
bearer data parameter can be included in the smdpp message.

If there are some short messages waiting to be sent in the SMC, the subsequent short
messages are sent from the SMC to the SM signaling gateway, then from the gateway to the MSC,
finally from the MSC to MS, and there is no need to query the information from HLR.

-512-
 Chapter 10 CDMA Short Message Center (ZXSC100)

9.11.4.2.3 Notification of SMC for MS receiving short messages

The above-mentioned signaling flow of the MS receiving short messages refers to the normal
cases.

Practically, it might the case that short messages cannot be received temporarily because of
MS unreachable or short of storage space. If the SMC fails to send short messages to the MS, the
SMC will proceed with different re-sending mechanism according to the SMC settings.

1. Forced resending

Even if the MS is unreachable or short of storage space, the SMC will still re-send the short
messages of a higher priority.

2. Timed resending

The failed short messages are saved into the timed sending queue, and resent by the SMC
when the set time is due.

3. Prompted resending

When the SMC receives the messages that the MS is reachable or has idle memory, it will
attempt to resend the messages to the MS.

When HLR or the MSC detects the ability of receiving short messages for the CDMA MS is
changed, the home SMC of MS will be notified. The signaling flow is as shown in Fig. 10-63.

Notes:

a. If the availability status of the MS short messages is changed (for example, the MS
proceeds with the registration of alarm clock of the sleep mode), and if the SMSDPF flag of MSC
is 1, the MSC will send SMS notification message (SMSNOT) to the home SMC of MS.

b. The SMC sends SMSNOT acknowledgement to the MSC, confirming the receipt of SMS
notification messages.

c. When the MS registers in the system, HLR will send the SMS notification message
(SMSNOT) to the home SMC of MS according to the contents of REGNOT message and the
SMSDPF flag.

d. The SMC sends SMSNOT acknowledgement to HLR, confirming the reception of SMS
notification.

The SMS Delivery Pending Flag (SMSDPF) is mentioned in the above flow, and its use is
introduced below.

-513-
Chapter 10 CDMA Short Message Center (ZXSC100)

Fig. 10-63 Short messages notification flow

9.11.4.2.4 Handling of SMSDPF

1. SMSDPF definition

SMSDPF, the SMS Delivery Pending Flag, is used to record the status of messages sent to
subscribers at the network side. If the SMC fails to send short messages to the network side, this
flag can be set as “active” in the database. When the MS or the network can receive short
messages again, the SMC can be notified to re-send short messages according to the flag, which
will be cleared after sending short messages successfully.

2. SMSDPF database distribution

SMSDPF is saved in the database of networks. According to protocol requirements, this flag
should be saved as subscriber data in the databases of HLR and the service MSC. However,
according to the design requirements of the current CDMA, it is normally saved in the HLR and
VLR databases.

3. SMSDPF setting and clearing

The setting and clearing of SMSDPF are determined by the fact that whether the MSs and
networks can receive short messages and the changes of their abilities of receiving short messages.
Namely, the conditions that an MS is allowed to receive short messages are that the subscriber has

-514-
 Chapter 10 CDMA Short Message Center (ZXSC100)

registered and is authorized to use the short message service, the home MSC of this subscriber
supports short message services and the mobile terminal of this subscriber is capable of receiving
short messages. In respect of data, in the user service item list the SMS_OriginationRestrictions
indicates that the subscriber has the short messages outgoing authority, while the
SMS_TerminationRestrictions indicates the subscriber has the short messages incoming authority.
If a subscriber registers in a new MSC, and if it is allowed to carry the SMS-Address parameter in
the registration message, it indicates that this MSC supports short message services. If the
subscriber has the short message ability flag in the ClassMark2 carried during location update, it
indicates the mobile terminal supports short message service.

The setting and clearing of SMSDPF are related to the point-to-point SMDPP sending, short
messages routing request SMSREQ, subscriber registration REGNOT, subscriber registration
cancellation REGCANC and subscriber deactivation MSINACT, which are respectively explained
below:

1. In normal short message services, it is not necessary for subscribers to handle SMSDPF.

2. When the SMC sends short messages to subscribers, if the short message address of the
subscriber is missing, it should request it from HLR. If the subscriber does not belong to the HLR,
or falls into arrears, or has no short messages service, the value Denied is returned for
SMS_AccessDeniedReason. If the HLR can specify that the subscriber is powered off or
deactivated, and the SMS_NotificationIndicator parameter does not exist in SMSREQ or its value
is 1, the value PostPoned is returned for SMS_AccessDeniedReason, and the SMSDPF should be
set in HLR. In the meantime the SMSNOT notification should be sent to the SMC when
subscribers can receive short messages. If the value of SMS_NotificationIndicator is 2, then in
abnormal conditions the value Unavailable is returned for SMS_AccessDeniedReason, without the
need to set SMSDPF. Even when subscribers can receive short messages, no notification is sent to
the SMC.

If the short message address of the subscriber is not available in HLR, HLR requests VLR for
it, and VLR processes SMSDPF the same way as HLR does.

3. After the SMC sends SMDPP to the MSC. If the MSC fails to notify subscribers, and if
SMS_NotificationIndicator is not available in SMDPP, or its value is 1, and the returned
SMS_CauseCode value is 36 (SMS delivery postponed, for instance, subscriber no response, busy,
no acknowledgement, not supported in destination service, etc), it is necessary to set the SMSDPF
in VLR. In the meantime, when subscribers can receive short messages, VLR activates and sends
SMSNOT to the SMC. If the value of NotificationIndicator is 2, the SMS_CauseCode is returned
in abnormal and there is no need to set SMSDPF. Meanwhile, when subscribers can receive short
messages, no notification is sent to the SMC.

4. If subscribers cannot receive short messages at MSC1, and the SMC fails to send short
messages to MSC1, after the SMSDPF is set, if the subscriber roams to MSC2 which supports the

-515-
Chapter 10 CDMA Short Message Center (ZXSC100)

short message service, the subscriber registers in MSC2, and HLR sends REGCANC to VLR1. If
the returned parameter has the message waiting indictor SMSMWI, HLR returns to VLR2, with
SMSMWI carried. In the meantime, HLR sends SMSNOT to the SMC indicating the permission
of message sending. After VLR2 receives the registration acknowledgement, SMSDPF is set. At
this time, if MSC2 receives the short message from the SMC, and SMSMSGCNT (count of short
messages) is 0, MSC2 will notify VLR2 to clear the SMSPDF, and return acknowledgement to the
SMC. If SMSMSGCNT is greater than 0, MSC2 will wait till it is 0. In the end MSC2 notifies
VLR2 to clear SMSDPF.

5. If a subscriber cannot receive short messages at MSC1, and the SMC fails to send short
messages to MSC1, then after the SMSDPF is set, if the subscriber roams to MSC2 which also
doesn’t support the short message service, the subscriber will register in MSC2. In this case HLR
sends REGCANC to VLR1. If the returned parameter has the message waiting indictor SMSMWI,
HLR returns to VLR2, without SMSMWI carried, while HLR sets SMSPDF on its own.

6. If a subscriber is deactivated or powered off, and HLR has SMSPDF set in it, then after the
subscriber registers again, and short message function is supported, HLR sends REGNOT to VLR,
with SMSMWI carried, and SMSDPF is cleared. In the meantime, SMSNOT is sent to the SMC,
indicating the permission of message sending. After VLR receives the REGNOT, it sets SMSDPF.
At this moment, if MSC2 receives short messages from the SMC, and if the SMSMSGCNT is 0,
MSC2 notifies VLR2 to clear the SMSPDF, and returns acknowledgement to the SMC. If
SMSMSGCNT is greater than 0, MSC2 will wait till SMSMSGCNT is 0, and MSC2 will notify
VLR2 to clear SMSDPF.

7. The local roaming as listed in the protocol, namely the handling of direct sending of
REGCANC between VLR and the MSC, is similar to the handling of that between HLR and VLR.
Taking into consideration of current conditions of the system, it is temporarily not supported.

8. Under the condition that VLR has SMSDPF in it, if a subscriber is powered off or
deactivated, VLR will notify HLR to deactivate MSINACT, with parameter SMSMWI carried.
After HLR receives it, it sets the SMSDPF, and acknowledges to VLR, and VLR clears SMSDPF.

9. The SMC sends messages to the MSC, and the MSC forwards it to the subscribers, and
notifies VLR of the results of sending. If the message is successfully sent, VLR will clear the
SMSDPF; otherwise, it will set SMSDPF.

10. After HLR or VLR receives the registration of subscribers or location update, and the
SMS_Address is available, it will check for the SMSDPF. If the flag is set, it will send SMSNOT
to the SMC, indicating that short messages can be sent to subscribers.

11. After the SMC service server fails to send short messages to a subscriber, a timer can be
set. After the timer is triggered, and if there are waiting messages, there will be short message
sending attempts made to this subscriber regardless of its current status. If the message sending

-516-
 Chapter 10 CDMA Short Message Center (ZXSC100)

fails, the server will set a failure mark, and set the timer again; otherwise, it will set the current
status of this subscriber as it can receive short messages.

9.11.4.3 SMPP service functions

9.11.4.3.1 Overview
The ZXSC100 provides standard SMPP protocol interface for the access by ESMEs. For the sake
of security, the ESME must not be connected with the service server directly. Instead, it must be
connected with an SMPP agent in the first place, through which short messages are forwarded.
SMPP functions as an independent physical entity, providing such functions as establishing
communication links with ESME (TCP/IP or X.25 protocol), checking the connection conditions
of links, rejecting illegal ESME operation requests, etc.

The SMPP agent fulfils the establishment of communications and message delivery between
the ESME and SMC. It mainly includes the main processing module, process scheduling module,
internal message communications module, standard message communications module, and public
resource module. Fig. 10-64 shows the structure.

Fig. 10-64 SMPP agent structure diagram

The process scheduling module is responsible for message delivery between modules inside
the SMPP agent. Messages between the SMPP agent and service server are delivered via the
internal communication module. Messages between the SMPP agent and the expanded message
entities are delivered through standard communication modules.

-517-
Chapter 10 CDMA Short Message Center (ZXSC100)

1. Main processing module

This module converts the internal messages from the service server into standard SMPP
messages which are sent to the ESME, and converts the standard SMPP messages from ESME
into internal messages which are sent to the service server.

2. Process scheduling module

It implements the message sending/receiving and process scheduling management between

the main processing module, standard message communication module and internal message
communication modules.

3. Internal message communication module

The internal message communication module provides services for the message
communication inside SMC, which is based on TCP/IP. Meanwhile, it automatically maintains the
smooth transportation of communication links.

4. Standard message communication module

The standard message communication module provides message communication services

between the SMC and ESME, which is based on the TCP/IP (or X.25) and complies with the
SMPP protocol. Meanwhile it automatically maintains the smooth transportation of
communication links.

5. Public resource module

It provides the resources for the SMPP access processing (for instance, the ESME link
information queue) and the configuration management function, available for invoking by the
main processing module and the standard communication module in the function mode.

The main processing module and standard message communication module are detailed
below.

9.11.4.3.2 Main processing module

The main processing module implements such functions as message conversion, parameter
checking and resource management.

The message conversion implemented here is the inter-conversion between the standard
messages and internal messages. Standard message refers to the message used for communication
between the SMC and ESME, and internal message refers to the message internally communicated
within the SMC.

The parameter checking function serves to verify the message headers.

-518-
 Chapter 10 CDMA Short Message Center (ZXSC100)

The resource management includes the management for standard message communication
module resources and the management for configuration files.

Now, we introduce the main processing module in three service processing processes:
message header processing, ESME message processing and service server message processing.

2. Message header processing

A message header is composed of the message serial number, length, command ID and
command status.

The message header processing means to judge whether the message length exceeds the
limitation, and check the validity of message commands. The processing flow is as shown in Fig.
10-65.

Y
Message length exceeding Discarding
the limitation?
the message

N
Valid command?

Y
Discarding the message Going to the next processing step

Fig. 10-65 Message header processing flow diagram

2. ESME message processing

As for the message sent from the ESME, check whether it is the SMPP standard message in
the first place. If it is, check whether it is a login request. As for login request, the SMPP agent
converts it immediately into a corresponding internal message, and forwards it to the service
server. Messages other than the registration request are only converted into internal messages until
the ESME logs in successfully. Then the converted messages can be forwarded to the service
server. Otherwise, they will be rejected. The processing flow is as shown in Fig. 10-66.

3. Service server message processing

-519-
Chapter 10 CDMA Short Message Center (ZXSC100)

The internal messages sent from the service server are not forwarded to the ESME before
they are converted into the corresponding standard messages. The processing flow is as shown in
Fig. 10-67.

Is it an SMPP standard message? N

Y Is it a login request?

Is the ESME logged in? N

Converted into internal message and forwarded to service

processor Reject

Fig. 10-66 SME processing flow diagram

Converted into standard message

Sent to the ESME

Fig. 10-67 Service server message processing flow

9.11.4.3.3 Standard message communication module

The standard message communication module is responsible for the communications between the
ESME and SMPP agent, which is based on TCP/IP (X.25), and complies with SMPP.

1. Function

1) Link establishment

-520-
 Chapter 10 CDMA Short Message Center (ZXSC100)

To establish communications between the ESME and SMPP agent, the ESME as a client
requests to establish a link, and the SMPP agent as a server accepts the request.

2) Link tests

The communication between the SMPP agent and ESME is a “virtual connection”, therefore,
it is necessary to check whether the link is connected or disconnected periodically after the
communication is established.

3) Communication interrupted

ESME actively requests the termination of communications. After accepting and handling the
request, SMPP agent disconnects the link with ESME, interrupting the communication.

2. Software structure

The communication module on the NT platform is designed with the asynchronous SOCKET
mechanism, and all the communications are implemented via a process. Fig. 10-68 shows the
software structure in use. The standard message module comprises six function modules: the
initial processing module, data sending module, data receiving module, link testing module, error
processing module, and monitoring module.

1) Initial processing module

The initial processing module is used to initialize the communication threads, the SOCKET
environment, and read the configuration files. Meantime, according to the information on the
nodes designated to connect in the configuration files, it initiates the link establishment or waits
for link establishment by the opposite party.

2) Data sending module

The waiting messages sent from each application threads in the thread queue are extracted
and put in the waiting queue by the data sending module. According to the FIFO principle waiting
messages in the waiting queue are picked up and sent out through SOCKET.

3) Data receiving module

The link data transmitted on the basis of TCP/IP is obtained by the data receiving module
from the SOCKET, and then divided into a number of individual messages, which are sent to the
scheduling process.

4) Link testing module

The link testing module tests the links regularly, to guarantee smooth operation of links.

-521-
Chapter 10 CDMA Short Message Center (ZXSC100)

Fig. 10-68 Software structure of standard message communication module

5) Error processing module:

The error processing module handles the errors that happen during the operations of
communication modules. Possible errors occurring in the course include the following:

A. Initialization error: the communication modules cannot be initialized normally, for

instance, the incorrect version of WINDOWS SOCKET, or the wrong information of remote end
connected with this node, etc. In case of any of these errors, the communication module cannot be
started before troubleshooting.

B. Sending queue overflow, causing data loss: If the volume of data to be sent is so large that
the communication module fails to send in time, the sending queue corresponding to a SOCKET
will overflow. In this case, an alarm should be sent to the monitoring module.

C. Link interrupted abnormally: If the link is interrupted abnormally, a message should be

sent to the monitoring window.

D. Error data received: If an error message is received, a message should be sent to the
monitoring window.

E. Other abnormal errors: It is necessary to send a message to the monitoring window if any
other abnormal error happens.

F. Monitoring module

The monitoring module monitors the operation statuses of communication modules, to

discover troubles present.

9.11.4.3.4 ESME access flow

The SMPP login system facilitates the dynamic connection of ESME. In order to improve the
flexibility of the system, the SMPP agent is allowed to connect to the SMC dynamically, and the
service server is allowed to connect to multiple SMPP agents at the same time.

Take the example of an ESME submitting a short message to a mobile subscriber, to illustrate
the SMPP accessing flow, as shown in Fig. 10-69.

-522-
 Chapter 10 CDMA Short Message Center (ZXSC100)

The steps of the access flow is as follows:

1) The SMPP agent requests accessing service server (internal message).

2) If the SMPP agent provides a correct access password, and the number of SMPP agents
accessed doesn’t exceed the stated limitation, the service server accepts the request.

3) The service server requests the SMPP agent for the information of the ESME that has
logged in the SMPP agent (internal information).

4) The SMPP agent returns the information the logged in ESME to the service server, thus, if
the service server is restarted, there is no need for the logged-in ESME to log in again.

5) The ESME establishes the communication link with the SMPP, and requests to login
(standard message).

6) The SMPP agent forwards the ESME login request (internal message) to the service server.

7) The service server accepts (or rejects) the login request of this ESME after checking.

Fig. 10-69 SMPP accessing flow

8) The SMPP agent takes records of the ESME login information, and sends the login request
acknowledgement (standard message) to the ESME.

9) After the ESME is logged in successfully, it submits a short message (standard message) to
the SMC.

10) After the SMPP agent confirms that the ESME has successfully logged in, it forwards the
short message submission request (internal message) to the service server.

11) The service server returns the processing results for the message.

12) The SMPP agent forwards the short message submission request acknowledgement to the
ESME.

13) After the submission of short messages, the ESME requests logout to the SMPP agent
(standard message).

-523-
Chapter 10 CDMA Short Message Center (ZXSC100)

14) The SMPP agent forwards the ESME logout request (internal message) to the service
server.

15) The service server clears the information of ESME login, and accepts the logout request
of this ESME.

16) The SMPP agent clears the ESME login information, and forwards the logout
acknowledgement to the ESME, and then disconnects the link to the ESME.

9.11.4.3.5 SME service functions

1. Assisted operator position function

1) Position log in/out; call access; call rejection; outgoing call; call forwarding; three party
call service; call recording; on-hook; internal call; indicating busy/idle.

2) Monitor position should also have the monitoring, inserting and forced disconnection
function.

Query information about account establishment of a mobile subscriber in the SMC; submit
short message (normal call, priority call, emergency call, alarm call, timed call); query, substitute
and delete short message; owner message leaving; owner query; modify subscriber’s password;

3) Support short message both in Chinese and English; support long and short messages;
support submission of the short message with the destination subscriber as a distribution list;
support preset short message function; support the transmission of the short message as a text.

4) Assisted operator position IOD function.

2. Automated operator position function

1) Sending pre-defined short messages;

2) Sending calling number;

3) Sending digital information code function;

4) According to the short message ID and destination subscriber number, query the short
message status;

5) Use the destination user number and the password to query short message contents;

6) Integrated information platform function;

7) IOD help information;

-524-
 Chapter 10 CDMA Short Message Center (ZXSC100)

8) Real-time stock information on demand;

9) Real-time exchange rates on demand;

10) Weather forecast on demand as per city codes;

11) Flight information on demand;

12) Telephone fee information on demand;

13) News headlines on demand;

14) Information fee (amount) compliance prompt function;

15) Support IOD contents both in Chinese and English;

16) Automatic login function when the program is started or the link is disconnected;

17) Information subscription function.

3. Voice mailbox function

Short message prompt function of the message leaving of the voice mailbox.

4. Web Server function.

1) Web short message submission;

2) Web short message query.

9.12 ZXSC100-GW CDMA-GSM Interworking Shared

Gateway and Independent Short Message System

9.12.1 Solution for The Short Message Interworking & Shared Gateway—
ZXSC100 Connection With Other Networks

The ZXSC100 can provide multiple solutions for interworking with the short message networks of
other PLMNs (mainly GSM). Let’s take a closer look at the connection with GSM networks as an
example.

Besides the existing CDMA-SMC, ZTE Corporation can provide independent equipment for
information interworking and resource sharing of short messages between the CDMA network and

-525-
Chapter 10 CDMA Short Message Center (ZXSC100)

the GSM network, i.e. short message interworking and shared gateway—ZXSC100-GW. The
ZXSC100-GW short message interworking and shared gateway (abbreviated as ZXSC100-GW)
can connect with multiple SMCs of the GSM and CDMA via SMPP interfaces, forward short
messages between the SMCs and provide the interworking function of the short messages between
the GSM network and the CDMA network. In the mean time, various ESMEs can be attached to
the ZXSC100-GW according to the SMPP protocol, then the ZXSC100-GW can forward the
standard SMPP messages between the SMC and the ESME, enabling one ESME to provide
valued-added service for multiple SMCs. The ZXSC100-GW can be used either independently or
integrated in the ZXSC100.

According to different network structures and network construction philosophies of different

operators, the short message interworking and shared gateway can be further divided into the
built-in one and the external one.

9.12.1.1 External interworking and shared gateway of short messages

As the interworking and shared gateway of short messages, the ZXSC100-GW can be respectively
connected to the CDMA-SMC and GSM-SMC, so as to implement short message interworking of
the two networks. On the one hand, as a SMC, the interworking and shared gateway of short
messages can log in to the existing GSM-SMC according to SMPP (V3.3), and log in to the
CDMA-SMC according to SMPP (V3.4), and transfer the messages between two SMCs, so as to
implement point-to-point short message interworking between GSM mobile phones and CDMA
mobile phones. On the other hand, the short message interworking and shared gateway can
implement the goal for both the GSM-SMC and the CDMA-SMC to share the ESME which
provides value-added services.

The connection of the ZXSC100-GW with the GSM and CDMA SMCs is shown in Fig. 10-
70.

-526-
 Chapter 10 CDMA Short Message Center (ZXSC100)

GSM mobile communication network

GSM mobile
phone
position
operator

GSM -SM C
Assisted

BSS
SMPP
SMPP
n platform
Informatio

SM PP ZXSC100-GW

SM PP SMPP
mailbox
Voice

CDMA mobile phone

CDMA-SM C
BSS

CDMA mobile communication network

Fig. 10-70 ZXSC100-GW connection with GSM and CDMA SMCs

9.12.1.2 Built-in interworking and shared gateway of short messages

To save investment and facilitate management, the interworking and shared gateway of short
messages can be built in the ZXSC100, to provide CDMA short message services and access to
other GSM-SMC via SMPP (V3.3) interfaces, so as to implement short messages interworking
with the GSM networks..

-527-
Chapter 10 CDMA Short Message Center (ZXSC100)

GSM mobile communication network

GSM-SM C GSM mobile phone

BSS
SM PP

CDMA mobile communication network

CDMA- SMC M SC/VLR CDMA mobile phone

BSS

HLR

Fig. 10-71 Connection between ZXSC100 built-in interworking and shared gateway and the
GSM-SMC

In fact, the principle of the solutions mentioned above is basically the same. The guideline of
either of the solutions is: to connect the SMC of the CDMA network with other public land mobile
networks (e.g. GSM network) so as to implement the interworking and interconnection of the two
networks, thus implement the resource information sharing. The difference between GSM and
CDMA network development leads to different interconnection protocols adopted between the
SMCs of GSM and CDMA networks, and the ESMEs. With regard to the SMC, the SMPP (V3.3)
is employed between the GSM-SMC and ESME, while the SMPP (V3.4) is employed between the
CDMA-SMC and ESME.

9.12.2 ZTE Independent SMC

On the basis of the original CDMA-SMC, the hardware platform of the ZXSC100 remains
unchanged, and the simultaneous access into the CDMA network and GSM network via expansion
of software functions is provided. At the same time, the system provides both CDMA-SMS and
GSM-SMS , and enables the short message sending between the subscribers of the two networks
via the internal message conversion in the ZXSC100.

The connection between ZXSC100 and GSM and CDMA networks is shown in Fig. 10-72.

-528-
 Chapter 10 CDMA Short Message Center (ZXSC100)

GSM mobile

Communication

network GSM mobile

M SC/VLR
phone
BSS
HLR

Independ ent SMC

CDMA mobile CDMA mobile

communication network
phone

M SC/VLR
BSS

HLR

Fig. 10-72 Connection between the ZXSC100 and CDMA and GSM networks

The structure of ZTE independent SMC is shown in Fig. 10-73. It’s structure and the service
functions are described as follows:

Billing center

Signaling gateway/intelligent switch module

network

management
CSS7
PLMN
center TCP/IP
PSTN
X.25/DDN/E1

Service Automated
Router operator TUP/ISUP
server position
Assisted operator
position Voice mailbox

OMM server

Web server
Email server

SMPP SMPP
agent server TCP/IP/X.25
Operation and
maintenance
service handling Integrated Other
information ESME Internet
platform
/Infonet

Fig. 10-73 Schematic diagram of the structure of ZTE independent SMC

-529-
Chapter 10 CDMA Short Message Center (ZXSC100)

9.12.2.1 Traffic model and system configuration

The ZXJ10V10.0 compact rack is employed for the SM signaling gateway, each rack has six
layers of shelves, and each module occupies one layer of shelf. There are at most eight modules
for the SM signaling gateway, each module can be connected with 32 SS7 links, and 256 links for
eight modules altogether. Each link can carry the signaling of 10 short messages per second at
0.4Erl load. In consideration of MP processing ability, a single module can support 150 messages
per second, thus eight modules can support 1200 messages per second (one message = one
originating call + one terminating call).

9.12.2.2 Interconnection protocol (SMPP) between SMC and ESME

Short message point to point protocol (SMPP) is a kind of interconnection protocol specification
between the ESME and the SMC, and it can be based on either TCP/IP link or X.25 link.

The ZXSC100 supports the SMPP protocols based on both TCP/IP link and X.25 link. The
ESMEs of other manufacturers can interconnect with the ZXSC100 via the SMPP protocol, while
the ESMEs of the ZXSC100 can interconnect with the short message centers of other
manufacturers via the SMPP protocol.

9.12.2.3 Interworking and shared gateway

The interworking and shared gateway can connect to the existing GSM-SMC via the SMPP
(V3.3), or connect to the existing CDMA-SMC via the SMPP (V3.4), so as to implement
interworking of the two networks.

Via the interworking and shared gateway provided by ZTE, all kinds of ESMEs can be
connected to both the GSM-SMC and the CDMA-SMC, so as to share the value-added services.

9.12.2.4 Cell broadcast

Cell broadcast is one of the major services provided by CDMA mobile communication networks,
which is mainly used to send general-purpose messages to mobile subscribers in a specific
geographical area. The differences between the cell broadcast and the point-to-point service are:
the receiver of point-to-point short messages is a specific mobile subscriber, while the receiver of
the cell broadcast short messages is all the mobile subscribers within a specific area, including
foreign subscribers roaming into the area. The smallest area that can be addressed by the network
is a cell. The messages that the network can send are all kinds of news, enterprise advertisement,
weather forecast, traffic information, etc. In the ZXSC100, the cell broadcast server stores and
manages all the information and broadcast messages of the cell, utilizes the SS7 function provided
by the cell broadcast signaling gateway (integrated in the SM signaling gateway) to interwork with
the mobile switching center (MSC), and control MSC in sending or deleting cell broadcast short

-530-
 Chapter 10 CDMA Short Message Center (ZXSC100)

messages to BSS. The ZXSC100 provides two kinds of operation terminations: management
console and announcement console of the cell broadcast. The system servicing staff configure the
cell information and manage the announcement console via the management console; the general
subscribers set up the cell broadcast information via the announcement console, which can be
stretched to remote end for the convenient of the subscribers.

9.12.2.5 Charging and network management

The ZXSC100 can provide the detailed originating and terminating bills of the short messages; the
ZXSC100-GW can provide detailed forwarding tickets of the short messages. The system can
connect to the charging or network management center to transmit bills according to the FTAM or
the FTP protocol via such leased lines as X.25/DDN/E1.

9.12.2.6 ESME
At present, the ESMEs of the ZXSC100 are:

Assisted operator position for manual connection

Voice automated operator position

Integrated information platform

Dunning platform

Voice mailbox

Other ESMEs

9.12.2.7 OMM
The OMM include the application server, the accounting server, the service handling console and
the operation and maintenance console.

The service handling console, with certain authority, manages subscriber data in the database,
and performs such operations as subscriber adding, deletion, service registration, and
modification.

With the application server, the operation and maintenance console implements the operation
and maintenance of the system, including: data configuration, service observation, signaling trace,
performance measurement, trouble trace and location, system monitoring and alarm, charging, cell
broadcast control, etc.

-531-
Chapter 10 CDMA Short Message Center (ZXSC100)

The high-speed HUB is employed between various functional modules for communications
within the ZXSC100.

9.12.2.8 Service functions

9.12.2.8.1 SMC functions

The SMC provides such functions as short message reception, storage, forwarding, retry
forwarding, SME access control, cell broadcast, etc.

For more information about the service functions of the ZXSC100, please refer to the Service
Functions in Section 10.5.

9.12.2.8.2 Charging function

Generate original bills without error, omission or repetition.

Save the bills.

Backup, copy and browse the bills.

Send the bills to the billing center offline or online.

9.12.2.8.3 Operation & maintenance functions

Local operation and maintenance functions.

Functions of storing, querying, and modifying operation and maintenance data.

Having the functions of the remote operation and maintenance console.

Functions to access superior network management.

9.13 ZXSC100 Networking and Configuration

The ZXSC100 includes the following parts: SS7 gateway module, service server module, SMPP
agent server module, cell broadcast server module and OMM. The auxiliary systems include
intelligent ACD module (including CTI server), all kinds of short message entities (SME),
charging unit (combined with the OMM server if in small-capacity), remote telecommunication
unit, etc.

The ZXSC100 just needs the following parts when providing the cell broadcast function only:
SS7 gateway module, cell broadcast server module and OMM.

-532-
 Chapter 10 CDMA Short Message Center (ZXSC100)

When the ZXSC100-GW is used as an independent equipment, it includes: interworking and

shared processing service module and the OMM.

9.13.1 Short Message Signaling Gateway

The modularized structure is employed in the SM signaling gateway processing module, which
provides a variety of flexible networking modes. The networking modes are divided into single
module mode and compact module mode.

9.13.1.1 Single module networking

The single module of the signaling gateway has a capacity of 32 links, and 20 E1 interfaces,
requiring only one layer of shelf, as shown in Fig. 10-74. If each short message contains 40 bytes,
a single module has a processing ability of 150 short messages/sec.

Layer 6 BCTN

运行支撑子系
统

Fig. 10-74 Shelf layout of the rack of the single module SM signaling gateway

Board layout is shown in Fig. 10-75:

-533-
Chapter 10 CDMA Short Message Center (ZXSC100)

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

P S M M C C C C C C P M T T D D D D D P
W M P P O O O O O O E O N N T T T T T W
R E M M M M M M P N E E I I I I I R
B M M M M M M M D T T B

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

Fig. 10-75 Board layout of the rack of the single module SM signaling gateway

The broad configurations in the 6th layer (the control network layer) is as follows:

The DT boards can be added by starting from Slot 26 to the left, able to provide five DT
boards, with each DT board connected to four PCM links.

As a pair of mutual-assistant communication boards, COMM1 and COMM2 are used for
MP-MP communication. If the single module structure is available in the SM signaling gateway,
COMM1 and COMM2 should not be used. As a pair of mutual-assistant communication board,
COMM3 and COMM4 are used for the connection control of the network card and
communication between the MP and DT (MT—DT).

COMM5 and Board 6 implement the SS7 functions. Each COMM board processes 16 SS7
links.

Slot 16 is installed with a MON board. If necessary, Slot 15 can be used to install the PEPD
board.

Slot17 and Slot 18 is inserted with the active/standby synchronous clock network cards
(TNET).

-534-
 Chapter 10 CDMA Short Message Center (ZXSC100)

9.13.1.2 Compact module networking

In this mode, a compact module serves as the center, and the requirements of large capacity can be
met through DT connecting multiple compact modules. Because only message communications
are involved between modules, each peripheral module uses two E1s to connect to the central
module.

In this way, the central compact module can connect at most seven peripheral modules, and
the system provides 256 SS7 external links. A rack can hold a maximum of six modules, and there
can be at most two racks.

Its networking is shown in Fig. 10-76.

Signaling gateway
(center)

2× E1
2× E1
2× E1

Signaling Signaling Signaling

gateway 1 gateway 2 gateway 7

Fig. 10-76 Networking of the SM signaling gateway

9.13.2 Server Configurations

9.13.2.1 Service server configurations

9.13.2.1.1 Configuration modes for the WINDOWS NT platform service server

In the ZXSC100, the service server is composed of one or more nodes, with each node carrying
two servers and one disk array. Two ways are available for placing a node:

1. Separate installation

No rack is required. The service server and the disk chassis are placed separately and

-535-
Chapter 10 CDMA Short Message Center (ZXSC100)

connected via network lines.

2. Integrated installation

Every two servers and one disk chassis share a rack.

For a single node, its processing ability is 150 short messages/sec; it can support 0.9 million
subscribers when the traffic model is 0.6 short messages/subscriber busy. Here, the typical
configurations for the server and database are: two servers and one disk chassis.

Multi-node mode can be employed to meet the requirement of capacity expansion.

9.13.2.1.2 Configuration modes for the UNIX platform service server

In the ZXSC100, the service server consists of the service processor and mini-computer. The
configuration modes are:

The service processor single module has a processing ability of 150 short messages/sec, and
the N+1 backup configuration mode or single node active/standby working mode is used.

The database server (Mini-computer) works in the configuration of the dual-system + disk
array. ZTE Corporation employs the mainstream famous-brand mini-computers, with a single
module processing ability of at least 400 short messages/sec.

9.13.2.2 SMPP agent server configurations

In the ZXSC100, the SMPP agent server is composed of one or more nodes. Each node can be
either the single server or the dual-server (forming a cluster system).

9.13.2.3 Cell broadcast server configuration

The configuration of cell broadcast server is the same as that of the service server. A single node
suffices.

9.13.2.4 Interworking and shared server configurations

The configurations of the interworking and shared server are the same as that of the SMPP agent
server, which allows multi-node cooperation.

-536-
 Chapter 10 CDMA Short Message Center (ZXSC100)

9.13.3 OMM

The CDMA operation and maintenance system of ZTE employs the modular design, which is
highly reliable, flexible in configurations and easy for expansion. The OMC manages such
functional entities as SMC, MSC/VLR, HLR/AUC via the OMM of various systems. Fig. 10-77
illustrates the basic structure of the CDMA operation and maintenance system of ZTE.

MSC/VLR
OMC
OMM Maintenance
terminal
Maintenance
console HLR/AUC

OMM TCP/ I P, X. 25
Maintenance
console
SC

OMM
Maintenance
console

Fig. 10-77 Schematic diagram of the CDMA-OMM of ZTE

Most of the OMC functions are performed by the OMMs distributed in the SMC, MSC/VLR
and HLR/AUC. The OMC mainly provides OMC Man-Machine Interface (MMI). The OMC
communicates with the OMM of each entity via TCP/IP, X.25, DDN and E1.

In the ZXSC100, the OMM is mainly composed of one application server, operation and
maintenance terminals and service handling console. Among them, operation & maintenance
terminals and service handling console are configured as required and connected with each other
via HUB.

If the traffic volume is large, and the accounting server is separately set, the cluster system
(dual-server + disk array) is employed, which is similar to the conditions of the service server.

Exercise

1. What are the related interfaces and protocol standards of the ZXSC100 in the CDMA cellular
mobile communication system?

-537-
Chapter 10 CDMA Short Message Center (ZXSC100)

2. What are the main technical indices of the ZXSC100?

3. What are the main components and their functions of the hardware of the ZXSC100?

4. What are the main components and their functions of the software of the ZXSC100?

5. What are the main components and their functions of SS7 of the ZXSC100?

6. What are the basic and expand service functions of the ZXSC100?

7. What are the service processing flows of the MAP and SMPP of the ZXSC100?

8. What are the network structures of the ZXSC100-GW and ZTE independent SMC?

9. What are the configuration modes for the WINDOWS NT platform service server of the
ZXSC100?

10. What is the reliability assurance mechanism of the software and hardware of the ZXSC100?

11. Summarize the networking configuration of the ZXSC100 with 0.5 million subscribers (when
the traffic model is 0.6 short messages/subscriber busy).

-538-
 Chapter 11 ZXC10-BSS

Chapter 10 ZXC10-BSS

Objectives

Get a basic idea of the ZXC10-BSS.

Introduction

This chapter introduces the software and hardware composition, structure and function of the
ZXC10-BSS, including the external interfaces of the system, the overall structure and technical
indices of the system, the software structure of the system, and the networking mode and system
configuration.

10.1 Overview of the Base Station System

10.1.1 Brief Introduction to ZXC10-BSS

With the continuous expansion of the wireless services and the rapid development of Internet
services, the requirements for the capacity of the wireless communications system, the supported
data rate and service categories are getting ever higher.

ZXC10 is an IS-2000-based 3G digital cellular mobile communications system designed by

ZTE to meet these requirements.

For the ZXC10 system, its spread spectrum rate is 1 × 1.2288 Mbps, a single carrier occupies
a bandwidth of 1.25MHz, and it supports the data transmission at the rate of 144 kbps.

The ZXC10-BSS is the core of the cdma2000 digital cellular mobile communications system
developed in line with IS-2000 and IOS4.0 standards and other relevant standards. It is connected
with mobile stations through air interfaces on the one hand, and with the mobile switch and PDSN
through A interfaces on the other hand.

The structure of the ZXC10-BSS is as follows:

-539-
Chapter 11 ZXC10-BSS

BTS

C S A Interface
R B C
Um Interface V
D D
F D S
I MSC
MS S C
S S U
U M
Abis
BTS Interface

C A10/A11
R B C Interface
P
D D
F D S
C PDSN
S F
S S U
U

BSS

Fig 11-1 Structure of ZXC10-BSS

The ZXC10-BSS consists of two parts: the base station controller (BSC) and base transceiver
station (BTS).

As the control part of the BSS, BSC includes the high-speed interconnect router subsystem
(HIRS), selector/vocoder PCF subsystem (SVPS), call processing subsystem (CPS), base station
management subsystem (BSM) and timing subsystem (TS). BSC is connected to BTS through
CDSU, to MSC through SVICM, and to PDSN through PCF. The operation and maintenance of
the BSS is performed at the BSC side. BSC is mainly in charge of wireless NM, radio resources
management, maintenance and management of BSS, call processing, control of MS handoff and
voice coding, together with the support for the high-speed packet data service of 144 kbps at
maximum.

The BTS is the wireless part of the BSS. It includes the Baseband Digital Subsystem (BDS),
Radio Frequency Subsystem (RFS) and Timing Frequency Subsystem (TFS). Controlled by the
BSC, the BTS implements the wireless transmission and related control functions. Modules in the
BDS are interconnected through the internal S_HIRS packet network.

10.1.2 Features of ZXC10-BSS

The ZX3G1X-BSS is designed and developed on top of all the merits of the cdma2000 systems
developed by overseas vendors. Following are the main features of the ZXC10-BSS system.

-540-
 Chapter 11 ZXC10-BSS

Sophisticated technology: The system has adopted many patent technologies, such as
reverse real-time online performance detection and pilot pollution evaluation expert system.

Upward compatibility: The system is designed in such a way as it can meet the
demands on high-speed packet data service of the 3G mobile communications system, can be
upgraded smoothly to HDR and can be cross-connected with the next-generation fully IP-based
systems.

High integration: Using many advanced components, the ZXC10-BSS is highly

integrated and uses fewer boards.

High reliability: The system becomes more reliable by using fewer boards, adopting
1+1 or N+1 redundancy configurations for important boards in the system, removing single-point
fault, and providing software error tolerance, etc.

Flexible configuration: In addition to supporting the traditional networking modes, the

ZXC10-BSS system provides the 4-BTS daisy-chain connection mode; the BTS can flexibly be
configured in various modes as required, from 1 carrier sector to 12 carrier sectors.

Ample services supported: Voice call (8k, 13k, 8k EVRC voice coding), test call
(Markov call, loop back call, and TDSO call), data call, circuit data service (asynchronous data,
G3 fax) and supplementary services.

10.1.3 Architecture and Features of Air Interface (Um Interface) Protocol

The air interface of the cdma2000-1X BSS conforms to the IS-2000 protocol standard, and the
protocol reference model is shown in Fig. 11-2.

10.1.3.1 Features and Structure of Physical Layer

The physical layer implements the coding/decoding and modulation/demodulation functions
of the forward/reverse physical channel. The main physical channels and their functions are as
follows:

F-PICH: Forward Pilot Channel, equivalent in function to the F-PICH in IS-95A,

enables the MS to perform coherent (or synchronous) demodulation.

F-SYNC: Forward Synchronous Channel, equivalent in function to the F-SYNC of IS-

95A, provides the MS with system time and frame synchronization information.

F-BCCH: Forward Broadcast Control Channel, working only above RC3, transmits
overhead messages to the MS.

-541-
Chapter 11 ZXC10-BSS

F-CACH: Forward Common Assignment Channel only works above RC3 together with
F-CPCH, R-EACH and R-CCCH. When the BS demodulates an R-EACH Header. It indicates via
F-CACH which R-CCCH the access message should be sent on and which F-CPCH the power
control bit should be received from.

F-CPCCH: Forward Common Power Control Channel transmits the inverse control bit
to the MS when the MS sends data on R-CCCH.

R-PICH: Reverse Pilot Channel, working only above RC3, serves to help the BS check
the data sent by MS.

R-EACH: Reverse Enhanced Access Channel, working only above RC3, can send the
control information to the BS via this channel when no TCH is established in the MS, thus
improving the access capability of the MS.

F/R-CCCH: Forward/Reverse Common Control Channel serves to transfer the control

messages and burst short data between the BS and the MS when no TCH is established in the MS.

R-ACH: Reverse Access Channel provides the same function as the R-ACH of IS-95A.

F-PCH: Forward Paging Channel provides the same function as the F-PCH of IS-95A.

F-QPCH: Forward Quick Paging Channel, working only above RC3, serves to instruct
the MS on which timeslot it should receive the control message on F-PCH or F-CCCH. Since it is
not necessary for MS to monitor the F-PCH or F-CCCH timeslot all the time, it can sharply cut
back the power consumption of the MS.

F/R-DCCH: Forward/Reverse Dedicated Control Channel, a kind of TCH working only

above RC3, serves to transfer messages or low-speed packet data service or circuit data service
when the MS is in TCH status.

F/R-FCH: Forward/Reverse Fundamental Channel, a kind of TCH, carries the

signaling/voice/low-speed packet data service, circuit data service or auxiliary service when the
MS enters into the TCH status.

F/R-SCH: Forward/Reverse Supplementary Channel, a kind of TCH working only

above RC3, serves to carry high-speed packet data service (14.4K or above).

-542-
 Chapter 11 ZXC10-BSS

Fig. 11-2 Standard protocol reference model of cdma2000-1X air interface

10.1.3.2 Features and Structure of MAC Sub-layer

According to the IS-2000 protocol structure, MAC sub-layer mainly includes the
multiplexing/demultiplexing sub-layer and the RLP implementation, as described below:

Common channel multiplex sub-layer: It performs multiplexing and demultiplexing of

-543-
Chapter 11 ZXC10-BSS

common channels (common signaling channels), providing timeslot-specific sending and

receiving according to the length of the message and the timeslots to be sent.

Dedicated channel multiplex sub-layer: It performs multiplexing and demultiplexing

of dedicated channels (TCH). In the forward direction, it mainly multiplexes the signaling segment
of SAR sub-layer on LAC layer, the voice data from Vocoder, and the circuit data or packet data
from RLP into a physical channel frame. In the reverse direction, it demultiplexes the signaling
segment, voice data, circuit data and packet data from a specific physical channel, and sends them
respectively to the corresponding upper-layer protocol stack for processing.

RLP: It provides different protocol stacks according to different requirements of the

upper-layer protocol stack, and implements the reliable or real-time data transmission between BS
and MS.

10.1.3.3 Functional Structure of the Forward Channel LAC Sub-layer

The functional structure of the forward channel LAC sub-layer is shown in the following figure.

The functional structure of the forward channel LAC sub-layer is described as follows:

F-SYNC: Mainly implementing the functions of Utility sub-layer and SAR sub-layer.

F-BCCH: Mainly implementing the functions of Utility sub-layer and SAR sub-layer.

Other forward common control channels: Mainly implementing the functions of ARQ sub-
layer, Addressing sub-layer, Utility sub-layer and SAR sub-layer.

Forward dedicated signaling channel (F-DCCH and F-FCH): Mainly implementing the
functions of ARQ sub-layer, Utility sub-layer and SAR sub-layer.

-544-
 Chapter 11 ZXC10-BSS

Fig. 11-3 Functional structure of the forward channel LAC sub-layer

10.1.3.4 Functional Structure of the Reverse Channel LAC Sub-layer

The functional structure of the reverse channel LAC sub-layer is shown in the following figure.

-545-
Chapter 11 ZXC10-BSS

Fig. 11-4 Functional structure of the reverse channel LAC sub-layer

The functional structure of the reverse channel LAC sub-layer is described as follows:

Reverse common control channel: Mainly implementing the functions of Authentication

sub-layer, ARQ sub-layer, Addressing sub-layer, Utility sub-layer and SAR sub-layer.

Reverse dedicated signaling channel (R-DCCH and R-FCH): Mainly implementing the
functions of ARQ sub-layer, Utility sub-layer and SAR sub-layer.

-546-
 Chapter 11 ZXC10-BSS

10.1.3.5 Functional Description of LAC Sub-layers

Authentication sub-layer: The MS provides authentication-related field information in the
LAC protocol data unit of the R-CSCH, so as to originate the authentication process of the MS.

ARQ sub-layer: It implements the signaling transfer acknowledgement between the BS

and MS in order to ensure the reliable reception and transfer of signaling and implement repeated
detection of signaling.

Addressing sub-layer: The MS provides MS-address-related fields in the LAC protocol

data units of the F-CSCH and R-CSCH, so as to provide data for the BS to identify the MS.

Utility sub-layer: It maintains such fields as message types and radio environment in the
forward and reverse LAC protocol data units, so as to provide a basis for the upper layer to
distinguish different messages and make a decision to originate access handoff, and also maintains
and fills BIT and message length in PDU.

SAR sub-layer: It performs segmentation and reassembly function. Forwardly, it segments

a message so that it can be multiplexed to a physical channel frame, and reversely, it provides
sequential reassembling of multiple message segments to form a complete message.

10.1.3.6 New features of IS-2000 Air Interface Standard

Compared with IS-95A air interface standard, IS-2000 air interface provides considerable
flexibility and complexity to support high-speed packet data transmission and more reliable and
perfect functions, as summarized below:

The physical layer provides various channels with different functions: IS-95A system only
provides six kinds of channels, while IS-2000 multiplies the channel types, and adds the physical
channels such as R-PICH, R-EACH, R-PCCH, F/R-CCCH, F/R-SCH, F-BCCH, F-QPCH, and F-
CACH.

It defines diversified modulation and coding modes: Walsh, Qof and Turbo codes of
different lengths, and QPSK modulation mode are introduced.

The data rate and frame length of the physical channel are more flexible: Some channels in
cdma2000 support Flexible-Rate and Variable-Rate. The highest rate of the supplementary channel
at 1X stage may be up to 144K. Different rates are available during forward/reverse transmission.
Some channels can select 5ms, 20ms, 40ms or 80ms frame, so as to support different features in
packet data transmission.

-547-
Chapter 11 ZXC10-BSS

Diversified handoff: Compared with IS-95A, IS-2000 provides greatly enhanced support
for handoff. It supports Access Probe Handoff, Access Handoff, Channel assignment into
soft/softer Handoff, thus improving call accessibility and reliability for the MS.

Clearer protocol architecture: IS-2000 clearly defines MAC and LAC sub-layers. The TCH
multiplexing sub-layer in the MAC sub-layer is more flexible and complicated than IS-95A. The
layer-2 acknowledgement of the control channel and SAR (Segmentation and Reassembly)
functions are implemented in the LAC layer.

It introduces the concepts of logic channel and mapping from logic channel to physic
channel so that Layer-3 need not care about which channel the message is received from or sent to.

The new air interface standard essentially improves the performance of the whole system, but
the complexity and a great number of new functions it brings may make the whole system design
more difficult and troublesome.

10.1.4 Architecture and Features of A Interface Protocol

cdma2000 A interface conforms to IOS4.X protocol standard, and the protocol reference model is
shown in the following figure.

10.1.4.1 A1 Interface Functions and Protocol Stack Structure

A1 interface is responsible for carrying the signaling information related to BSMAP (base station
management part) and DTAP (direct transfer part) between BSS and MSC, including the signaling
messages related to call processing, mobility management, radio resource management,
authentication and encryption.

The structure of A1 interface protocol stack is shown in Fig. 11-6.

Compared with IOS2.1 version, the A1 signaling interface defined in IOS4.X standard
involves the following additional contents.

Support the packet data call.

Support priority access and channel assignment (PACA) call.

Support User Zone.

Support the preferred terrestrial circuit.

The structure of this protocol stack is completely the same as that of the IOS2.X protocol

-548-
 Chapter 11 ZXC10-BSS

stack, so no further details are provided here.

Fig. 11-5 cdma2000-1X A interface protocol reference model

A1 Signaling
SCCP
MTP3
MTP2
MTP1
Physical layer

Fig. 11-6 A1 Interface Protocol Stack structure

-549-
Chapter 11 ZXC10-BSS

10.1.4.2 A2 Interface Functions and Protocol Stack Structure

A2 interface mainly carries the 64/56k PCM data (using E1 interface in CDMA-ONE BSS, one
timeslot carries 64k data) between the BS-side SDU and MSC-side switching network. This
interface is exactly the same as IOS2.1, and the software/hardware can be designed completely in
the same way as CDMA-ONE BSS, so no further details will be provided here.

10.1.4.3 A3 Interface Functions and Protocol Stack Structure

A3 interface is used to support the soft handoff between BSSs when the MS is under the control of
TCH. A3 interface includes two parts: A3 signaling interface and A service interface, as described
below:

10.1.4.3.1 A3 Signaling Interface Function and Protocol Stack Structure

The signaling carried on A3 signaling interface mainly serves to establish and release the A3
service interface link. Its protocol stack structure is shown in Fig. 11-7.

A3 Signal
TCP
IP
AAL5
ATM
Physical Layer

Fig. 11-7 A3 signaling protocol stack structure

The physical layer in the protocol stack may use multiple standard interfaces such as E1, T1
or STM-1. The functions of other protocol layers are as follows:

ATM layer: Receiving and sending ATM cells on the specific layer in the unit of 53 bytes,
usually implemented by hardware chip group provided by chip manufacturers.

AAL5: AAL adapts the upper-layer protocol to the ATM layer, and AAL5 supports
adaptation to the ATM layer of a variable-rate, burst or real-time upper-layer protocol or an upper-
layer protocol requiring reliable transmission, usually implemented by hardware chip group

-550-
 Chapter 11 ZXC10-BSS

provided by chip manufacturers.

IP: Carrying the data of upper-layer protocol stack for transmission between
heterogeneous networks.

TCP: Providing end-to-end reliable transmission between heterogeneous networks. TCP

connection will be made to carry the upper-layer A3 interface signaling via the well-known TCP
port 5602 defined in the IOS4.X Standard.

The main functions of A3 interface signaling are as follows:

Establishing one or more A3 service interface links;

Releasing an established A3 service interface link.

Providing the function of notifying the change of status of the home TCH.

In order to implement the A3 signaling interface functions, the hardware should support ATM
and AAL5, and the software should drive AAL5 to adapt IP layer to ATM layer. It is also
necessary to establish and maintain the corresponding TCP connection and implements the
signaling flow of A3 signaling interface.

10.1.4.3.2 A3 Service Interface Functions and Protocol Stack Structure

The structure of A3 service interface protocol stack is shown in Fig.11-8.

The functions of the protocol layer in this protocol stack are as follows:

Physical layer: Refer to the relevant sections above.

ATM layer: Refer to the relevant sections above.

AAL2: Supporting the adaptation of real-time and variable-rate upper-layer data service to
the ATM layer.

SSSAR (Segmentation and Reassembly of Specific Services): Segmenting the upper-layer

PDU and submitting it to the ATM layer, and sequentially reassembling the received ATM
cells into an upper-layer PDU and submitting it to the upper-layer protocol stack.

The functions of A3 service interface are as follows:

Transferring the forward/reverse IS-95 TCH data and control information between BSSs.

-551-
Chapter 11 ZXC10-BSS

A3 Traffic
SSSAR
AAL2
ATM
Physical Layer

Fig. 11-8 Structure of A3 service Interface Protocol Stack

Transferring the forward/reverse IS-2000 DCCH data and control information between
BSSs.

Transferring the forward/reverse IS-2000 FCH data and control information between
BSSs.

Transferring the forward/reverse IS-2000 SCH data and control information between
BSSs.

Transferring the TCH features between BSSs.

Transferring the statuses of one or more cells between BSSs.

As for A3 service interface, the hardware should support ATM layer and AAL2, the software
should encapsulate and decapsulate A3 service interface messages and drive AAL2, so as to adapt
the upper-layer A3 service interface message to the ATM layer.

10.1.4.4 A5 Interface Functions and Protocol Stack Structure

A5 interface is responsible for carrying the circuit data for transmission between the BS-side SDU
and IWF. This interface is exactly the same as IOS2.X, and the software/hardware can be designed
completely in the same way as CDMA-ONE BSS, and so no further details will be provided here.

10.1.4.5 A7 Interface Functions and Protocol Stack Structure

A7 interface is used to support the handoff between BSSs when the MS is not yet under the
control of TCH status, and support the control flow when the MS undergoes soft handoff between
BSSs and new service needs to be established, as described below:

-552-
 Chapter 11 ZXC10-BSS

The structure of the A7 interface protocol stack is shown in Fig.11-9.

The structure of A7 interface protocol stack is the same as that of A3 interface protocol stack.
It also adopts the well-known TCP port 5603 to maintain the connection carrying the A7 signaling.
The A7 signaling interface mainly implements the following functions:

Support the soft/softer handoff between BSSs.

Support the access or access probe handoff between BSSs.

Support channel assignment and soft/softer handoff between BSSs.

The source BSS requests, via the A7 signaling, the destination BSS to allocate the
resources so as to support specific calls.

A7 Signal
TCP
IP
AAL5
ATM
Physical Layer

Fig. 11-9 Structure of A7 Interface Protocol Stack

The destination BSS responds, via A7 signaling, to the request by the source BSS for
resource allocation.

The source BSS requests the destination BSS to release, via A7 signaling, the radio
resources supporting the physical channel.

The destination BSS responds, via A signaling, to the request by the source BSS for
resource release.

The destination BSS requests, via A7 signaling, the source BSS to remove one or more
cells.

The source BSS responds, via A7 signaling, to the request by the destination BSS for
removing cell(s).

-553-
Chapter 11 ZXC10-BSS

The source BSS requests, via A7 signaling, to send a specific message on the specific
paging channel of the destination BSS.

The destination BSS responds, via A7 signaling, to the request by BSS for sending paging
channel messages.

The destination BSS sends, via A7 signaling, the message received from the access
channel to the source BSS.

The source BSS responds, via A7 signaling, to the access channel message sent by the
destination BSS.

The source BSS requests, via A7 interface signaling, the destination BSS to reserve radio
resources to support the specific burst data transmission.

The destination BSS responds, via A7 interface signaling, to the request by the source BSS
for reserving radio resources.

The source BSS requests, via A7 interface signaling, the destination BSS to allocate the
reserved radio resources.

In order to implement the A7 signaling interface functions, the hardware should support ATM
and AAL5, and the software should drive AAL5 to adapt IP layer to ATM layer. It is also
necessary to establish and maintain the corresponding TCP connection and implements the
signaling flow of A7 signaling interface.

10.1.4.6 A8 Interface Functions and Protocol Stack Structure

The structure of A8 interface protocol stack is shown in Fig. 11-10.

GRE
IP
Link Layer
Physical Layer

Fig. 11-10 Structure of A8 Interface Protocol Stack

-554-
 Chapter 11 ZXC10-BSS

There are no specific requirements in the IOS4.X standard for the implementation of the
physical layer and link layer of A8 interface. The network layer adopts IP protocol, and the GRE
protocol is used to encapsulate the protocol data unit of the upper-layer protocol stack, so as to
make it carried in the IP message for transfer. The CRE protocol is used in cdma2000-1X to
encapsulate the PPP protocol stack PDU between the MS and PDSN, so as to adapt it to the IP
message.

The A8/A9 interfaces proposed in IOS4.X are intended for the standardization between BSS
and PCF, but manufacturers typically implement the PCF at BSC side. Therefore, A8/A9
interfaces can be left unimplemented, or some A9 signaling can be converted into internal
signaling of BSS for processing. cdma2000-1X BSS plans to implement A8/A9 interfaces
according to the definitions in IOS4.X standards.

10.1.4.7 A9 Interface Functions and Protocol Stack Structure

A8/A9 interfaces serve to transmit the signaling and data between BSS and PCF. A9 interface
carries the signaling to maintain the A8 connection between BSS and PCF.

The structure of A9 interface protocol stack is shown in Fig. 11-11.

A9 Signal
TCP/UDP
IP
Link Layer
Physical Layer

Fig. 11-11 Structure of A9 Interface Protocol Stack

There are no specific requirements in IOS4.X standard for the implementation of the physical
layer and link layer of A9 interface. The network layer and transmission layer use IP and
TCP/UDP respectively. The well-known port 5603 is used for maintaining the UDP/TCP
connection carrying A9 signaling. The main functions implemented by A9 signaling are as
follows:

BSS requests, via A9 signaling, PCF to originate the establishment of an A8 link.

-555-
Chapter 11 ZXC10-BSS

PCF responds, via A9 signaling, to the request originated by the BSS for establishment
of an A8 link.

PCF requests, via A9 signaling, the BSS to originate a call establishment of a specific
service call.

BSS responds, via A9 signaling, to the request originated by the PCF for establishment
of a specific service call.

BSS requests, via A9 signaling, the PCF to release an A8 connection.

PCF responds, via A9 signaling, to the request originated by the BSS for A8
connection release.

PCF requests, via A9 signaling, the BSS to release an A8 connection.

BSS responds, via A9 signaling, to the request by PCF for A8 connection release.

PCF requests, via A9 signaling, the BSC to reactivate a packet data service.

BSS responds, via A9 signaling, to the request by PCF for the packet data service
reactivation.

10.1.4.8 A10 Interface Functions and Protocol Stack Structure

The structure of A10 interface protocol stack is shown in Fig. 11-12.

GRE
IP
Link Layer
Physical Layer

Fig. 11-12 Structure of A10 Interface Protocol Stack

A10 protocol stack is the same as A8 protocol stack. The software needs to encapsulate
upper-layer PDU into GRE frame and decapsulate GRE message into upper-layer PDU;
encapsulate GRE message into IP message and decapsulate IP message into GRE message, and

-556-
 Chapter 11 ZXC10-BSS

drive the lower-layer network interface to transfer and receive the IP message.

10.1.4.9 A11 Interface Functions and Protocol Stack Structure

A10/A11 interfaces serve to transmit the signaling and data between PCF and PDSN. A11
interface carries the signaling to maintain the A10 connection between BSS and PCF.

The structure of A11 interface protocol stack is shown in Fig. 11-13.

A11 Signal
UDP
IP
Link Layer
Physical Layer

Fig. 11-13 Structure of A11 Interface Protocol Stack

There are no specific requirements in IOS4.X standard for the implementation of the physical
layer and link layer of A11 interface. The network layer and transmission layer use IP and UDP
respectively. The well-known port 434 is used for maintaining the UDP connection carrying A11
signaling. The main functions implemented by A11 signaling are as follows:

PCF requests, via A11 signaling, the PDSN to originate the establishment of an A10 link.

PDSN responds, via A11 signaling, to the request originated by PCF to establish an A10
link.

PCF periodically registers, via A11 signaling, to PDSN for maintaining the A10 link.

PCF originates, via A11 signaling, a release process of A10 link.

PDSN originates, via A11 signaling, a release process of A10 link.

PCF sends, via A11 signaling, various relevant accounting information to PDSN.

-557-
Chapter 11 ZXC10-BSS

10.1.5 Architecture and Features of Abis Interface Protocol

The Abis protocol is an interface protocol between the BSC and BTS. It includes two parts in the
application layer: control part (Abisc) and service part (Abist). The control part mainly converts
the Um interface control channel signaling, and the service part mainly controls the TCH. As Abis
interface is an internal interface, the ZXC10 system includes Abisd (the interface between CCM
and SVICM), Av (the interface between CPM and SVICM), Am (the interface between CCM and
CHM) and Aba (the interface between SVICM and SVM) under the category of Abis interface.

The hierarchical structure of the interface is shown in Figure 11-14.

Abisc, Abist, etc.

With Without
Service Startup/broadcast
acknowledgement acknowledgement
protocol protocol stack
message protocol message protocol
stack
stack stack

HDLC

MSSL

Figure 11-14 The Structure of Abis Interface Protocol Structure

Abisc is the application part of the control channel signaling, such as call establishment,
mobility management and short message services occurring in the control channels.

Abist interface is the transfer part of the service link establishment management and
service data.

Av interface is the application part of TCH, such as call establishment, mobility

management, supplementary service, short message services occurring in TCH, and TCH
management.

Am interface is the transfer part of the channel unit management and control channel
signaling data.

Confirmed message protocol stack is for transfer layer protocols, providing confirmed re-
transmission, packet assembler/de-assembler functions.

Non-confirmed message protocol stack is a transfer layer protocol, providing non-

-558-
 Chapter 11 ZXC10-BSS

confirmed transfer and packet assembly/disassembly.

The service protocol stack is a transfer layer protocol, providing non-confirmed transfer
and non-packet assembly/disassembly functions, satisfying the requirements for quick data
transfer.

The startup/broadcast protocol stack is a transfer layer protocol, providing non-confirmed

transfer and non-packet assembly/disassembly.

MSSL physical layer protocol generally refers to 422 link, E1 etc. in ZTE’s CDMA
system.

The specific distribution of Abis interfaces in the ZXC10-BSS is shown in Fig. 11-15.

10.2 Technical Indices of BSS

10.2.1 Technical Performances of BSS

The main technical performances of the ZX3G1X-BSS are as follows:

Adopting the structure of the packet switched network, providing 192 full duplex ports,
each port with a rate of 9.72 Mbps.

Providing radio resource management, BS monitoring, BSS system operation and

maintenance management, and BS testing.

Supporting star, chain and ring networking of BTS, and providing BTS daisy-chain
connection.

Supporting 8KQCELP, 13KQCELP and EVRC algorithms, and having powerful

background noise-suppressing capability.

Supporting data calls originated by MS and MSC or PDSN, supporting circuit data
services (asynchronous data and G3 facsimile), and supporting high-speed (up to
153.6kbps) packet data services.

-559-
Chapter 11 ZXC10-BSS

BTS BSC
Abisc
CCM CPM

Abisd
Av

Am SVICM

Aba
Abist
CHM SVM

Fig. 11-15 Distribution of the Abis Interfaces in the ZXC10-BSS.

Each S/V board can process 15 full-rate voice channels.

Providing up to 7200 vocoders.

Supporting up to 240 E1 connections with MSC.

Providing up to 5040-Erl traffic processing capability.

Supporting up to 380 BTS connections.

Supporting up to 40,000 PPP connections of packet data.

Each channel board supports 64 channels; BTS provides 384 channels at most and
supports the sharing of the channel units of all sectors of the same carrier.

Supporting forward/reverse open-loop and closed-loop power control.

Supporting macro-cell, micro-BS and remote RF unit.

Supporting multiple soft handoff modes: BTS internal soft handoff, BSC internal soft
handoff, and inter-BSC soft handoff.

Supporting cell respiration function, thus ensuring the QoS of busy cells.

Supporting cell shrinkage and expansion.

-560-
 Chapter 11 ZXC10-BSS

Supporting Transmission Power Track Loop (TPTL) function.

Supporting such frequency configurations such as Band Class 0 (800MHz cell band), Band
Class 1 (1900MHz PCS band) and BandClass 5 (450M band).

10.2.2 Work Environment

The work environment requirements for the ZXC10-BSS depend on the locations of the BSC and
BTS.

10.2.2.1 Work Environment Requirements for BSC

Long-term operating temperature: +15°C ~ +35°C

Short-term operating temperature: 0°C ~ +45°C

Long-term operating humidity: 40% ~ 65%

Short-term operating humidity: 15% ~ 90%

(Short-term operating conditions mean that continuous operation lasts no more 48 hours and
the total operation time per year does not exceed 15 days)

The density of dust particles with diameters larger than 5¦Ìm in the equipment room should be
smaller than 3 × 104 particles/m3, and the dust particles should be non-conductive, non–magnetic
conductive and non-corrosive.

10.2.2.2 Work Environment Requirements for BTS

Indoor BTS:

Operating temperature: -5°C ~ +45°C

Relative humidity: 15% ~ 85%

Outdoor BTS:

Operating temperature: -45°C ~ +55°C

Relative humidity: 5% ~ 98%

-561-
Chapter 11 ZXC10-BSS

10.2.2.3 Power Supply Requirements

BSC and BTS should work normally within the following DC power performance range.

Nominal value: 48V Voltage fluctuation range: －57V ~ －56V

BTS should work normally within the following AC power performance range if DC power
is unavailable:

Nominal value: 220V, 50Hz Voltage fluctuation range: 176V ~ －264V

Frequency range: 45HZ ~ 65HZ

Grounding modes:

The joint grounding mode should be used for the equipment.

BSC should be able to work normally when the grounding resistance is less than 5 Ω.

BTS should be able to work normally when the grounding resistance is less than 5 Ω.

10.3 Hardware Structure of BSS

10.3.1 Overview

The logic structure of BSS is shown in Fig. 11-16.

BSS

BTS BSC System

TFS RFS BDS TS CDSU HIRS SVPS CPS BSM Subsystem

T F G B R T H R C C R B S T G B N N S S P C P
C D P T F R P F H C F T A C P S C I V V C P A Module
M M S M C X A E M M I S M M S C M M I M F M M
T M M _ T _ C
M C M C M
D D
S S
T T R I C S U U S S
C
X X X Q E H I V V Unit
U U U U P E E P

Fig. 11-16 Logic Structure of BSS

-562-
 Chapter 11 ZXC10-BSS

BTS: Base station transceiver including the following components:

TFS: Timing Frequency Subsystem

TCM: Timing Control Module

FDM: Frequency Distribution Module

GPSTM: GPS Timing Module

RFS: Radio Frequency Subsystem

BTM: BS Test Module

RFCM: RF Control Module

TRX: RF Transceiver

TXU: Transmitting Unit

RXU: Receiving Unit

IQU: I/Q Modulation/Demodulation Unit

HPA: High Power Amplifier

RFE: RF Front End

BDS: Baseband Digital Subsystem

CHM: Channel Handling Module

CE: Channel Unit

CHP: Channel Processor

CCM: Communication Control Module

RFIM: RF Interface Module

SIE: Sector Interface Element

BTS_CDSU: BTS-Side CDSU Module

SAM: Site Alarm Module

-563-
Chapter 11 ZXC10-BSS

BSC: Base Station Controller including the following parts:

TS: Timing Subsystem

TCM: Timing Control Module

GPSTM: GPS Timing Module

CDSU: Channel Data Service Unit

BSC_CDSU: BSC-Side CDSU

HIRS: High-speed Route Subsystem

NCM: Network Control Module

NIM: Network Interface Module

SVPS: Selector/Vocoder/PCF Subsystem

SVICM: Selector/Vocoder Interface Control Module

SVM: Selector/Vocoder

SVE: Selector/Vocoder Element

SVP: Selector/Vocoder

PCF: Packet Control Function

CPS: Call Processing Subsystem

CPM: Call Processing Module

PAM: Power Alarm Module

BSM: Base Station Management Subsystem

10.3.2 Overall Hardware Structure of the ZXC10-BSS

The network structure and overall framework of the ZXC10-BSS are illustrated in Fig. 11-17.

-564-
 Chapter 11 ZXC10-BSS

OMS SVPS
SVM PCF
SVPS

TS B -HIRS Subsystem SVICM S-HIRS

BTS SVM SVM

BDS
CPS BTS TFS
RFS
Antenna

Fig. 11-17 Overall Structure of BSS

The network framework of the ZXC10-BSS includes two levels:

The first level is the HIRS of BSC, called “B_HIRS”. It is the packet data switching hub of
the whole system. The system’s signaling protocol processing center—CPS is directly connected
to the “B_HIRS” port through an RS422 serial communication port, the system’s voice
coding/decoding device—SVBS is also directly connected to the “B_HIRS” port through an
RS422 serial communication port, the system’s operation and maintenance center—base station
manager (BSM) is connected to the NCM of the “B_HIRS” through an Ethernet port, and the
modulation/demodulation device of respective BTS—BDS is connected to the BSC_CDSU of the
“B_HIRS” through a non-channelized E1 (here the BSC_CDSU mainly converts RS_422 into E1
signals suitable for long-distance transmission).The “B_HIRS” mainly provides packet data
switching service for all subsystems or modules connected to it. Any devices needing to
communicate with other subsystems can communicate and exchange data with one another
without changing the hardware structure so long as they are allocated with appropriate network
addresses and attached to the unoccupied ports of the “B_HIRS”.

The second level is the low-speed packet data switching network formed in the SVBS or
BDS, called “S_HIRS”. It mainly provides packet data switching service for various modules in
the SVBS or BDS. The major differences between “B_HIRS” and “S_HIRS”: First, the packet
data switching capacity of the former is 16 × 19.44 = 311.04 Mbps, and that of the latter is 8 × 5 =
40 Mbps; second, the NIM of the former provides a dedicated network interface, and the SVM or
CHM of the latter only provides data distribution service for several units of this module.

-565-
Chapter 11 ZXC10-BSS

10.3.3 Hardware System of ZXC10-BSC

The layout of the ZXC10-BSC is shown in Fig. 11-18.

10.3.3.1 HIRS
HIRS, short for high-speed interconnection route subsystem, is the switching core of the whole
BSC, and all the functional modules of the BSS communicate with each other through it. The
HIRS consists of NCM and NIM. As the HIRS plays a vital role, once it malfunctions, the whole
system will be paralyzed. To ensure the reliable operation of the HIRS, 1+1 hot backup is made
for NCM and N+1 backup is made for NIM.

Fig. 11-18 Layout of ZXC10-BSC

-566-
 Chapter 11 ZXC10-BSS

10.3.3.1.1 System Composition

The system structure of the HIRS is shown in Fig. 11-19.

RS232
Ethernet
GPSTM NCM OAM Platform

Double Bus

NIM NIM NIM

HDLC HDLC

CPM CDSU SVBS

Fig. 11-19 Structure of HIRS

The system structure of the whole HIRS is a fast packet switched network based on shared
storage (bus type) and has a hierarchical and modular structure. The bus-type packet switched
network forms the framework of the HIRS network switching platform through two unidirectional
buses—CO bus and DIS bus. The CO bus is Consolidation bus. Under the mediation and control
of the U gateway of the NCM, the NIMs send to the CO bus the data frames received from the
internal serial communication port. After the U gateway receives the data frames from the CO bus,
it distributes the data according to the data frame’s destination addresses: to ATM or DIS bus. DIS
(distribution BUS) is a broadcast distribution bus. The data frames from ATM interface and the
CO bus are sent to DIS bus in broadcast distribution mode under the control of U gateway. All the
NIMs simultaneously receive the broadcast data frame on DIS bus, and determine whether to
accept the data frame according to the node number of the destination address. The NIM will then
send the data frame received to the corresponding internal serial communication port according to
the port number of the destination address of the data frame.

10.3.3.1.2 Shelf Structure

The HIRS network may comprise two HIRS shelves at most. One HIRS shelf is enough if the
capacity of the system is small. Each HIRS shelf has 22 slots. The two slots in the middle are for
NCMs, and nine slots at either side of the NCM are for NIMs. The slot layout in the shelf of the
HIRS is shown in Fig. 11-20.

-567-
Chapter 11 ZXC10-BSS

P N N N N N N N N N N N N N N N N N N N N P
S I I I I I I I I I C C I I I I I I I I I S
M M M M M M M M M M M M M M M M M M M M M M
B B

Fig. 11-20 Slots in the HIRS Shelf

10.3.3.1.3 Input and Output Interfaces

HIRS provides multiple internal serial ports for the access of the respective functional subsystems.

HIRS provides 10/100M Ethernet port for connection with BSM background.

10.3.3.2 SVBS Subsystem

SVBS is short for Selector Vocoder Bank Subsystem. Located in the BSC of BSS, the SVBS is the
core in the CDMA for implementing voice services and circuit-based packet data services and
supporting the MTP1 and MTP2 of SS7. Its basic functions include:

Path selection function: Selecting the best-quality service path among multiple soft
handoff paths to perform transcoding.

Transcoding function: Transforming 64K PCM codes and variable-rate QCELP codes into
each other.

Forward echo suppression function: Echo suppression of the forward link PCM data.

Deciding and implementing soft handoff;

Power control.

Signaling processing function.

The channel resources of the SVBS, the minimum physical unit of the selector/vocoder
resource sharing pool, are shared by all BTSs under the BSC.

10.3.3.2.1 System Composition

The SVBS logically consists of SVICM and SVM. In the design of the system, a fully configured
BSC consists of 1 central rack and 6 vocoder racks. Each vocoder rack holds 10 SVBSs, and every
two SVBSs form a selector/vocoder shelf (i.e. each SVBS backplane supports two independent

-568-
 Chapter 11 ZXC10-BSS

SVBSs).

The structure of the SVBS is shown in Fig. 11-21.

DI S
CO
NI M

SVI CM

SVM ... SVM SVM

HW

MSC E1
SVBS

Fig. 11-21 Structure of SVBS

The SVBS mainly provides selector/vocoder resources for the CDMA system, and the
SVICM and SVM form the “S_HIRS”, providing a channel for service and signaling transmission
between the BSS and the MSC.

10.3.3.2.2 Shelf Structure

Physically an SVBS forms a selector/vocoder shelf, which is composed of one SVICM and eight
SVMs. The SVBS can simultaneously provide 15 × 8 = 120 selector/vocoder resources and 4 E1
channels connected with the MSC for the transmission of the service data of A interface, with
Timeslot 16 of one of the E1 channels used as the physical channel SS7 signaling link for the
transmission of A interface signaling.

In the mechanical structure, a shelf has two SVBSs. One or more SVBS shelves can be
configured depending on the capacity. An SVBS shelf has 22 slots, numbered 1 ~ 22 from left to
right. Slots 11 and 12 in the middle are empty, slots 10 and 13 hold SVICMs and slots 2 ~ 9 and
14 ~ 21 hold SVMs. Slots 1 and 22 at the two sides hold power boards. The slots of the SVBS are
shown in Fig. 11-22.

-569-
Chapter 11 ZXC10-BSS

P S S S S S S S S S S S S S S S S S S P
S V V V V V V V V V V V V V V V V V V S
M M M M M M M M M I I M M M M M M M M M
B C C B
M M

Fig. 11-22 Slots in the SVBS Shelf

10.3.3.2.3 Input and Output Interfaces

The SVBS has the following input/output interfaces:

Serial bus interface connected to NIM.

4 E1 interfaces connected to MSC.

10.3.3.3 PCFS
PCFS, short for packet control functional subsystem, is the minimum physical unit in the resource
sharing pool for implementing packet control function. Its main functions are: Selecting the best-
quality service path among multiple soft handoff paths to implement GRE encapsulation of data;
providing adaptation between GRE packets and RLP packets; establishing, configuring and
maintaining A8 and A10 links via A9 and A11 interfaces, establishing the PPP link between MS
and PDSN for the transfer of packet data service; and providing the interface with the internal
communication network of the BS, which may have different functions depending on the
distribution of the software function points of the BS, such as RLP protocol, power control and
handoff control.

10.3.3.3.1 System Composition

The PCFS logically consists of PCF module and PCFIM.

The PCFS structurally consists of PCF board and PCFIM board.

The PCFS comprises 1 PCFIMM and 8 PCF modules. Its overall framework is shown in Fig.
11-23.

-570-
 Chapter 11 ZXC10-BSS

RS422
Dual bus
To HIRS subsystem
PCFI M
100M fast Ethernet
To PDSN

PCF1 PCF2 PCF8

Fig. 11-23 Structure of PCFS

10.3.3.3.2 Shelf Structure

Physically a PCFS forms a packet control function shelf and consists of 1 PCFIM and 8 PCFs. The
PCFS can simultaneously provide 8 × 16 = 128 PCF resources, provide one 100M fast Ethernet
channel connected to the PDSN as the A11 and A9 signaling channel and A10 and A8 data
channel.

In the mechanical structure, a shelf has two PCFSs. One or more PCFS shelves can be
configured depending on the capacity. A PCFS shelf has 22 slots, numbered 1 ~ 22 from left to
right. Slots 11 and 12 in the middle are empty, slots 10 and 13 hold PCFIMs and slots 2 ~ 9 and 14
~ 21 hold PCF boards. Slots 1 and 22 at the two sides hold power boards. The slot layout in the
shelf of the PCFS is shown in Fig. 11-24.

P P
P P
P P P P P P P P C C P P P P P P P P
S S
C C C C C C C C F F C C C C C C C C
M M
F F F F F F F F I I F F F F F F F F
B B
M M

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Fig. 11-24 Slots in the PCFS Shelf

10.3.3.3.3 Input and Output Interfaces

The PCFS provides a 100M fast Ethernet interface for connection with the PDSN.

The PCFS provides a 422 port for connection with the HIRS switching network.

-571-
Chapter 11 ZXC10-BSS

10.3.3.4 CPS
CPS, the center for BSS system resource management and call signaling protocol processing,
mainly provides the call signaling processing of the whole BSS, radio resource management and
distribution, terrestrial circuit resource management, and the processing of the MTP3 and SCCP
parts of signaling SS7. In addition, CPS is the monitoring center of BSC and monitors the power
supply and environment and reports alarm signals.

10.3.3.4.1 System Composition

The CPS contains two modules: call processing module (CPM) and power alarm module (PAM).

The main functions of CPS are as follows:

HDLC protocol format processing, signaling frame acknowledgement and retransmission,

and packet assembly/disassembly.

SCCP and MTP3 protocol processing of signaling SS7

BSSAP protocol processing of A interface IS-634A.

Signaling processing of Abis interface connected to BTS-CCM.

Maintenance, management and distribution of radio resources.

Database management, covering BS system parameters, terrestrial resource data, TCH

resource, call record data, and performance data.

CPS is also the monitoring center of BSC, monitoring the power supply and environment
and reporting alarm signals. CPS mainly monitors:

Equipment room temperature, humidity, smoke and infrared alarms.

Intra-rack secondary power under-/overvoltage and overcurrent alarms.

Intra-rack fan alarm.

Primary power supply check of the rack.

Power supply checking.

10.3.3.4.2 Shelf Structure

Since the CPS does not contain many boards, it shares the same shelf with the CDSU and
GPSTM, with the slot layout shown in Fig. 11-25.

-572-
 Chapter 11 ZXC10-BSS

G G
P C C C C C C C C C C P
C C P P T P
S D D D D D D D D D D S
P P A S C S
M S S S S S S S S S S M
M MM T M T
B U U U U U Y U U U U B
M M

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

Fig. 11-25 Slot Layout of CPS

The shelf holding the CPS has 22 slots, numbered 1 ~ 22 from left to right. Slots 14 and 15
hold CPMs in 1+1 backup and slot 16 holds PAM. Slots 1 and 22 hold power boards, slots 2 ~ 13
hold CDSUs, each GPSTM occupies two slots, including slots 17 and 18 and slots 20 and 21, and
slot 19 holds TCM.

10.3.3.4.3 Input and Output Interfaces

CPS provides an internal serial bus port to connect with the HIRS and to serve as the path for the
CPM to access the HIRS switching subsystem.

Providing seven RS485 buses, which collect the secondary power alarm signals output by the
PSMBs in the seven racks and the alarm signals output by the power distribution boards in the
seven racks. Each rack occupies one bus.

Providing RS485/232 interfaces for communication with the power and environment
centralized monitoring system and for monitoring the equipment room environment and power
supply.

Providing one RS485 interface for communication with the alarm box, sending to the alarm
box the critical alarm signals (smoke, etc.) detected by the PAM and the alarm signals sent by the
operation and maintenance unit BSM (the alarm box will then give corresponding audible and
visual alarms), and receiving the fault signal reported by the alarm box about itself.

10.3.3.5 CDSU Subsystem

The CDSU, which comprises CDSU and ASM, serves to provide data communication between
BTS and BSC. The BSC-side CDSU and the BTS-side CDSU are the same in hardware, different
only in the widths of their panels. For details about the CDSU, please refer to the description about
the CDSU board. The ASM provides data communication between BSCs and provides a
communication link for inter-BSS soft handoff.

-573-
Chapter 11 ZXC10-BSS

10.3.3.5.1 Shelf Structure

The structure of the CDSU shelf is shown in Fig. 11-26.

C C C C C C C C C C C C C C C C C C C C
D D D D D D D D D D D D D D D D D D D D
S S S S S S S S S S S S S S S S S S S S
U U U U U U U U U U U U U U U U U U U U

Fig. 11-26 Structure of CDSU Shelf

10.3.3.6 BSM
The BSM is the operation and maintenance part of the BSS and its hardware is the background
server. It communicates with the BSC rack via the 10/100M Ethernet and implements operation
and maintenance functions of the whole BSS, such as its configuration, data statistics,
performance management, and alarm.

10.3.3.7 PS
PS, short for power subsystem, supplies power for the boards of the BSC and BTS, and meanwhile
detects the faults of itself and notifies the background.

10.3.3.7.1 System Composition

The ZXC10-BSS consists of the ZXC10-BSC rack and the ZXC10-BTS rack, and the input power
supply of the system is －48VDC, divided into two subsystems along with the racks. The power
supply and monitoring of the ZXC10-BSC rack is implemented by the power distribution plug-in
layer unit PD, with the principle shown in Fig. 11-27.

10.3.3.7.2 Shelf Structure

The PS comprises the BTS part and BSC part, whose shelf structures in the BSC are described
below:

The power supply system of the ZXC10-BSC consists of the input protection unit, the plug-in
box unit layer PD and the PSMBs on the respective layers. The PSMBs are inserted in slots 1 and

-574-
 Chapter 11 ZXC10-BSS

22 of each shelf, and the PD located on top of the rack provides input isolation. The monitoring
signal of the power supply is reported via the communication interface RS485 of the PD.

All the boards in the BSC are provided by two PSMBs in load sharing mode. The PSMBs are
located at the two sides of every shelf, as shown in Fig. 11-28.

Protection
PSMD PPM +27V
unit

．．．
Communication +12V
PPM B
interface P
O
PPM W
-12V
DC－48V E
power supply R

PSMC

AC DC
PSMC

AC220V PSMB
+5V
Without DC 48V
Optional solution PSMB
48V

PSMB
+5V
ZXC10-BTS
Layer 1
PSMB

Protection PD PSMB
+5V
unit

PSMB Layer 2
Communication
interface
．．．

PSMB +5V

PSMB
Layer 5
48V

Fig. 11-27 The Power Distribution Principle of the PS.

-575-
Chapter 11 ZXC10-BSS

P P
S S
M M
B B

Fig. 11-28 Structure of PSMB Shelf

10.3.3.8 TS
TS, short for timing subsystem, provides (in the BSC) the system with time reference PP2S,
system clock and TOD message.

10.3.3.8.1 System Composition

The TS logically consists of GPSTM, TCM and FDM. The main functions of TFS are as follows:

Providing 16CHIP and PP2S.

Providing TOD message.

10.3.3.8.2 Shelf Structure

At the BSC side, the TS is located in the CDSU shelf. The TFS can be configured with one or
more GPSTMs as needed. The slots are numbered from left to right. Slots 17 ~ 19 hold the TFS,
slot 1 holds PSMB, slots 2 ~ 11 hold CDSUs, slots 12 ~ 15 hold CPMs, slot 16 holds a PAM and
slot 20 holds a PSMB. The structure of the CDSU shelf is shown in Fig. 11-29.

P C C C C C C C C C C C C C C P G T G P
S D D D D D D D D D D P P P P A P C P S
M S S S S S S S S S S M M M M M S M S M
B U U U U U U U U U U T T B
M M

Fig. 11-29 Structure of CDSU Shelf

-576-
 Chapter 11 ZXC10-BSS

10.3.3.8.3 Input and Output Interfaces

In the BSC, the TFS provides 2 PP2S and 2 16CHIP outputs for connection with the NCM.

10.3.4 Hardware System of ZXC10-BTS

The layout of the ZXC10-BTC is shown in Fig. 11-30.

10.3.4.1 BDS
BDS, short for baseband digital subsystem, is the part in the BTS that can best present the CDMA
features, incorporating many key CDMA technologies, such as diversity technology, RAKE
reception, softer handoff and power control. It mainly implements the modulation/demodulation of
the BTS control center, communication platform, Abis interface communication and CDMA
baseband. The BDS can simultaneously provide the modulation and demodulation of up to 12 ×
16 = 192 wireless channels (including overhead channels, soft handoff TCH and subscriber TCH),
and support up to 2-carrier 3-sector configuration. Two BDSs can support 4-carrier 3-sector BTS
configuration.

10.3.4.1.1 System Composition

The BDS logically consists of CCM, CHM and RFIM. And, to facilitate description, we also
describe the CDSU in this section.

One BDS may comprise up to 12 CHMs, 2 CCMs, 2 RFIMs and 1 BTS_CDSU, as shown in
Fig. 11-31.

The main functions of the BDS are as follows:

Forward modulation, summation and filtering of CDMA digital baseband.

Reverse demodulation of CDMA digital baseband.

Providing an interface with the RF part.

Providing the Abis interface with BSC.

-577-
Chapter 11 ZXC10-BSS

Fig. 11-30 Layout of ZXC10-BTS

E1 RS422 RS485
CDSU CCM SAM

Double Bus

CHM1 CHM12 RFI M RFI M

Fig 11-31 Overall Structure of BDS

10.3.4.1.2 Shelf Structure

Physically a BDS forms a BDS shelf, composed of 12 CHMs, 2 CCMs, 2 RFIMs and 1
BTS_CDSU. The BDS supports up to 2-carrier 3-sector configuration and provides up to 12 × 16
= 192 wireless channels at the same time.

In the mechanical structure, the BDS shelf has 20 slots, numbered 1 ~ 20 from left to right.
Slots 2 ~ 4 and 6 ~ 8 hold the 6 CHMs of the first carrier, slots 13 ~ 15 and 17 ~ 19 hold the 6

-578-
 Chapter 11 ZXC10-BSS

CHMs of the second carrier, slots 5 and 16 hold RFIMs, slot 9 holds an SAM, slots 12 holds the
CDSU, slots 10 and 11 hold CCMs in 1+1 backup, and slots 1 and 20 holds the power boards.

The slot layout of the BDS is shown in Fig. 11-32.

P C C C R C C C S C C C C C C R C C C P
S H H H F H H H A C C D H H H F H H H S
M M M M I M M M M M M S M M M I M M M M
B M U M B

Fig. 11-32 Slots in the BDS Shelf

10.3.4.1.3 Input and Output Interfaces

Providing 2 or 4 E1 interfaces for connection with the BSC.

Providing via the cable the connection interfaces with up to 6 TRXs.

Providing 2 RS232 interfaces to read TOD messages, initializing, managing and maintaining
the GPSTM.

Providing 1 RS422 interface for communication with the SAM.

10.3.4.2 RFS
In the CDMA cellular network system, the BTS is the important component implementing the air
interface of the cellular network, while the RFS in the BTS is key for the BTS to perform normal
interaction of radio signals. As the CDMA system has incorporated many technologies such as
power control, cell breathing, soft handoff, GPS timing and diversity reception, the BTS RFS in
the CDMA system differ from the RFSs of other systems. In the overall structure, the CDMA BTS
consists of two subsystems: BDS and RFS. The RFS mainly implements the air interface via the
antenna, implements the interface with the BDS via the interface module, providing
modulation/transmission and demodulation/reception of CDMA signals, providing various related
functions like detection, monitoring, configuration and control, and providing such functions as
cell breathing, blossoming and wilting (i.e. FLOWER).

-579-
Chapter 11 ZXC10-BSS

10.3.4.2.1 System Composition

According to the structure of the BTS of the CDMA system, the RFS consists of the out-of-BTS
antenna feeder subsystem and intra-BTS transceiver subsystem. The antenna feeder subsystem
comprises the antenna, the feeder and the corresponding installation structural parts. The specific
type and composition of the antenna feeder system are subject to the network plan. A typical
antenna feeder system consists of antenna, antenna jumper, the main feeder, lightning arrestor, set-
top jumper and grounding part. The intra-BTS transceiver subsystem consists of the RF TRX,
HPA and RFE. The configuration of the RFS depends on the overall configuration of the BTS. A
single BTS can flexibly be configured with one carrier and one sector or two carriers and three
sectors. If racks are put in parallel, four carriers and three sectors can be supported. The RFS can
be configured flexibly as desired by the subscribers. We’ll take 1-carrier 3-sector and 2-carrier 3-
sector configurations for example to describe the structure of the RFS.

The structure of 1-carrier 3-sector RFS is shown in Fig. 11-33.In the 1-carrier 3-sector
configuration, each sector has one TRX, one RFCM (RFCM and TRX are put in the same
shielding box, forming a TRX board), one HPA and one corresponding RFE (one duplex filter, one
receiving filter, two LNAs). There are two sector antennas (one is a transceiving antenna, and the
other is a diversity reception antenna).

The structure of 2-carrier 3-sector RFS is shown in Fig. 11-34.In the 2-carrier 3-sector
configuration, each sector has two TRXs, two RFCMs, two HPAs and two corresponding RFEs
(one duplex filter and one LNA). There are two sector antennas (one is a transceiving antenna of
the first carrier, which also serves as the diversity reception antenna of the second carrier, and the
other is the transceiving antenna of the second carrier, which also serves as the diversity reception
antenna of the first carrier).

-580-
 Chapter 11 ZXC10-BSS

RFE(Alpha) RFE(Beta) RFE(Gamma)

HPA R R HPA R R HPA R R

X X X X X X
T 0 1 T 0 1 T 0 1
X X X

TRX TRX TRX

RFCM RFCM RFCM

Digital
数字机框 shelf

Fig. 11-33 The Structure of the 1-Carrier 3-Sector RFS

RFE RFE RFE RFE RFE RFE

(ALPHA) (ALPHA) (BETA) (BETA) (GAMMA) (GAMMA)

HPA R R R R HPA HPA R R R R HPA HPA R R R R HPA

X X X X X X X X X X X X
T0 1 1 0 T T0 1 1 0 T T 0 1 1 0 T
X X X X X X

TRX TRX TRX TRX TRX TRX

RFCM RFCM RFCM RFCM RFCM RFCM

Digital
数字机框 shelf

Fig. 11-34 The Structure of the 2-Carrier 3-Sector RFS

-581-
Chapter 11 ZXC10-BSS

10.3.4.2.2 Shelf Structure

The RFS includes three kinds of shelves, which are TRX shelf, HPA shelf and RFE shelf, as
shown respectively in Figs. 11-35, 11-36 and 11-37.

T T T F G T G T T T
R R R D P C P R R R
X X X M S M S X X X
T T
M M

Fig. 11-35 TRX Shelf

H H H H H H
P P P P P P
A A A A A A

Fig. 11-36 HPA Shelf

R R R R R R
F F F F F F
E E E E E E

Fig. 11-37 RFE Shelf

10.3.4.2.3 Input and Output Interfaces

Providing the antenna interface of the antenna feeder system.

Providing the data interface with the BDS.

Providing the alarm and configuration maintenance interface with the BDS.

-582-
 Chapter 11 ZXC10-BSS

10.3.4.3 PS
PS, short for power subsystem, supplies power for the boards of the BSC and BTS, and meanwhile
detects the faults of itself and notifies the background.

10.3.4.3.1 System Composition

The ZXC10-BSS consists of the ZXC10-BSC rack and the ZXC10-BTS rack, and the input power
supply of the system is －48 VDC, divided into two subsystems along with the racks. The power
supply and monitoring of the ZXC10-BTS rack is implemented by the power distribution plug-in
layer unit PD.

10.3.4.3.2 Shelf Structure

The PS comprises the BTS part and BSC part, whose shelf structures in the BTS are described
below:

The power supply system of the ZXC10-BTS (V5.0) consists of the input protection unit and
the plug-in box unit layer, and the latter consists of four types of modules: PSMD, PSMC, PPM
and PSMB, providing +27V, ±12V and － 48V distribution function respectively. There are
altogether 5 PPMs, 2 PSMC and 1 PSMD.

For an illustration of the system, please refer to Fig. 11-38. The input protection unit consists
of the feeder filter, etc. and the monitoring signals of the power supply are reported via the
communication port RS-485 of the PSMD.

P S PPM PPM PPM PPM PPM P S P S

MD MC MC

Fig. 11-38 BTS Power Supply Layer

10.3.4.4 TFS
TFS, short for timing frequency subsystem, provides (in the BTS) the system with time reference
PP2S, system clock, TOD message, and reference clock 10 MHz or 12 MHz.

-583-
Chapter 11 ZXC10-BSS

10.3.4.4.1 System Composition

The TFS logically consists of GPSTM, TCM and FDM.

The TFS consists of the clock and TOD message generation module GPSTM, TCM and
FDM, as shown in Fig. 11-39.

GPSTM

Clock

Clock 10MHz
10 10MHz or 12
10 12MHz
GPSTM TCM FDM

16CH IP
16C PP2S

Fig 11-39 Overall Structure of TFS

The main functions of TFS are as follows:

Providing 16CHIP, PP2S and 10 MHz or 12 MHz clock signals.

Providing TOD message.

10.3.4.4.2 Shelf Structure

Physically the BTS-side TFS consists of 2 GPSTM, 1 TCM and 1 FDM. Each GPSTM provides
two 16 CHIP and two PP2S outputs, and provides two TOD messages, one of which is used in the
home rack, and the other is used in the extended rack. The TCM outputs two 10 MHz, four 16
CHIPs and four PP2Ss, two of which are used in the home rack, and the other two are used in the
extended rack; the FDM outputs six 10 MHz or 12 MHz; physically the BSC-side TFS consists of
two GPSTMs and 1 TCM and functions like the BTS.

The BTS-side TFS is located in the TRX shelf and can be configured with one or more
GPSTMs as needed. The slots are numbered from left to right. Slots 4 ~ 7 hold the TFS, and slots
1 ~ 3 and 8 ~ 10 hold TRXs, as shown in Fig. 11-40.

-584-
 Chapter 11 ZXC10-BSS

T T T F G T G T T T
R R R D P C P R R R
X X X M S M S X X X
1 2 3 T T 4 5 6
M M

Fig. 11-40 TRX Shelf

10.3.4.4.3 Input and Output Interfaces

In the BTS, the TFS provides 4 PP2S and 4 16CHIP outputs for connection with the RFIM.

The TFS provides 6 10 MHz or 12 MHz signals for connection with the TRX.

The TFS provides 2 TODs for connection with the CCM or NCM.

10.3.5 Modules/Boards

Module is a concept of logic structure in this system. It is an entity with specific functions and
includes relevant hardware and software. Board is the physical implementation of module. In the
ZXC10-BSS, modules and boards correspond to each other one by one. Therefore, we make no
distinction between modules and boards in the following.

10.3.5.1 NCM Board

NCM, short for network control module, is the core module of the HIRS shelf and its CPU system
functions as an independent unit. When the NCM is in slot 11, it is attached via the serial bus to
port 6 of the NIM in slot, and when it is in slot 12, it is attached to port 6 of the NIM in slot 9,
communicating with other boards of the system and monitoring the whole system. Its performance
has a direct effect on the HIRS and the whole system, so main/standby NCMs are designed. In
addition, fault locating and self recovery measures are also included in the design, and, from the
selection of components to the layout of PCB boards, various factors such as thermal design and
electromagnetic compatibility design have been taken into account, so as to make the module
work reliably.

10.3.5.1.1 Functions of NCM Board

The NCM mainly implements the following functions:

-585-
Chapter 11 ZXC10-BSS

Providing flow control of the HIRS network.

Distributing module software and configuration information.

Detecting, isolating, reporting and recovering the faults of HIRS;

Distributing GPS clocks.

Managing the operation and maintenance of the whole BSS.

10.3.5.2 NIM Board

NIM belongs to the HIRS. Located in the HIRS shelf, it connects other subsystem boards such as
SVICM and CDSU to the HIRS, and distributes GPS clocks to those boards.

The NIM is the interface unit through which the respective port devices in the CDMA BSS
are connected to the HIRS network. According to the requirements specified in the general design,
each HIRS shelf on the BSC contains 18 NIM boards, 16 of which are active boards and two are
standby boards, forming two N+1 backups. The active/standby changeover is in the daisy chain
mode. Each NIM board has 8 bi-directional internal serial bus ports. At the same time, the clocks
(like even second and CHIP signal) required by various devices are also transmitted in the
difference signal mode through the serial bus port of the NIM board. The NIM of the latest version
supports data priority. The HIRS provides routing and addressing of every NIM serial port via the
node number and port number of the network address.

10.3.5.2.1 Functions of NIM Board

The NIM mainly implements the following functions:

Communicating with 8 boards through 8 serial bus cables.

Providing GPS clocks for the boards attached.

Providing support for data priority (for D version only).

Reporting to the NCM via I 2C the work status of the boards and receiving the control of
the NCM.

Supporting daisy chain changeover mode.

Providing via the DISCO bus the data transmission between the gateway logics of the
NCM.

-586-
 Chapter 11 ZXC10-BSS

10.3.5.3 SVICM Board

SVICM board belongs to the SVBS and forms an SVICM. It is located in the SVBS shelf. The
hardware of the board is designed with a modular structure. From the selection of components to
the layout of the PCB boards, various factors have been taken into account, such as the
upgradeability and development potential of the product, derating design, thermal design, security
design and electromagnetic compatibility design, so as to ensure the reliability and maintainability
of the boards.

10.3.5.3.1 Functions of SVICM Board

As the connection link between the SVBS and other parts of the BSS and as the physical channel
between the BSS and MSC, the SVICM board mainly implements the following functions:

Controlling and maintaining the SVMs in the SVBS.

Maintaining and managing the running software and configuration data in the SVBS.

Communicating with the HIRS network.

Processing the interface signaling between the CPS and BSM.

Providing layer-1 and layer-2 processing of Abis interface signaling between the BDSs.

Providing layer-2 processing of a 64 kbps SS7 signaling link.

Obtaining TOD information via the gateway and the DISCO bus interface unit, and
broadcasting to all SVMs.

Obtaining, via the gateway and the DISCO bus interface unit, the clock signals from
GPSTM and distributing them to the respective SVMs.

Providing via DTI the transcoding on the PCM transmission link between MSC and BSS.

Extracting via DTI the clock signals and frame synchronization signals from the MSC
input data stream.

Extracting and inserting via DTI the common channel signaling.

10.3.5.4 SVM Board

SVM board belongs to the SVBS, and is located in the SVBS shelf. It mainly implements the
functions of the vocoder and selector, is connected via DISCO bus to the SVICM board and then
attached to the HIRS to serve as the vocoder resource pool.

-587-
Chapter 11 ZXC10-BSS

SVM is the basis of the SVBS and each SVM contains 15 vocoders. SVM mainly provides
transcoding between 64kbps PCM codes and QCELP codes. It is the core for voice data
processing in BSC. It supports the voice channel in the soft handoff via the selection function of
multi-channel reverse packet service data; and participates in the reverse outer loop power control
by stabilizing the reverse FER and adjusting the threshold of the reverse signal-to-noise ratio. The
hardware is designed with a modular structure, and state-of-the-art technologies are adopted on the
basis of careful analysis and study. From the selection of components to the layout of the PCB
boards, various factors have been taken into account, such as the upgradeability and development
potential of the product, thermal design and electromagnetic compatibility design, so as to ensure
the reliability of the boards.

10.3.5.4.1 Functions of SVM Board

The SVM board mainly implements the following functions:

Processing voice service options and providing the transcoding between 64 kbps PCM
codes and EVRC and QCELP codes.

Supporting soft and hard handoff.

Participating in forward power control through the FER report. Participating in the reverse
outer loop power control by stabilizing

Supporting message transfer in the soft handoff by extracting and inserting channel
associated IS-95 signaling.

Call processing (like ringing, ringback, hooking on and service selection).

Processing Abis interface signaling layer 3.

Providing PCM time division multiplexing and allocating timeslots.

Receiving timing signals, TOD messages, 50Hz and 1.2288MHz clocks.

Providing performance management and periodically collecting and reporting such

performance statistic data such as bit errors and utilization ratio.

Providing fault management and detection, providing various alarm messages, and, if
possible, implementing fault recovery.

Providing auxiliary services, providing three 64K HDLC channels to support low-speed
data services, such as asynchronous data based on circuit switching, digital facsimile, packet data
and analog facsimile.

-588-
 Chapter 11 ZXC10-BSS

10.3.5.5 PCFIM Board

PCFIM board belongs to the PCFS, and is located in the PCFS shelf. It mainly provides packet
control and is connected to the PCF board via the internal dual-bus, which is the level-2 switching
platform of the BSC. The PCFIM moderates the internal bus of the PCFS and is connected as a
gateway to the B_HIRS.

PCFIM is the core of the PCFS, and each PCFIM provides a 100M fast Ethernet interface for
connection with the PDSN, and provides A11 and A9 signaling channels and A10 and A8 data
channels. Besides serving as the gateway of the PCFS, the PCFIM also implements PCF-related
protocols, and each PCFIM can support 128 wireless packet functions. PCFIM mainly provides
GRE encapsulation and decapsulation of data, adapts GRE packets and RLP packets to each other,
and provides the interface with the internal communication network of the BS. Depending on the
distribution of the software function points of the BS, it may have different functions, such as RLP
protocol, power control and handoff control. PCFIM is the core hardware for packet data
processing in the BSC. It is designed with a modular structure, and state-of-the-art technologies
are adopted on the basis of careful analysis and study. From the selection of components to the
layout of the PCB boards, various factors have been taken into account, such as the upgradeability
and development potential of the product, thermal design and electromagnetic compatibility
design, so as to ensure the reliability of the boards.

10.3.5.5.1 Functions of PCFIM Board

PCFIM mainly implements the following functions:

Providing GRE encapsulation and decapsulation of data.

Adapting GRE packets and RLP packets into each other.

Serving as the external gateway of the PCFS to connect to B_HIRS.

Providing level-2 switching platform in the system.

Serving as a arbitrator and providing bus arbitration for the internal bus of the PCFS.

Receiving and generating clocks: Receiving PP2S and 1.2288 MHz clock signals,
generating 20 MHz clock signals, and distributing clock signals.

Providing performance management on the boards in the PCFS.

Providing fault management and detection, providing various alarm messages, and, if
possible, implementing fault recovery.

-589-
Chapter 11 ZXC10-BSS

10.3.5.6 PCF Board

PCF board belongs to the PCFS, and is located in the PCFS shelf. PCF mainly selects the multiple
reverse TCH data in soft handoff and distributes forward TCH data to different cells/sectors in soft
handoff. It is connected to the PCFIM board via the internal bus of the PCFS and is then attached
to the HIRS to serve as SDU resource pool.

As the basis of the PCFS, each PCF supports 16 packet control function services. The
hardware is designed with a modular structure, and state-of-the-art technologies are adopted on the
basis of careful analysis and study. From the selection of components to the layout of the PCB
boards, various factors have been taken into account, such as the upgradeability and development
potential of the product, thermal design and electromagnetic compatibility design, so as to ensure
the reliability of the boards.

10.3.5.6.1 Functions of PCF Board

PCF mainly implements the following functions:

Selecting the multiple reverse TCH data in soft handoff.

Distributing forward TCH data to different cells/sectors in soft handoff

Receiving and monitoring clocks: Receiving PP2S, 20 ms and 1.2288 MHz clock signals,
generating corresponding interruptions for the main control unit, monitoring the receiving of the
time coming from the PCFIM, and reporting clock status.

Providing performance management on the internal bus of the PCF, and locating and
reporting the status faults of the respective clocks.

Providing fault management and detection, providing various alarm messages, and, if
possible, implementing fault recovery.

10.3.5.7 CPM Board

CPM is located in the CDSU shelf of the ZXC10-BSC (V5.0) and belongs to the CPS.CPM
mainly provides Abis interface signaling processing of the whole CDMA BSS system, manages
and allocates radio resources, manages terrestrial circuit resources, and processes the MTP3 and
SCCP parts of SS7. It is the center for BSS system management and signaling processing. CPMs
work in 1+1 backup mode and occupy two slots.

10.3.5.7.1 Functions of CPM Board

The CPM board has the following functions:

Receiving and processing Abis interface signaling.

-590-
 Chapter 11 ZXC10-BSS

Receiving TOD messages from the network interface.

Providing call signaling processing, supporting mobile services such as call (establishment
and release), registration (location update), authentication, SSD update, and short message service
(control channel and TCH), supporting handoff decision, supporting softer handoff, half-soft
handoff, soft handoff and hard handoff, and supporting paging messages.

Providing overload control of the BSS, generating A interface and Abis messages
supporting various mobile services of the MS, and establishing signaling links with the CCM and
SVCM.

Maintaining, managing and distributing the radio resources of the BSS.

Providing signaling SS7 interface. Providing category-0 connectionless-oriented SCCP

service and category-2 connection-oriented SCCP service, providing MTP3 service, changeover
(TCOC), changeback (TCBC), signaling point restart (TPRC), link availability control (TLAC)
and signaling service flow control (TSFC).

Providing database management of relevant resources of the BSS, covering BSS

parameters, terrestrial resource data, wireless channel resource, TCH resource, call record data,
performance data, and handoff record data.

10.3.5.8 PAM Board

PAM is located in the BSC-side CDSU frame. It mainly functions to monitor the running statuses
of the BSC-side power modules and the environment signals including the temperature, humidity
and smoke of the equipment room, and report the results to the background operation and
maintenance console via NCM for processing. In addition, the PAM board also provides duplex
RS-232 and RS-485 interfaces to be connected with the external monitoring devices and the alarm
box.

10.3.5.8.1 Functions of PAM Board

The PAM board mainly performs the following functions:

Sending alarm signals to the NCM board automatically, receiving and executing the
control commands from the NCM board.

Collecting alarm signals in power supply and fan sent from power supply boards.

Monitoring the smoke alarms.

Monitoring the temperature and humidity of the equipment room.

-591-
Chapter 11 ZXC10-BSS

Providing backup input/output interface.

10.3.5.9 CDSU Board

In the CDMA system, the interface between the BSC and BTS is called Abis interface. This
interface connects the BSC with the BTS through an E1 trunk link in daisy chain mode. CDSU is
the board module that implements the Abis interface functions. CDSU is available with two
panels: A narrow one used at BTS side and a broad one used at BSC side.

There are two types of CDSU boards with different interface capacities: CDSU of 2 E1’s and
CDSU with 4 E1’s.

10.3.5.9.1 Functions of CDSU Board

The CDSU board mainly performs the Abis interface communication functions between BTS and
BSC, i.e. the conversion between serial bus and E1 serial link inside BSS. The performance
indexes are as follows:

1. CDSU board with two E1’s.

Providing 32-frame buffer memory for each E1.

The buffer memory of each E1 supports 4-level flow control.

Supporting start networking.

Loading sharing and backup for the two E1’s.

2. CDSU board with four E1’s.

Processing data of E1 interfaces on priority, providing 500 frame buffer memory for data
of high priority and 1000 frame buffer memory for data of low priority.

Supporting broadcast data;

Supporting start networking.

Supporting daisy chain networking.

Load sharing and backup between E1 links.

Delay test of Abis interface and large HIRS.

Performance statistics.

-592-
 Chapter 11 ZXC10-BSS

Full compatibility with CDSU board with two E1’s.

10.3.5.10 CCM Board

CCM (communication and control module) is located in the BDS shelf of ZXC10-BTS (V5.0),
exercising centralized control of data signaling routing, signaling processing, resource
management and M&A of the whole BDS subsystem. CCM consists of the gateway unit and
module control unit. It works in 1+1 hot backup mode, occupying two slots.

10.3.5.10.1 Functions of CCM Board

The software of CCM board performs the following functions:

Signaling processing and transferring.

Maintenance, management of the radio channel resources and reporting information.

Management & maintenance of modules in the BDS subsystem.

GPSTM maintenance management and TOD message reading.

Software downloading and data distribution.

10.3.5.11 CHM Board

The CHM board, located in the BDS frame of the ZXC10-BTS (V5.0), mainly performs
modulation and demodulation of CDM channels. It is connected with CCM board via a DISCO
bus and connected with RFIM board via a baseband data bus. CHM is basically composed of four
parts: CPU, MODEM unit, clock distribution unit and DISCO bus control unit. There are 6 CHM
boards for each carrier in a single shelf and 12 CHM boards for two carriers.

10.3.5.11.1 Functions of CHM Board

Main functions of CHM board are as follows:

Providing DISCO interface communicating with CCM board.

The forward link modulates the voice and data frames received from the CCM board via
the DISCO interface and then sends the modulated signals to RFIM board.

The reverse link receives the antenna signals from RFIM board sent via the baseband data
interface, demodulates them into voice and data frames and sends them to CCM board via
the DISCO interface for processing.

-593-
Chapter 11 ZXC10-BSS

Providing 10MHz Ethernet interface, used for board debugging and program downloading.

Providing RS232 interface, used for board debugging.

Supporting the physical layer of CDMA-2000, i.e. IS-2000-2 RELASE 0.

Supporting OTD and STS sending diversity.

Supporting hot-swapping.

Supporting version downloading online via the DISCO bus.

Supporting the control of resetting remote software and closing backplane interface in the
system.

Panel indicator driving. Indicators are provided.

10.3.5.12 RFICM Board

The radio frequency interface module (RFIM) belongs to the baseband digital system (BDS) in
BTS. RFIM connects the digital subsystem and RF subsystem of BTS.RFIM is connected with
CCM via the DISCO bus, under the control of the CCM. It transmits and processes forward and
reverse baseband data.

10.3.5.12.1 Functions of RFICM Board

The RFCM board mainly performs the following functions:

Forward baseband data processing: Receiving the forward baseband data sent by the
channel board, Performing summation, filtering, multiplexing and sending to TRX unit.

Reverse baseband data processing: Receiving the reverse baseband data sent from TRX
unit in multiplex mode. The data are demultiplexed, re-synchronized and checked before being
sent to the channel board.

DISCO interface function: Making S/P conversion to the DIS buffer data, which are
buffered and sent to different TRX of different addresses in serial mode. Making S/P conversion to
the signaling data received by TRX, which are buffered, checked, queued and sent to CCM via the
CO bus.

MCU unit function: It is controlled by CCM via the DISCO bus, making local board
configuration, collecting the status of the local board and reporting to CCM.

Clock distribution function: Receiving 16CHIP clock and PP2S timing pulse sent by GPS,
providing for the local board as well as other channel boards.

-594-
 Chapter 11 ZXC10-BSS

10.3.5.13 RFE Board

There are two types of RFE boards: One is RFE-DUP and the other is RFE-DIV. The former is
used for transmitting/receiving antenna integrated antenna and the latter used for receiving
antenna.

10.3.5.13.1 Functions of RFE Board

The RFE board is the module connecting the internal system of RFS in the BTS and the external
antenna of the BTS. Its terminal port is the FR port at the top of the BTS and the test port of the
BTS for system testing. It has great influences on the receiving sensitivity and exit transmitting
power of the whole BTS system.

RFE mainly fulfills the following functions:

Filtration and low-noise amplification to small signals received by the antenna;

Power distribution for low-noise amplified receiving signals.

Receiving/transmitting duplex function (only for DUP).

Forward transmission power signal filtration (only for DUP).

Low-noise amplifier status monitoring;

Power monitoring, providing related power detection values.

Injection and extraction of BTM signals.

10.3.5.14 HPA Board

In the whole RFS, HPA is the power amplification module. Its working current is large and
working temperature is rather high. At the same time, the application in CDMA system raises
special requirement for linearity. As an important part of BTS, There is some difficulty in
implementing this board.

10.3.5.14.1 Functions of HPA Board

The High Power Amplifier (HPA) amplifies the power of the TRX forward transmission signals,
so that the signals are transmitted from the antenna to the cell with proper signal power via the RF
front end duplex filter. The CDMA system has some special requirement for HPA. The CDMA
signals are modulated in QUSK mode so they are not constantly enveloped signals. A certain
degree of linearity is required for the HPA to prevent spectrum expansion of signals.

-595-
Chapter 11 ZXC10-BSS

10.3.5.15 TRX Board

TRX is the hub connecting RF signals and baseband signals. One TRX corresponds to one section
and one carrier. TRX receives the master receive signals and diversity receive signals of two RFEs
of one sector, performs down conversion and IF filtration, makes AGC processing, I/Q
demodulation and converts the received RF modulation signals into baseband I and Q signals.At
the same time, TRX receives the forward baseband I and Q signals for I and Q modulation, which
are filtered in the intermediate frequency and upward converted into RF modulation signals. TRX
also performs the TPTL power control. Therefore, TRX is a crucial part in processing
received/transmitted link signals in RFS.

10.3.5.15.1 Functions of TRX Board

Basic functions of TRX are as follows:

Providing an interface with RFIM (digital rack), transmitting & receiving baseband data
and transmitting information on configuration, control, status and alarm maintenance.

Forward link: D/A conversion, filtration, intermediate frequency I andQ modulation,

bandpass filtration, transmitting link gain control, signal amplification and up conversion etc.;

Reverse link: Down conversion, signal amplification, bandpass filtration, AGC,

intermediate frequency I and Q demodulation;

Generation of internal reference frequency based on the external references;

Generation of the IF and RF local oscillating frequency signals required by the reception
link and transmission link based on the internal reference frequency.

10.3.5.16 FDM Board

The FDM board belongs to the TFS subsystem. It is located in the TRX shelf of the BTS. Its main
functions include reception of TCM 10MHz signals in 1.9G system, synthesis and distribution,
reception of TCH 10 MHz signals in FDM of the 800 MHz system, phase-lock transmission of 12
MHz signals to be transmitted to TRX. In active/standby changeover, 12 MHz consecutive signals
are transmitted instead of 10 MHz signals because the latter is not consecutive. Therefore call
drops are lost. The design meets the high demand for reliability. Unreliable components are
reduced so that the circuit is simplified. Heating effect and electromagnetic compatibility are also
considered in the overall design, therefore the board reliability is ensured.

10.3.5.16.1 Functions of FDM Board

The FDM board mainly performs the following functions:

-596-
 Chapter 11 ZXC10-BSS

Receiving TCM clock signals.

Distributing 10 MHz signals directly or after phase-locking.

Reporting the working status of the local board via I2C.

10.3.5.17 PSMB Board

10.3.5.17.1 Functions of PSMB Board

The 5 V power supply board (PSMB) is the main board supplying power for the CDMA BTS. It is
located in the shelves of the BSC and the digital shelves (BDS) of the BTS, supplying power for
the BTS digital system. Distributed power supply between shelves and centralized power supply
inside a shelf are used in the BTS. To ensure reliable operation, all power supplies inside the shelf
are backed up in every layer: Normally two power units work in parallel. When a fault occurs to
one power unit, the other one will take over the whole shelf. In addition, PSMB reports its own
status to the system monitoring unit, therefore it provides a 485 interface used for communication.

10.3.5.18 PSMC Board

10.3.5.18.1 Functions of PSMC Board

PSMC is used to provide ±12 V power. A commercial DC/DC conversion module as the core part
and external circuits of protection, filtration and detection work together to form a 48 V-12 V
power conversion board, which is stable and reliable.

10.3.5.19 PSMD Board

10.3.5.19.1 Functions of PSMD Board

The PSMD is located in the power supply distribution shelf of the BTS system. It distributes the –
48 VDC input power to the shelves. PSMD is also responsible for checking and controlling the
working status of the power system and the fans. The PSMD also provides an RS-485 interface
communicating with SAM board.

10.3.5.20 PPM Board

10.3.5.20.1 Functions of PPM Board

The PPM is located in the power supply layer inside BTS shelf, providing 27 V DC power for the
RF subsystem. PPM works in N+1 backup mode. The PPM power unit performs DC/DC
conversion from –48 V to 27 V. It protects devices from over-voltage, over-current and ultra high

-597-
Chapter 11 ZXC10-BSS

temperature. The temperature control is implemented with forcible cooling air in a radiation
structure and load is equalized in parallel. Even when there are 5 modules, the flow equalization
indexes are also satisfied. A pre-charge and soft power-on measure is taken for the power input to
minimize the starting current. Diode isolation is used for the output to prevent back flow.
Therefore, hot-swapping is supported.

10.3.5.21 GPSTM Board

10.3.5.21.1 Functions of GPSTM Board

The GPSTM receives 1PPS signals of the GPS receiver, after phase-locking generating PP2S
signal, 16CHIP signal and 10 MHz signal as well as TOD signals for the system. In addition,
GPSTM has hold-on function when it cannot find the satellite. The requirement is that the wander
should not exceed 7μs in 24 hours but the GPSTM of our system could keep the wonder within
5μs for 4 days. In addition, it has the automatic active/standby changeover function, capable of
checking and reporting the working status of the board.

10.3.5.22 TCM Board

The TCM board belongs to the TFS subsystem. It is located in TRX shelf of the BTS or
CDSU shelf of the BSC. The main function of TCM board is receiving 10 MHz signals from the
active/standby GPSTM, synthesize and distribute them. At the same time, it receives PP2S and
16CHIP signals from the active/standby GPSTM, performs phase-locking and generate new PP2S
and 16CHIP signals.

TCM is the signal hub connecting the active and standby GPSTMs, so that the active/standby
GPSTMs can maintain continuous PP2S and 16CHIP and prevent call drops. The design meets the
high demand for reliability. Unreliable components are reduced so that the circuit is simplified.
Heating effect and electromagnetic compatibility are also considered in the overall design,
therefore the board reliability is ensured.

10.3.5.22.1 Functions of TCM Board

The TCM board mainly performs the following functions:

Receiving clock signals of the active/standby GPSTMs.

Synthesizing and distributing 10 MHz signals.

Receiving 16CHIP and PP2S signals of the active/standby GPSTMs.

Phase-locking 16CHIP signals.

-598-
 Chapter 11 ZXC10-BSS

• Regenerating new PP2S signals.

10.3.6 BSS Mechanical Properties

10.3.6.1 BSC Mechanical Properties

Overview of BSC Rack

The BSC is composed of a central rack and a vocoder rack.

The central rack and vocoder rack are of the same specification with standard plug-in boxes,
which serve as different plug-in boxes with different plug-ins installed.

The dimension of the rack: 2000 × 810 × 600 (H × W × D) (Unit: mm)

Each rack is composed of 1 power distributing box, 3~5 functional boxes, 1 fan box and a
anti-dust box in top-down order. Three kinds of functional boxes are provided:

Plug-in box at HIRS layer: including PSMB, NIM, NCM, etc.

Plug-in box at CDSU layer: including PSMB, CDSU (or CDSU, CPM, TCM, GPS), etc.

Plug-in box at SVBS layer: including PSMB, SVM, SVICM, etc.

The dimensions of the functional boxes are 790 × 279.5 × 319 (W × H × D). Each functional
box can hold as many as 22 plug-in boards.

Appearance and Layout of BSC Rack

Appearance and layout of BSC rack are shown in the following diagrams:

-599-
Chapter 11 ZXC10-BSS

ZX3G1X-BSC

Power distribution plug-in box

Functional plug-in box 1

Functional plug-in box 1

Functional plug-in box 1

Functional plug-in box 1

Functional plug-in box 1

Fan plug-in box (with dustproof )

Fig. 11-59 Appearance of BSC Rack

-600-
 Chapter 11 ZXC10-BSS

Z X3 G1 X- BS C
Z X3 G1 X- BS C

Fig. 11-60 Layout of BSC Rack.

-601-
Chapter 11 ZXC10-BSS

10.3.6.2 BTS Mechanical Properties

Overview of BTS Rack

BTS contains a baseband system and a transceiving system.

The baseband system includes: CHM, CCM, RFIM, CDSU, SAM and power supply module.

The transceiver system includes: RF front end (RFE), transceiver (TRX), high power
amplifier (HPA) and power supply module

It includes the following components from top to bottom:

RFE plug-in box

HPA plug-in box

PSMD/PPM/PSMC plug-in box

TRX Plug-in box

BDS plug-in box

According to the heating design, fans and shunt boards are installed between plug-in boxes to
form three separate air channels inside the equipment, to keep the equipment at a normal
temperature.

BTS Structural Dimensions and Layout

Basic dimensions of BTS rack:

Dimensions of the rack: W × D × H = 750 mm× 600 mm× 1800 mm

Dimensions of the base: W × D × H = 750 mm× 600 mm× 100 mm

Basic dimensions of the plug-in box:

The plug-in box is designed as 24 inches high, in the height scale of 44.45 mm(1U) as the
basic dimensions.

-602-
 Chapter 11 ZXC10-BSS

609.6
592
322
560.6

U
NX
Fig. 11-61 Dimensions of BTS Shelf

BTS Shelf

RFE Box

Height: 7U = ( 7 × 44.45 =311.15 mm) =310 mm

Seven RFE module panels: W × H = 93 mm × 297 mm

Dimensions of the plug-in board: D × H = 300 mm × 277.8 mm

Dimensions of the backplane: L × W = 549 mm × 302 mm

The module layout is shown in the diagram:

Fig. 11-63 Layout of RFE Shelf

-603-
Chapter 11 ZXC10-BSS

HPA plug-in box

Height: 7U = ( 7 × 44.45 =310.35 mm) =310 mm

Where the sizes of various modules are as follows:

Six HPA module panels: W × H = 69.7 mm × 297 mm

Dimensions of the plug-in board: D × H = 300 mm × 277.8 mm

One BTM module panel: W × H = 139.7 mm × 297 mm

Dimensions of the plug-in board: D × H = 250 mm × 277.8 mm

There is no backplane. Four DC fans are installed at the rear of the plug-in box, and the plug-
in boards are directly installed on the mounting plate.

The module layout is shown in the diagram:

Fig. 11-64 Layout of HPA Shelf

-604-
 Chapter 11 ZXC10-BSS

Z X 3 G1 X- BT S

F E 插箱plug-in box
RRFE

分Shunt/wiring
流 / 走 线 层 layer

H PHPA
A 插箱 plug-in box

分Shunt/wiring
流 / 走 线 层 layer

PSMD/PPM/PSMC
Pplug-in M/ P S MC 插箱
S MD / P P box

分Shunt/wiring
流 / 走 线 层 layer

R X 插箱plug-in box
TTRX

电风Fan
扇 plug-in
插 箱 box

B D S 插箱plug-in box
BDS

电滤Dust
电尘 插filter
箱 plug-in box

基 座
Base

Fig. 11-62 Layout of BTS Rack

PSMD/PPM/PSMC plug-in box

-605-
Chapter 11 ZXC10-BSS

Height: 6U = ( 6 × 44.45 =266.7 mm ) = 266 mm

PSM, PSMC, PPM module panels: W × H = 69.7 mm × 253 mm

Dimensions of the plug-in board: D × H = 300 mm × 234 mm

Dimensions of the backplane: L × W = 549 mm × 258 mm

The module layout is shown in the diagram:

Fig. 11-65 Layout of Power Supply Shelf

TRX Plug-in box

Height: 6U = ( 6 × 44.45 =266.7 mm ) = 266 mm

Six TRX module panels: W × H = 69.7 mm × 253 mm

Two GPS module panels: W × H = 59.7 mm× 246 mm

Dimensions of the plug-in board: D × H = 300 mm × 234 mm

Dimensions of the backplane: L × W = 549 mm × 258 mm

The module layout is shown in the diagram:

-606-
 Chapter 11 ZXC10-BSS

Fig. 11-66 Layout of TRX Shelf

BDS plug-in box

Height: 6U = (6 × 44.45 =266.7 mm) = 266 mm

CCM, CHM, CDSU, SAM, RFIM panels: W × H = 24.7 mm × 246 mm

Two RFE panels: W × H = 54.7 mm × 246 mm

Dimensions of the plug-in board: D × H = 300 mm × 234 mm

Dimensions of the backplane: L × W = 549 mm × 258 mm

The module layout is shown in the diagram:

Fig. 11-67 Layout of BDS Shelf

-607-
Chapter 11 ZXC10-BSS

10.4 Architecture of BSS Software

10.4.1 Overview

The BSS software system is divided into four subsystems: Operating System Subsystem
(OSS), Service Processing Subsystem (SPS), Operation and Maintenance Subsystem (OMS) and
Date Base Subsystem (DBS), as shown in Fig. 11-61.

SPS OMS

DBS

OSS

Fig. 11-61 Overall Structure of ZXC10-BSS Software System

Inside the BSS, the whole set of software is composed of programs distributed on the boards
and background processors. It operates in a distributed processing mode.

SPS (Service Process Subsystem): SPS is used to implement various cdma2000-1X

cellular mobile services as it complies with the standards of Um interface (IS-2000) and A
interface (IOS 4.0A).

OMS (Operation & Maintenance Subsystem): OMS provides interfaces for the authorized
administrators and the upper-level network management system to implement the operation and
maintenance management on the whole BSS.

DBS (Database Subsystem): DBS performs centralized management to the BSS system

-608-
 Chapter 11 ZXC10-BSS

data. It is the supporting system of the upper layer application (SPS, OMS).

OSS (Operating System Subsystem): As the extension of hardware and commercial

embedded operating system, OSS encapsulates the lower layer hardware and details of the
operating system, providing running mechanism and communication mechanism for the upper
layer application (SPS, OMS and DBS).

The features and positioning of various subsystems are determined by their different
functions.

10.4.2 OSS Subsystem

In the software system, OSS is located between other subsystems and hardware, uniformly
and efficiently managing the hardware resources of the whole system. Thus, OSS isolates other
subsystems from the complex hardware environment, providing a relatively easy-to-use virtual
machine environment supporting the operation of other subsystems. Therefore, OSS manages
various hardware resources under it and performs the functions of bearer layers of various
subsystems above it.

BSS is a distributed system with multiple processors. OSS performs the encapsulation of the
hardware information and communication information and provides a consistent platform for the
upper level (in the form of API) to implement the distributed processing.

The lower layer of BSS software is the pSOS operating system (not including background
operation and maintenance). There are hierarchical models as follows:

APP

OSS

pSOS

BSP

Fig. 11-62 Hierarchical model of BSS software

-609-
Chapter 11 ZXC10-BSS

Here, BSP is the Board Support Package.

The above model shows that the operation mechanism of the BSS software is divided into
two levels.

1. The first level is the task-based running mechanism provided by the pSOS operating
system, as is shown in the following diagram:

Task 1 Task 2 Task n

pSOS operating system

Fig. 11-63 Task-based running mechanism of the pSOS operating system

Task is the smallest operation unit in the pSOS operating system. Between tasks, there is a
scheduling mechanism where priority-based preemption is the main mode, and the time slot
round-robin on the same priority is an auxiliary mode.

The task priority levels range from 0 to 255, the larger the number, the higher the priority
level. Some priority levels are reserved in pSOS. Level 0 is assigned to the system idle task (idle),
Level 230 is assigned to the system booting task (root), Levels 240~255 are reserved for other
system tasks, and the rest are priority levels available for the user.

Multiple tasks can have the same priority.

The task features and priority assignment directly determine the behavior of the BSS system
software, and therefore a uniform planning is necessary. The preliminary planning is as follows:

Task features:

Tasks can normally be preempted.

Normally, tasks are not subject to timeslot round-robin mechanism. A task is allowed to
run continuously when it is not preempted by a higher-level task.

-610-
 Chapter 11 ZXC10-BSS

Task priority:

10~80: OSS low-priority system supported tasks

80~170: Application tasks

170~200: OSS interface driving task

200~220: OSS high-priority system supported tasks

2. The second level is the process-based (where process refers to the process instance, unless
otherwise specified hereinafter) operation mechanism similar to SDL provided by OSS. See the
following figure:

Process Task 1 Process Task 2 Process Task n

1 L+1 M+1

Process Process Process

2 L+2 M+2

Process Process Process

L M N
OSS OSS OSS

pSOS operating system

Fig. 11-64 Process-based Running Mechanism in pSOS Operating System

The Level 2 scheduling mechanism provided by the OSS exists inside the tasks, and a task
composed of several processes is scheduled by the pSOS operating system as an integral part.
After reasonable task classification, the design of the application layer software module is
performed only within the process level, without involving tasks. The process attributes are
registered with the process control table only at the time of module integration to determine the
task to which the process belongs. The creation and maintenance of a task is only performed by
the OSS.

Inter-process scheduling mechanisms are principally based on the SDL semantics, with the
following features:

A process priority is determined by the task to which it belongs. Processes under the same
task are not distinguished in priority, so they cannot be preempted.

Processes operate in the unit of transitions. At the end of each transition, the process is

-611-
Chapter 11 ZXC10-BSS

scheduled again in the scheduling kernel, and the scheduling policy is first in first served (FIFS).

10.4.3 Service Processing Subsystem

In compliance with the air Um interface and terrestrial A interface standards, SPS performs the
following cdma2000-1X cellular service functions:

Various call services:

Voice call (8k, 13k and EVRC)

Data call (high-speed packet data services with the highest rate of 144k bps, asynchronous
data and G3 facsimile)

Test call (Markov and Loopback and TDSO)

Supplementary services

IS-53 cellular services

Short message services

DTMF tone transfer

Call waiting

Call transfer

Mobility management services:

Registration

Terminal authentication

SSD updating

Parameter updating

Status query

Message waiting indication

Encryption (signaling encryption and voice encryption)

-612-
 Chapter 11 ZXC10-BSS

Radio resource management services:

Radio channel configuration

Radio channel allocation and release

Control channel management and release

Switching operations, including switching of MS access, intra-BSS/inter-BSS soft

switching, softer switching, hard switching, half-soft switching, etc.

Scheduling of SCH channel radio resources

Terrestrial circuit management:

Terrestrial circuit allocation and release

Terrestrial circuit blocking and unblocking

Terrestrial circuit resetting

Global system resetting

10.4.3.1 SPS Subsystem Structure

As shown in Fig. 11-72, the SPS subsystem is composed of the following modules:

S_BSSAP: BSS Application Part module

S_RCM: Radio Channel Management module.

S_CSCHP: Common Signal Channel Level 3 Signal Process module

S_DSCHP: Dedicated Signal Channel Level 3 Signal Process module

S_LACP: LAC Signal Process module

S_SDM: Select Distribute Multiplex module

S_PCF: Package Control Functional module.

S_RLP: RLP Protocol Processing module

S_CEC: Channel Element Control module.

S_SCCP: Signaling Connection Control Part module

-613-
Chapter 11 ZXC10-BSS

SPS
S-BSSAP S_SCCP S_MTP3

S_RCM S_CSCHP S_DSCHP S-PCF S_MTP2

S-LACP S-LACP

S-CEC S-SDM S-RLP

CES Vocoder IWF PDSN

Fig. 11-72 Structure of SPS subsystem

S_MTP3: Message Transfer Part Layer 3 module

S_MTP3: Message Transfer Part Layer 2 module

10.4.3.1.1 Functions of S BSSAP Module

The S_BSSAP module is the centralized point of multiple functions such as call processing, radio
resource management, mobility management and terrestrial circuit management. It is also the
centralized point of the signaling flows between BSS and MSC and between BSS and PCF. The
S_BSSAP module must get involved in all signaling interactions from the BSS side to the MSC
side and the PCF side. Specific functions are described as follows:

S BSSAP participates in the control of multiple service call processing, including:

Voice call creation process when MS originates/receives calls.

Circuit data call creation process when MS originates/receives calls.

Packet data call creation process when MS originates/receives calls.

Voice call release process initiated by MS/MSC/BSS in various abnormal circumstances.

-614-
 Chapter 11 ZXC10-BSS

Circuit data call release process initiated by MS/MSC/BSS in various abnormal

circumstances.

Packet data call release process initiated by MS/MSC/BSS in various abnormal

circumstances.

S BSSAP participates in the control processes of various switchovers:

Hard handoff add-on control.

Hard handoff removal control.

Soft/softer handoff add-on control.

Soft/softer handoff removal control.

Initiation of soft/softer handoff of channel assignment.

Control of access handoff.

Control of rapid soft handoff.

Control of half soft handoff.

Control of hard handoff between different PCFs under the same PDSN.

S BSSAP participates in the control of the MS registration process under many

circumstances:

Registration of the MS power on.

Registration of the MS power off.

Distance-based registration.

Registration of parameter alterations.

Timed registration.

User Zone registration.

Zone-Base registration.

S BSSAP participates in the control of multiple terrestrial circuit management functions:

Process control of the terrestrial circuit blocking for various reasons.

-615-
Chapter 11 ZXC10-BSS

Process control of the terrestrial circuit unblocking for various reasons.

Process control of the global system resetting for various reasons.

Overload control functions.

BSSAP controls the following interface signaling flows to implement the above-mentioned
functions:

A1 interface signaling flow with MSC.

A9 interface signaling flow with S_PCF.

Abisc interface signaling flow with S_CSCHP and S_RCM.

Av interface signaling flow with S_DSCHP.

10.4.3.1.2 Functions of S_RCM Module

Basic functions and its position of the S_RCM module in SPS are similar to those of S_RCM
module in CDMA-ONE BSS. However, in cdma2000-1X BSS, S_RCM is also responsible for the
configuration of two channel boards of CHM-95 (with CSM1.5) and CHM-1X (with CSM5000).
Furthermore, since variation of the IS-2000 standards, the much channel types are to be
configured. Therefore, the interface message formats of the S_RCM module with other SPS
modules and the definition of its data structure must be re-designed and it controls more abundant
and complex items. Specific functions of the S_RCM module are as follows:

1. Originating the operating process related to the forward/reverse control channel in various
cases (when power on and database configuration change).

Originating the enabling and disabling operations of the forward common signaling
channels (F-PCH, F-QPCH, F-BCCH, F-CCCH or F-CACH).

Originating the configuration operations of the forward common signaling channels (F-
PCH, F-QPCH, F-BCCH, F-CCCH or F-CACH), including the transmission gain, frame bias
and other parameter settings.

Originating the enabling and disabling operations of the reverse common signaling
channel (R-ACH, R-EACH and R-CCCH).

Originating the configuration operations of the reverse common signaling channel (R-
ACH, R-EACH and R-CCCH), including demodulation, search set and other parameter
settings.

Originating the constitution and sending of the OverHead messages in various cases (when

-616-
 Chapter 11 ZXC10-BSS

the power on and database configuration change).

Sending and updating F-PCH OverHead messages in various cases.

Sending and updating F-BCCH OverHead messages in various cases.

Maintenance of the configuration serial numbers of OverHead messages.

Originating the enabling, disabling and configuration operations of the forward/reverse

traffic channel.

The enabling, disabling, transmission gain and other parameter settings of F-FCH, F-SCH
and F-DCCH.

The enabling, disabling, demodulation, search set and other parameter settings of R-FCH,
R-SCH and R-DCCH.

FDM, TCM configuration.

RFCM configuration management function.

Transmission power loop control (TPTL).

Control of cell expansion and shrinkage (B&W).

Cell breathing control.

Please note the following two points:

F-PICH, F-PCH, F-SYNCH and R-ACH can be configured on both CHM-95 and CHM-
1X, subject to DBS subsystem. Other control channels must be configured on CHM-1X.

When working on RC1 and RC2, F/R-FCH can be configured on both CHM-95 and CHM-
1X. F/R-SCH and F/R-DCCH must be configured on CHM-1X.

10.4.3.1.3 Functions of S_CSCHP Module

In the whole SPS, the S_CSCHP module is equivalent to the SPS version S_CCHSP module in
CDMA-ONE BSS, but excluding the functions verified in the control channel layer 2 in the S-
CCHSP module. The S_CSCHP module mainly performs the signaling flow processing of the
forward/reverse common signaling channel layer 3 of IS-2000.Many new flexible and complex
features are added in the forward/reverse control channels in IS-2000 than in IS-95A, such as the
access handoff (Access Entry HO/ Access Probe HO/ Access HO/ Assignment to Soft HO), quick
paging and enhanced access. To support such features, additional processing to R-EACH, F-
QPCH, F/R-CCCH, F-CACH, F-CPCCH is required. Therefore, the S_CSCHP module is more

-617-
Chapter 11 ZXC10-BSS

complex than the S_CCHSP module in terms of implementation.

Functions of the S_CSCHP module are as follows:

HASH calculation functions related to the message sending of the forward common
signaling channel layer 3.

Calculation of the CDMA channel number.

Calculation of the paging channel/forward common control channel (F-PCH/ F-CCCH)

numbers.

Calculation of timeslots of the paging channel/forward common control channel (F-PCH/

F-CCCH).

Calculation of the quick paging channel (F-QPCH) number.

Indicator position calculation of the quick paging channel (F-QPCH).

Reception of the forward Abis interface signaling and the conversion to the Um interface
message format.

Constitution and sending of the reverse Abis interface signaling.

MS access overload level control.

Idle MS exit control.

Part field contents of the forward common signaling channel LAC layer are submitted to
the S_LACP module.

Analysis of part of fields of LAC layer of the reverse common signaling channel (radio
environment report).

Supporting the access handoff (Access Entry HO/ Access Probe HO/ Access HO/
Assignment to Soft HO).

Supporting the enhanced access (basic mode and reserved mode).

Constitution of the early assignment channel acknowledgement (EACAM) messages.

Constitution of the power control channel assignment (PCCAM) messages (soft handoff
on R-CCCH is supported).

Calculation of the common assignment channel (F-CACH) number.

-618-
 Chapter 11 ZXC10-BSS

Decision on the physical channel type of the forward common control channel signaling.

10.4.3.1.4 Functions of S_DSCHP module

In the whole SPS, the S_DSCHP module is equivalent to the S_TCH3P module of SPS version in
CDMA-ONE BSS. The S_DSCHP module mainly performs the signaling flow processing of the
forward/reverse dedicated signaling channel layer 3. Compared to IS-95A, IS-2000 supports the
high-speed packet data service and the concurrency of multiple services, so the signaling flow
processing of the traffic channel will become more complex and flexible. Thus the processing
flow of S_DSCHP will become more complex and flexible than with S_TCH3P.

Functions of the S_DSCHP module are as follows:

Constructing and encoding/decoding messages in the dedicated signaling channel layer 3.

Guiding the mobile station and BTS to create the traffic channels (FCH, DCCH and SCH)
to implement the basic services (voice, circuit data and high-speed packet data) and auxiliary
services defined in cdma2000.

Performing the service consultation with the mobile station with the coordination of the
S_BSSAP module and the relevant modules of DBS.

Participating in the call (voice, circuit data and packet data) processing when the traffic
channel is created.

Supporting the concurrent calls of cdma2000.

Supporting the mobile management operations (such as SSD updating and authentication)
between MS and MSC/VLR/HLR.

Supporting supplementary services (such as three-party communication, call forwarding,

indication of message waiting, burst and continuous DTMF voice transmission and other
cellular services) between MS and MSC.

With the coordination of the mobile station and the control of CPM, the S_DSCHP module
implements the soft/softer/hard handoff of the mobile station between different BTSs (that is,
implementing the soft/softer add-on, soft/softer handoff removal, quick soft/softer handoff,
hard handoff add-on, hard handoff removal and other flows).

Supporting the short message services happening between MS and MSC or located on the
traffic channel.

Participating in processing the power control process.

Coordinating the OMS to implement the signaling tracing and other functions.

-619-
Chapter 11 ZXC10-BSS

10.4.3.1.5 Functions of S_LACP Module

The S_LACP module performs part of functions of IS-2000 standard LAC layer. In the IS-2000
standard, the common signaling channel (CSCH) has basically the same functions as the dedicated
signaling channel (DSCH) in LAC layer, but slightly different in the implementation details.
Therefore, the S_LACP module can be divided into two sub-modules:

S_LAC_CP sub-module: It implements part of functions of the common signaling channel

LAC layer of the IS-2000 standard, excluding the SAR sub-layer. Note that the LAC sub-
layer processing of the forward synchronous channel is implemented in CES, and
S_LAC_CP excludes processing to the synchronous channel.

S_LAC_DP sub-module: It implements part of functions of the dedicated signaling

channel LAC layer of the IS-2000 standard, excluding the SAR sub-layer.

The S LAC CP sub-module has the following functions:

Authentication fields processing of the registration, call originating and call receiving of
the MS.

Implement the ARQ sub-layer functions of the common signaling channel (excluding the
forward synchronous channel) LAC layer.

Implementing the reliable transmission mechanism of the forward common signaling layer
3 signaling.

Repeated checking of the common signaling channel layer 3 signaling received reversely.

Implementing the Addressing sub-layer functions of the common signaling channel

(excluding the forward synchronous channel) LAC layer.

Assembling the mobile station address to the LAC layer PDU when sending signaling
signals of the forward common signaling channel.

Resolving the mobile station address from the received message after receiving signaling
signals from the reverse common signaling channel.

Implementing the Utility sub-layer functions of the common signaling channel (excluding
the forward synchronous channel) LAC layer.

Assembling and resolving the message types.

Filling in the blank of PDU in LAC layer.

Reverse resolution of the radio environment report.

-620-
 Chapter 11 ZXC10-BSS

Calculation of the signaling CRC of the forward common signaling channel.

The S_LAC_DP sub-module has the following functions:

Implementing the ARQ sub-layer functions of the common signaling channel (excluding
the forward synchronous channel) LAC layer.

Implementing the reliable transmission mechanism of signaling of the forward dedicated

signaling channel layer 3.

Repeated checking of the signaling of the dedicated signaling channel layer 3 received
reversely.

Implementing the Utility sub-layer functions of the dedicated signaling channel (excluding
the forward synchronous channel) LAC layer.

Assembling and resolving the message types.

Filling in the blank of PDU in LAC layer.

Calculation of the PDU CRC of the forward dedicated signaling channel LAC layer.

10.4.3.1.6 Functions of S_SDM Module

The S_SDM module performs the functions of the multiplexing sub-layer of the dedicated
signaling channel (dsch) and the dedicated traffic channel (dtch) MAC layer in the IS-2000
standard, excluding implementation of RLP between the mobile station and BTS. The S_SDM
module is basically equivalent to the S_SVLP module in Version SPS of CDMA-ONE BSS
system. Since IS-2000 supports the complexity arising from high-speed packet data services and
the asymmetry of the forward/reverse rate, the multiplexing/de-multiplexing in the IS-2000
standard is much complex, and the S_SDM module implementation is also inevitably highly
complex, demanding higher rate.

The S_SDM module has the following functions:

Selection and de-multiplexing of the reverse service data.

In soft handoff, receiving and buffering the multi-channel reverse traffic channel (R-
DCCH, R-FCC and R-SCH) data de-modulated by the de-modulating unit on the channel
board.

In multi-party soft handoff, selecting a best service frame for de-multiplexing according to
the code rate and the error symbol ratio before the defined time boundary.

The de-multiplexed data are distributed in the following principles:

-621-
Chapter 11 ZXC10-BSS

The de-multiplexed packet data or circuit data are submitted to the corresponding S_RLP
module.

The de-multiplexed voice data are submitted to the corresponding Vocoder.

The de-multiplexed signaling data are buffered, to perform the SAR sub-layer functions of
the dedicated signaling channel LAC layer.

Distribution and multiplexing of the forward service data.

Controlling the corresponding S_RLP module instance to generate the circuit data or
packet data suitable for multiplexing.

Controlling the corresponding Vocoder module to submit the voice data suitable for
multiplexing.

Multiplexing the data of different types to a frame of forward traffic channel data
according to the defined rules.

Distributing the forward service data in multi-party soft handoff.

SAR sub-layer functions of the dedicated signaling channel LAC layer.

Forward disconnection of PDU in the dedicated signaling channel LAC layer.

Reverse assembling of the de-multiplexed signaling data and CRC calculation of PDU at
the LAC layer.

Submission of the LAC layer PDU after passing the CRC calculation to the S_LACP
module.

Control of Vocoder:

Vocoder enabling and disabling functions.

Vocoder algorithm activation function.

Vocoder algorithm conversion function.

Vocoder abnormality processing.

Originating the activation/release to the RLP instance.

Coordinating OMS to implement the operation/maintenance-related functions.

Calling the power control function and transferring the power control parameters.

-622-
 Chapter 11 ZXC10-BSS

Forward/reverse processing of Markov calls and TDSO calls, and report of the error frame
ratio.

10.4.3.1.7 Functions of S_CEC Module

S_CEC is an interface control point between SPS and CES, implementing part of control functions
to CES and transferring the interface signaling between SPS and CES.

Functions of the S_CEC module fall into two categories:

Control and management functions:

Originating the initialization and boot configuration of the whole CES.

Enabling, disabling and configuration of the forward/reverse control channel, including:

Driving the CES to enable, disable and configure the pilot channel.

Driving the CES to enable, disable and configure the synchronous channel.

Driving the CES to enable, disable and configure other forward common signaling
channels (F-PCH, F-QPCH, F-BCCH, F-CCCH or F-CACH).

Driving the CES to enable, disable and configure the reverse common signaling channels
(R-ACH, R-EACH and R-CCCH).

Enabling, disabling and configuration of the forward/reverse service channel, including:

Driving CES to enable, disable and configure the forward/reverse dedicated control
channel (F/R-DCCH).

Driving CES to enable, disable and configure the forward/reverse fundamental channel
(F/R-FCH).

Driving CES to enable, disable and configure the forward/reverse supplementary channel
(F/R-SCH).

Driving CES to implement the corresponding test functions, including:

BIT test function.

LoopBack test function.

Direct transfer function:

Transferring the control channel signaling between other modules and the MS in the SPS

-623-
Chapter 11 ZXC10-BSS

subsystem.

Transferring the request for relevant fields in the synchronous parameter modification
messages of the S-RCM module to the synchronous channel application module of CES.

Transferring the request for OverHead message modification of the S_RCM module to the
paging channel application module of CES.

Transferring the request for sending messages to the mobile station of the S_CSCHP
module to the paging channel application module of CES.

Transferring the messages received by the CES access channel application module to
S_CSCHP.

10.4.3.1.8 Functions of S_PCF Module

The S_PCF module mainly implements the PCF functions defined in the IOS4.X standard. PCF is
a new function unit added for cdma2000 to support the high-speed packet data services. In view of
the possible future standardization, IOS4.X defines that PCF can be at the BSC side or
independent of BSC, and also defines the standard A8 and A9 interfaces between BSS and PCF.

For features such as the forward/revere asymmetry and strong burst of the packet data calls,
in IOS4.X, the concept of idle status is raised when the packet data call is defined. The status
transition process of a packet data call is shown in Fig. 4-6.

Active/
Dormant
Connected
State
State

Null/Inactive
State

Fig. 11-73 Status transition process of a packet data call

The three statuses have the following features:

Active/Connected status: Data can be transmitted/received at any end of the mobile station

-624-
 Chapter 11 ZXC10-BSS

or PDSN in this status. The air radio resources corresponding to this packet data call are still
occupied. The A1 signaling connection between BSS and MSC, the A8 data connection
between BSS and PCF and the A10 data connection between PCF and PDSN are kept active.

Dormant status: The air radio resources corresponding to this packet data call are released
in this status, while the PPP virtual circuit between the mobile station and PDSN is still
connected. The A1 signaling connection between BSS and MSC and the A8 data connection
between BSS and PCF are released, and the A10 data connection between PCF and PDSN
still keeps active.

Null/Inactive status: The air radio resources corresponding to this packet data call and the
PPP virtual circuit between the mobile station and PDSN are released. The A1 signaling
connection between BSS and MSC, the A8 data connection between BSS and PCF and the
A10 data connection between PCF and PDSN are all released.

The trunk transfer function for data is implemented between PCF, BSS and PDSN at the
following interfaces.

The A9 signaling interface between BSS and PCF is used for the maintenance of the A8
service connection between PCF and BSS.

The A8 service connection between BSS and PCF is used for data transfer between PCF
and BSS.

The A11 signaling interface between PDSN and PCF is used for the maintenance of the
A10 service connection between PCF and PDSN.

The A10 service connection between PDSN and PCF is used for data transfer between
PCF and PDSN.

The S_PCF module has the following functions:

Participating in multiple packet data call control processes, including:

A10 communication link creation in the MS packet data call origination process.

Transition process from the Active status to the Dormant status originated by BSS.

Transition process from the Active status to the Dormant status originated by the mobile
station.

Packet data call release process caused by MS power-off.

Packet data call release process originated by PDSN.

-625-
Chapter 11 ZXC10-BSS

Re-activation process from the Dormant status to the Active status originated by the
mobile station.

Re-activation process from the Dormant status to the Active status of the packet data call
originated by PCF.

Hard handoff of the packet data call in the Active status.

Hard handoff of the packet data call in the Dormant status.

The S_PCF module participates in the above-mentioned multiple packet call control
processes by implementing the following functions:

Implementing the A9 signaling flow between BSS and PCF defined in the IOS4.X
standard.

Implementing the A11 signaling flow between PDSN and PCF defined in the IOS4.X
standard.

(3) Implement A10 and A8 interface data processing defined in the IOS4.X standard.

10.4.3.1.9 Functions of S_RLP Module

The S_RLP is a new module to SPS of the CDMA-ONE version, , mainly implementing RLP
processing and A8 interface data processing functions.

The details are as follows:

1. Implementing RLP:

Implementing the RLP procedure of the bearer circuit data.

Implementing the RLP procedure of the bearer packet data.

Implementing A8 interface data processing at the IOS4.X BSS side.

Generating GRE messages for the data after packet data RLP processing, and sending
them to S_PCF.

Receiving the GRE messages from S_PCF, and performing RLP packet data protocol
processing after de-encapsulation.

-626-
 Chapter 11 ZXC10-BSS

10.4.3.2 External Interfaces of SPS

The SPS external interfaces includes the following:

A1 signaling interface between S_BSSAP and MSC.

Interface between S_CEC and CES.

A10/A11 interfaces between S_PCFs and between PDSNs.

Interface of database access between S_BSSAP and DBS.

Interface of database access between S_RCM and DBS.

Interface between S_SDM and Vocoder.

Interface between S_RLP and IWF.

Various system control message interfaces between SPS modules and OSS.

10.4.4 Database Subsystem

The database subsystem (DBS) implements centralized management on the ZX3G1X BSS data.
The DBS consists of two parts: The foreground database and the background database. The
foreground database is a real-time embedded database, which features simple structure and small
capacity, and can satisfy the real-time data operation requirement of the foreground application
part, mainly the service part. The background database is a mainstream commercial database
management system, constructing a stable, reliable and huge-capacity data management system.

DBS mainly implements organization and management of the BSS data, the data description
of the system hardware configuration in ZX3G1X- BSS, the configuration description of the A1
interface (SS7) and A2 interface (E1 terrestrial circuit) between BSS and MSC and the data
description of the radio environment. It also implements the allocation policy of the system
resources and the effective scheduling of the IS-2000 air radio resources.

The DBS software subsystem is composed of the following parts:

Database core module D_K: It provides a series of operation primitives for three objects:
relation, index and queue, and constructs the operation methods of various object instances
through these primitives. This module provides data support and the database definition language
for other software modules of DBS, and organizes and manages the data.

Database maintenance module D_S: Database initialization, regular backup of database,

-627-
Chapter 11 ZXC10-BSS

database loading, synchronization of active/standby data and dynamic monitoring of the database.

Relational table method module D_M: It creates various specific objects by invoking the
primitives provided by the database kernel module, and performs loading, insertion, deletion and
modification to the objects to maintain the integrity between the data tables.

Database access interface module D_V: In order to ensure the security and consistency of
data, the database user cannot operate the database directly, but through data encapsulation of the
database user. When the database user needs to operate the database, he or she submits a request to
the database. The database access interface module D_V performs operation on the data based on
the request type and returns the result to the user.

Resource scheduling module in the air forward/reverse supplementary channel D_SCH:

Effective scheduling of power resource, CE resource, Walsh Code resource and time resource on
SCH channel, to maximize the availability of limited resources for high-speed packet data
transmission.

The above-mentioned software modules of DBS serve the data organization, which is
composed of four parts:

SS7 data part.

Physical configuration data part.

Radio resources data part.

PCF data part.

10.4.5 OMS Subsystem

The basic task of the Operation and Maintenance Subsystem (OMS) is to provide maintenance
staff with a means to ensure the normal, high-efficient, reliable, economical and safe operation of
ZX3G1X-BSS.Supported by the database system, OMS implements the centralized operation and
maintenance management on ZX3G1X BSS, including the centralized operation and maintenance
management on BSC and BTS. In addition, OMS supports the local operation and maintenance on
BTS.OMS provides man-machine interfaces in graphic and command line mode for users. Its
major functions include:

Configuration management

The configuration management function of OMS is used to manage the current

configurations of BSS. The change of the configuration of the network/system/unit for any reason

-628-
 Chapter 11 ZXC10-BSS

comes into effect only via the configuration management function. The configuration management
includes the hardware configuration, software configuration and logic configuration.

Performance management

The performance management function of OMS can be used to start the performance
measurement function of BSS, collect the processing measurement data, and take necessary
network management control actions based on the measurement results to improve the overall
performance of the network. Performance management includes traffic and signaling performance
measurement, service quality measurement, availability measurement, throughput measurement
and handoff function measurement, as well as user/signaling tracing functions.

Alarm management

The alarm management function of OMS is used to receive the detailed alarm information
sent from various network units in the form of fault reports, and monitor the network status,
including the circuit group status, network node status, signaling system status and the MSC area,
registration area and cell status. If any network abnormality is found, it converts such information
into audible, visual and screen display alarms to arouse the operator’ attention.

Test Management

The test management function of OMS is used for the operator to start the corresponding test
program when an alarm occurs or the system performance becomes deteriorated. The operator
performs the fault diagnosis and location test, so as to take proper maintenance measures to
minimize the impact of the fault on the network operation. For on-site replaceable component
modules, the precision of fault location is not more than three modules. Diagnosis tests include the
board test and the inter-module communication link test.

Security management

The security management part is mainly used to prevent unauthorized persons from
performing malicious or non-malicious modification or damage on important data through the
background maintenance interface. Through exercising necessary restrictions on the operation
rights of operation staff with different operation authority levels, and by means of integration with
the operating system right management based on this, the security strategy of the whole system is
constructed.

Signal tracing

The signaling tracing function can be used to observe the real-time signaling process
conveniently, and it is useful for analyzing signaling faults and observing signaling coordination.
In addition, it also facilitates the debugging of the foreground service subsystem programs during
the development process. Signaling tracing can be set according to the interface and user.

-629-
Chapter 11 ZXC10-BSS

Service observation

The service observation module provides a man-machine interface for real-time observation
of the service process and the data contents of the specified process. The user can also observe
service failures and their causes.

Local maintenance

OMS provides the BTS-side local maintenance function to enable the maintenance staff to
perform necessary maintenance activities on the BTS site. As a support network of BSS, OMS
itself is a relatively independent system.

The parts of OMS have clearly defined functions. The basic structure is illustrated in the
following diagram.

O_CMP O_AMP

O_RMP

O_TMP O_PMP

Fig. 11-67 OMS structure

O_CMP: Configuration Management Part

O_AMP: Alarm Management Part

O_TMP: Test Management Part

O_PMP: Performance Management Part

-630-
 Chapter 11 ZXC10-BSS

O_RMP: Right Management Part

(Here the prefix O represents OMS).

10.4.5.1 Configuration Management Part (O_CMP)

The O_CMP is composed of the foreground module and the background module. The foreground
module resides in CPM and CCM hardware modules.

The background module of O_CMP provides the user with a man-machine interface for BSS
configuration. The configurable data of BSS include physical resources, radio resources, system
parameters, software parameters, etc. The configuration results are generally shown in the
background database first and then in the foreground database or software (through manual
intervention).

The foreground module of O_CMP refers to the CMP proxy module that resides in the
hardware modules of CPM, CCM, SVICM and NCM, responsible for receiving the commands
from the background module and performing corresponding operations as well as reporting the
results to the background module.

10.4.5.2 Test Management Part (O_TMP)

The O_TMP is responsible for the diagnosis and test on BSS. It is composed of a foreground
module and a background module. The foreground module resides in CPM, CCM, SVICM, NCM,
SVM and CHM5K hardware modules.

The background module of O_TMP receives the man-machine commands, interprets and
locates test points, and displays, prints and saves the test results via the man-machine interface.

The foreground module of the O_TMP refers to the TMP proxy module that resides in CPM,
CCM, SVICM, NCM, SVM and CHM5K hardware modules. It is responsible for receiving the
commands from the background module and performing the corresponding operations, as well
reporting the results to the background module.

10.4.5.3 Performance Management Part (O_PMP)

The O_PMP is responsible for the performance assessment work of the BSS system. It is
composed of a foreground module and background module. The foreground module resides in the
hardware modules of CPM, CCM, SVICM and NCM.

The background module of the O_PMP provides the user with a man-machine interface for
BSS performance assessment. Currently, the performance indexes of BSS include traffic,

-631-
Chapter 11 ZXC10-BSS

resources availability, resources access, handoff, power control, load, service quality and signaling
tracing. The background module receives the man-machine commands, interprets and locates test
points, and displays, prints and saves the test results via the man-machine interface.

The foreground module of O_PMP refers to the PMP proxy module that resides in the
hardware modules of CPM, CCM, SVICM and NCM, responsible for receiving the commands
from the background module and performing corresponding operations as well as reporting the
results to the background module.

10.4.5.4 Alarm Management Part (O_AMP)

The O_AMP is responsible for alarm and alarm recovery management of BSS. It is composed of a
foreground module and a background module, and the front module resides in the NCM hardware
module.

The background module of the O_AMP provides the user with a BSS alarm interface, saves
the alarm records and controls the audible and visual alarms.

The foreground module resides in NCM. The operating system control part residing in
various hardware subsystems is responsible for collecting board status reports, generating alarm
messages or alarm recovery messages based on the status reports and reporting to the foreground
module. In addition, there is also other alarm information. The foreground module is responsible
for receiving the alarm messages and alarm recovery messages. It saves the alarm messages into
the alarm pool in a specific data structure, and transfers the alarm messages and alarm recovery
messages to the background, as well as synchronizes the foreground and background alarms.

10.4.5.5 Right Management Part (O_RMP)

The O_RMP is mainly used to prevent unauthorized persons from performing malicious or non-
malicious modification or damage on important data via the background maintenance interface.
Through exercising necessary restrictions on the operation rights of operation staff with different
operation authority levels, and by means of integration with the operating system right
management based on this, the security strategy of the whole system is constructed.

10.5 Networking Mode and Typical Configuration

10.5.1 ZXC10-BSS System Networking Modes

ZXC10-BSS supports the following networking modes: Star networking, ring networking, chain

-632-
 Chapter 11 ZXC10-BSS

networking and hybrid networking.

10.5.1.1 Star Networking

The star networking mode of ZXC10-BSS is shown in Fig. 11-68.

In star networking, n E1 PCM links are led into each SITE directly via the BSC. The BTS
device on each site is an end one. The networking mode is simple, featuring easy construction and
maintenance. Signals go through few links, which enhances the line reliability. This kind of
networking mode is generally employed in populous urban areas.

BTS0

BTS1

BSC
BTS2

BTS3

Fig. 11-68 Schematic Diagram of Star Networking

10.5.1.2 Ring Networking

The ring networking mode of ZXC10-BSS is shown in Fig. 11-69.

BTS0

BTS1

BSC
BTS2

BTS3

Fig. 11-69 Schematic Diagram Of Ring Networking

-633-
Chapter 11 ZXC10-BSS

In ring networking, there are two sets of mutual-backup links. Each node in the ring has two
upper-level nodes, which enhances the reliability of the links. If one SITE is damaged or if one
link fails, then subordinate nodes can select the other one as an active link.

10.5.1.3 Chain Networking

The chain networking mode of ZXC10-BSS is shown in Fig. 11-70.

BTS0 BTS1 BTS2

BSC

Fig. 11-70 Schematic Diagram of Ring Networking

Chain networking is also suitable for the one-station-multiple-BTS situation. Since signals go
through many links, so the line reliability is relatively poor. This networking mode is applicable to
the areas of belt-like distribution and with only a small population, thus saving a large number of
transmission devices.

In actual networking projects, unlike basic networking modes, the transmission equipment is
usually used for intermediate connection between BSC and BTS because of the decentralization of
sites. Common transmission modes are: Microwave transmission, optical cable transmission,
HDSL cable transmission and coaxial cable transmission.

10.5.1.4 Combined Star and Chain Networking Mode

The chain networking mode of ZXC10-BSS is shown in Fig. 11-71.

-634-
 Chapter 11 ZXC10-BSS

BTS0 BTS1 BTS2

BSC BTS3

BTS4

Fig. 11-71 Schematic Diagram Of Combined Star-Chain Networking

10.5.2 Typical System Configuration

10.5.2.1 Site Types

The radio cellular mobile network, according to frequency resources and cell planning, can be
divided into a certain number of cells and a cell system that abut on each other. Fig. 11-72
illustrates the structure.

In the system, each cell is covered by multiple radio channels. If an omni-antenna is

employed, a base station should be set at the center of each cell (as A in the diagram). And if a
directional sector antenna is used, the base station rack should be established at the intersection of
three cells (as B in the diagram). Such a base station covers three adjacent cells, which in fact
contains at least three TRXs. The BTS site with an omni-antenna covers only one Cell; while the
BTS site with a directional antenna covers three Cells.

The site types are O-type site and S-type site. An O-type site refers to an omni-directional
cell. That is, all the carriers of one site serve this O-type cell. An S site refers to a sector cell. 3-
sector stations are generally used. That is to say, each site contains three sectors, with each sector
supports multiple TRX’s. Models of O-type site and S-type site are as shown in Fig. 11-73.

-635-
Chapter 11 ZXC10-BSS

Cell1
Cell2 B Cell3
Cell4 Cell8
Cell5 Cell7
Cell6
A
Cell9

Fig. 11-72 Schematic Diagram Of Cellular Cells

Type O site Type S site

Fig.11-73 Two Site Types

10.5.2.2 BTS Basic Configuration of ZXC10- BSS

In the ZXC10-BSS system, a single-cabinet BTS can hold up to six TRX modules, or six
carrier modules, which provide totally 120 traffic channels. Thus, if only one BTS is provided at a
site, and three sectors are to be covered, then the configuration should be 2 carriers - 40 channels
for each sector.

In order to increase the subscriber capacity of the cell, two cabinets are usually configured at
each site, thus supporting 4 carriers/3-sectors and providing 240 traffic channels.

-636-
 Chapter 11 ZXC10-BSS

10.5.2.3 Antenna Configuration

Each site may be configured as either an omni-directional cell or multiple directional cells. Based
on different field intensity coverage modes, BTS antennas can be divided into omni-directional
antennas and directional antennas. An omni-antenna can provide omni-directional coverage, thus
lowers site construction costs. However, the omni-antenna has low gain and poor anti-interference
capability. The directional antenna is direction sensitive with high gain and strong anti-
interference capability. To ensure the complete coverage of a service area, combination of multiple
antennae is required.

An O-type site uses two omni-directional antennas to satisfy the requirement of omni-
directional cells.

An S-type site employs a duplexer (in this case, the duplexer is placed in the combiner), and
six antennae, i.e. three transceiving antennas plus three diversity receiving antennas. Thus, a set of
receiving antenna can be saved, and the original transmitting antenna becomes a set of
transceiving antenna. BTS in such a site is configured with 4 carriers/3 sectors, requiring only six
sets of antennas.

10.5.2.4 Description of Typical Configuration

Listed here are three configurations: Full configuration of the BSC central rack, full configuration
of the rack for BSC vocoder, and single-load 3-sector BTS. Specific configurations are as follows:

10.5.2.5 BSC Configuration

Full configuration of central rack in BSC is shown in Fig. 11-81:

-637-
Chapter 11 ZXC10-BSS

Fig. 11-81 Full Configuration of BSC Central Rack

Full configuration of BSC vocoder rack is shown in Fig. 11-82:

-638-
 Chapter 11 ZXC10-BSS

Fig. 11-82 Full Configuration of BSC Vocoder Rack

10.5.2.6 BTS Configuration

Configuration of a single-load 3-sector BTS is shown in Fig. 11-83:

-639-
Chapter 11 ZXC10-BSS

Fig. 11-83 Configuration of a single-load 3-sector BTS

Exercises

1. Please describe the composition of the ZXC10-BSS system.

2. Give a brief introduction to the working environment requirement for BSC and BTS.

3. What CDMA voice coding standards does SVBS support?

4. Describe the structure of RFE module in ZTE CDMA BTS.

5. What protocol is used for the communication between the foreground and background of ZTE
CDMA?

6. How many vocoders can the ZXC10-BSS provide?

7. What is the maximum traffic processing capability of the ZXC10-BSS?

8. Describe the BTS networking modes of ZTE CDMA system

-640-
 Chapter 11 Micro BTS

Objectives

After learning this chapter, the readers are supposed to have a basic idea about ZXCBTS
M800 and ZXCBTS M190.

Introduction

This chapter describes the technical indexes, hardware architecture, product characteristics
and networking modes & configuration of ZXCBTS M800 and ZXCBTS M190 systems.

11.1 Overview
With the emergence of various new technologies, BTS is becoming more and more intelligent
and miniaturized, with lower consumption and higher reliability at lower cost. On the other hand,
as more and more tall buildings are being built in the large and medium cities, problems may
occur in the coverage of hotspots if nothing but the ordinary macro-cell BTSs are employed.
While in some remote areas where much attention is paid to the service coverage rather than the
capacity it can provide, if the macro-cell BTS equipment is employed, it cannot have its role fully
played. Furthermore, it is hard for the macro-cell BTS to meet the requirement for the equipment
room environment Upon such a market demand, ZTE Corporation has developed the ZXCBTS
CDMA micro BTS system.

The ZXCBTS CDMA micro BTS products belong to the BTS product family in the ZXC10
BSS, which is further divided into two categories: ZXCBTS M800 (800 MHz micro BTS) and
ZXCBTS M190 (1900 MHz micro BTS). They support IS-95A and relevant standards and are
capable of smooth upgrade to IS-2000 1X.

ZXCBTS CDMA micro BTS is connected to the Mobile Stations (MSs) via the air interfaces
(Um interfaces) and connected to the BSC via the Abis interface, as shown in Fig. 12-1.
 ZXCBTS M800
ZXC10 BSC
ZXCBTS M190

MS Um interface CDMA micro BTS Abis interface CDMA BSC

Fig. 12-1 The schematic diagram of the ZXCBTS CDMA micro BTS system

ZXCBTS CDMA micro BTS includes three subsystems: Baseband Digital Subsystem (BDS),
GPS Timing Module (GPSTM) subsystem and Radio Frequency Subsystem (RFS). The BDS
performs the baseband modulation and demodulation of the CDMA signals, and provides resource
management, signaling processing and operation & maintenance functions. The GPSTM provides
the time and frequency signals required by BDS and RFS. The RFS can provide air interfaces
through an antenna to transmit CDMA signals after the modulation, receive CDMA signals after
the demodulation, and to complete various related functions such as detection, monitoring,
configuration and control. See Fig. 12-2.

E1 interface
BDS RFS

Environment control
module
Primary power supply
GPSTM Power module

Fig. 12-2 The schematic diagram of ZXCBTS CDMA micro BTS composition

11.2 ZXCBTS M800 Technical Specifications

ZXCBTS M800 performance indexes:

-643-
Chapter 11

A single BTS case can implement the single-carrier omni-directional coverage and can
support the three-sector configuration through cascaded extension.

It supports sharing of three-sector channel unit.

The three-sector configuration can provide at most 4 pieces of CSM5000, i.e., 256 forward
channels and 128 backward voice channels.

With comparatively independent module functions, ZXCBTS M800 supports smooth

upgrade to 1X without changing hardware.

It has E1 interfaces to connect the BSC and supports daisy chain networking mode.

It can also be used as a remote module compatible with 95 and 1X BTS by replacing the
digital boards.

11.2.1 MTRX Technical Specifications

11.2.1.1 Receiving (RX) Module Indexes

Frequency range: 824~849 MHz

Channel bandwidth: 1.23 MHz

Signal modulation mode: OQPSK

Input Standing Wave Ratio (SWR): < 1.2

Intermodulation stray response attenuation: 72 dB

Monotone desensibilization @ ±750 kHz 50 dB

@ ±900 kHz 87 dB

11.2.1.2 Indexes of Local Oscillators In The Frequency Synthesis (FS) Module

Radio Frequency (RF) local oscillator: it should be configured according to the frequency
specified in IS-95. Programmable configuration is also available for it. The RF local oscillator
frequency is the corresponding transmitting frequency minus 114.99 MHz.

Frequency precision: 0.05ppm

Phase noise: -75 dBc/Hz@1 kHz

-644-
 Chapter 11
-95 dBc/Hz@100 kHz

-125 dBc/Hz@1000 kHz

Level: +0 dBm±1 dB

Harmonic suppression: >30 dB

Intermediate Frequency (IF) local oscillator:

Frequency: TX IF local oscillator 114.99 MHz

Frequency precision: 0.05ppm

Phase noise: －85 dBc/Hz@1 kHz

－105 dBc/Hz@100 kHz

－130 dBc/Hz@1000 kHz

Level: +0 dBm±1 dB

Harmonic suppression: >30 dB

11.2.1.3 Transmitting (TX) Module Indexes

Frequency range: 849~894 MHz

Channel bandwidth: 1.23 MHz

Signal modulation mode: QPSK

TX frequency tolerance: < (0.05 ppm)

Power control voltage: 0~5 V

11.2.2 MPA Technical Specifications

Working frequency range: 869~894 MHz

Output power: 10W (40 dBm) average power

IMD: <－45 dBc

Adjacent channel power suppression: ≤ －45 dBc @f0 ± 750 kHz@10W

-645-
Chapter 11

≤ －60 dBc @f0 ± 1.98 MHz@10W

Power gain: 54 dB (provisional). It should be 49 dB.

Gain fluctuation: ± 0.25 dB@ arbitrary 2M bandwidth

Temperature-related gain fluctuation: ± 0.5 dB (Max)

Linear dynamic range: ≥ 30 dB

Input return loss: ≥ 18 dB

Output return loss: ≥ 18 dB

Output protection: Add an isolator

Harmonic suppression: ≤ －45 dBc secondary harmonic

≤ －60 dBc tertiary harmonic

Stray suppression: ≤ －60 dBc (outband)

Temperature detection dynamic status and precision: －25°C ~ 50°C±3°C

Working voltage: 27 V±1V

Working current: ≤5A

Working temperature: 0°C~60°C

11.2.3 RFE Technical Specifications

11.2.3.1 Low Noise Amplifier (MLNA) Technical Specifications

Working frequency band: 824∼849 MHz

Gain: 30 dB

Passband ripple: ≤ 0.3 dB

Output power at the 1 dB compression point: >20 dBm

Noise coefficient: <1.5 dB

Input and output VSWR: <1.5:1

-646-
 Chapter 11
Input and output impedance: 50Ω

LNAWorking status indication: TTL level

Working environment temperature: －30°C~50°C

Input and output interface form: SMA

Power input: +11VDC

11.2.3.2 Duplex Filter (MDUP) Technical Specifications

Working frequency 869∼894 MHz (TX frequency band)

824∼849 MHz (RX frequency band)

Insertion loss Tx→Ant ≤ 1.0 dB; Ant→Rx ≤ 1.0 dB

Passband ripple ≤0.4 dB

Power capacity 200W (CW on average); 2500 W(peak value)

Outband suppression ratio Rx→Tx ≥ 80 dB@869∼894 MHz

Tx→Rx ≥80 dB@824∼849 MHz

≥45 dB @1∼820 MHz

≥50 dB @895∼2600 MHz

≥30 dB @2601∼4000 MHz

Input/output impedance 50Ω in a coaxial cable

Input SWR ≤1.25

Output SWR ≤1.25

11.2.3.3 RX Filter Technical Specifications

Working frequency: 869∼894 MHz(TX frequency band)

824∼849 MHz(RX frequency band)

Insertion loss: ≤ 0.3 dB

Passband ripple: ≤0.2 dB

-647-
Chapter 11

Input/output impedance: 50Ω in a SMA-F coaxial cable

Input SWR: ≤1.25

Output SWR: ≤1.25

Power capacity: 100 W (CW on average); 1000 W(peak value)

11.3 ZXCBTS M190 Technical Specifications

ZXCBTS M190 performance indexes:

A single BTS case implements single-carrier omni-directional coverage and can support
the three-sector configuration through cascaded extension.

It supports sharing of three-sector channel unit.

The three-sector configuration can provide at most 4 pieces of CSM5000, i.e., 256 forward
channels and 128 backward voice channels.

With comparatively independent module functions, it supports smooth upgrade to 1X

without changing hardware.

It has E1 interfaces to connect the BSC and supports daisy chain networking mode.

It can also be used as a remote module compatible with 95 and 1X BTS by replacing the
digital boards.

11.3.1 MTRX Technical Specifications

11.3.1.1 Receiving (RX) Module Indexes

Frequency range: 1850~1910 MHz

Channel bandwidth: 1.23 MHz

Signal modulation mode: OQPSK

Input SWR: < 1.2

Intermodulation stray response attenuation: 72 dB

Monotone desensibilization @±1.25 MHz 80 dB

-648-
 Chapter 11
11.3.1.2 Indexes of Local Oscillators in the Frequency Synthesis (FS) Module
RF local oscillator: it should be configured according to the frequency specified in IS-95.
Programmable configuration is also available for it. The RF local oscillator frequency is the
corresponding transmitting frequency minus 114.99 MHz.

Frequency precision: 0.05 ppm

Phase noise: －75 dBc/Hz@1 kHz

－95 dBc/Hz@100 kHz

－125 dBc/Hz@1000 kHz

Level: +0 dBm±1 dB

Harmonic suppression: >30 dB

IF local oscillator:

Frequency: TX IF local oscillator 150 MHz

Frequency precision: 0.05 ppm

Phase noise: －85 dBc/Hz@1 kHz

－105 dBc/Hz@100 kHz

－130 dBc/Hz@1000 kHz

Level: +0 dBm±1 dB

Harmonic suppression: >30 dB

11.3.1.3 Transmitting (TX) Module Indexes

Frequency range: 1930~1990 MHz

Channel bandwidth: 1.23 MHz

Signal modulation mode: QPSK

TX frequency tolerance: < (0.05 ppm)

Power control voltage: 0~5V

-649-
Chapter 11

11.3.2 MPA Technical Specifications

Working frequency range: 1930~1990 MHz

Output power: 5W (37 dBm) average power

IMD: ≤ －48 dBc@ ± 885 kHz

Adjacent channel power suppression: ≤ － 48 dBc @f0 ± 885 kHz (under normal
temperature)

≤ －45 dBc@f0 ± 885 MHz (-5°C~+50°C)

Power gain: 46 ± 0.5 dB (specific to 1960 MHz)

Gain fluctuation: ± 1 dB

Temperature-related gain fluctuation: ± 1 dB (Max)

Linear dynamic range: ≥ 25 dB

Input return loss: ≥ 14 dB

Output return loss: ≥ 14 dB

Output protection: Add a ring protector

Harmonic suppression: ≤ －45 dBc secondary harmonic

≤ －60 dBc higher harmonic

Stray suppression: ≤ －60 dBc (out-of-band)

Temperature detection dynamic status and precision: －25°C~50°C±3°C

Working power: 27V3A, 11V0.5A

Working temperature: －5°C to +50°C

11.3.3 RFE Technical Specifications

11.3.3.1 Low Noise Amplifier (MLNA) Technical Specifications

Working frequency band: 850∼1910 MHz

-650-
 Chapter 11
Gain: 28 dB

Passband ripple: ≤ 1 dB

Output power at the 1 dB compression point: >10 dBm

Noise coefficient: <2 dB

Input and output VSWR: <1.7:1

Input and output impedance: 50 Ω

LNAWorking status indication: TTL level

Working environment temperature: －30°C~50°C

Input and output interface form: SMA-F

Power input: +12VDC

11.3.3.2 Duplex Filter (MDUP) Technical Specifications

Working frequency 1970∼1990 MHz (TX frequency band)

1890∼1910 MHz (RX frequency band)

Insertion loss TX → Ant ≤ 1.6 dB; Ant → RX ≤ 1.6 dB

Passband ripple ≤0.5 dB

Power capacity 50 W (CW on average); 500 W(peak value)

Outband suppression ratio RX→TX ≥ 50 dB@DC~1890 MHz

≥ 90 dB@1890 MHz~1910 MHz;

≥ 30 dB@1920 MHz~1960 MHz

≥ 60 dB@2010 MHz~3980 MHz;

≥ 35 dB@3980 MHz~6000 MHz;

≥ 20 dB@6000 MHz~12750 MHz

TX→RX ≥ 50 dB@DC~1870 MHz

≥ 40 dB@1870 MHz~1880 MHz

-651-
Chapter 11

≥ 30 dB@1920 MHz~1960 MHz

≥ 90 dB@1970 MHz~1990 MHz;

≥ 60 dB@1990 MHz~3980 MHz;

≥ 35 dB@3980 MHz~6000 MHz;

≥ 20 dB@6000 MHz~12750 MHz

Input/output impedance 50 Ω in a coaxial cable

Input SWR ≤ 1.25

Output SWR ≤ 1.25

11.3.3.3 RX Filter Technical Specifications

Working frequency: 1970∼1990 MHz(TX frequency band)

1890∼1910 MHz(RX frequency band)

Insertion loss: ≤ 1.6 dB

Passband ripple: ≤ 0.5 dB

Input/output impedance: 50 Ω in a SMA-F coaxial cable

Input SWR: ≤ 1.25

Output SWR: ≤ 1.25

Power capacity: 50 W (CW on average); 500 W(peak value)

11.4 Hardware Architecture of ZXCBTS CDMA Micro BTS

The ZXCBTS CDMA micro BTS consists of three subsystems: Baseband Digital Subsystem
(BDS), Timing Frequency Subsystem (TFS) and Radio Frequency Subsystem (RFS). ZXCBTS
CDMA micro BTS belongs to the wireless part of the BSS. It implements wireless transmission
with its subordinate MSs through air interfaces (Um interfaces) and control over wireless channel,
and provides the wired interface with the BSC as well. The cells covered by ZXCBTS CDMA
micro BTS are usually of Omni or Sector structure.

As shown in Fig. 12-3, ZXCBTS CDMA micro BTS includes three subsystems: Baseband
Digital Subsystem (BDS), GPS Timing Module (GPSTM) subsystem and Radio Frequency

-652-
 Chapter 11
Subsystem (RFS). The BDS performs the baseband modulation and demodulation of the CDMA
signals, and provides resource management, signaling processing and operation & maintenance
functions. The GPSTM provides the time and frequency signals required by BDS and RFS. The
RFS is mainly to provide air interfaces through an antenna, implement modulated transmitting and
demodulated receiving of CDMA signals, and implement various related detection, monitoring,
configuration and control functions.

For its outdoor BTS features, ZXCBTS CDMA micro BTS contain two important modules
inside it, i.e., PEPD module and POWER Module. By referring to overseas outdoor BTS indexes,
its environment temperature is designed to be between -40°C and 55°C. Therefore, the micro BTS
must be furnished with the heating equipment inside it so that ZXCBTS CDMA micro BTS can be
started in the case of low temperature. Meanwhile, it has the corresponding temperature detection
and control components for cooperation. The integrated equipment of ZXCBTS CDMA micro
BTS should be supplied by 220V mains, and respective modules inside it is powered by the Power
Distribution Module (MPD).

Fig. 12-3 ZXCBTS CDMA micro BTS architecture

The integrated equipment of ZXCBTS CDMA micro BTS is composed of ten parts: BDM,
MTRX, GPSTM, MPA, MDUP, MDIV, MLNA, MPD, case component and support component,
as shown in Fig. 12-4.

11.5 ZXCBTS CDMA Micro BTS Product Characteristics

The ZXC10-BSS fully incorporates the features of overseas CDMA systems in the design and
development, and improved as per the requirements of the present service operators. The features
of the ZXC10-BSS system mainly include the following aspects:

-653-
Chapter 11

Advanced: by absorbing the advantages of the existing oversea CDMA micro BTSs,
ZXCBTS CDMA micro BTS is advanced in design.

Upward compatible: The problem of transition to the 3G mobile communication system

has been taken into full consideration in the system design, so that the ZXCBTS CDMA micro
BTS system can be smoothly upgraded to a 3G system in the direction of cdma2000.

1.GPSTM 2. BDM 3. MTRX 4. MPD 5. MDIV 6. MLNA 7. MPA 8. MDUP

Fig. 12-4 The layout of ZXCBTS CDMA micro BTS modules

Highly integrated: The ZXCBTS CDMA micro BTS system employs a large amount of
advanced components, such as Motorola’s MPC8260, thus enhancing the system integrity and
reducing the types and number of boards.

Compact structure: this system has an indoor and outdoor compatible wall-mounted
structure.

Highly reliable: The system’s reliability is improved by means of reducing the number of
boards and adopting the 1+1 or N+1 redundancy configuration for important boards in the system,
as well as the error tolerance design of the software.

Flexible configuration: ZXCBTS CDMA micro BTS system can be either directly

-654-
 Chapter 11
connected to the CDSU in the BSC or to the original macro-cell BTS in the daisy chain mode and
support the daisy chain connection between micro BTSs. The newly added micro BTS will not
and should not affect the layout and connection of the existing BSC and macro BTS. A single
micro BTS can implement single-carrier omni-directional coverage and can implement the single-
carrier three-sector functions through the remote RF unit.

11.6 Networking Mode And System Configuration

11.6.1 Networking Mode

The ZXCBTS CDMA micro BTS system can be either directly connected to the BSC or to the
macro-cell BTS for networking, as shown in Fig. 12-5.

Macro-cell BTS Macro-cell BTS

BSC Micro BTS

Macro-cell BTS Micro BTS

Macro-cell BTS Macro-cell BTS

BSC Micro BTS Micro BTS

Macro-cell BTS Micro BTS

Fig. 12-5 ZXCBTS CDMA micro BTS networking diagram

-655-
Chapter 11

ZXCBTS CDMA micro BTS can implement three-sector and multi-carrier networking with
the cooperation of the remote RF unit module. Meanwhile, ZXCBTS CDMA micro BTS can be
connected in a daisy chain mode.

11.6.2 System Configuration

11.6.2.1 The Micro BTS Case Configuration of ZXCBTS CDMA Micro BTS
BDM: one piece

GPSTM: one piece

BRFS: one piece

BGPS: one piece

MDUP: one piece

MDIV: one piece

MLNA: two pieces

MPA: one piece

MTRX: one piece

MPD: one piece

Cabinet: One

Parts (cables and a lightning arrester)

11.6.2.2 Configuration of the Remote RF Unit Case

The configuration of the remote RF unit case is basically the same as that of ZXCBTS CDMA
micro BTS case except that BDM is replaced with RFM and GPS is not necessary (i.e., neither
GPSTM nor BGPS):

RFM: one piece

BRFS: one piece

MDUP: one piece

-656-
 Chapter 11
MDIV: one piece

MLNA: two pieces

MPA: one piece

MTRX: one piece

MPD: one piece

Cabinet: one

Parts (cables and a lightning arrester)

11.6.2.3 Configuration of the Single-Sector Micro BTS

One set of micro BTS case;

Two pairs of antennas;

One pair of GPS antenna.

11.6.2.4 Configurations of the Two-Sector Micro BTS (Two Kinds)

1)

One micro BTS case, with 1 OIM interface board added;

one remote RF unit case;

four pairs of antennas (two pairs of antennas for each sector);

one pair of GPS antenna.

remote
Micro RF site
BTS

Fig. 12-6 Configuration of the two-sector micro BTS

2)

-657-
Chapter 11

One micro BTS case, with 2 OIM interface boards added;

two remote RF unit cases;

four pairs of antennas (two pairs of antennas for each sector);

one pair of GPS antenna.

Remote Remote
RF site RF site

Micro BTS

Fig. 12-7 Configuration of the two-sector micro BTS

11.6.2.5 Configurations of the Three-Sector Micro BTS (Two Kinds)

1)

One micro BTS case, with 2 OIM interface boards added;

two remote RF unit cases;

six pairs of antennas (two pairs of antennas for each sector);

one pair of GPS antenna.

-658-
 Chapter 11

Remote Remote
Micro BTS
RF site RF site

Fig. 12-8 Configuration of the three-sector micro BTS

2)

One micro BTS case, with MDUP, MDIV and two MLNA removed but three OIM interface
boards added;

three remote RF unit cases;

six pairs of antennas (two pairs of antennas for each sector);

one pair of GPS antenna.

Remote RF Remote RF Remote RF

site site site

Micro BTS

Fig. 12-9 Configuration of the three-sector micro BTS

-659-
Chapter 11

11.6.2.6 Configurations of the Two-Carrier And Single-Sector Micro BTS (Two Kinds)
1)

One micro BTS case, with the MDIV and one MLNA removed but one OIM interface board
added;

one remote RF unit case, with the MDIV and one MLNA removed;

two pairs of antennas;

one pair of GPS antenna.

Micro BTS Remote

RF site

Fig. 12-10 Configuration of the two-carrier and single-sector micro BTS

2)
One micro BTS case, with MDUP, MDIV and two MLNA removed but two OIM interface
boards added;

two remote RF unit cases, with the MDIV and one MLNA removed from each;

two pairs of antennas;

one pair of GPS antenna.

-660-
 Chapter 11

Remote Remote
RF site RF site

Micro BTS

Fig. 12-11 Configuration of the two-carrier and single-sector micro BTS

11.6.2.7 Configurations of the Three-Carrier And Single-Sector Micro BTS (Two

Kinds)

1)
One micro BTS case, with the MDIV and one MLNA removed but two OIM interface boards
added;

two remote RF unit cases, with the MDIV and one MLNA removed from each;

three pairs of antennas;

one pair of GPS antenna.

Remote Micro BTS Remote

RF site RF site

Fig. 12-12 Configuration of the three-carrier and single-sector micro BTS

-661-
Chapter 11

2)
One micro BTS case, with MDUP, MDIV and two MLNAs removed but three OIM interface
boards added;

three remote RF unit cases, with the MDIV and one MLNA removed from each;

three pairs of antennas;

one pair of GPS antenna.

Remote Remote Remote

RF site RF site RF site

Micro BTS

Fig. 12-13 Configuration of the three-carrier and single-sector micro BTS

Exercises

1. Please describe the system compositions of ZXCBTS CDMA micro BTS.

2. Please list the major performance indexes of ZXCBTS M800.

3. Give a brief introduction to the overall architecture of ZXCBTS CDMA micro BTS.

4. Briefly describe the product characteristics of ZXCBTS CDMA micro BTS.

5. Describe the networking modes of ZXCBTS CDMA micro BTS.

-662-
 Chapter 13 Remote RF Unit

Chapter 12 Remote RF Unit

Objectives

After learning this chapter, the readers are supposed to have a basic idea about ZXCBTS R800 and
ZXCBTS R190.

Introduction

This chapter describes the technical indexes, hardware architecture, product characteristics and
networking modes & configuration of ZXCBTS R800 and ZXCBTS R190 systems.

12.1 Overview
With the emergence of various new technologies, BTS is becoming more and more intelligent and
miniaturized, with lower consumption and higher reliability at smaller cost. On the other hand, as
more and more tall buildings are being built in the large and medium cities, it may be hard to solve
the problems of coverage if nothing but the ordinary macro-cell BTSs are employed. In some
hotspots, such as large buildings and underground marketplaces, subways, suburbs and towns
along the trunk roads, sightseeing areas, independent large and medium factories and mines, and
highways, where there is no equipment room and exists difficulty in installing the BTS, it is also
hard to solve the coverage problem only by employing the ordinary macro-cell BTS. While in
some remote areas where much attention is paid to the service coverage rather than the capacity it
can provide, if the macro-cell BTS equipment is employed, it cannot have its role fully played.
Furthermore, it is hard for the macro-cell BTS to meet the requirement for the equipment room
environment For these reasons, it is necessary to develop the miniature and economical Micro
BTS featured by easy installation and maintenance, so as to extend our product series and
meanwhile to better satisfy the market demands.

Seen from the sites of the pilot exchanges that have been deployed, it is hard to control the
distance from the BTS equipment room to the building top roof or the tower top. The feed cables
for transmitting RF signals are mostly 50 meters long, some even 70~80 meters long. As the loss
of the feed cables is great, most of the power output by the power amplifier will be wasted.
Therefore, the development of remote RF module with optical interfaces, which can be used to
extend the RF part from the BTS rack to the antenna, not only solves the above-mentioned
problems, but also makes it more flexible to select the location of the BTS equipment room. The
position of the remote RF unit in the CDMA system is shown in Fig. 13-1.

-663-
 Chapter 13 Remote RF Unit

Macro-cell BTS Remote RF unit

BSC Abis interface

MS
Micro BTS Remote RF unit Um interface
Abis interface

Fig. 13-1 The position of the remote RF unit in the CDMA system

The ZXCBTS CDMA remote RF units belong to the BTS product family in the ZXC10 BSS,
which fall into two types: ZXCBTS R800 (800 MHz remote RF unit) and ZXCBTS R190 (1900
MHz remote RF unit). They support IS-95A and relevant standards and are capable of smooth
upgrade to IS-2000 1X.

The remote RF unit consists of four major subsystems: an optical/electrical conversion and
Timing Frequency (TF) subsystem, a Radio Frequency Subsystem (RFS), a power subsystem and
a lightning protection subsystem. The optical/electrical conversion and Timing Frequency (TF)
subsystem provides the forward and reverse data and signaling processing and operation
maintenance and ranging functions, and provides various the time and frequency signals required
by RFS. The RFS provides air interfaces through an antenna to transmit CDMA signals after the
modulation, receive CDMA signals after the demodulation, and to complete various related
functions such as detection, monitoring, configuration and control. The power subsystem supplies
power for the entire system. The lightning protection subsystem of the remote RF unit includes
antenna feeder lightning protection and power lightning protection. The former refers to the
lightning protection of the TRX antennas.

The cells covered by the remote RF unit are usually of Omni or Sector structure.

The remote RF unit is connected to the macro BTS through a pair of fibers to provide the
extension coverage of a single sector. The remote RF unit can also be connected to the micro BTS
through a pair of fibers to provide the extension coverage of a single sector.

The remote RF unit composition is shown in Fig. 13-2.

-664-
 Chapter 13 Remote RF Unit

RF transceiving antenna

Remote RF unit
Optical fiber O/E conversion
And timing RFS subsystem
subsystem
Macro BTS or
Micro BTS
RF transceiving
antenna & feeder and
power supply lightning Power supply
protection

Fig. 13-2 The remote RF unit composition

12.2 ZXCBTS R800 Technical Specifications

12.2.1 MTRX Technical Specifications

12.2.1.1 Receiving (RX) Module Indexes

Frequency range: 824~849 MHz

Channel bandwidth: 1.23 MHz

Signal modulation mode: OQPSK

Input SWR: < 1.2

Intermodulation stray response attenuation: 72 dB

Monotone desensibilization @ ±750 kHz 50 dB

@ ±900 kHz 87 dB

12.2.1.2 Indexes of Local Oscillators in the Frequency Synthesis (FS) Module

RF local oscillator: it should be configured according to the frequency specified in IS-95.
Programmable configuration is also available for it. The RF local oscillator frequency is the
corresponding transmitting frequency minus 114.99 MHz.

Frequency precision: 0.05 ppm

-665-
Chapter 13 Remote RF Unit

Phase noise: －75 dBc/Hz@1 kHz

－95 dBc/Hz@100 kHz

－125 dBc/Hz@1000 kHz

Level: +0 dBm±1 dB

Harmonic suppression: >30 dB

IF local oscillator:

Frequency: TX IF local oscillator 114.99 MHz

Frequency precision: 0.05 ppm

Phase noise: -85 dBc/Hz@1 kHz

-105 dBc/Hz@100 kHz

-130 dBc/Hz@1000 kHz

Level: +0 dBm±1 dB

Harmonic suppression: >30 dB

12.2.1.3 Transmitting (TX) Module Indexes

Frequency range: 849~894 MHz

Channel bandwidth: 1.23 MHz

Signal modulation mode: QPSK

TX frequency tolerance: < (0.05 ppm)

Power control voltage: 0~5 V

12.2.2 MPA Technical Specifications

Working frequency range: 869~894 MHz

Output power: 800M 10W (40 dBm) average power,

IMD: <－45 dBc

-666-
 Chapter 13 Remote RF Unit

ACPR:(@Po=10W) ≤ －48 dBc @ ± 750 kHz (under normal temperature)

≤ -63 dBc @ ± 1.98 MHz (under normal temperature)

≤ －45 dBc @ ± 750 kHz (-5°C~+50°C)

≤ －60 dBc @ ± 1.98 MHz (-5°C~+50°C)

Power gain: 49 dB ± 0.5 dB (800M), 46 dB (1.9G)

Gain fluctuation: ± 0.25 dB@ arbitrary 2M bandwidth

Temperature-related gain fluctuation: ± 0.5 dB (Max)

Linear dynamic range: ≥ 25 dB

Input return loss: ≥ 18 dB

Output return loss: ≥ 18 dB

Output protection: adding an isolator

Harmonic suppression: ≤ －45 dBc secondary harmonic

≤ －60 dBc tertiary harmonic

Stray suppression: ≤ －60 dBc outband

Temperature detection dynamic status and precision: －25°C ~ 50°C±3°C

Working power: 27V 4A, 10V 0.5A

12.2.3 Duplex Filter (MDUP) Technical Specifications

Working frequency 869∼894 MHz (TX frequency band)

824∼849 MHz (RX frequency band)

Insertion loss Tx→Ant ≤ 1.0 dB; Ant→Rx ≤ 1.0 dB

Passband ripple ≤0.4 dB

Power capacity 200 W (CW on average); 2500 W(peak value)

Outband suppression ratio Rx→Tx ≥80 dB@869∼894 MHz

Tx→Rx ≥80 dB@824∼849 MHz

-667-
Chapter 13 Remote RF Unit

≥45 dB @1∼820 MHz

≥50 dB @895∼2600 MHz

≥30 dB @2601∼4000 MHz

Input/output impedance 50 Ω in a coaxial cable

Input SWR ≤1.25

Output SWR ≤1.25

12.2.4 Low Noise Amplifier (MLNA) Technical Specifications

Working frequency band: 824 MHz ~ 849 MHz

Gain: 30 dB

Passband ripple: ≤ 0.3 dB

Output power at the 1 dB compression point: >20 dBm

Noise coefficient: <1.5 dB

Input and output VSWR: <1.5:1

Input and output impedance: 50 Ω

LNAWorking status indication: TTL level

Working environment temperature: －30°C~50°C

Input and output interface form: SMA

Power input: +8 VDC

12.2.5 RX Filter Technical Specifications

Working frequency: 869 MHz ~ 894 MHz (TX frequency band)

824 MHz ~ 849 MHz (RX frequency band)

Insertion loss: ≤ 0.3 dB

-668-
 Chapter 13 Remote RF Unit

Passband ripple: ≤ 0.2 dB

Input/output impedance: 50 Ω in a SMA-F coaxial cable

Input SWR: ≤ 1.25

Input SWR: ≤ 1.25

Power capacity: 100 W (CW on average); 1000 W(peak value)

12.3 ZXCBTS R190 Technical Specifications

12.3.1 Technical specifications

12.3.1.1 The Receiving (RX) Module Indexes

Frequency range: 1850~1910 MHz

Channel bandwidth: 1.23 MHz

Signal modulation mode: OQPSK

Input SWR: < 1.2

Intermodulation stray response attenuation: 72 dB

Monotone desensibilization @±1.25 MHz 80 dB

12.3.1.2 Indexes of Local Oscillators in the Frequency Synthesis (FS) Module

RF local oscillator: it should be configured according to the frequency specified in IS-95.
Programmable configuration is also available for it. The RF local oscillator frequency is the
corresponding transmitting frequency minus 114.99 MHz.

Frequency precision: 0.05 ppm

Phase noise: －75 dBc/Hz@1 kHz

－95 dBc/Hz@100 kHz

－125 dBc/Hz@1000 kHz

Level: +0 dBm ± 1 dB

-669-
Chapter 13 Remote RF Unit

Harmonic suppression: >30 dB

IF local oscillator:

Frequency: TX IF local oscillator 150 MHz

Frequency precision: 0.05 ppm

Phase noise: －85 dBc/Hz@1 kHz

－105 dBc/Hz@100 kHz

－130 dBc/Hz@1000 kHz

Level: +0 dBm±1 dB

Harmonic suppression: >30 dB

12.3.1.3 The Transmitting (TX) Module Indexes

Frequency range: 1930~1990 MHz

Channel bandwidth: 1.23 MHz

Signal modulation mode: QPSK

TX frequency tolerance: < (0.05 ppm)

Power control voltage: 0~5V

12.3.2 MPA Technical Specifications

Working frequency range: 1930~1990 MHz

Output power: 5W (37 dBm) average power

IMD: ≤ －48 dBc@ ± 885 kHz

Adjacent channel power suppression: ≤ － 48 dBc @f0 ± 885 kHz (in normal
temperature)

≤ －45 dBc@f0 ± 885 MHz (-5°C~+50°C)

Power gain: 46 ± 0.5 dB (specific to 1960 MHz)

Gain fluctuation: ± 1 dB

-670-
 Chapter 13 Remote RF Unit

Temperature-related gain fluctuation: ± 0.5 dB (Max)

Linear dynamic range: ≥ 25 dB

Input return loss: ≥ 14 dB

Output return loss: ≥ 14 dB

Output protection: Add a ring protector

Harmonic suppression: ≤ －45 dBc secondary harmonic

≤ －60 dBc higher harmonic

Stray suppression: ≤ －60 dBc outband

Temperature detection dynamic status and precision: －25°C~50°C±3°C

Working power: 27V 3A, 11V 0.5A

Working temperature: －5°C ~ 50°C

12.3.3 Duplex Filter (MDUP) Technical Specifications

Working frequency 1870∼1990 MHz (TX frequency band)

1890∼1910 MHz (RX frequency band)

Insertion loss Tx→Ant ≤ 1.6 dB; Ant→Rx ≤ 1.6 dB

Passband ripple ≤ 0.5 dB

Power capacity 50 W (CW on average); 500 W(peak value)

Outband suppression ratio RX→TX ≥ 50 dB@DC~1890 MHz

≥ 90 dB@1890 MHz~1910 MHz;

≥ 30 dB@1920 MHz~1960 MHz

≥ 60 dB@2010 MHz~3980 MHz;

≥ 35 dB@3980 MHz~6000 MHz;

≥ 20 dB@6000 MHz~12750 MHz

TX→RX ≥ 50 dB@DC~1870 MHz

-671-
Chapter 13 Remote RF Unit

≥ 40 dB@1870 MHz~1880 MHz

≥ 30 dB@1920 MHz~1960 MHz

≥ 90 dB@1970 MHz~1990 MHz;

≥ 60 dB@1990 MHz~3980 MHz;

≥ 35 dB@3980 MHz~6000 MHz;

≥ 20 dB@6000 MHz~12750 MHz

Input/output impedance 50 Ω on a coaxial cable

Input SWR ≤1.25

Output SWR ≤1.25

12.3.4 Low Noise Amplifier (MLNA) Technical Specifications

Working frequency band: 1850 MHz ~ 1910 MHz

Gain: 28 dB

Passband ripple: ≤ 1 dB

Output power at the 1 dB compression point: >10 dBm

Noise coefficient: <2 dB

Input and output VSWR: <1.7:1

Input and output impedance: 50 Ω

LNA working status indication: TTL level

Working environment temperature: －30°C~50°C

Input and output interface form: SMA-F

Power input: +12 VDC

-672-
 Chapter 13 Remote RF Unit

12.3.5 RX Filter Technical Specifications

Working frequency: 1970∼1990 MHz(TX frequency band)

1890∼1910 MHz (RX frequency band)

Insertion loss: ≤ 1.6 dB

Passband ripple: ≤ 0.5 dB

Input/output impedance: 50 Ω on a SMA-F coaxial cable

Input SWR: ≤1.25

Output SWR: ≤1.25

Power capacity: 50 W (CW on average); 500 W (peak value)

12.4 Hardware structure of the remote RF unit

As shown in Fig. 13-3, the remote RF unit consists of an optical/electrical conversion and TF
subsystem, a Radio Frequency Subsystem (RFS), a power subsystem and a lightning protection
subsystem. The optical/electrical conversion and TF subsystem provides the forward and reverse
data and signaling processing and operation maintenance and ranging functions, and provides
various the time and frequency signals required by RFS. The RFS is mainly to provide air
interfaces through an antenna, implement modulated transmitting and demodulated receiving of
CDMA signals, and implement various related detection, monitoring, configuration and control
functions. The power subsystem supplies power for the entire system. The lightning protection
subsystem of the remote RF unit includes antenna feeder lightning protection and power lightning
protection. The former refers to the lightning protection of the transceiving antennas.

The remote RF unit belongs to the wireless part of the BSS. It implements wireless
transmission with its subordinate MSs through air interfaces (Um interfaces) and control over
wireless channel, and provides the wired interface with the BSC as well. The cells covered by the
remote RF unit are usually of Omni or Sector structure.

-673-
Chapter 13 Remote RF Unit

RF transceiving antenna

Remote RF unit
Optical fiber O/E conversion
Macro BTS or And timing RFS subsystem
Micro BTS subsystem

RF transceiving
antenna & feeder and
power supply lightning Power supply
protection

Fig. 13-3 The overall architecture of the remote RF unit

The connections of the remote RF unit with the macro BTS and the Micro BTS are shown in
Fig. 13-4.

The remote RF unit is connected to the macro BTS through a pair of fibers to provide the
extension coverage of a single sector. In the macro-cell, an LFM is used to replace the TRX in the
extension sector, the extension system is connected to the LFM through the RFM, and RFM
restores the system clock from the optical fiber and generates the frequency source required by RF.

The remote RF unit can also be connected to the micro BTS through a pair of fibers to
provide the extension coverage of a single sector. The extension system is connected to the optical
port on the BDM board in the micro BTS through the RFM and RFM restores the system clock
from the optical fiber and generates the frequency source required by RF.

The integrated equipment of the remote RF unit system consists of nine major parts: the
optical/electrical conversion & timing frequency module (RFM), transceiver (MTRX), power
amplifier (MPA), duplexer (MDUP), diversity receiving module (MDIV), lower noise amplifier
(MLNA), power distribution module (MPD), case and supports, as shown in Fig. 13-5.

-674-
 Chapter 13 Remote RF Unit

Remote RF unit

MDIV MDUP

R LVDS Optical fiber

Macro (Original
F
BTS TRX) MLNA MLNA
I
LFM
M
RX MPA
RX
TX

MTRX
Optical fiber
Micro B
BTS D
M
RFM

Fig. 13-4 The connections of the remote RF unit with the macro BTS and the Micro BTS

3 4 5 6 7

1. RFM 2. MTRX 3. MPD 4. MDIV 5. MLNA 6.MPA 7. MDUP

-675-
Chapter 13 Remote RF Unit

Fig. 13-5 The layout of the remote RF unit system

12.5 Product features of the remote RF unit

The features of the remote RF unit mainly are represented in the following aspects:

Advanced: by absorbing the advantages of the existing oversea CDMA remote RF units,
the remote RF unit is advanced in design.

Upward compatible: The problem of transition to the 3G mobile communication system

has been taken into full consideration in the system design, so that the system can be smoothly
upgraded to a 3G system in the direction of cdma2000.

Highly integrated: this system employs a large amount of advanced components, thus
enhancing the system integrity and reducing boards in both types and amount.

Structurally compact: this system has an indoor and outdoor compatible wall-mounted
structure.

Highly reliable: The error tolerance design of the software improves the system reliability.
Furthermore, the equipment of feeder antenna, signal line and power lightning arrester ensures the
reliable running of the system safely and reliability.

Configuration flexible: the remote RF unit is connected to the macro BTS and micro BTS
through a pair of fibers to provide the extension coverage of multiple carriers and multiple sectors.

12.6 Networking Mode and System Configuration

12.6.1 Networking Mode

The connections of the remote RF unit with the macro BTS and the Micro BTS are shown in Fig.
13-6.

The micro BTS can work together with the remote RF unit to implement networking of
multiple sectors and multiple carriers.

-676-
 Chapter 13 Remote RF Unit

Macro-cell BTS Remote RF unit

BSC Remote RF unit

Micro BTS Remote RF unit

Micro BTS

Fig. 13-6 The networking diagram of the remote RF unit with the macro BTS and the Micro
BTS

12.6.2 System Configuration

12.6.2.1 Configuration of the Remote RF Unit Case

The configuration of the remote RF unit case is basically the same as that of ZXCBTS CDMA
micro BTS case except that the BDM is replaced with an RFM and GPS is not necessary (i.e.,
neither GPSTM nor BGPS). Below is the detailed configuration:

RFM: one piece

BRFS: one piece

MDUP: one piece

MDIV: one piece

MLNA: two pieces

MPA: one piece

MTRX: one piece

MPD: one piece

Case: one piece

Parts (cables and a lightning arrester)

-677-
Chapter 13 Remote RF Unit

12.6.2.2 Configuration of the Two-Carrier Remote RF Unit and Micro BTS

One micro BTS case, with one OIM interface board added;

One remote RF unit case;

Four pairs of antennas (two pairs of antennas for each sector) and one pair of GPS antenna.

The single-carrier and two-sector connection is shown in Fig. 13-7.

Micro BTS Remote RF unit

MDIV MDUP MDIV MDUP

MLNA MLNA MLNA MLNA

RX MPA RX RX MPA RX
TX TX
MTRX MTRX

BDM RFM

Optical fiber

Fig. 13-7 The Single-Carrier And Two-Sector Connection

1.1.1.1 Configuration of the Three-Carrier Remote RF Unit and Micro BTS

One micro BTS case, with two OIM interface boards added;

two remote RF unit cases;

six pairs of antennas (two pairs of antennas for each sector) and one pair of GPS antenna.

The single-carrier and three-sector connection is shown in Fig. 13-8.

-678-
 Chapter 13 Remote RF Unit

Micro BTS Remote RF unit Remote RF unit

MDIV MDUP MDIV MDUP MDIV MDUP

MLNA MLNA MLNA MLNA MLNA MLNA

RX MPA RX RX MPA RX RX MPA RX

TX TX TX
MTRX MTRX MTRX

BDM RFM RFM

Optical fiber
Optical fiber

Fig. 13-8 The single-carrier and three-sector connection

12.6.2.3 Configuration of the Two-Carrier Single-Sector Remote RF Unit and Micro

BTS
One micro BTS case, with the MDIV and one MLNA removed but one OIM interface board
added;

One remote RF unit case, with the MDIV and one MLNA removed;

Two pairs of antennas and one pair of GPS antenna.

The two-carrier and single-sector connection is shown in Fig. 13-9.

-679-
Chapter 13 Remote RF Unit

Micro BTS Remote RF unit

MDUP MDUP

MLNA MLNA

MPA RX RX RX MPA
RX
TX TX
MTRX MTRX

BDM RFM

Optical fiber

Fig. 13-9 The two-carrier and single-sector connection

12.6.2.4 Configuration of the Three-Carrier Single-Sector Remote RF Unit and Micro

BTS
One micro BTS case, with the MDIV and one MLNA removed but two OIM interface boards
added;

Two remote RF unit cases, with the MDIV and one MLNA removed from each;

Three pairs of antennas and one pair of GPS antenna.

The three-carrier and single-sector connection is shown in Fig. 13-10.

Micro BTS Remote RF unit Remote RF unit

MDUP MDUP MDUP

MLNA MLNA MLNA

MPA RX RX RX MPA RX RX MPA

RX
TX TX TX
MTRX MTRX MTRX

BDM RFM RFM

Optical fiber
Optical fiber

-680-
 Chapter 13 Remote RF Unit

Fig. 13-10 The three-carrier and single-sector connection

Exercises

1. Describe briefly the applicable cases of the ZXCBTS remote RF unit.

2. Describe briefly the major performance indexes of the ZXCBTS remote RF unit.

3. Describe briefly the overall architecture of the ZXCBTS remote RF unit.

4. Describe briefly the product features of the ZXCBTS remote RF unit.

5. Describe the configuration and networking mode of the two-carrier ZXCBTS remote RF
unit and micro BTS.

-681-
 Chapter 14 ZXRPT-C800

Chapter 13 ZXRPT-C800

Objectives

After learning this chapter, the readers are supposed to have a basic understanding about ZXRPT-
C800.

Introduction

This chapter describes the technical indexes, hardware architecture, product characteristics and
networking modes & configuration of ZXRPT-C800 system.

13.1 ZXRPT-C800 Characteristics

The specially designed stray suppression technology of the repeater makes the stray
radiation of ZXRPT C800 repeater lower than －60 dBm at the GSM band, thus greatly reducing
the interference on the G network and facilitating the engineering installation of the repeater.

It can be used to replace the BTS, thus providing an economical solution to RF signal blind
area; and may be easily mounted to a pole or wall.

The downlink (to MSs) output power is 30 dBm/37 dBm/40 dBm.

And the uplink (to the BTS) output power is 27 dBm/34 dBm/37 dBm correspondingly.

The downlink working frequency ranges from 870 MHz to 880 MHz, and the uplink
working frequency ranges from 825 MHz to 835 MHz.

The repeater can be programmed and controlled from a computer through the RS232C
interface, or controlled by the OMC through a dialup MODEM/MS.

The system administrator can monitor the status of the repeater through a computer.

This system uses the standard power supply AC 220 V, with frequency 50 Hz (single-
phase).

Its waterproof A-alloy frame is painted with antirust lacquer, ensuring reliable running
under any weather condition.

-683-
 Chapter 14 ZXRPT-C800

Each subsystem module has an A-alloy case to guard it against electromagnetic

interference.

13.2 ZXRPT-C800 Technical Specifications

The key technical indexes of ZXRPT-C800 are shown in Table 14-1:

Table 14-1 Key technical indexes

Parameter Value
Working Downlink 870~880 MHz
frequency Uplink 825~835 MHz
Working bandwidth 10 MHz
Output power Downlink 40 dBm ± 2 dB /FA (1FA)
35 dBm ± 2 dB/FA (3FA)
Uplink 27 dBm ± 2 dB /FA (1FA)
22 dBm ± 2 dB /FA (3FA)
Gain Maximum gain 90 ± 3 dB
Adjustment 10 dB ±1.0 dB
linearity 20 dB ±1.0 dB
30 dB ±1.5 dB
Stray radiation in fc ± 750 kHz Uplink ≤ −42 dBc/30 kHz
the first channel Downlink ≤ −45 dBc/30 kHz
fc ± 900 kHz Uplink ≤ −42 dBc/30 kHz
Downlink ≤ −45 dBc/30 kHz
fc ± 1.98 Uplink ≤ −54 dBc/30 kHz
MHz Downlink ≤ −60 dBc/30 kHz
Stray radiation Inband ≤ －22 dBm/30 kHz
9 kHz~150 kHz ≤ －36 dBm/1 kHz
150 kHz~30 MHz ≤ －36 dBm/10 kHz
30 MHz~1 GHz(excluding ≤ －36 dBm/100 kHz
885 MHz~915 MHz and 930
MHz~960 MHz bands)
806~821 MHz ≤ −67 dBm/100 kHz
885~915 MHz ≤ −67 dBm/100 kHz
930~960 MHz ≤ −47 dBm/100 kHz

-684-
 Chapter 14 ZXRPT-C800

Parameter Value
1.71 GHz~1.92 GHz ≤ −47 dBm/100 kHz
3.4~3.53 GHz ≤ −47 dBm/100 kHz
Out-of-band Uplink ≤ －60 dBc or ≤ -33 dBm/30 kHz
suppression ( ± 10 MHz at the working band edge)
≤ －80 dBc (870 MHz ~880 MHz)
Downlink ≤ －60 dBc or ≤ -33 dBm/30 kHz
( ± 10 MHz at the edge of the working
band)
≤ －80 dBc (825 MHz ~835 MHz)
Intermodulation Inband ≤ −15 dBm/30 kHz
suppression 9 kHz ~ 1 GHz ≤ −36 dBm/30 kHz
1 GHz ~12.75 GHz ≤ −30 dBm/30 kHz
Gain adjustment range 60 dB~90 dB
VSWR. 1.4
System delay 1.5 µs (maximum)
Noise characteristic 5 dB (maximum)
Inband flatness 3 dB (maximum)
Waveform quality Downlink ρ > 0.95
Uplink ρ > 0.96
Interface PC/dialing
PSTN modem (optional)
MS (optional)
Alarm Power amplifier, power and open-door, etc.
Monitoring PC program
LED

13.3 Hardware Structure of ZXRPT-C800

ZXRPT-C800 mainly consists of 3 parts: RF unit, monitoring unit and power unit.

Fig. 14-1 shows the internal arrangement of the repeater.

-685-
Chapter 14 ZXRPT-C800

MCU PA-I
LPA-D LNA-D

LNA-U
ZTE ZXRP T-C801
PA-U
CDM A Mob ile Communication Repeater

进网许可证号：17-0004-011267 重量：36kg

额定电压：220V 50Hz 尺寸：560× 410× 280

工作温度：-30℃～+ 55℃ 功耗：115W

工作湿度：5%～90% 出厂日期：年 月 日

产品序号：

ZTE Corporation
Z TE CO RP O RA T I O N

TSP
ON

OFF

PU

COMP
Power inlet
DUP2
Modem line inlet
DUP1 Donor interface
Transfer interface

Fig. 14-1 The internal structure of the repeater

The repeater has the following basic modules:

DUP1: donor duplexer;

DUP1: repeat duplexer;

LNA–D: downlink low noise amplifier;

LNA–U: uplink low noise amplifier;

PA–I: downlink power amplifier interface module;

LPA–D: downlink linear power amplifier module;

PA–U: uplink power amplifier module;

MCU: monitoring and control unit

PU: power unit module

COMP: coupler.

-686-
 Chapter 14 ZXRPT-C800

13.4 ZXRPT-C800 Networking Mode

ZTE

BTS coverage Repeater

coverage
Donor BTS Repeater

Fig. 14-2 The transmission schematic diagram

In applications, the BTS in the cell where the repeater is located is called the donor BTS, and
the wireless link between the donor BTS ad the repeater is called donor link, the antenna of the
repeater that is used to receive the donor BTS signals is the donor antenna, and the antenna of the
repeater that is used to receive signals from the MS is called repeat antenna.

Exercises

1. Please describe the system compositions of ZXRPT-C800.

2. Please list the major performance indexes of ZXRPT-C800.

3. Describe briefly the product characteristics of ZXRPT-C800.

4. Describe the networking mode of ZXRPT-C800.

5. What is the meaning of the donor BTS?

-687-
 Chapter 15 ZTE CDMA Indoor Distribution System

Chapter 14 ZTE CDMA Indoor Distribution System

Objectives

After learning this chapter, the readers are supposed to have a basic idea about ZTE CDMA indoor
distribution system.

Introduction

This chapter mainly describes the technical indexes, hardware architecture, product characteristics
and networking configuration mode of ZXICS C800 and ZXICS C801 systems.

14.1 Overview
Thanks to its devotion to study on deep coverage solution to the wireless network, ZTE
Corporation has developed ZXICS C800 active intelligent indoor coverage system and ZXICS
C801 passive indoor coverage system. These two systems are applicable in different cases
respectively to enable seamless coverage of the network.

ZXICS C800 and ZXICS C801 are applicable to the indoor coverage of both CDMA IS-95
and cdma2000 1X wireless network, and they work at CDMA 800 MHz and PCS1900 MHz. With
the corresponding GSM unit being added, these two types of systems can provide the coverage of
the CDMA&GSM combined network, thus fully satisfying operators’ requirement and entitling
the network with a high cost performance ratio.

14.2 Hardware structure of the Indoor Distribution System

14.2.1 ZXICS C800 System Structure

The diagram of ZXICS C800 indoor coverage system structure is shown in Fig. 15-1. This system
is designed by following such a concept: the signals from the micro BTS or repeater are amplified
through the Extension Unit (ESU) and the Remote Unit (RU), and then sent to the indoor area
needed to be covered. Meanwhile, the traffic of the MSs there are absorbed, and amplified by the
RU and ESU, then sent back to the BTS. In this way, the coverage is extended indoor, the blind
areas are eliminated, and thereby the voice and data service quality is improved. Furthermore, the

-689-
 Chapter 15 ZTE CDMA Indoor Distribution System

intelligent monitoring system configuration also guarantees excellent RF performances in the

network coverage and guard against interference on other cells.

Fig. 15-1 The block diagram of the ZXICS C800 structure

ZXICS C800 consists of the feed source (a micro BTS or a repeater), ESUs, RUs, and the
corresponding passive components such as cables, power splitter, coupler, indoor antenna. They
are described briefly as below:

14.2.1.1 The Feed Source (the Micro BTS or the Repeater)

ZXCBTS M800 technical specifications

Using the CSM5000 chip

The capacity of a single BTS channel unit is 128/64 in the forward direction and is 64/32 in
the reverse direction.

Transmit power: 10 W

Synchronization mode: GPS clock synchronization

Total power consumption: <250 W

Environmental temperature: －40°C to +55°C

Sensitivity of receiver: －117 dBm

Power requirements: mains AC 150-300 V/50-60 Hz

-690-
 Chapter 15 ZTE CDMA Indoor Distribution System

ZXRPT C800-1 repeater technical specifications

Bandwidth: 870-880 MHz for uplink and 825-835 MHz for downlink

Total power: 33 dBm for downlink and 30 dBm for uplink

Gain: 90 dB

Inband flatness: <3 dB

Frequency error: <0.05 ppm

Voltage SWR (VSWR): <1.5

Total power consumption: 200 W

Noise coefficient:<6 dB

Environmental temperature: -30°C to 60°C

14.2.1.2 ESU
The appearance of an ESU is shown in Fig. 15-2. It has the following functions:

realizing uplink and downlink loss compensation and power adjustment;

repeating the MBTS signal command, reporting the RU status and storing the related
control index;

and transforming the 220 VAC into +27 V DC to supply power for the RUs through thin
coaxial cables.

ESU technical indexes:

Frequency range: 825-835 MHz for uplink and 870-880 MHz for downlink

Transmit power: 10 dBm(0/-2 dBm) for downlink

Noise coefficient: 6 dB on uplink

AGC adjustment range: 30 dB

ALC adjustment range: 30 dB

System gain: 45 dB ± 1 dB

Power: 150-280 VAC, 15 W Max (for this machine), 400 W (remote feed)

-691-
Chapter 15 ZTE CDMA Indoor Distribution System

Fig. 15-2 ESU appearance

14.2.1.3 RU
The appearance of an RU is shown in Fig. 15-3. It has the following functions:

Amplifying the uplink RF signal;

Automatically compensating and scaling the cable loss of the downlink signals and
monitoring the transmit power.

RU technical indexes:

Frequency range: 825-835 MHz for uplink and 870-880 MHz for downlink

Transmit power: 15 dBm

Noise coefficient: ≤ 6 dB

AGC adjustment range: 30 dB

ALC adjustment range: 30 dB

System gain: 45 dB Max for uplink and 50 dB Max for downlink

• Power: +27 VDC, 15 W Max

-692-
 Chapter 15 ZTE CDMA Indoor Distribution System

Fig. 15-3 RU Appearance

14.2.1.4 Power Splitter

This system employs two kinds of power splitters: feed power splitters and ordinary power
splitters. A feed power splitter is used between an ESU and an end RU. Together with the coaxial
cable, it is used for the ESU to provide +27 VDC power for the RU. The low-loss power splitter is
used in the antenna combinations to achieve different radiation effects, or used in the uniform
signal distribution in the indoor coverage system.

Table 15-2 Performance parameters of the feed power splitters

Model Two-line Power Splitter Four-line Power Splitter

Working frequency 800~2200 MHz
Insertion loss ≤ 3.3 dB ≤ 6.4 dB
Inband fluctuation ≤ 1 dB(800~1000 MHz, in which the fluctuation <0.3 dB
within 20 MHz bandwidth)
Amplitude balance level 0.2 dB
Phase balance level 3°

Isolation ≥ 25 dB(800~1000 ≥ 30 dB(800~1000 MHz)
MHz)
Input/output impedance 50Ω (coaxial N(f))
Input/output SWR 1.5
 (800~1000 MHz)
Power capacity >3 W (CW on average); >30 W(peak value)
Output port allowed transmission DC~50 MHz signal, 50 MHz signal insertion loss ≤ 3.5
dB (no requirement for SWR)
DC current allowed at the power >2~3 A/30 VDC
splitter port for transmission
DC current allowed at the combiner >8~10 A/30 VDC
port for transmission
Working temperature: －30~60°C

-693-
Chapter 15 ZTE CDMA Indoor Distribution System

Table 15-3 Performance parameters of the ordinary power splitters

Model Two-Line Three-Line Four-Line Splitter

Power Splitter Splitter
Connector N-type female connector
Frequency range 800~2,200 MHz
Input SWR ≤ 1. 5
Insertion loss 3.4 dB 5.3 dB 6.8 dB
Power allowance: (average/peak 50 W
value)
Matching impedance 50 Ω
Intermodulation distortion ≤ －140 dBc
Working temperature: －35°C~+75°C
Application scope Indoor or outdoor

14.2.1.5 Feed Coupler

A feed coupler is used to connect an ESU and an RU. Together with the coaxial cable, it is used
for the ESU to provide +27 VDC power for the RU.

Table 15-4 Performance parameters of the feed coupler

Type 10 dB coupler 7 dB coupler

working frequency 800~2000 MHz
Insertion loss ≤ 0.8 dB ≤ 1 dB
Inband fluctuation ≤ 1 dB(800~1000 MHz, in which the fluctuation <0.3 dB
within 20 MHz bandwidth)
Coupling degree 10 dB 0.5
 dB 7 dB 0.5
 dB
Isolation ≥ 30 dB(800~1000 MHz)
Input/output impedance 50Ω (N(f) coaxial cable)
Input/output SWR ≤ 1.5 (800~1000 MHz)
Power capacity ≥ 3 W (CW on average); ≥ 30 W(peak value)
Coupling port allowed For DC~50 MHz signal, the insertion loss ≤ 3.5 dB (no
transmission requirement for SWR)
DC current allowed at the ≥ 3 A/30 VDC
coupling port for transmission
DC current allowed at the through ≥ 8~10 A/30 VDC
port for transmission
Connector N-type female connector

-694-
 Chapter 15 ZTE CDMA Indoor Distribution System

Working temperature －30~60°C

14.2.1.6 Indoor antenna

The indoor antennas used in the indoor coverage system include directional wall-mounted
antennas and omni-directional ceiling antennas. In consideration of combined CDMA/GSM
network, the broadband antenna is recommended preferably. The indoor directional wall-mounted
antenna is usually used in such premises as long corridors, lift rooms, and the rooms whose
ceilings are not easy to mount antennas to. The indoor omni-directional ceiling antenna is usually
mounted to the ceiling for omni-directional indoor coverage. All the indoor antennas are designed
with special installation kits. Their major features include high gain accuracy, precise direction
map, small volume, light weight, delicate design, nice shape and long life.

Tale 15-5 Performance indexes of indoor antennas

Electrical indices
Type Omni-directional ceiling Directional wall-mounted
antenna antenna
Frequency range 800~2,200 MHz
Gain 3 dBi 6 dBi
VSWR ≤ 1.5:1
Max input power 50W
Impedance 50Ω
3 dB bandwidth 360° 87°
horizontally
3 dB bandwidth 90° 70°
vertically
Lightning protection Direct ground

-695-
Chapter 15 ZTE CDMA Indoor Distribution System

14.2.2 ZXICS C801 System Structure

Power splitter Trunk amplifier

Coupler

Indoor antenna Trunk amplifier

Coaxial cable

Micro BTS or Repeater

Trunk amplifier

Fig. 15-4 The diagram of the ZXICS C801 structure

As we can see from Fig. 15-4, ZXICS C801 passive indoor coverage system consists of feed
source (the micro BTS or repeater), coupler, power splitter, indoor antenna and trunk amplifier.
The working principle is like this: The BTS, the micro BTS or the repeater is the signal source for
indoor coverage; the signal power is distributed rationally through the power distribution
components such as the coupler and power splitter, and then transmitted to respective indoor
transceiving antennas for indoor area coverage. In this process, the trunk amplifier may be added
according to the attenuation degree of the signal. The key for engineering implementation is to
select an optimal place for the indoor coverage antenna and to set proper power distribution
devices.

14.2.2.1 Composition
ZXICS C801 consists of the trunk amplifier, power splitter, coupler, combiner, indoor antenna and
coaxial cables. Their indexes are described briefly as below:

CDMA trunk amplifier

-696-
 Chapter 15 ZTE CDMA Indoor Distribution System

Table 15-6 Technical specifications of the CDMA trunk amplifier

Items Indexes
Downlink Uplink
Frequency range 870-880 MHz 825-835 MHz
Maximum output power 33/37 dBm 10 dBm
Automatic Level Control (ALC) At the maximum power point, if the input power is increased by
10 dB, the output power variation should be kept within 2 dBm
or closed
Frequency error ≤ ± 0.05 ppm
Maximum gain 50 dB ± 3 dB
Gain adjustment range ≥ 30 dB
Gain adjustment step ≤ 2 dB
Gain adjustment error Gain adjustment step error ≤ ± 1 dBpstep; In the range of 0-10
dB, the total error ≤ ± 1 dB; In the range of 10-20 dB, the total
error ≤ ± 1 dB; Being greater than 20 dB, the total error ≤ ± 1.5
dB
≤ 3 dB (peak-peak value)
Noise coefficient ≤ 6 dB
VSWR Input/output VSWR: ≤ 1.5
Delay Trunk amplifier ≤ 1.5 µs; (the trunk amplifier applied to the
acoustic surface filter ≤ 5µs)

Waveform quality >0.95 >0.96

Stray Within each carrier ≤ －45 dBc/30 kHz@ ∆ ≤ －42 dBc/30 kHz@ ∆f ≥ 900 kHz
emission f ≥ 750 kHz
≤ －65 dBc/30 kHz@ ≤ －59 dBc/30 kHz@ ∆f ≥ 1.8 MHz
∆f ≥ 1.8 MHz
Within working ≤ －22 dBm/30 kHz
band
Outside the －36 dBm/1 kHz@9 kHz-150 kHz
working frequency －36 dBm/10 kHz@150 kHz-30 MHz
band (beyond 2.5 －36 dBm/100 kHz@30 MHz-1 GHz (excluding 885 MHz-915
MHz from the MHz and 930 MHz-960 MHz frequency bands)
working frequency －30 dBm/1 MHz1 GHz-12.75 GHz (excluding 1.8 GHz-1.92
band) GHz and 3.4 GHz-3.53 GHz frequency bands)
－67 dBm/100 kHz@806 MHz-821 MHz
－36 dBm/100 kHz@881 MHz-885 MHz
－67 dBm/100 kHz@885 MHz-915 MHz

-697-
Chapter 15 ZTE CDMA Indoor Distribution System

Items Indexes
Downlink Uplink
－47 dBm/100 kHz@930 MHz-960 MHz
－47 dBm/100 kHz@1.7 GHz-1.80 GHz
－47 dBm/100 kHz@1.8 GHz-1.92 GHz
－47 dBm/100 kHz@3.4 GHz-3.53 GHz
Intermodula Within working ≤ -15 dBm/30 kHz
tion band
attenuation Outside the －36 dBm/30 kHz@9 kHz-1 GHz (including 1 GHz)
working frequency
band (beyond 2.5 －30 dBm/30 kHz@1 GHz-12.75 GHz
MHz from the
working frequency
band)
Outband Per band ≤ －40 dB or ≤ －13 dBm/30 kHz @ beyond the working
suppression frequency band edge ≥ 2.5 MHz
≤ －60 dB or ≤ －33 dBm/30 kHz@ beyond working frequency
band edge ≥ 10 MHz

Coupler

The broadband directional coupler is designed for CDMA, PCS and GSM, and it may be used
in the distribution of unequal powers. There are couplers with 5 dB, 7 dB, 10 dB, 15 dB, 20 dB, 25
dB and 30 dB coupling degrees, enabling the system design more flexible. The broadband design
of the components means more economical investment. With less connected fixed parts and air
mediums, not only insertion loss is lowered but also the reliability is enhanced.

Table 15-7 Indexes of the coupler

Work frequency band 800-2200 MHz

Standing Wave Ratio ≤ 1.5
Coupling degree 5 dB 7 dB 10 dB 15 dB 20 dB 25 dB 30 dB
Insertion loss ≤ 1.8 dB ≤ 1.5 ≤ 1.0 ≤ 0.5 dB ≤ 0.5 dB ≤ 0.5 dB ≤ 0.5 dB
dB dB
Power tolerance
Directivity
Matching impedance 50 Ω
Intermodulation result ≤ －140 dBc
Working temperature －35°C~+75°C

-698-
 Chapter 15 ZTE CDMA Indoor Distribution System

Power splitter

The low-loss power splitter is used in the antenna combinations to achieve different radiation
effects, or used in the uniform signal distribution. The system employs the two-line, three-line and
four-line power splitters.

Table 15-8 Indexes of power splitter

Model Two-line power Three-line power Four-line power splitter

splitter splitter
Connector N-type female connector
Frequency range 800~2,200 MHz
Input SWR ≤ 1.5
Distribution loss 3 dB 4.8 dB 6 dB
Insertion loss 0.1 dB 0.15 dB
Power allowance: 500 W/3 KW
(average/peak value)
Matching impedance 50 Ω
Intermodulation distortion ≤ －140 dBc
Working temperature: －35°C~+75°C
Application scope Indoor or outdoor

Indoor antenna

The antennas used in the indoor coverage system include indoor directional wall-mounted
antennas and indoor omni-directional ceiling antennas. In consideration of combined
CDMA/GSM network, the broadband antenna is recommended preferably. The indoor directional
wall-mounted antenna is usually used in such premises as long corridors, lift rooms, and the rooms
whose ceilings are not easy to mount antennas to. The indoor omni-directional ceiling antenna is
usually mounted to the ceiling for omni-directional indoor coverage. All the indoor antennas are
designed with special installation kits. Their major features include high gain accuracy, precise
direction map, small volume, lightweight, delicate design, nice shape and long life.

Table 15-9 Performance indexes of indoor antennas

Electrical indices
Type Omni-directional Directional wall-mounted
ceiling antenna antenna
Frequency range 800~-2,200 MHz
Gain 3 dBi 6 dBi
VSWR ≤ 1.5:1

-699-
Chapter 15 ZTE CDMA Indoor Distribution System

Max input power 50 W

Impedance 50 Ω
3 dB bandwidth 360° 87°
horizontally
3 dB bandwidth vertically 90° 70°
Lightning protection Direct ground

Combiner

Table 15-10 Performance indexes of the combiner

Characteristic impedance 50 Ω
Work frequency band 825~880 MHz, 909~960 MHz
SWR ≤ 1.3
Insertion loss ≤ 0.7 dB
Isolation ≥ 60 dB
Max. input power ≥ 50 W

14.3 Networking Modes And System Configuration

14.3.1 Networking Modes and System Configuration of ZXICS C800

ZXICS C800 networking and configuration modes include the minimum networking mode, cell
cable mode, cell fiber mode and cell hybrid mode. Which one to use depends on the actual
environment. The system support a maximum of ESUs, 16 ×16 RUs. Each RU supports 1-3 indoor
antennas, the output power of the antenna port should be configured to 5-13 dBm. Each antenna
can cover 500-1000 m2 area according to different environment.

14.3.1.1 Minimum Networking Mode and System Configuration

The minimum configuration of ZXICS C800 in the case of a single network includes one ESU,
one to sixteen RUs and corresponding passive components. In the case of combined network of
the two, the minimum configuration includes two ESUs (one for GSM and one for CDMA), eight
GSM RUs, eight CDMA RUs and the corresponding passive parts. The coverage area is about
15,000~30,000 square meters according to different indoor environments.

-700-
 Chapter 15 ZTE CDMA Indoor Distribution System

Take for example a 16-floor building, with each floor being 4 meters high and covering 1500
square meters. Suppose one RU and three indoor antennas are configured for every two floors for
the signal coverage. We can get the minimum configuration table below:

RU_8

RU_2

MBTS
RU_1
RU

ESU
ESU
MBTS

Fig. 15-5 The Minimum Networking Mode

Table 15-11 The minimum configuration table

Component Quantity Remarks

ESU 1
RU 16/2=8 One RU for every two floors
Indoor ceiling omni- 3×16/2=24 Three antennas for each RU
directional antenna
Indoor directional wall- 1-5 For coverage of long and narrow
mounted antenna area
2/3/4-linie ordinary 16/2=8 One for each RU
power splitter
2/4-line feed power 1 For connection of end RU
splitter
7/10 dB feed coupler 16/2-2=6
1/2 coaxial cable 8×2=16 cables. The length depends For connection from the RU to the
on the actual environment. Each antenna
cable is 20-40 meters long.
-5D thin cable 8×2-1=15 cables. The length For connection from ESU to RU
depends on the actual environment.
Each cable is about 7-30 meters.
N-type connector (1/2 16×2=32

-701-
Chapter 15 ZTE CDMA Indoor Distribution System

cable)
N-type connector (-5D 15×2=30
cable)

14.3.1.2 Cell Cable Networking Mode and System Configuration

This mode is applicable to densely built areas, such as living districts, campuses or commercial
centers. This mode implements cell coverage by connecting one micro BTS to 1-16 ESUs that are
distributed in different buildings and the corresponding RUs. The connection mode inside the
building is the same as that for the minimum configuration mode. If a building has more than 32
floors or there are more than 16 buildings, then ESUs may be concatenated so as to send the
coverage signals to higher floors and more buildings.

Suppose there are eight 16-floor buildings in an area, with each floor being 4 meters high and
covering 1500 square meters. We may take the configuration scheme of the indoor part as below:
(For the outdoor part, the calculation of couplers, power splitters and cable lengths depends on the
environment.)

Fig. 15-6 The cell cable mode

14.3.1.3 Cell Fiber Networking Mode and System Configuration

This mode is applicable to the areas where the buildings are far away from each other. This
mode implements cell coverage by connecting one micro BTS to 1-16 ESUs that are distributed in
different buildings through fibers. The connection mode inside each building is the same as that
for the minimum configuration mode. If a building has more than 32 floors or there are more than

-702-
 Chapter 15 ZTE CDMA Indoor Distribution System

16 buildings, then ESUs may be concatenated so as to send the coverage signals to higher floors
and more buildings.

Table 15-12 The cell cable configuration table

Component Quantity Remarks

Micro BTS for indoor 1
coverage
ESU 8 One ESU for each building
RU 8×8=64 One RU for every two floors
Indoor omni-directional 3×8×8=192 Three pairs for each RU
ceiling antenna
Indoor directional wall- 1-5 Depending on the network plan
mounted antenna
2/3/4-line power splitter 1×8×8=64 One for each RU
7/10 dB feed coupler 8×(8-2)=48
2/4-line feed power splitter 8×1=8
-5D thin cable 8×(2×(8-1)+1)=120 Used for connection between the ESU
pieces and the RU. The length depends on
the environment. Each cable is 5-30
meters long.
1/2 coaxial cable 2×8×8=128 Used for connection between the RU
and the antenna. The length depends
on the environment. Each cable is 20-
40 meters long.
N-type connector (1/2) 256
N-type connector (-5D) 240

-703-
Chapter 15 ZTE CDMA Indoor Distribution System

Fig. 15-7 The cell fiber mode

The configuration plan is as follows. For the calculation method of the some indoor
components, refer to that in the cell cable mode.

Table 15-13 The cell fiber configuration table

Component Quantity Remarks

Micro BTS for indoor coverage 1
ESU Several One for each building
RU Several One for every two floors
Indoor omni-directional ceiling Several E for each RU
antenna
Indoor directional wall-mounted Several Depending on the network plan
antenna
2/3/4-line power splitter Several One for each RU
2/4-line feed power splitter Several One for each building
7/10 dB feed coupler Several The number of such couplers should be the
number of RUs minus 2 for each building
1/2 coaxial cable Several Used for connection between the RU and the
antenna. The length depends on the environment.
Each cable is 20-40 meters long.
-5D thin cable Several The length depends on the environment. Each
cable is 7-30 meters long
Optical fiber Several The selection of the optical fiber types and
lengths depends on the distance from the micro
BTS to the ESU

-704-
 Chapter 15 ZTE CDMA Indoor Distribution System

N-type connector (1/2) Several

N-type connector (-5D) Several

14.3.1.4 Cell Hybrid Networking Mode and System Configuration

The configuration of this mode is very flexible. The selection of coaxial cable or fiber depends on
the distribution of the buildings. This mode implements cell coverage by connecting one micro
BTS to 1-16 ESUs that are distributed in different buildings. The connection mode inside each
building is the same as that for the minimum configuration mode. If a building has more than 16
floors or there are more than 16 buildings, then ESUs may be concatenated so as to send the
coverage signals to higher floors and more buildings.

Fig. 15-8 The cell hybrid mode

The configuration plan is as follows. For the calculation method of the some indoor
components, refer to that in the cell cable mode.

Table 15-14 The cell hybrid mode configuration

Component Quantity Remarks

Micro BTS for indoor coverage 1
ESU Several One for each building
RU Several One for every 2 floors
Indoor omni-directional ceiling Several Three for each RU
antenna
Indoor directional wall-mounted Several Depending on the network plan

-705-
Chapter 15 ZTE CDMA Indoor Distribution System

Component Quantity Remarks

antenna
2/3/4-line power splitter Several One for each RU
2/4-line feed power splitter Several One for each building
7/10 dB feed coupler Several The number of such couplers should be the
number of RUs minus 2 for each building
1/2 coaxial cable Several Used for connection between the RU and the
antenna. The length depends on the
environment. Each cable is 20-40 meters long.
－5D thin cable Several The length depends on the environment. Each
cable is about 30 meters long
Optical fiber Several The selection of the optical fiber types and
lengths depends on the distance from the micro
BTS to the ESU
N-type connector (1/2) Several
N-type connector (-5D) Several

14.3.1.5 Combined (C Network and G Network) Networking Mode and System

Configuration

CDMA
RU 8
Coupler

GSM
RU 8

CDMA
RU 1
Coupler

GSM
RU 1

Filter CDMA
CDMA MBTS/ BTS/ RPT
ESU unit

GSM GSM
ESU unit Filter MBTS/ BTS/ RPT

Fig. 15-9 Networking mode for the combined network of the active system

-706-
 Chapter 15 ZTE CDMA Indoor Distribution System

14.3.2 Networking Modes and System Configuration of ZXICS C801

14.3.2.1 Minimum Networking Mode and System Configuration

The networking diagram of the minimum configuration is shown as below. This mode is
applicable to indoor coverage of medium and small buildings. Since the micro BTS or the repeater
has had 10 W output power, the coverage can reach 20,000 m 2 area without the trunk amplifier. At
the same time, the output power at each antenna interface is between 5 and 13 dBm.

Fig. 15-10 Minimum configuration diagram

Take for example a 10-floor building with each floor having 1,500 m2 construction area. To
achieve indoor coverage in this configuration mode, the output power at each antenna port is 5-13
dBm, each floor requires 1-3 indoor antenna for signal coverage. Then we can have the
configuration as below:

Table 15-15 Configuration table

List of parts Quantity Remarks

Coupler About 20
Power splitter Several Depending on the on-site network plan
Omni-directional ceiling antenna About 15
Directional wall-mounted antenna 1-5 For coverage of corridors and staircases
1/2 cable The quantity and the length depends on the

-707-
Chapter 15 ZTE CDMA Indoor Distribution System

environment
CDMA/GSM signal combiner 1 For combined C/G networks

14.3.2.2 Active Networking Mode and System Configuration

This mode is applicable to the indoor coverage of large and medium buildings. When the building
area need to be covered is greater than 20,000 m 2, it is necessary to introduce some trunk
amplifiers on the main link. Each 2~5 W trunk amplifier can increase a coverage area of 15,000 m2
and provides signals for about 15-30 indoor antennas, to ensure the input power at each antenna
port to be in the range of 5~13 dBm.

Fig. 15-11 Active configuration diagram

We can have the configuration table below:

Table 15-16 Configuration table

List of parts Quantity Remarks

Coupler Tens to hundreds
Power splitter Tens to hundreds Depending on the on-site network
plan
Omni-directional ceiling antenna Tens to hundreds
Directional wall-mounted antenna Several For coverage of corridors and
staircases

-708-
 Chapter 15 ZTE CDMA Indoor Distribution System

1/2 cable Several The quantity and the length

depends on the environment
CDMA/GSM signal combiner 1 For combined C/G network
CDMA trunk amplifier Several
GSM trunk amplifier Several

Exercises

1. Describe the applicable cases of ZTE CDMA indoor distribution system.

2. Please list the major performance indexes of ZXICS 800.

3. Please describe the system structure of ZXICS801.

4. What are the major functions of ZXICS 800 power splitter?

5. There is a 16-floor building, with each floor being 4 meters high and covering 1500 square
meters. Suppose one RU and three indoor antennas are configured for every two floors for the
signal coverage, please list the networking configuration with ZXICS C800 indoor distribution
system.

-709-
Chapter 16 ZTE CDMA-Wide and Deep Coverage Solutions

Chapter 15 ZTE CDMA Wide and Deep Coverage

Solutions

Objectives

After learning this chapter, the readers are supposed to have a basic idea about ZTE CDMA wide
and deep coverage solutions.

Introduction

This chapter deals with the ZTE CDMA wide and deep coverage solutions.

15.1 ZTE CDMA Wide Coverage Solution

15.1.1 Overview

To construct an elaborate cdma2000 1x network to provide subscribers with seamless mobile

communication services, the network coverage is required to reach a high level. In the areas where
there are less people populated and less mobile subscribers compared to the center cities, such as
seashores, plains, countries and towns, highway and railway sides, deserts and grasslands, the
requirement for system capacity is low but that for wide network coverage is high.

In coastal areas, there are many administration departments such as the departments for
frontier defense, smuggling suppressing, fishing management, marine monitoring, weather, harbor
supervision and custom. There are also groups engaged in sea fishing and breeding, as well as
individuals and organizations engaged in offing passenger and goods transportation. Such people
are in urgent need for convenient, quick and high-quality communication services.

As the subscribers are scattered and small in amount in the offshore super-long coverage
application, the macro BTS, if used in these areas, will not be made full use in terms of its large
capacity. The macro BTS has strict requirements for equipment room conditions, iron towers and
other supporting facilities, and also a great power consumption, and there are many limits in use.
Furthermore, as there is feed cable loss, the tower-top amplifier or other devices should be
furnished to meet the requirement for reverse coverage, thus increasing the equipment investment.

-710-
 Chapter 16 ZTE CDMA-Wide and Deep Coverage Solutions

ZTE outdoor micro BTS (40W) for super-long coverage can not only satisfy the subscriber
capacity, but also has such features as small volume, lower power consumption, outdoor
application and flexible installation. The radius of its coverage is almost 100km on the
precondition of its antenna can be mounted high enough. This product also features a high cost-
performance ratio, short construction period, low construction cost and flexible configuration as
required.

In the vast plain or hilly areas where the mobile subscribers are densely scattered, a small
amount of ordinary macro BTSs will have a poor network coverage effect while a large amount
will surely increase the equipment investment.

ZTE super-long-coverage product series have an 80 km coverage radius, so it can effectively

solve the wide area coverage problem. For some service hotspots and small bazaars in the
coverage area, ZTE micro BTS series products can satisfy the capacity requirement in partial areas
as a supplementary.

In the areas along highways where the traffic is also small, the use of ordinary macro BTS for
network coverage will have a low cost-performance ratio on the condition that the service demand
is satisfied.

The super-long-coverage micro BTS and RF BTS series products self-developed by ZTE
provide pertinent solutions to the problems above.

15.1.2 Features

ZTE Corporation, based on its many years’ experience, has launched CDMA network wide
coverage solution. This solution has the following features:

Supporting the cdma2000 1x packet data service and cdma2000 1x EV/DO.

Fully guaranteeing the network quality. With rich experience in networking planning and
optimization and in engineering implementation, ZTE Corporation is capable of making practical
and feasible solution subject to different radio broadcast environments and complex topographical
conditions.

Low construction cost. ZTE Corporation adopts its self-developed super-long micro BTS
and super-long RF BTS series products in its solutions, allowing flexible configuration.

As the topographic conditions vary greatly, for every project, the site survey and
measurement shall be conducted by the veteran network planning personnel so that they can make
pertinent solutions.

-711-
Chapter 16 ZTE CDMA-Wide and Deep Coverage Solutions

In a word, different combinations of ZTE BTS series products can cater for the wide area
coverage under various conditions.

15.1.3 ZTE CDMA Wide-Coverage Product Series

Wide area macro BTS

Fig. 16-1 Wide area macro BTS

Technical indexes:
Maximum configuration of this BTS: 2 carriers and 3 sectors

Maximum transmit power: 40 W. It is equivalent to 80W ordinary transmit power (allowing

3dB loss on the feed cable) because the power amplifier is on the tower top.

Sensitivity of receiver: <－125 dBm

Working temperature: －5°C~+55°C.

Coverage distance: 100~150 km.

-712-
 Chapter 16 ZTE CDMA-Wide and Deep Coverage Solutions

Product features:
With a tower-top amplifier, the reverse link noise coefficient is bettered. With the amplifier
mounted on the tower top, the budget allowance on both the forward and reverse links is increased
greatly, and uplink and downlink long-distance coverage can be implemented. Therefore, the wide
area macro BTS is widely applied in the coverage of seashore, plain, grassland and country areas.

Ordinary macro BTS

Fig. 16-2 Ordinary macro BTS

Technical indexes:
Maximum configuration: 4 carriers and 3 sectors

Maximum transmit power: 40 W

Sensitivity of receiver: <－125 dBm

Working temperature: －5°C~+55°C.

Product features:
Wide application.

Micro BTS

-713-
Chapter 16 ZTE CDMA-Wide and Deep Coverage Solutions

Fig. 16-3 Micro BTS

Technical indexes:
Maximum configuration: 3 carriers and a single sector

Maximum transmit power: 20 W.

Sensitivity of receiver: <－125 dBm

Working temperature: －40°C~+55°C.

Power: 220 VAC.

Dimensions: 630 mm(height) ×400 mm(width) ×285 mm(depth)

Weight: 37 kg.

Product features:
The micro BTS supports both the single-carrier and single-sector configuration and the multi-
carrier and single-sector configuration; and also supports cross-carrier/sector channel sharing.

It can be applied in some hotspots in the wide area coverage.

Remote RF BTS

-714-
 Chapter 16 ZTE CDMA-Wide and Deep Coverage Solutions

Fig. 16-4 Remote RF BTS

Product features:
Maximum configuration: 3 carriers and 1 sector

Fiber transmission distance: 40 km

Maximum transmit power: 20 W

Sensitivity of receiver: <－125 dBm

Environment temperature requirement: －40°C-+55°C

Power: 220 VAC

Dimensions: 630 mm x 400 mm x 285 mm (20 W)

Weight: 37 kg

Product features:
The outdoor remote RF module supports a singe sector that may have one carrier or multiple
ones, shares the baseband processing resource pool in the basic cabinet, and does not need GPS.
With an outdoor design, it can be installed close to the feeder antenna to improve coverage.

It can be applied in some hotspots of the wide area coverage.

Repeater

-715-
Chapter 16 ZTE CDMA-Wide and Deep Coverage Solutions

Fig. 16-5 Repeater

Technical indexes:
Type: optical fiber or RF mode

Outdoor working temperature: －30°C~+55°C.

Power: 220 VAC.

Transmit power: 5 W~20 W.

Product features:
The repeater can be used flexibly for networking through the RF or optical fiber mode. With
the modular design and flexible configuration, it can provide a variety of applications. It is
applicable to the coverage of such special areas as long distance from the equipment room to the
antenna installation site, tunnels and railways or along the highways and railways.

15.2 ZTE CDMA Deep Coverage Solution

15.2.1 Overview

The CDMA network is an elaborate mobile network oriented to high-end subscriber groups. High-
end subscribers are mostly distributed in big and medium cities and mainly move about in high

-716-
 Chapter 16 ZTE CDMA-Wide and Deep Coverage Solutions

buildings, and they are major subscribers of CDMA 1X supplementary services (such as high-
speed Internet access, mobile office, mobile commercial and mobile multimedia, etc.).With the
rapid development of city construction, there are more and more high buildings. If only the
ordinary macro BTSs are used for networking in the CDMA network, there may be problems in
the coverage of some hotspot areas, like blind signal areas in indoor coverage of high buildings,
weak signal areas inside dense buildings and the blind signal areas in stations and underground.

High commercial buildings

Normally, an ordinary macro BTS can only be used for coverage of 1 to 12 floors for an ideal
effect. However there are many blind areas in underground 1 to 4 floors, and higher above the
12th floor, there is great interference and contaminated pilot frequencies.

To completely solve the problems of signal coverage in a high building, you can install a
micro BTS in the meeting room or a large office and a distributed indoor coverage system inside
the building, and finally optimize the network, to achieve deep coverage of this building.

Hotel meeting room in dense buildings

If the deep coverage is not implemented, there may be such phenomena as too weak signals,
frequent call drops and MS being out of the network.

These problems can be solved and good communication qualify can be achieved by installing
a micro BTS in the hotel meeting room.

Underground station
If the deep coverage is not implemented, the signals from the macro BTS on the ground may
not be able to reach underground stations.

This problem can be solved and good communication qualify can be achieved by installing
micro BTSs or remote RF BTSs in the underground stations, and this will not affect the wireless
coverage around.

15.2.2 Features

ZTE solution to CDMA 1X deep coverage has the following features:

Supporting the cdma2000 1x packet data service and to-be-launched CDMA 1x EV/DO.

Fully guaranteeing the network construction quality: ZTE is closely synchronizing its CDMA
technology to the world level, and has gained rich experience in network planning and

-717-
Chapter 16 ZTE CDMA-Wide and Deep Coverage Solutions

optimization through several years’ large-scale commercial use.

Effective control of construction cost: ZTE adopts self-developed micro BTS, RF BTS,
repeater and indoor distribution system series products in its solutions, facilitating operation and
maintenance.

15.2.3 ZTE CDMA Deep-Coverage Product Series

Ordinary micro BTS

Fig. 16-6 Ordinary micro BTS

Product features:

Maximum configuration: 3 carriers and 1 sector in a single case

Maximum transmit power: 20 W

Sensitivity of receiver: <－125 dBm

Working temperature:－40°C~+55°C

Power: 220 VAC

-718-
 Chapter 16 ZTE CDMA-Wide and Deep Coverage Solutions

Dimensions: 630 mm(height) ×400 mm(width) ×285 mm(depth)

Weight: 37 kg

Product features:
This product supports both the single-carrier and single-sector configuration and the multi-
carrier and single-sector configuration; and also supports cross-carrier/sector channel sharing since
it is composed of an outdoor rack.

It is applicable to deep indoor coverage of the building and also possible to increase capacity.

Remote RF BTS

Fig. 16-7 Remote RF BTS

Product features:
Maximum configuration: 3 carriers and 1 sector in a single cabinet

Fiber transmission distance: 40 km

Maximum transmit power: 20 W

Sensitivity of receiver: <－125 dBm

Environment temperature requirement: －40°C-+55°C

Power: 220 VAC

-719-
Chapter 16 ZTE CDMA-Wide and Deep Coverage Solutions

Dimensions: 630 mm(height) ×400 mm(width) ×285 mm (depth)

Weight: 37 kg

Product features:
This product supports a singe sector which may have one carrier or multiple ones, shares the
baseband processing resource pool in the basic cabinet, and does not need GPS. With an outdoor
design, it can be installed close to the feeder antenna to improve coverage.

Repeater

Fig. 16-8 Repeater

Product features:
Type: optical fiber or RF mode

Outdoor working temperature: －30°C~+55°C.

Power: 220 VAC

Transmit power: 5-20 W

Product features:

-720-
 Chapter 16 ZTE CDMA-Wide and Deep Coverage Solutions

This product can be used flexibly for networking through the RF or optical fiber mode. With
the modular design and flexible configuration, it can easily and conveniently form many types.

It is applicable to the coverage of such special areas as long distance from the equipment
room to the antenna installation site, tunnels and railways.

Trunk amplifier

Fig. 16-9 Trunk amplifier

Product features:
It features simple and flexible networking. The feed source may be either a micro BTS or a
repeater.

It is applicable to the medium and small premises.

Networking mode
Passive + trunk repeater indoor coverage system

Product features:
This product features simple and flexible engineering and networking since it supports star
networking and 24 network nodes.

With signal equalization function, the MS works at a low power transmitting level in most

-721-
Chapter 16 ZTE CDMA-Wide and Deep Coverage Solutions

part of the coverage area.

The flexible system structure facilitates future expansion;

Smart devices and antenna have little influence to its surroundings in terms of beauty.

It is applicable to large buildings.

Networking mode

Fig. 16-10 Networking diagram of passive indoor coverage system

Fiber indoor coverage system

-722-
 Chapter 16 ZTE CDMA-Wide and Deep Coverage Solutions

Fig. 16-11 Fiber indoor coverage system

-723-
Chapter 16 ZTE CDMA-Wide and Deep Coverage Solutions

Fig. 16-12 Networking diagram of fiber indoor coverage system

Active distributed indoor coverage system

-724-
 Chapter 16 ZTE CDMA-Wide and Deep Coverage Solutions

Remote unit 8

Coupler Power splitter Remote unit 7

Indoor
Coaxial cable
antenna

Optical fiber Remote unit 2

Remote unit 1

Fiber-optic expansion unit Expansion unit 8 Expansion unit 1

MBTS

Fig. 16-13 Distributed indoor coverage system

Product features:
This product supports up to 128 nodes.

Flexible networking: this product may be combined with the macro BTS (by integrating its
local end into the macro BTS), the remote RF BTS (by integrating its local end into the remote RF
BTS), the outdoor micro BTS ((by integrating its local end into the micro BTS), or the repeater. It
can distribute the RF signals into every corner of the building through cables/fibers or other
transmission mediums, to solve the blind area, weak area or call drop problems.

Exercises

1. Describe the features of ZTE CDMA wide coverage solution.

2. Describe the applications of ZTE CDMA wide coverage solution.

3. Describe the features of ZTE CDMA deep coverage solution.

-725-
Chapter 16 ZTE CDMA-Wide and Deep Coverage Solutions

4. Describe the applications of ZTE CDMA deep coverage solution.

-726-
 Chapter 17 ZTE CDMA-WLL Solution

Chapter 16 ZTE CDMA-WLL Solution

Objective

After studying this chapter, the readers should have a basic understanding of ZTE CDMA-WLL.

Introduction

This chapter gives a description of the ZTE CDMA-WLL solution.

16.1 CDMA-WLL Characteristics

Wireless access refers to the access mode in which terminal users and switches are connected in the
wireless mode. A wireless access system boasts of the characteristics of shortened time necessary for
the network construction, low initial investment, flexible capacity planning, diversified networking
modes, simple and convenient maintenance, high reliability, etc. In comparison with other wireless
access modes, CDMA wireless access solution has the following unmatched advantages:

 The CDMA technology is the best of the wireless technologies that are currently in
commercial use.

 The CDMA technology is one of the technologies adopted in 3G telecommunications.

 Lower construction cost.

 Better voice quality.

 Better calling performance: Lower frame error rate (FER) and call drop rate.

 Higher frequency spectrum utilization ratio.

 Simple network planning.

 Capability of meeting the subscribers’ requirements of local mobile services and wireless
data services.

 Capability of using the present resources to quickly start wireless services, and of being
directly upgraded to a cellular mobile system when conditions permit, so as to protect the
initial investment.

-727-
Chapter 17 ZTE CDMA-WLL Solution

16.2 ZTE CDMA-WLL Solution

The ZTE cdma2000 1x WLL solution, a wireless access solution launched by ZTE Corporation
according to market demand, is oriented to user groups that move locally in large and medium cities. It
can also be applied in mountainous areas, oil fields, etc.—customers of the traditional wireless access
system.

The ZTE cdma2000 1x WLL solution supports the cdma2000 1x, and is backwardly compatible
with the IS95 CDMA system. It is capable of connecting with the PSTN, Internet and other networks. It
supports basic telecommunications services and supplementary services, and supports circuit-type data
service and high-speed packet data service.

The ZTE cdma2000 1x WLL can implement wide coverage and deep coverage in cellular cells.

16.2.1 Network Architecture

The ZTE cdma2000 1x WLL solution, a wireless access system using CDMA technology, is kind of
telecommunications access network. What it differs from a cabled access mode is that it connects with
the PSTN, PDSN and terminal subscribers in the wireless mode.

The cdma2000 1x WLL whole network solution network based on V5.2 interface and A-interface
is as shown in Fig. 17-1 and Fig. 17-2.

Fig. 17-1 Network diagram of cdma2000 1x WLL (based on V5.2 interfaces) mobile
communications system whole network solution

-728-
 Chapter 17 ZTE CDMA-WLL Solution

Fig. 17-2 Network diagram of cdma2000 1x WLL (based on A interfaces) mobile communications
system whole network solution

Among them:

BTS--BTS transceiver MSC/VLR—mobile switch center/visitor location register

BSC--BTS Controller. HLR/AUC--Home Location Register/Authentication Center

PCF—packet control function PDSN—Packet data service node

HA--Home Agent AAA—Authentication, Authorizing and Accounting server

16.2.2 Network Interfaces

The ZTE cdma2000 1x WLL solution may provide the following main interfaces:

 Interfaces with fixed networks: using SS7 or using international standard V5.1/V5.2 protocol;

 Interfaces with terminal subscribers: using air interfaces Um which is in conformity with the
IS-2000 protocol standard to connect terminals;

 Interfaces with NM center: using Q3 interface protocol that conforms to international

standard. The physical layer can be X.25/DDN/PSTN/E1/SDH/ TCP/IP, etc.;

 Interface between BSC and BTS: User-defined Abis interface protocol;

 Interfaces with mobile switches and the PDSN: using cdma2000 interfaces A, which conform
to the ISO4.x protocol standard.

-729-
Chapter 17 ZTE CDMA-WLL Solution

16.2.3 Network Features

The ZTE cdma2000 1x WLL network solution has the following features:

 Support the cdma2000 criteria, and backwardly compatible with the IS95 CDMA system;

 Capable of providing a complete set of solutions ranging from the cdma2000 1x network
equipment to the terminal products;

 Capable of realizing CS mobile service and PS data mobile service;

 Capable of satisfying subscriber requirement for local mobility;

Capable of smooth transition to a cellular mobile communications system, satisfying carriers’

requirements for future upgrading of mobile networks, and protecting investment;

 Facilitate a smooth transition to the third generation mobile communications system.

Exercises

1. Give a description of the ZTE CDMA-WLL features.

2. Give a description of the ZTE CDMA-WLL solutions.

3. Give a description of the ZTE CDMA-WLL network interfaces.

-730-
 Chapter 18 ZXPDSS Packet Switching System

Chapter 17 ZXPDSS Packet Switching System

17.1 System Overview

17.1.1 Location of the ZXPDSS System in Networks and the Main System
Functions

As an access gateway, PDSN (Packet Data Serving Node) offers Simple IP and Mobile IP access
modes, to provide services for the cdma2000 mobile stations to access Internet or Intranet. At the
cdma2000 1x stage, a maximum access rate of 153.6 kbps can be provided for each subscriber, and at
the cdma2000 EV-DO stage, a maximum access rate of 2.4 Mbps can be provided for each subscriber.

In comparison with the IS-95 system, to accomplish access of cdma2000 user data services, three
functional entities–PDSN, HA (providing Mobile IP service) and AAA, which are referred to as
ZXPDSS system here, should be added in the cdma2000-1x core network, and PCF functional entity
should be added in the cdma2000-1x access network. These newly added devices are mainly used to
satisfy the requirements of packet data service transmission, so as to provide functions of high-speed
Internet access, visual telephone, e-commerce in the 3G mobile communications system for the
terminal subscribers.

The cdma2000-1x network architecture is shown in Fig. 18-1:

PSTN/PLMN

Um(IS-95A)
HLR/AUC
Internet
2GB TS Abis

Um(IS-95A) A(IOS4.X)
2G B SC AAA Server

Router
Um(IS-2000)
2GB TS Abis MSC/VLR

A(IOS4.X) IP Cloud

HA
Abis
IP Cloud
3GB TS B SC
/PCF Router
PDSN/FA(ZX-PD10)

CDMA2000-1X network structure

Fig. 18-1

-731-
Chapter 18 ZXPDSS Packet Switching System

The location of the ZXPDSS system in the network is as shown in the diagram. The cdma2000 1x
packet data services are jointly accomplished by the MS, BTS, PCF, PDSN, AAA and HA. The
functional entities of a packet switching core network include: PDSN (Packet Data Serving Node), HA
(Home Agent), and AAA (Authentication, Authorization and Accounting) servers.

PDSN

PDSN (Packet Data Serving Node) provides services for the cdma2000 mobile stations to access
the Internet or Intranet.

PDSN is an interface between the Radio Network (RN) and Packet Data Network (PDN,). Its
main function is to provide Simple IP access service or Mobile IP access service for the mobile
stations, so that subscribers can access a public data network or a private data network. In case of
simple IP, PDSN is similar to a Network Access Server (NAS), and in case of mobile IP, PDSN will
serve as a Foreign Agent (FA) for the MS. PDSN also helps with user authorization and accounting
functions.

In providing mobile IP service, PDSN implements a Foreign Agent (FA) function. FA (Foreign
Agent), a router located in an MS visiting network, provides the mobile station with IP forwarding
address and IP routing service (on condition that the MS must register with the HA). In respect with
data sent to a mobile station, FA extracts IP data packet for the tunnel of HA (Home Agent), and
transfers it to the mobile station, while in respect with data sent by the mobile station, FA can serve as a
default router or use a reverse tunnel to send the data to the HA.

In this document, PDSN equipment is also called ZXPDSS P100.

HA

Home Agent, a router on an MS home network, is responsible for maintaining the current location
information of the MS, establishing a corresponding relation between the IP address and the forwarding
address of the MS. When the MS leaves the network with which it registers, it should be registered to
the HA. When receiving a data packet sent to the mobile station, the HA will transfer the data packet
via the tunnel between the HA and FA to the transfer address of the mobile station. Then the tunnel
encapsulation is removed via the transfer address, and the data packet is sent to the MS to accomplish
the mobile IP function.

The simple IP does not need an HA, while the mobile IP needs an HA.

In this document, the HA equipment is also referred to as the ZXPDSS H100.

AAA server

AAA (Authentication, Accounting and Authorization Server) uses an RADIUS server mode at
present. It performs authentication on user script file information, accomplishes data service

-732-
 Chapter 18 ZXPDSS Packet Switching System

authorization, and implements accounting function.

AAAfalls into three kinds: service AAA, intermediate AAA and home AAA.

Service AAA is located in the service network (or referred to as visitor access providing network),
and communicates with the PDSN in the service network. Home AAA is located in the home network,
and communicates with the HA in the home network in case of mobile IP. If the MS is not roaming, the
service AAA is combined with the home AAA. The intermediate AAA, located in an intermediate
network (which is optional, and may not be available in actual conditions), is in security relationships
with the service AAA and home AAA, and is used to safely transmit AAA messages between the
service AAA and the home AAA. In some cases, there may be more than one intermediate AAA
between the service AAA and the home AAA.

In this document, AAA equipment is also referred to as the ZXPDSS A100.

17.1.2 Overall System Performance

The ZTE Communications cdma2000 1x packet switching system ZXPDSS, an important part of the
cdma2000 1x digital cellular mobile communications system, includes three independent entities:

ZXPDSS P100 (Packet Data Serving Node, or called PDSN for short)

ZXPDSS H100 (Home Agent, or HA for short)

ZXPDSS A100 (Authentication, Authorization and Accounting server, or AAA server for short)

ZXPDSS provides two types of packet services to mobile subscribers:

 Local and public network access

 Private network access

ZXPDSS implements the two types of packet data services in the following two ways:

 Simple IP

Simple IP is similar to dial-up Internet access. As the IP address allocated every time to the MS is
dynamically variable, so only packet data communications with the MS as the caller can be
implemented, and in case of cross-PDSN address allocation, the on-going data communications will be
interrupted, and cannot be continued unless it is restarted.

 Mobile IP

Mobile IP provides an IP routing mechanism on the global Internet, allowing the MS to be

-733-
Chapter 18 ZXPDSS Packet Switching System

connected to any subnet with a permanent IP address, so as to implement packet data communications
with the MS as the caller or the called, and ensure the on-going communications with the MS to be
continued in case of cross-PDSN.

17.1.2.1 Network Reference Model

The network reference models of the cdma2000 1x packet data subsystem include two types of network
reference models: one is based on simple IP and the other is based on mobile IP.

A simple IP-based packet core network includes a PDSN and AAA servers, as shown in Fig. 18-2.
A PDSN is an interface between the cdma2000 1x wireless access network and packet data network. It
is responsible to manage user status, transfer user data, and assign IP address for the MS. AAA servers,
located in the packet data core network, accomplish functions of authentication, authorization and
accounting. The intermediate AAA server is responsible to transfer authentication and accounting
information between the visitor AAA server and the home AAA server.

Fig. 18-2 Simple IP-based network reference model

A mobile IP-based packet subsystem should include PDSN and AAA servers, and HA as well, as
shown in Fig. 18-3. HA is responsible for allocating IP addresses to subscribers, and sending packet
data to the MS by means of the tunnel technology, and an FA (Foreign Agent) function should be added
to the PDSN, so that it can provide a tunnel outlet, and send the data to the MS after decapsulation.

-734-
 Chapter 18 ZXPDSS Packet Switching System

17.1.2.2 Main System Features

1.1.1.1.1 Main PDSN features

1. Using the latest network processor technology, hence allowing much larger data flow
processing capacity;

2. Using a dedicated HDLC high-speed processor developed by ZTE, having completely solved
the bottleneck problems in HDLC deframing and framing processing;

3. Realizing load sharing and intelligent selection because of the Cluster mode used;

4. Providing two operation and maintenance modes of TELNET remote login and serial-port
access, and supporting remote maintenance;

5. Realizing SNMP V2 Agent function, and supporting integrated network management;

6. Dual-power supply allows greater extent of security and reliability.

Fig. 18-3 Mobile IP-based network reference model

-735-
Chapter 18 ZXPDSS Packet Switching System

1.1.1.1.2 Main HA features

1. Using the latest network processor technology, hence allowing much larger data flow
processing capacity;

2. Providing two operation and maintenance modes of TELNET remote login and serial-port
access, and supporting remote maintenance;

3. Realizing SNMP V2 Agent function, and supporting integrated network management;

4. Dual-power supply allows greater extent of security and reliability.

1.1.1.1.3 AAA server main features

1. Based on WIN2000 platform;

2. Supporting SQL database interfaces;

3. Realizing SNMP V2 Agent function, and supporting integrated network management;

4. High reliability of hardware, supporting 1+1 backup;

17.1.3 Interface Features

17.1.3.1 R-P Interface between PDSN and PCF

R (Radio)-P (Packet) interface is an interface between a wireless access network and a packet core
network, i.e., an interface between the PCF and PDSN, also referred to as an aquarter interface. A
channel bearing signaling control in the R-P interface is called an A11 interface, and a channel bearing
packet data is called an A10 interface.

It can be seen from Fig. 18-4 that the A11 interface uses the UDP protocol as its own bearer
protocol. The port numbers supported are 434 and 699, of which 434 is the port number of the earlier
A11 interface. In order to separate with the port number of the Mobile IP and to support new functional
services, the 3GPP2 has initiated the new port number 699, which is used to supporting A11 interface.
In order to implement compatibility with the previous versions, this system will support both these two
port numbers.

The GRE (universal route encapsulation protocol) of A10 interface is used to encapsulate packet
data to implement tunnel transmission. The data borne on the GRE layer are PPP conversation data
between the MS and PDSN. The bearer data are transmitted in a transparent mode to the PCF.

-736-
 Chapter 18 ZXPDSS Packet Switching System

MSC
IWF Call control
mobile SWITCH
management

A1
A2
A5
A3 A9 (signal) A11 (signal)
(signaling) Source BSC
Target PCF PDSN
A3 A8 (traffice)
BSC A10 (traffic)
(user traffic)
SDU
A7
Function

Ainter A quater

A9Asignaling
信令 A11 signaling
9
GRE TCP/UDP GRE UDP
IP IP IP IP
Link
链路层 layer Link
链路层 layer Link layer
链路层 Link
链路层 layer
Physical
物理层layer Physical
物理层 layer Physical
物理层 layer Physical
物理层 layer

A8 A9 A10 A11

Fig. 18-4 CDMA 1x network A-interface protocol

A11 interface controls the establishment of A10 connection, re-registration, canceling and
transmission of air link accounting information via signaling.

Packet data services are in three states:

 Active/Connected

Assigning service channels for the MS, A8 connection, A10 connection and PPP connection are all
kept. The MS can either transmit or receive data.

 Dormant

Assigning service channels for the MS, A8 connection is released, but A10 connection and PPP
connection are kept.

 Null/Inactive

No connection is available.

17.1.3.2 Interface between PDSN and AAA Server

Between the bottom layers of the PDSN and the local AAA server, the IP/UDP protocol is used, and for

-737-
Chapter 18 ZXPDSS Packet Switching System

the upper layers, the RADIUS protocol is used to transmit authentication and accounting information.
PDSN serves as the Client of the AAA server.

17.1.3.3 Interface between PDSN and HA

The IP protocol is used between the PDSN and HA, to transmit registration information, establish
tunnels and transmit packet data.

By means of the IKE process or mobile IP Foreign-Home authentication extended items, PDSN
can establish, maintain and terminate security communications with the HA.

17.1.4 Service Application

The cdma2000 1x packet data service is completely based on the IP technology. When subscribers are
using packet data services, an IP connection will be established between the mobile terminal and the
network, and all the services will be accomplished via the IP connection. On the basis of the IP
connection, the ZXPDSS system is capable of providing subscribers with multiple basic services:

1. FTP file transfer

2. WEB browse

3. E-Mail transceiving

4. E-Commerce

5. Multimedia conference

6. Video broadcast on demand

7. Online chat

8. Visual telephone

17.1.5 Product Technical Standards

The ZXPDSS is designed in compliance with the related standards of China’s posts and
telecommunications industries, the related recommendations of the 3GPP2 and IETF. The main
standards and protocols taken for reference are as follows:

1. YDC XXXX-2002 cdma2000 Digital Cellular Mobile Communications Packet Subsystem

-738-
 Chapter 18 ZXPDSS Packet Switching System

Equipment Technical Specifications

2. YDC XXXX-2002 cdma2000 Digital Cellular Mobile Communications Packet Subsystem

Equipment Test Specifications

3. YDC XXXX-2002 cdma2000 Digital Cellular Mobile Communications Packet Subsystem

Equipment protocol Test Specifications

4. 3GPP2 A.S0001-A 3GPP2 Access Network Interfaces Interoperability Specification, November

2000

5. 3GPP2 P.R0001 Version 1.0.0 Wireless IP Architecture Based on IETF Protocols, July 2000

6. 3GPP2 P.S0001-A Version 3.0 Wireless IP Network Standard, July 2001

7. RFC 768 User Datagram Protocol, August 1980

8. RFC 791 Internet Protocol, September 1981

9. RFC 792 Internet Control Message Protocol, September 1981

10. RFC 793 Transmission Control Protocol, September 1981

11. RFC 826 An Ethernet Address Resolution Protocol, November 1982

12. RFC 854 Telnet Protocol Specification, May 1983

13. RFC 1122 Requirements for Internet Hosts -Communication Layers, October 1989

14. RFC 1144 Compressing TCP/IP Headers for Low Speed Serial Links, February 1990

15. RFC 1321 The MD5 Message-Digest Algorithm, April 1992

16. RFC 1332 The PPP Internet Protocol Control Protocol (IPCP), May 1992

17. RFC 1661 The Point-to-Point Protocol (PPP), July 1994

18. RFC 1662 PPP in HDLC-like Framing, July 1994

19. RFC 1701 Generic Routing Encapsulation (GRE), October 1994

20. RFC 1702 Generic Routing Encapsulation over Ipv4 networks, October 1994

21. RFC 1918 Address Allocation for Private Internets, February 1996

22. RFC 1962 The PPP Compression Control Protocol (CCP), June 1996

-739-
Chapter 18 ZXPDSS Packet Switching System

23. RFC 1974 PPP Stac LZS Compression Protocol, August 1996

24. RFC 1979 PPP Deflate Protocol, August 1996

25. RFC 1994 PPP Challenge Handshake Authentication Protocol (CHAP), August 1996

26. RFC 2002 IP Mobility Support, October 1996

27. RFC 2003 IP Encapsulation within IP, October 1996

28. RFC 2004 Minimal Encapsulation within IP, October 1996

29. RFC 2005 Applicability Statement for IP Mobility support, October 1996

30. RFC 2006 The Definitions of Managed Objects for IP Mobility Support Using SMIv2,
October 1996

31. RFC 2118 Microsoft Point-To-Point Compression (MPPC) Protocol, March 1997

32. RFC 2138 Remote Authentication Dial In User Service (RADIUS), April 1997

33. RFC 2139 RADIUS Accounting, April 1997

34. RFC 2290 Mobile-IPv4 Configuration Option for PPP IPCP, February 1998

35. RFC 2344 Reverse Tunneling for Mobile IP, May 1998

36. RFC 2401 Security Architecture for the Internet Protocol, November 1998

37. RFC 2402 IP Authentication Header, November 1998

38. RFC 2406 IP Encapsulating Security Payload (ESP), November 1998

39. RFC 2409 The Internet Key Exchange (IKE), November 1998

40. RFC 2474 Definition of the Differentiated Services Field (DS Field) in the IPv4 and IPv6
Headers, December 1998

41. RFC 2475 An architecture for Differentiated Services, December 1998

42. RFC 2484 PPP LCP Internationalization Configuration Option, January 1999

43. RFC 2597 Assured Forwarding PHB Group, June 1999

44. RFC 2598 An Expedited Forwarding PHB, June 1999

45. RFC 2794 Mobile NAI Extension, March 2000

-740-
 Chapter 18 ZXPDSS Packet Switching System

46. RFC 2868 RADIUS Attributes for Tunnel Support, June 2000

47. RFC 3012 Mobile IPv4 Challenge/Response Extensions, November 2000

48. ITU-T Recommendation E.212 The International Identification Plan for Mobile Terminals and
Mobile Users

49. ITU-T Recommendation X.509 Public-key and attribute certificate frameworks

17.2 Cdma2000-1x Packet Data Switching Node (ZXPDSS-P100)

Located between the packet data core network and the cdma2000 1x wireless access network, PDSN is
responsible to provide the MS with simple IP access service or mobile IP access service, so that
subscribers can access public data networks or private data networks. Meanwhile, PDSN also
coordinates in realizing subscriber authentication and accounting functions.

While providing mobile IP services, PDSN implements FA (Foreign Agent) function. As a router
located in a mobile station visitor network, an FA provides routing service to mobile stations that are
registered with the FA. In respect with data sent to a mobile station, FA extracts IP data packets from
HA tunnel, and transfers the data to the mobile station; and in respect with data sent by a mobile
station, FA can serve as a default router, or can use a reverse tunnel to transmit the data to HA.

17.2.1 Working Principles

17.2.1.1 Hardware Structure

1.1.1.1.4 Designing concept

PDSN system hardware provides a support platform for realizing PDSN functions and ensuring PDSN
performance. Viewed from the hardware alone, hardware functions can be divided into the following
parts:

1. Physical interface function: functions required for data transmission on lines, such as framing,
encoding, media access control, timing, driving, etc., and realizing R-P or WAN physical interfaces. At
present, the PDSN system provides 10/100 Ethernet interfaces.

2. Data processing and switching functions: to incoming data, performing real-time processing
operations, such as encapsulation, decapsulation, table checking, sorting, segmentation, reassembly,
statistics, modifying, etc. Some of the operations, in cooperation with the CPU signaling processing
function, help accomplish PDSN communications protocol (such as PPP protocol) processing function.

-741-
Chapter 18 ZXPDSS Packet Switching System

The data processing function is the core content of hardware design, and this function is implemented
by the micro-engine of the network processor IXP1200.

3. HDLC processing function: User data service flows coming into the PDSN from the R-P
interface are all PPP packets encapsulated with HDLC (IP/GRE encapsulation as the outer wrap). As
the HDLC encapsulation is not in a standard format, and the HDLC processing is after the outer
processing, and is located on the whole user data channel, i.e., all the user data must pass this
processing, hence a great data flow should be processed here in this processing section. But this is
beyond the network processor, so the HDLC encapsulation/decapsulation cannot be implemented
without the help of external hardware. In the system, the trope and check of HDLC frame, and PPP
packet reassembly are implemented by hardware FPGA processing logic in cooperation with the micro-
engine of the network processor.

4. Signaling protocol processing function: To process communications protocols (including R-P

interface signaling, NM protocol, etc.), a high-speed CPU that has an extremely large code space and
data space will be required, as it involves processing of multiple layers, instead of only layer 3
processing in the above-mentioned data processing function. In the system, that function is
accomplished by the ARM kernel of the IXP1200 and an external main control CPU.

5. System control function. The system control function is accomplished mainly by an external
main control CP. The control function includes: Initialization and work configuration of various
modules and boards in the system, and status information collection, etc.

1.1.1.1.5 Overall framework

As shown in Fig. 2-1, the PDSN system is mainly composed of the PrPMC module (PrPMC) and the
network processing module (NPM). Of which, the PrPMC module is designed as a subcard, and the
NPM module is designed as a backplane, and a PCI bus is used for communications between the two
modules.

-742-
 Chapter 18 ZXPDSS Packet Switching System

Ethernet
755
controller
82559 PMC card

PCI

SSRAM
Serial port
( 8M) NPU
IXP1200
SDRAM FLash
(256M) (8M)

IX Bus

IXF440 Multiport 10/ HDLC processing

100M Ethernet MAC logic

4 10/100M SSRAM
Ethernet PHY

2 R-P
4 10/100M
RJ45*4
Ethernet
Connector
transform
2 Pi

Fig. 18-4 Overall framework of PDSN system hardware

1.1.1.1.6 PrPMC module

The PrPMC module (PrPMC) is mainly composed of CPU (MPC755)+PCI Bridge (XPC107) and
peripheral interface units. The PCI Bridge provides connection for multiple PCI devices, among which
information interaction is performed via a PCI bus. The principle block diagram of the PrPMC module
is shown in Fig. 18-5,

PrPMC module has the following main functions:

 Providing whole board control: including initialization of various board parts, working status
control and monitor and whole board management, etc.;

 Providing NM function (SNMP, Telnet);

 Supporting maintenance and management of the configuration information database;

-743-
Chapter 18 ZXPDSS Packet Switching System

 Providing 32-bit 33 MHz PCI interfaces, realizing interaction with the NPM module.

PMCP13/P14
connector

FLASH EPLD
LED display

SDRAM UART controller

BOOTROM
512KB RS232
Transceiver chip
Debug serial port

CPU HOST/PCI
PCI interface
33MHz-32bit PCI总线

Ethernet
Interface control RJ45
chip

CORE Debug network port

Power

PMC P11/P12
connector

Fig. 18-5 Block diagram of PrPMC module (subcard) principle

1.1.1.1.7 NPM module

A schematic block diagram of the NPM module is shown in Fig. 2-3.

The NPM module, the hardware core of the PDSN system, is implemented by an Intel IXP1200
network processor, around which there are the following peripheral basic interface units:

 Storage interface unit

Including 8M SSRAM, 256M SDRAM (memory bar) and 8M FLASH.

 PCI bus interface unit:

Including one 10/100M Ethernet interface (used for debugging or providing TELNET service).

-744-
 Chapter 18 ZXPDSS Packet Switching System

PMC P11/P12 PMC P13/P14

Connector Connector
PCI

SSRAM Ethernet
Flash Controller
BootROM
NPU Debug
network port
IXP1200
SDRAM Serial Port
Debug serial
port

IX Bus

10/100M Ethernet
HDLC Processor
MAC

10/100M Ethernet
PHY SSRAM

10/100M Ethernet
Transformer

RJ45 Connector

Fig. 18-6 Block diagram of NPM module (backplane) principle

 IX bus interface unit:

Including two subunits: The 100M Ethernet interface unit and the HDLC hardware processing
logic unit. Through these two interface units, the system is capable of supporting 4 10/100M Ethernet
physical interfaces and accomplishing hardware HDLC processing.

 Serial port

It can serve as a background Console interface.

In selecting the MAC layer interface chips, as the IX bus has not yet been opened at present, so an
INTEL chipset is used, which is capable of providing standard 100M MAC layer chips of IX bus
interface, hence standard interfaces for the physical layer.

Functions of the NPM module are mainly as follows:

-745-
Chapter 18 ZXPDSS Packet Switching System

 Providing control on backplanes: including initialization of various backplane parts, working

status control and monitoring, backplane management, etc.;

 Providing service data flow processing functions, including:

1. IP processing, GRE processing and PPP processing on the service data received from the PCF,
and sending these data to WAN interfaces after HDLC deframing and adding a corresponding IP header
information;

2. Providing PPP processing on service data received from the WAN, and after HDLC framing,
sending the data to PCF interfaces with corresponding IP header information added.

 Providing control functions: such as microcode downloading, transferring configuration of

various interfaces, configuring FPGA etc.;

 Providing functions of data packet receiving, encapsulation processing, routing and data
packet transmitting, etc.

17.2.1.2 Software Structure

According to the designing concept of clear module, low module coupling between software and
hardware, and low coupling of software module, the ZXPDSS software can be logically divided into
the following subsystems: Operating system subsystem, database subsystem, protocol stack subsystem,
service subsystem, system control subsystem, NM/OMM subsystem. In each system, there are some
submodules, and each of them is distributed to each hardware board according to the actual
configuration, as shown in Fig. 2-4.

A description of functions of each subsystem is given below:

 Operating system subsystem (OSS)

Located at the bottom layer of the control channel, it encapsulates the RTOS and different CPUs,
providing a running platform irrelevant to the hardware and operating systems, including: Functions of
process management, memory management, timer management, file management, driving task and
communications, distributed on all the modules. Specific driving tasks can be configured according to
the board requirements.

 Database Subsystem (DBS)

Managing the system resources, providing unified data storage interfaces and highly effective
memory data management for upper layer application. Distributed on all the modules. There may be
different data table contents, depending on different module functions.

 System control subsystem (SCS)

-746-
 Chapter 18 ZXPDSS Packet Switching System

Monitoring the system running, including: Boot function, version management, system power on,
active/standby control, board monitor and alarm. Distributed on all the modules. Depending on the
system architecture, different modules are of different levels and have different work divisions.

SPS
SCS DBS NMS
Service
Database Operation and processing
System control
subsystem maintenance subsystem
subsystem
subsystem

PSS

Control channel
Protocol stack
subsystem

ARM
OSS
Support subsystem

Data channel
MCS
uE
Microcode subsystem

Fig. 18-7 Overall framework of PDSN system software

 NM/operation and maintenance subsystem (NMS)

Accomplishing functions of system alarm, configuration, accounting, security, statistics, signaling

tracing, etc, and providing standard access interfaces (SNMP/Q3). Different functions will be
accomplished on different modules, depending on the work division of the modules.

 Protocol stack subsystem (PSS)

Shielding details of communications conducted by the upper application subsystems with the
outside. The PSS performs link layer, network layer and transmission layer protocol processing on
packets that are sent and received, providing the upper layer application with transparent IP network
transmission services, so as to facilitate the compiling of the upper layer application and for its better
portability.

 Service processing subsystem (SPS)

-747-
Chapter 18 ZXPDSS Packet Switching System

Providing upper layer signaling control channels for user packet data access, and maintenance and
management of user service data channels as well.

 Microcode system (MCS)

In processing media flow (data channels), network processor microcode technology is used, so as
to implement user data quick processing and transferring functions via sharing information, with the
SPS, such as user connection attribute table and routing table, etc.

17.2.2 Performance Specifications

PDSN performance specifications are shown in Table 18-1.

Table 18-1 PDSN performance specifications

Performance specifications Single PDSN PDSN Cluster

Total number of activated subscribers 10,000 160,000
Total number of online subscribers 40,000 640,000
Total number of data subscribers
120,000 1,920,000
supported
Total number of L2TP subscribers
4,000 64,000
supported
Total number of MIP subscribers
10,000 160,000
supported
Data flow per second 200 Mbps 3.2 Gbps
Valid data flow per second 150 Mbps 2.4 Gbps
System work time without fault MTBF>400,000 hours
System fault recovery time MTTR<30 minutes

17.2.3 Equipment Functions

PDSN system has the following main functions:

 Establishing and managing PPP channels and R-P channels for the MS;

 Providing two access modes of simple IP and mobile IP of the MS;

 Receiving accounting information sent from the PCF, integrating the accounting information
at the IP network side, and generating accounting records to send to AAA servers;

 Supporting MS switchover and dormant switchover;

-748-
 Chapter 18 ZXPDSS Packet Switching System

 Assigning IP address for MS in simple IP;

 Supporting FA functions;

 When MIP access is used for the MS, providing maintenance of the forward and reverse
tunnels between the FA and HA for the MS;

 Using the IKE or the FA-HA in Mobile IP protocol to extend, maintain and terminate the
security relationships with HA. Theses security relationships can be either static or dynamic;

 Providing the MS with authentication, authorization and accounting, by means of transferring

MS authentication, authorization and accounting information to AAA servers;

 Receiving user Profile from the AAA servers and transferring it to the MS.

17.2.4 Equipment Data

17.2.4.1 Rack Parameters

PDSN is designed as a 1U-high box according to itscapacity. The box can be used independently as a
desktop PC, or it can be configured as a 19-inch standard 2U plug box, with added lateral installation
side ears, to be installed in the related device for use.

Dimensions: 43.65 mm×440 mm×640 mm (H×W×D)(excluding the base)

Dimensions of box with lateral ears: Size: 43.65 mm × 254 mm × 494 mm (H ×W×T)

17.3 cdma2000-1x Packet Data Home Agent (ZXPDSS-H100)

As a router located on a mobile station home network, the HA is responsible for the maintenance of the
current position information of the mobile station. The mobile station should register with the HA after
leaving its registration network. HA broadcast can reach the route information of the mobile station IP
address, collect all the data packets sent to the mobile station and send the data packets to the FA via
the tunnel between the HA and the FA. And the HA will unpack the tunnel encapsulation to send the
data packets to the mobile station, so as to accomplish a mobile IP function. If a reverse tunnel is used,
the HA will receive data packets sent from the FA before routing them to the destination.

Only when the mobile station uses a mobile IP service is the HA needed.

-749-
Chapter 18 ZXPDSS Packet Switching System

17.3.1 Working Principles

17.3.1.1 Hardware Structure

1.1.1.1.8 Designing concept

The HA system hardware is basically the same as that of the PDSN in designing concept, except that
the HA does not have an HDLC processing function. Refer to 18.2.1.1.1 of this chapter.

1.1.1.1.9 Overall framework

The HA system hardware architecture is basically the same as that of the PDSN in overall framework,
except that the HA does not have HDLC processing logic. Refer to 18.2.1.1.2, 18.2.1.1.3 and 18.2.1.1.4
of this chapter.

17.3.1.2 Software Structure

The HA system software is basically the same as that of the PDSN in overall framework. Refer to
18.2.1.2 of this chapter.

17.3.2 Performance Specifications

HA performance specifications are shown in Table 18-2,

Table 18-2 HA performance specifications

Performance specifications HA
Total number of data subscribers
120,000
supported
Data flow 400 Mbps
64-Byte IP packet delay is less than 1 ms
Transfer delay 512-Byte IP packet delay is less than 15 ms
1518-Byte IP packet delay is less than 350 ms
IP packet loss rate is less than 0.1% under circumstance of light
load (with a 10% processing capacity)
Packet loss rate
IP packet loss rate is less than 0.3% under circumstance of
heavy load (with a 80% processing capacity)
System work time without fault MTBF>400,000 hours

-750-
 Chapter 18 ZXPDSS Packet Switching System

Performance specifications HA
System fault recovery time MTTR<30 minutes

17.3.3 Equipment Function

HA system has the following main functions:

 Assigning home IP address for MS;

 Providing authentication for the MIP-RRQ of MS;

 Providing routing function for MS in the network;

 Supporting the reverse tunnel function of MS;

 Using IKE or the FA-HA security extension in the Mobile IP protocol to establish, maintain
and terminate the security relationships with the PDSN. Theses security relationships can be
either static or dynamic;

 Receiving user information provided by the home AAA;

 Supporting multicast and routing functions;

 Supporting DNS function of MS according to the configuration;

 Supporting multi-port registration: Providing multi-port registration to the same NAI by

using different static addresses; or multi-port registration to different NAIs by using static or
dynamic addresses.

17.3.4 Equipment Data

17.3.4.1 Rack Parameters

HA is designed as a 1U-high box according to its capacity. The box can be used independently as a
desktop PC, or it can be configured as a 19-inch standard 2U plug box, with added lateral installation
side ears, to be installed in the related device for use.

Outline dimensions: 43.65 mm×440 mm×640 mm (H×W×D)(excluding the base)

Outline dimensions of the box with side ears: Size: 43.65 mm × 254 mm × 494 mm (H×W×T)

-751-
Chapter 18 ZXPDSS Packet Switching System

17.4 cdma2000-1x Packet Data Authentication, Authorization and

Accounting Server (ZXPDSS-A100)

AAA servers, located in the packet core network, are responsible for performing authentication of
packet data calling subscribers, accomplishing data service authorization and realizing accounting
function.

The AAA servers can be divided into visitor AAA server, intermediate AAA server and home AAA
server.

The visitor AAA server, located in the visitor access providing network, is connected with the
PDSN; the home AAA server, located in the home network, is connected with the HA in case of mobile
IP; the intermediate AAA server, located in the intermediate network (optional, may not be existent in
actual conditions), is in security relationships with the visitor AAA server and home AAA server, and is
responsible for transferring authentication and accounting information between the visitor AAA server
and home AAA server.

17.4.1 Working Principles

17.4.1.1 Designing concept

The RADIUS server mode is used for the AAA server at present.

RADIUS is based on the typical client/server mode, and it includes two parts of the RADIUS
client and the server. The RADIUS client dwells on the PDSN or HA, and its task is to send a user
authentication request to the RADIUS server, and to respond to the response returned by the server. The
RADIUS server usually runs of a workstation. All the user authentication and network visitor service
information is on the RADIUS server, and is stored in various modes that are adaptive to the client
requirements. The RADIUS server is responsible for receiving requests sent from the client,
authenticating the user authority, and returning configuration information necessary for providing
services to the client.

17.4.1.2 Overall Framework

The overall framework of AA server is shown in Fig. 4-1,

-752-
 Chapter 18 ZXPDSS Packet Switching System

PDSN Configuration and

O (Charging information maintenance
IE
collecting point) management
M (background program)
C R adius HTTP
SNMP
Radius server Web server CDR processing
system (ACE
Transferring to other platform)
Radius servers ODBC
DBLIB Generating CDR file to
be collected by the
billing center
Database server
Receiving data from upper
settlement center

Fig. 18-8 Overall framework of AAA server system software

Fig. 4-1 shows that the charge information collecting point is the PDSN. Actually, any equipment
in conformity with the RADIUS protocol will be allowed to access. The charging information
collecting point sends a request to the RADIUS server via the RADIUS protocol. The request can be
either a status authentication request, or an accounting request. When receiving the request, the
RADIUS server will visit the database via the database interface, and will notify the accounting
information collecting point with the request result.

In the database, the system basic information and a great deal of charging data are stored. In case
of a very large database, the data stored in the database can be stored in different servers. As a DBLIB
interface is used between the RADIUS service program and the database, a dynamic database provided
by the database itself can accomplish the visit to the database, so the program does not need to take
care of the location of database.

The RADIUS server implements an Agent Function of the SNMPv2, interacts with the OMC
(operation and maintenance center), and supports a unified network management.

The RADIUS server performs background operations via a configuration maintenance and
management program, and supports user remote account opening via the WEB server.

The CDR (Call Details Record) processing system sorts out the CDRs that are written into the
database by the RADIUS service program, and generates them into a CDR file, and stores the file in the
text format currently provided by the CISIO.

Instances of CDR files:

2002-07-31 11:46:01

Event_TimeStamp = 1028014259

-753-
Chapter 18 ZXPDSS Packet Switching System

Acct_Status_Type = 2

Acct-Delay-Time = 3

Tunnel-Type = 1

Tunnel-Server-Endpoint = 10.42.19.13

17.4.2 Performance Specifications

AAA server performance specifications are shown in Table 18-3.

Table 18-3 AAA server performance specifications

Performance specifications AAA server

Number of subscribers supported 1,000,000
Number of authentications processed at the same time 300
Duration for authentication processing <50 ms
Duration of system working without fault MTBF>400,000 hours
Duration for system fault recovery MTTR<30 minutes

17.4.3 Equipment Functions

17.4.3.1 Functions of the AAA Server in Simple IP

1.1.1.1.10 Visitor AAA server functions

 Sending PDSN Access-Request to the intermediate or home AAA, and sending the
intermediate or home AAA Access-Accept (or Access-Reject) to PDSN, accomplishing
authentication and authorization of MS packet data calling;

 Storing the MS accounting information transferred from PDSN, which mainly includes
Accounting Start, Interim Accounting records and Accounting Stop, and transferring the
information to the intermediate or home AAA;

 Transferring the user profile and QoS information (contained in the Access-Accept) sent by
the home (or intermediate) AAA to the PDSN;

 Supporting CHAP/PAP. If the MS uses CHAP or PAP, the PDSN will send a Access-Request
message containing authorization information to the service AAA, which will, if not having

-754-
 Chapter 18 ZXPDSS Packet Switching System

been authorized to receive or reject the request, forward the request to the intermediate or
home AAA;

 Capable of dynamically assigning the IP address of the MS.

1.1.1.1.11 Functions of home AAA server

 The Access-Request of the visit-based AAA server exercises authentication and authorization
to MS, using PAP or CHAP;

 Providing user profile and QoS information (contained in Access-Accept) to the PDSN;

1.1.1.1.12 Functions of intermediate AAA server

 Request and response of information between the visitor AAA server and the home AAA
server can be conducted in three modes:

1. Non-transparent. The intermediate AAA server checks requests and response messages, and
generates new requests and response messages, demanding the intermediate AAA server to shoulder the
economic responsibilities of the service network;

2. Transparent. The intermediate AAA server only transfers messages but not generate new
messages;

3. Changing direction. The intermediate AAA server takes another AAA server as a service AAA
server.

The transparent mode is adopted in this system.

 Capable of authenticating the certificates (optional) transmitted between the service AAA and
home AAA.

IP security can be used between the visitor AAA server, intermediate AAA server and home AAA
server, to ensure security of communications.

17.4.3.2 Functions of AAA servers in Mobile IP

1.1.1.1.13 Functions of visitor AAA server

 Sending the Access-Request of PDSN to the intermediate or home AAA server (based on
NAI of MS), and sending the Access-Accept (or Access-Reject) of the home AAA server to

-755-
Chapter 18 ZXPDSS Packet Switching System

the PDSN, accomplishing authentication and authorization to MS packet data calls;

 Storing MS billing information transferred from the PDSN, and transferring to the
intermediate or home AAA server;

 Transferring user profile and QoS information (contained in Access-Accept) provided by the
home AAA server to the PDSN;

 In case of mobile IP version 2, the home AAA server, in response to the MS request, will
support static or dynamic HA assigning. If the MS requests dynamic HA assigning, the AAA
server in the service providing network will indicate the home IP network whether it supports
dynamic HA assigning. If the AAA server in the service providing network indicates that it
can assign HA, the home AAA server can select to let the visitor AAA server perform HA
assigning. Otherwise the home AAA server will assign HA.

1.1.1.1.14 Functions of home AAA server

 The visitor AAA server-based Access-Request performs authentication and authorization on

MS, using Foreign Agent Challenge authentication;

 Supporting statically assigned HA (designated by the MS);

 Capable of providing key information to the HA and the visitor AAA server, mainly the Pre-
shared key for IKE or the Mobile IP Foreign-Home Authentication Extension, used for safe
communications between the HA and FA (i.e. PDSN);

 The home AAA server is capable of deciding whether the FA uses the IP security to registered
information or tunnel data;

 Providing user profile and QoS information (carried in the Access-Accept) to the FA;

 In respect with the mobile IP version 2, the home AAA server will support statically
assigning or dynamically assigning the HA in response to the request of the MS. If the MS
requests a dynamic assigning of the HA, the AAA server in the service providing network
will indicate to the home IP network whether it supports dynamic assigning of the HA. If the
AAA server in the service providing network indicates that it can do so, the home AAA
server may select to let the visitor AAA server execute the assigning of the HA. Otherwise
the home AAA server will assign the HA.

1.1.1.1.15 Functions of intermediate AAA server

 Transferring request and response information between the visitor AAA server and the home

-756-
 Chapter 18 ZXPDSS Packet Switching System

AAA server. Three modes can be used:

1. Non-transparent. The intermediate AAA server checks the requests and response information,
and generates new requests and response information, and demands the intermediate AAA server to
shoulder the economic liability of the service network;

2. Transparent. The intermediate AAA server only transfers messages, but does not generate new
messages;

3. Changing direction. The intermediate AAA server takes another AAA server as a service AAA
server.

The transparent mode is used for this system.

 Capable of authenticating certificates (optional) transmitted between the service AAA and the
home AAA.

IP security can be used between the visitor AAA server, the intermediate AAA server and the
home AAA server, so as to ensure security of communications (optional).

17.4.4 Equipment Data

17.4.4.1 Rack Parameters

AAA server is composed of servers and disk array cabinets, which can be independent or placed in
racks.

Rack dimensions: 2,000 mm×600 mm×900 mm (H×W×D)

17.5 Networking Mode

As a single PDSN board has a limited processing capacity, the Cluster mode will be adopted in actual
networking solution.

The ZXPDSS provides two Cluster methods:

 Adjacent cluster: PDSNs are located in the same subnet

 Cluster in different places: PDSNs are located in different subnets

PDSN cluster has the following advantages:

-757-
Chapter 18 ZXPDSS Packet Switching System

 Intelligent selection

Participating the PDSNs in Cluster for the maintenance of global and unified MS access records.
Facilitating MS optimization access in case of switchover with the MS.

 Load sharing

Participating the PDSNs in Cluster for mutually informing their own load conditions. When the
MS requests access, the PDSN can decide, according to the selection tactics, whether to assign PDSN
access with a relatively light load to it.

As shown in Fig. 18-9, each PDSN board periodically informs other boards of the user load
information of the local board, so on the PDSN boards, the number of user connections and system
load information of other boards in the Cluster are collected. When there is a big load for the local
board (The number of user connections exceeds the specification or the system resources are
insufficient), an idle board can be searched according to the information collected on the boards, and
the PCF should be notified via the A11 reject signaling (which carries the IP address of the idle board
PDSN) to establish R-P conversation with a designated PDSN board, so as to implement the PDSN
Cluster load balance function.

PDSN1 pdsn#sh cdma pdsn selection session table

PCF1
 A11 RRQ (HA=1.1.1.1) CDMA PDSN selection session table summary:
-
PDSN Session count
 A11 RRP Reject , code=136 1.1.1.1 100
1.1.1.2 55
HA=1.1.1.2 1.1.1.1
 A11 RRQ (HA=1.1.1.2)
seconds
Keepalive(224.0.0.11) every 10

A11 RRP Accept PDSN2

# PDSN Configuration
 Standards compliant ip mobile secure [pcf addr] spi 100 key hex …
1.1.1.2
Utilizing A11 code 136 ip mobile secure 224.0.0.11 spi 100 key hex …

cdma pdsn selection

-session-tablesize 20000
cdma pdsn selection keepalive 10
cdma pdsn selection load
-balancing threshold 100

Fig. 18-9 PDSN cluster mode

17.5.1 Small-capacity Networking Mode (100,000 users)

Three PDSNs will be needed for the networking, as a single PDSN can process as many as 40,000
users.

-758-
 Chapter 18 ZXPDSS Packet Switching System

Fig. 18-10 Small-capacity networking mode (100.000 users)

17.5.2 Intermediate-capacity Networking Mode (150,000 users)

Four PDSNs will be needed for the networking as the processing capacity of a single PDSN is as many
as 40,000 users.

Fig. 18-10 Intermediate-capacity networking mode (150,000 users)

-759-
Chapter 18 ZXPDSS Packet Switching System

17.5.3 Large-capacity Networking Mode (600,000 users)

Fifteen PDSNs will be needed for the networking as a single PDSN can process as many as 40,000
users.

Fig. 18-11 Large-capacity networking mode (600,000 users)

17.6 System Configuration Principles

17.6.1 General Traffic Model

1. PDSN supports 120,000 data users, of which some 30% are online users, that is, there are
40,000 users that have PPP connection (dormant, activated), 25% of which are PPP connections that are
activated, i.e., 10,000 in number.

2. HA supports 1,6000,000 data users, of which some 30%*25% are online Mobile IP users, that
is, HA supports 120,000 online users.

Notes: The traffic model ratio is: The proportion between data users and online users is 10:3, the
proportion between online users and activated users on the PDSN is 4:1, and the proportion between
PDSN users and the Mobile IP users on the HA is 4:1

17.6.2 Module Calculation Methods

According to the above traffic module, the following instance of module calculation can be derived. In

-760-
 Chapter 18 ZXPDSS Packet Switching System

actual configuration module calculation, attention should be drawn to the specific traffic model of the
telecom operator.

1. In case of 200,000 PDSN users, the calculation is given below:

Number of PDSN modules required = 200,000 PDSN users ÷ Total data users supported: 120,000
= 2.

2. In case of 600,000 HA users, the calculation will be as follows:

Number of HA modules required = 600,000 HA users ÷ Total data users supported: 120,000 = 5.

3. If the number of AAA (RADUIS) users is 1,500,000, the calculation will be:

Number of RADUIS modules=Number of simultaneous users: 1,500,000 ÷ 1,000,000 a single

module RADUIS supports simultaneously

=2 pieces.

Exercises

1. Give a brief description of the composition, main features and interfaces of the ZXPDSS
packet data switching system;

2. Give a brief description of the working principles and performance indices of ZXPDSS-P100;

3. Give a brief description of the ZXPDSS-H100 working principles and performance indices;

4. Give a brief description of the working principles and performance indices of ZXPDSS-A100;

5. Give a brief description of the MAIN performance indices of ZXPDSS-P100, H100 and
A100;

6. Give a brief description of the main networking modes of ZXPDSS;

7. Give a brief description of the networking configuration of ZXPDSS for 800,000 users.

-761-
Chapter 19 Hierarchical Centralized Network Management Center (ZXCOMC)

Chapter 18 Hierarchical Centralized Network

Management Center (ZXCOMC)

Objectives

After studying this chapter, the readers should have a basic understanding of the ZTE hierarchic
centralized network management center (ZXCOMC).

Introduction

Given in this chapter is mainly a description of the protocols, the standards, the technical specifications,
the system architecture and the networking configuration modes of the ZTE hierarchic centralized
network management center (ZXCOMC).

18.1 Overview

As the NE management layer of the Telecommunications Management Network (TMN), the Operation
& Maintenance Center (OMC) emerged along with the TMN in compliance with the principles of the
TMN.

The management of telecommunications networks has been evolving together with the
development of telecommunications networks and the progress of science and technology. It has
basically undergone the following three stages: Manual managementDispersed computer aided
managementCentralized distribution management. The ultimate goal of telecommunications network
management is to make use of network resources to the maximum extent, reduce enterprises’ operating
costs, and provide users with quality and highly reliable telecommunications services. For this goal, the
telecom management network (TMN) provides a whole package of solutions, which simplifies the
management of a telecom operating enterprise with the hybrid network environment of multiple
companies, reduces the management cost, so that the enterprise can benefit more.

The basic conception of TMN is to offer an organized network structure to facilitate the
interconnection between all kinds of operating systems (OS), and between the operating systems and
telecom devices. TMN is a system employing the standard protocols and message interfaces to manage
information switching, and to support the planning, configuration, installation, operation and
organization of telecommunications networks and services.

As illustrated in Fig. 19-1, the five functional layers of TMN in descending order are:: Business
management layer, service management layer, network management layer, network element

-762-
 Chapter 19 Hierarchical Centralized Network Management Center (ZXCOMC)

management layer and network element layer. The OMC is located in the network element
management layer, and the network management layer and the network element layer are directly
related with it.

The business management layer comprises the management functions supporting the decision of
the whole network, e.g., generating economic analysis report, quality analysis report, setting of tasks
and goals, etc., and its user is the leading management of enterprises.

The service management layer comprises service provision, service control and supervision, and
billing processing related to the services, e.g., telephone switching service, intelligent network service,
mobile communications service, leased data line services, etc., and its user is the service operation
managers of enterprises.

The network management layer provides the management functions on the networks, e.g., network
traffic supervision and control, network protection route dispatching, trunk segment/route quality
supervision and measurement, comprehensive analysis and collaboration of multiple network element
faults, etc., and its user is the network organization managers of enterprises.

The network element management layer performs the operation and management on one or
multiple network elements, e.g., remote operation and maintenance on switches, and multiplexers, and
management on equipment software, hardware, etc. The network element layer is not held responsible
for the problems between the network elements. Its users are the operation and maintenance personnel
of the equipment.

As the network element in the telecommunications network, the network element layer
implements the basic functions of the telecommunications network. As the managed object, the layer
provides the primitive data for network management. In PLMN, the layer comprises MSC, VLR, HLR,
BSC, BTS, SC, etc.

The TMN specifies that Q3 interface should be used for the interworking of different layers.

The ZXCOMC CDMA operation and maintenance center system includes:

 ZXCOMC S100 (Operation & maintenance center for the switching subsystem)

 ZXCOMC R100 (Operation & maintenance center for the wireless subsystem)

ZXCOMC (V2.0) is organized in compliance with the TMN concept of the ITU-T, the system is
located on the NE management layer, and is also capable of providing NM layer function. It can
perform local operation and maintenance over all kinds of network elements such as BSC, BTS, etc.,
and provide operation and maintenance functions such as configuration management, fault
management, security management, performance management, etc.

-763-
Chapter 19 Hierarchical Centralized Network Management Center (ZXCOMC)

M anager
Transaction management layer
MO
Q3

Agent
Service management layer
M anager
MO
Q3

Agent
Network management layer
M anager
MO
Q3

Agent
NE management layer
M anager
MO
Qx

Agent
NE layer
MO

Fig. 19-1 Functional layers of TMN

18.2 Protocols and Standards

18.2.1 Protocols

 RMI

RMI protocol is a system of remote method invocation supported by Java technology. It enables
Clients to make use of the resources of Servers to fulfill the remote execution method, and then Clients
receive the returned results. As a matter of fact, RMI is a distributed object mode. Since it is not
necessary to design any protocol, it is easier to use RMI than SOCKET to develop distributed program.

A typical RMI application comprises the following parts:

Servers and clients: The object that implements RMI is the client object, and the corresponding
remote object is called the Server object. The Server program that creates Server objects: this program

-764-
 Chapter 19 Hierarchical Centralized Network Management Center (ZXCOMC)

is used to create Server objects. It registers the corresponding object, so that users are able to access the
Server object according to the registered name.

Interface: The interface helps the Client end understand the working range of the Server end. That
is to say, it lists all the methods that can be executed on the Server. The program on the Client end is
required to search out the methods of the defined type, otherwise, it is impossible to invoke the Server
functions.

Stub: it provides the Client program with the local code bound to the remote Server object. The
stub will be downloaded to the Client when the Client program initially invokes the remote methods,
aiming at decoding and transmitting the request of the Client to the Server. After running the current
invocation, the Server sends the results back to the stub, which starts the decoding and then sends the
decoded results to the Client program. The programmer that is responsible for developing the Client
programs does not have to acquire the specific progress. He can use the remote object the same way as
he uses a local one.

 BSS network element communications protocol

The foreground/background communications of ZXC10-BSS network elements employs the

asynchronization Socket communications protocol of TCP/IP. This protocol includes link maintenance,
message management, and route management. It supports automatic NE discovery function, and it is
perfectly adaptable to the environment and reliable for communications.

The BSS network element communication module provides a powerful link maintenance function.
No matter the foreground NE or ZXCOMC R100(V2.0), so long as it is normally started, a
communications link will be automatically established. In normal conditions, both sides of the
communications check the links regularly. If it is detected that a link is broken, BSS NE
communications protocol allows reestablishing the link at the same time the information is temporarily
saved.

 MSS network element communication protocol

The foreground/background communications of ZXC10-MSS network elements employs the

asynchronization Socket communication protocol of TCP/IP. This protocol includes link maintenance,
message management, and route management. It supports automatic NE discovery function, and it is
perfectly adaptable to the environment and reliable for communications.

The MSS network element communication module provides powerful link maintenance function.
No matter the foreground NE or ZXCOMC S100(V2.0), so long as it is normally started, a
communications link will be automatically established. In normal conditions, both sides of the
communication check the links regularly. If it is detected that a link is broken, MSS NE
communications protocol allows reestablishing the link at the same time the information is temporarily
saved.

-765-
Chapter 19 Hierarchical Centralized Network Management Center (ZXCOMC)

18.2.2 Standard

The ZXCOMC is designed in compliance with the following standards:

1. X.700 Management Framework for Open Systems Interconnection (OSI) for CCITT
Application

2. X.701 Information Technology – Open Systems Interconnection – Systems Management

Overview

3. X.710 Common Management Information Service Definition for CCITT Applications

4. X.711 Common Management Information Protocol Specification for CCITT Applications

5. X.720 Information Technology – Open Systems Interconnection – Structure of Management

Information : Management Information Model

6. X.721 Information Technology – Open Systems Interconnection – Structure of Management

Information : Definition of Management Information

7. X.722 Information Technology – Open Systems Interconnection – Structure of Management

Information: Guideline for the Definition of Managed Objects

8. X.730 Information Technology – Open Systems Interconnection – System Management: Object

Management Function

9. X.731 Information Technology – Open Systems Interconnection – System Management: State

Management Function

10. X.732 Information Technology – Open Systems Interconnection – System Management:

Attributes for Representing Relationships

11. X.733 Information Technology – Open Systems Interconnection – System Management:

Alarm Reporting Function

12. X.734 Information Technology – Open Systems Interconnection – System Management: Event
Report Management Function

13. X.735 Information Technology – Open Systems Interconnection – System Management: Log
Control Function

14. X.738 Information Technology – Open Systems Interconnection – System Management:

Summarization Function

15. X.739 Information Technology – Open Systems Interconnection – System Management:

-766-
 Chapter 19 Hierarchical Centralized Network Management Center (ZXCOMC)

Metric Objects and Attributes

16. M.3010 Principles for a Telecommunications Management Network

17. M.3020 TMN Interface Specification Methodology

18. M.3100 Generic Network Information Model

19. M.3200 TMN Management Services and Telecommunication Managed Areas: Overview

20. M.3300 TMN Management Capability Presented at the F Interface

21. M.3400 TMN Management Function

22. Q.811 Lower Layer Protocol Profiles for the Q3 and X Interface

23. Q.812 Upper Layer Protocol Profiles for the Q3 and X Interface

24. Q.821 Stage 2 and Stage 3 Description for the Q3 Interface – Alarm Surveillance

25. Q.822 Stage 1, Stage 2 and Stage 3 Description for the Q3 Interface – Performance
Management

26. Refer to ETSI GSM 12 system specifications

27. Refer to the “GSM network management system-LNMS-PNMS interface specifications”

issued by the Ministry of Information Industry

28. Refer to and comply with the basic principles for ISO TMN system specifications

29. Refer to the GSM management information model specifications

30. Implement “China Unicom’s technical systems for CDMA 800MHz digital cellular mobile
communications networks”

31. Implement the OMC part of the “China Telecom’s CDMA Great Wall mobile network
technology system YDN 044-1997”

18.3 Technical Specifications

18.3.1 System Specifications

The main technical specifications of XCOMC (V2.0) are as follows:

-767-
Chapter 19 Hierarchical Centralized Network Management Center (ZXCOMC)

 Capable of simultaneously managing 10 NEs.

 Supporting cascaded networking

 Managing 60 NEs simultaneously under the circumstances of cascading

 With its transportability, the system can simultaneously support the Unix platform and the
Windows platform

 Supporting a variety of databases, e.g., Oracle, SQL Server, etc.

 With its expansibility in structure, the system adapts to the requirements on functional
expansion for cdma2000 OMC

 Supporting the standard Q3/Corba interfaces for the upper-level network management system

18.3.2 Environmental Specifications

18.3.2.1 Temperature and Humidity Requirements

The tested values of the working temperature and humidity in an equipment room refer to the values
acquired under the condition that there is no protection board either in the front or at the back of the
server rack, and the test is conducted 1.5 m above the floor and 0.4m away from the front of the
equipment, and they should meet the following requirements:

 Long-term working condition:

Temperature: 15°C~25°C

Humidity: 30%~70%

 Short-term working conditions:

Temperature:0°C ~45°C

Humidity: 20%~90%

The short term operating condition means that the monthly continuous operating time should be
no more than 48 hours and the annually accumulated working time should be no more than 15 days.

18.3.2.2 Power Supply Requirements

The computer system’s power supply is the 220 VAC±10%at 50 Hz. They are usually connected to the

-768-
 Chapter 19 Hierarchical Centralized Network Management Center (ZXCOMC)

mains power supply and added with UPSs or inverters. The power supply system to the server requires
special protection, because the data in the server are liable to damage once the power is off, and even
the whole system might be paralyzed in serious cases.

The distortion ratio of the voltage waveform of the standby power generator is 5% to 10%.

18.4 ZXCOMC System Architecture

18.4.1 Overall Architecture of the XCOMC System Hardware

ZXCOMC(V2.0) is mainly composed of three parts: server units, operation terminals and
communications units. The overall structure of the XCOMC(V2.0) is shown in Fig. 19-2.

Upper level OMC

Disk array

Workstation Workstation
OMCServer OMCServer
Cluster disk array
server
TCP/IP Communications network

Communications
element

OMC1 OMC2 OMC3 OMC4

Fig. 19-2 Hardware structure of ZXCOMC (V2.0)

18.4.2 Mechanical and Electrical Characteristics

The server unit in ZXCOMC(V2.0), which is composed of servers and disk cabinets, can be located in
a rack, or placed independently. The parameters of the rack are as follows:

 Dimensions: 2000 mm × 600 mm × 950 mm (height × width × depth), the height shall be
2200 mm with base.

 Weight: <300 kg.

-769-
Chapter 19 Hierarchical Centralized Network Management Center (ZXCOMC)

 Power supply: 220 V±10%, 50 Hz±5%, waveform distortion <5%.

 Power consumption: 1500W.

The structural and workart characteristics of server rack:

 Solid structure, rack skeleton welded into a whole with formed steel, with enough rigidity
and strength. In compliance with the standard for 19-inch cabinet installation.

 The structure and the outlook are consistent with the switch cabinet of ZTE Corporation,
showing the consistency of ZTE products.

 Bright colors of internationally chic systems: natural combination of sea blue and gray, so
that the cabinet looks tidy, simple and elegant.

 Front and back doors for convenient opening, side boards hung on both sides for convenient
assembling and disassembling, facilitating cabinet installation, testing and maintenance.

 Clear height of 42U within the server cabinet, blank panels installed for the blank areas, 1U
blank panels employed between two kinds of equipment, with good cooling result.

 Dual return-circuit power supply, in compliance with internationally certified power boards,
dedicated internal grounding copper bars, with high reliability.

18.4.3 ZXCOMC System Software Structure

According to the TMN function system, ZXCOMC (V2.0) can be divided into such subsystems as
workstation function WSF, local management function OMF, NE adaptation function NAF, Q3 access
function QAF and system support function SSF. The subsystems belong respectively to the system
support layer and the application service layer, as shown in Fig. 19-3.

NMC

Q3/Corba
QAF

Application QX or internal interface

service layer
OMF Internal
F Qx F interface
WSF MAF MIF NAF NEF
G

SSF

Fig. 19-3 System functional structure distribution

-770-
 Chapter 19 Hierarchical Centralized Network Management Center (ZXCOMC)

18.4.4 System Support Function Subsystem (SSF)

The support subsystem is located at the bottom layer of the ZXCOMC (V2.0) above the operating
system. It provides other subsystems with services such as groupware management, network
communications, file transfer, software timing, Java/C message conversion, database access, etc. SSF
shields off the complexity of the operating system, provides a unified distributed message
communications mechanism and a stable process running environment for the upper-level application
service layer.

The support subsystem provides the following subfunctions:

 Process management

 Communications management

 Software timing

 System monitoring

 Groupware management

 File transfer

 Debugging printing

18.4.5 Workstation WSF Subsystem

As an application at the client side, WSF provides the F interface and the G interface required by TMN.
The G interface is located between the client side and the operator, which provides convenient and
direct graphics, as well as character interfaces for users. The F interface is a port between the client side
and the server. The main function of WSF is to provide users with all kinds of operation terminals,
including graphic interfaces and character terminals, and different types of user terminals are
transparent for application servers. WSF shall perform correct analysis on the MML commands input
by the user and the results returned from the server, and display the results to the user.

WSF furnishes the following subfunction modules:

 User Applications Function (UAF)

 Window Applications Management (WAM)

 Command Resolving Management (CRM)

 Link Control Module (LCM)

-771-
Chapter 19 Hierarchical Centralized Network Management Center (ZXCOMC)

The architecture of various subsystems and messages flow are shown in Fig. 19-4.

UAF
FM WAM
G interface F interface
PM
Subscriber WCM LCM MAF
SM

CM CRM

Fig. 19-4 Architecture of WSF subsystem and messages flow

The Window Control Module (WCM) is the first started module for the WSF program, which
controls the whole process from login to logout. In case of successful login, it will start each of the
application programs according to the authority information, and monitor the running of these key
application programs.

18.4.6 Operation & Maintenance Function (OMF)

As the core of the ZXCOMC (V2.0), the OMF subsystem interacts with the WSF via the F interface,
with the upper-level NM adaptation functional module via the Qx or an internal interface, and with the
NE adaptation functional module via an internal interface.

OMF furnishes the following functional modules:

 Session management function

 Management Applications Function (MAF)

 Management Information Function (MIF)

18.4.7 Network Element Adaptation Function (NAF)

NE adaptation (NAF) function implements data exchange between the NE system and the ZXCOMC
(V2.0).The NAF module converts the data flow from an NE into a manageable internal message format
corresponding to MO in the ZXCOMC (V2.0), and converts the internal messages from the ZXCOMC
(V2.0) into a corresponding internal message format that can be identified by NEs, and sends the
format to the NE system.

The NE system can be either accessed directly via the foreground equipment or via the server

-772-
 Chapter 19 Hierarchical Centralized Network Management Center (ZXCOMC)

programs of the OMM system. The access is fulfilled via the OMM server at the first phase. For future
NE devices, the ZXCOMC(V2.0) can make the NAF module directly connected with the NE, or make
the NAF module embedded in the NE system.

For the NAF development, it should be taken as the principles to adapt to the NE system as much
as possible at the side facing the NE, and to avoid introducing external peculiarity to the
ZXCOMC(V2.0) at the side facing the ZXCOMC.

Fig. 19-5 shows the internal structure of NAF. NAF mainly includes Configuration Management
(CM), Performance Management (PM), Fault Management (FM), etc.

NAF
CM

MIF PM OMM server or NE

FM

Fig. 19-5 NAF architecture

18.4.8 Software Environment Requirements

Operating system:

 Windows NT Server 4.0 + SP6 standard edition/enterprise edition Chinese version/English

version

 Windows NT Workstation 4.0 + SP6 Chinese version/English version (WSF environment)

 Windows 2000 professional edition/server edition/advanced server edition/data center service

edition Chinese version/English version

 Windows XP professional version Chinese version/English version

 SUN Solaris 8 Chinese server edition/English server edition

Database system:

 MS SQL Server 2000 standard edition/enterprise edition Chinese version/English version

 Oracle 8.16 and above, Chinese version/English version workgroup edition/enterprise

-773-
Chapter 19 Hierarchical Centralized Network Management Center (ZXCOMC)

System software:

 J2SDK 1.3.1 or above, JRE1.3.1 or above, Sun JDMK4.2 or above

Other software:

 JDBC Driver for MS SQL Server or Oracle 8i, etc.

18.5 Service Functions

Services that the ZXCOMC(V2.0) provides are management services, which are described in the aspect
of the operations implemented on the managed networks by users, such as, operation, organization and
maintenance. The ZXCOMC(V2.0) mainly provides four management services: Performance
management, fault management, configuration management and security management, in addition,
there are also the auxiliary report printing system.

18.5.1 Introduction to Service Functions

18.5.1.1 Configuration Management

The ZXCOMC(V2.0) configuration management subsystem exercises overall control on the

NE/network equipment configuration. It involves NE identification, and collection of data relevant to
the NE configuration from the network elements. The task of configuration management is to design
the capacity of network infrastructures, and to provide system configuration data according to the
services provided in the network plan and on the basis of traffic load as well as demand prediction. The
configuration concerns all kinds of resources (system physical equipment resource, wireless resource,
SS7 link, land circuit resource, etc.). It is responsible for monitoring and controlling some aspects of
the network elements, and changing the service status of network elements or that of their components.
With its direct and friendly graphic interfaces, it provides various configuration data required for
ensuring the normal operation of ZXC10 NE, such as, system user capacity, inter-office signaling mode
and supported service type, etc. The configuration management system fundamentally determines the
operation modes and states of ZXC10, which is the core of the entire CDMA switching mobile network
element system, and the busiest part of the background maintenance system.

The configuration management flow is shown in Fig. 19-6.

The ZXCOMC(V2.0) configuration subsystem exercises overall monitor on the NE/network

equipment configuration. WSF of configuration management sends messages to MAF via F interface,
and MAF acquires required data from MIB via Qx interface, which are displayed on the WSF interface.

-774-
 Chapter 19 Hierarchical Centralized Network Management Center (ZXCOMC)

F inter face Qx inter face

WSF MAF
configuration configuration MIF MIB
management management

Fig. 19-6 Configuration management flow chart

18.5.1.2 Fault Management

Fault management functions include alarm function, alarm query/deleting function, alarm setting
function and rack diagram display function.

The user operations on the Client interface of WSF fault management, such as alarm query, alarm
setting, etc. undergo the following process: first WSF fault management Client forms an F interface
man-machine command, which is sent to WSF session part, and then to MAF session part, and then to
MAF fault management part for processing. After processing, the result is returned along the same
route. The alarm management WSF user operation flow chart is shown in Fig. 19-7.

WSF FM WSF session MAF session MAF FM

Fig. 19-7 Alarm management WSF user operation flow chart

18.5.1.3 Performance Management

The ZXCOMC (V2.0) performance management subsystem, which is designed in conformity with the
international standards, reflects the performance specifications of the mobile system via measurement
and statistics of the system performance parameters and traffic data, to the business department for
reference. The maintenance terminal can define the performance measurement flexibly. A performance
measurement job includes the start/end time, days of duration, measurement object set and granularity
period. The maintenance terminal can generate, delete, modify and observe in real time the
performance measurement. The performance measurement contents include registration, short
messages, releasing, calling, switching, system performance, resources, supplementary channel statistic
data, packet control data, etc. Performance management is distributed on a couple of modules, such as
WSF, MAF NAF and NE. Fig. 19-8 shows the operation model.

The ZXCOMC (V2.0) performance management subsystem provides the following main
functions:

Task management

-775-
Chapter 19 Hierarchical Centralized Network Management Center (ZXCOMC)

Data query

WSF MAF NAF NE

performance performance MIF performance performance
management management management management

DB

Fig. 19-8 Performance management operation flow chart

18.5.1.4 Security Management

Security management includes two parts: the security management Client in the WSF module, and the
security management Client in the MAF module.

The WSF security management part provides user interfaces, presents security information in
graphic interface mode to users, and presents the security management capability to users. Its user
interface is friendly, visual and easy to operate.

The MAF security management part implements security management services. On one hand, it
performs security information management, on the other it provides user authentication and authority
services, and exposes them in the form of interfaces to other applications, such as session management,
configuration management, etc.

Security management includes user management and role management. Besides general
information, a user’s authority information also consists of his roles, that is, a user has multiple roles. A
role defines an operable man-machine command set. It relies on users to present related authority
information to the operator.

18.5.1.5 Report Print System

The ZXCOMC(V2.0) report printing system has the following main functions: offering data statistics
function for fault management and performance statistics, so that users can print the desired data in
time in the report form.

-776-
 Chapter 19 Hierarchical Centralized Network Management Center (ZXCOMC)

18.6 Networking Modes and System Configuration

18.6.1 Networking Modes

The networking architecture of the ZXCOMC(V2.0) is shown in Fig. 19-9.

Layer 3 Provincial-level NM
OMC-R OMC-S center (POMC)

Layer 2
Prefecture-level NM
OMC-R OMC-S OMC-R OMC-S center (LOMC)

Layer 1
NE operation and
OMM OMM OMM OMM maintenance (OMM)

MSS1 MSSn MSS1 MSSn NE layer

Fig. 19-9 Schematic diagram of ZXCOMC(V2.0) 3-layer networking architecture

Fig. 19-9 is a schematic diagram of the ZXCOMC (V2.0) network management 3-layer
networking architecture, which is composed of NE operation and maintenance OMM, local-level NM
center LOMC, and provincial level NM center POMC. The OMC-S site can be a centralized point of
the switching system and the base station, namely, between the LOMC and the POMC. The OMC-S
and OMC-R can be either integrated or independent of each other. LOMC can control about 10 MSSs
network elements, while POMC can supervise around 60 MSSs.

In case of relatively few network elements, a POMC can be constructed in a two-layer mode as
shown in Fig.7-10, with an LOMC omitted, starting from OMM to construct the POMC directly.

OMC-R OMC-S Layer 2 Provincial-level NM

center (POMC)

Layer 1 NE operation and

OMM OMM OMM OMM
maintenance (OMM)

MSS1 MSSn MSS1 MSSn NE layer

Fig. 19-10 Schematic diagram of ZXCOMC (V2.0) 2-layer networking architecture

-777-
Chapter 19 Hierarchical Centralized Network Management Center (ZXCOMC)

18.6.2 System Configuration

18.6.2.1 OMM Configuration

Each OMM manages one NE (such as MSC, BSC, HLR or MSC/HLR two-in-one). It consists of 2
OMM Servers, 2 maintenance consoles and 1 alarm box. OMM structure is shown in Fig. 19-11.

Fig. 19-11 OMM Structure

Use of two servers:

When no centralized network management is available (namely, without LOMC and POMC in
Fig. 19-8): One serves as a database server, i.e. the data center; the other serves as an application server,
i.e. the processing center.

When there is integrated network management as Fig. 19-9 or 19-10 shows, namely, when data
need to be sent to the LOMC or POMC, one of the servers can be used as the network management
front processor.

The OMM Server is of a PC server type.

18.6.2.2 OMM Remote Maintenance Configuration

The OMM has a powerful remote operation and maintenance function, allowing the extension of the
OMM client via E1 (with at least 4 time slots configured), DDN (128K and up), PSTN, etc., so that
remote management operations can be implemented completely, as shown in Fig. 19 through Fig. 11.

Fig 19-12 shows three pull-away maintenance modes, i.e., E1 pull-away, DDN pull-away, and
PSTN dialing pull-away.

The OMM Server is a PC server.

-778-
 Chapter 19 Hierarchical Centralized Network Management Center (ZXCOMC)

18.6.2.3 OMC Configuration

The ZXCOMC (V2.0) NM system implements centralized network management on multiple OMMs
(each LOMC can manage 10 NEs, a POMC, 60 NEs), and it is composed of servers, workstations and
communications devices, as shown in Fig. 19-13. The OMC server is configured as a dual disk array
server. The communications equipment consists of routers and interface converter (framer), and it
communicates with the lower OMM. Relevant equipment should be configured in OMM.

OMC can be configured in a common mode (Windows system) and an advanced mode (Unix
system) in accordance with the scale (the number of NEs to be managed) Usually the common
configuration is adopted for a LOMC, and the advanced configuration for a POMC.

Router
Remote Remote Remote
maintenance maintenance maintenance
console MODEM HUB
console console
MODEM MODEM
DDN
Router
PSTN
Remote
MODEM HUB maintenance
console
MODEM
MODEM MODEM
MODEM
Router
Router Remote
E1
SDH HUB maintenance
Alarm box Framer Framer console
NE

HUB
E1

Data Router

Remote
Maintenance Maintenance Framer HUB maintenance
OMMServer OMMServer
console console console

Fig.19-12 Configuring remote OMM structure

-779-
Chapter 19 Hierarchical Centralized Network Management Center (ZXCOMC)

OMC 网管中心
OMC NM center

工作站
Workstation 工作站
Workstation
OMCServer

HUB

Framer
成帧器 Modem路由器
Router 成帧器
Framer Modem

OMM1 OMM2 OMM3 OMM4

Fig. 19-13 ZXCOMC NM system OMC hardware structure

Exercises

1. Give a description of the component parts of the TMN function, from top down.

2. Give a brief description of RMI parts.

3. Give a description of the main technical specifications of the ZXCOMC.

4. Give a description of the ZXCOMC system architecture.

5. Give a brief description of the performance management functions in the ZXCOMC.

6. Give a description of the ZXCOMC networking modes.

7. Give a description of the configuration management functions in the ZXCOMC.

8. Give a description of the ZXCOMC working software environment.

-780-
Chapter 20 Introduction to ZTE cdma2000 ix Services

Chapter 19 Introduction to ZTE cdma2000 1x Services

19.1 Introduction to ZTE cdma2000 1x Services

19.1.1 Basic Services

The basic services (mobile telecommunications services) the ZTE cdma2000 1x mobile
communications system offers mainly include mobile telephone service, emergency call service and fax
service, etc.

 Mobile telephone service

 Mobile telephone service is one of the mobile management services defined by the cdma2000
1x mobile communications system specifications. It is the most extensively used service in
the cdma2000 1x system.

 Mobile telephone service offers a voice communications capability for mobile subscribers in
the cdma2000 1x system to communicate in voice with other mobile subscribers in the
cdma2000 1x system or in other telecommunications networks (such as: GSM, PSPDN,
PSTN, ISDN, etc.).

 Emergency call service

 Emergency service permits mobile subscribers to initiate calls to the nearby emergency call
center (such as 110 police call in China).

 Emergency service, one of telecommunications services, is similar to telephone service, but

with relatively simpler and faster call establishment.

 The cdma2000 1x system gives a definition to all emergency services, though carriers still
can set their emergency call numbers according to the local conditions.

 Emergency calls will be directed to the nearby emergency call center in the mode of cell-
oriented routing mode.

 Fax service

 Fax service offers a graphic and character (letter) communications capability for mobile
subscribers in the cdma2000 1x system to communicate in graphics or characters (letters)

-782-
 Chapter 20 Introduction to ZTE cdma2000 1x Services

with other mobile subscribers in the cdma2000 1x system or in other telecommunications

networks (such as: GSM, PSPDN, PSTN, ISDN, etc.).

19.1.2 Supplementary Services

The ZTE cdma2000 1x mobile communications system is capable of realizing supplementary mobile
services specified in the national standards. Services of this type include:

 Call forwarding  Roaming barring

－CFB Barring roaming
－CFNA Barring roaming to a designated area
－CFU  Call Waiting (CW)
－CFD  CT
 Number identification  Three-party conversation (3WC)
－CNIP  CC
－CNIR  PL
 Incoming call barring  User group prompt (FA)
－PCA  Message Waiting Notification (MWN)
－Selective Call Acceptance (SCA)  Voice message recovery (VMR)
－Do-Not-Disturb Service (DND)  RFC
 Outgoing call barring  Mobile station access hunting (MAH)
－Subscriber password access (SPINA)  Partition service charging
－Subscriber password interception (SPINI)  Malicious call tracing

 Call forwarding

 CFB

 When a subscriber is busy, this service allows the subscriber to forward his/her incoming call
to another preset phone number, or to the subscriber voice mailbox.

 When subscriber A dials up subscriber B, the call can be forwarded to subscriber C, so long
as the following conditions are satisfied:

 Subscriber B is authorized to CFB service, and the forward-to number is subscriber C.

 If subscriber B is in conversation.

 Subscriber B has no call waiting service.

 CFNA

-783-
Chapter 20 Introduction to ZTE cdma2000 ix Services

 This service permits a subscriber to forward his/her incoming call to another preset phone
number, or to the subscriber voice mailbox under the following circumstances.

 The system fails to page the MS or there is no answer from the subscriber after long ringing.

 The subscriber is authorized to DND.

 The mobile phone set is off.

 The subscriber is in an outgoing call status (caused by long-time no outgoing or incoming

call, though the mobile phone set is on).

 The mobile phone set is on, but no paging message signal is received from the BTS.

 The mobile phone set rings without subscriber answer.

 There is no response to the waiting notification.

 CFU

 This service permits a subscriber to forward all his/her incoming calls to another preset phone
number, or to the subscriber voice mailbox.

 When the system is performing this service and transferring an incoming call, a prompt tone
will be received on the subscriber mobile phone set.

 CFD

 This service permits a subscriber to forward all his/her incoming calls to another preset phone
number, or to the subscriber voice mailbox under the following circumstances.

 The subscriber is authorized to the DND service.

 The mobile phone set is off.

 The subscriber is in an outgoing call status (caused by long-time no outgoing or incoming

call, though the mobile phone set is on).

 The mobile phone set is on, but no paging message signal is received from the BTS.

 The mobile phone set rings without subscriber answer.

 There is no response to the waiting notification.

 The called is making a call, and is not authorized to call waiting service.

-784-
 Chapter 20 Introduction to ZTE cdma2000 1x Services

 Number identification:

 CNIP

 This is a service with the subscriber as the called.

 This service provides the caller number to the called.

 When the system is performing a call forwarding service, the caller number is displayed on
the mobile phone set of the forward object subscriber.

 This supplementary service should be activated or deactivated at the network side at the
authorization by the carrier, and no mobile phone set can operate it.

 CNIR

 This is a service with the subscriber as the caller.

 When a caller subscriber is authorized to the CNIR service, the caller number will not be
displayed on the mobile phone set of the called.

 When both a caller subscriber and a called subscriber are authorized to the CNIR service, the
called subscriber CNIR will function, so that the caller number will not be displayed on the
mobile phone set of the called.

 Incoming call barring

 PCA

 In using this service, subscribers can selectively accept some calls and reject other calls.

 When this service is activated, the caller subscriber will be requested to provide a password
during the connection process.

 No connection will be executed unless the correct password in input by the caller. Otherwise,
the call will be directed to the voice mailbox or the preset forwarding number.

 Selective Call Acceptance (SCA)

 This service permits subscribers to selectively accept some calls and reject other calls.

 When this service is activated, subscribers enter a caller number that is accepted to the
system.

 After receiving the incoming call, the system will make a comparison with the preset number.
If not the same, the call will be rejected or will be forwarded to the voice mailbox or a preset

-785-
Chapter 20 Introduction to ZTE cdma2000 ix Services

forwarding number.

 DND

 When this service is activated, the subscriber will reject any incoming call, and the system
will no longer issue a call forwarding notification tone or message waiting notification tone
to the subscriber.

 When a subscriber is authorized to the CFU service and the service is activated, the system
will perform the CFU service.

 Outgoing call barring

 Subscriber password access (SPINA)

 This is a method for preventing illegal use or cloning of mobile phone sets.

 When this service is activated, only by entering the correct password can the caller access the
network.

 SPINI

 This is another method for preventing illegal use or cloning of mobile phone sets.

 When this service is activated, only by entering the correct password can a designated initial
call or service operation (such as a toll call) be performed.

 Roaming barring

 Barring roaming

 When this service is activated, the mobile subscriber can make calls within the local area
only.

 Barring roaming to a designated area

 When this service is activated, and the mobile subscriber roams to a designated area, no
communications can be conducted.

 Call Waiting (CW)

 When a subscriber is busy, this service will notify the subscriber that there is a new incoming
call, and the subscriber can select to accept or reject the new call.

 If the subscriber answers the new incoming call, a switchover between the two conversations
can be performed.

-786-
 Chapter 20 Introduction to ZTE cdma2000 1x Services

 CT

 During a two-party calling, one of the subscribers can transfer the call to a third party and
disconnect himself, so that the other subscriber will continue the conversation with the third
subscriber.

 Calls that are transferred can either be incoming calls or outgoing calls.

 Three-Way Calling (3WC)

 This service makes it possible to include a third party into the already established two-party
calling, so as to implement three-party conversation.

 This service can be authorized or activated by carriers only, but no subscriber should be
permitted to modify it.

 Conference Call (CC)

 This service permits a multi-subscriber conversation. A subscriber that is authorized to this

service can hold a call conference as a main control subscriber at any time. The main control
subscriber can add conference participants by means of entering phone numbers one after
another.

 If any non-main control subscriber exits the conference, no influence will be imposed on
other participants;

 If the main control subscriber releases, the conference call will be terminated, and all the
conversations will be released;

 The main control party can use the “Delete the latest participant” to release a participant, and
all the participants can be release din this way.

 Preferred language (PL)

 In using this service, a subscriber can select a language used in the network service according
to his/her own requirement.

 When this service is activated, the network should provide services to the subscriber in the

-787-
Chapter 20 Introduction to ZTE cdma2000 ix Services

language the subscriber has selected.

 User group prompt (FA)

 When this service is activated, and an incoming call is introduced to a certain group of
numbers, ringing will be effected in all the subscribers within the group of numbers. The
subscriber that answers first will be connected, while others’s ringing will be stopped.

 The registration and authorization of this service will be accomplished at the same time, and
the registration includes group number registration and group user registration.

 In case all the subscribers in the group are inaccessible, the group number will be assumed as
inaccessible.

 Message Waiting Notification (MWN)

 With a certain prompt tone, this service notifies subscribers that there is a voice mailbox
message or short message waiting to be viewed.

 For example: When there are two short messages, the system will notify you: “There are two
short messages for you”.

 VMR

 In using this service, subscribers can recover messages from the voice mailbox system.

 For example: This function allows you to attain the contents in the voice mailbox: “Please go
to XX Mobile Communications Company, where the ZTE802 CDMA mobile phone sets, the
world first pattern of mobile phone sets with an independent card, are on sale, with limited
number of the sets”.

 Remote service control (RFC)

 Via this service, subscribers can conduct certain service operations at other terminals (such as
fixed phone or other mobile phone sets).

 Subscriber dial-up remote service control RFC access code. It can start to operate this
service.

-788-
 Chapter 20 Introduction to ZTE cdma2000 1x Services

 The remote service control RFC code will be set by the carrier, and the terminal should not
modify it.

 The RFC PIN code will be set by the carrier, and the terminal should not modify it.

 Mobile station access hunting (MAH)

 It refers to a user group, which is formed by a number of users in relationship with each
other. Subscribers in the group can be divided into two types: Leading subscribers and
common subscribers.

 When a caller subscriber calls a leading subscriber in the group, the first subscriber in the
MAH group will be called according to the group property of the subscriber. If there is
response from the subscriber, the call will be completed. Otherwise, in case that the call fails
because the first subscriber is busy or any other reason, the next subscriber will be called, and
so on and so forth, until the call succeeds, or it fails to call all the subscribers in the group.

 Sector service accounting

 Sector service accounting is an accounting service with special rate.

 Settlement with different rates can be performed according to different subscribers in

different places, different BTS transceiver BTS or different sectors that are accessed to the
CDMA network system.

 The rate can either be lower or higher than the ordinary rate.

 For example: The rate of BTS access network for a subscriber in place A is
RMB2.00/min./toll, while it is RMB1.00/min./toll in place B.

 The calling location can be determined via transferring the subscriber access information by
the local mobile switching office to the operation and maintenance center, from where further
to the billing center.

 By using the sector-based service, rates can be set in a flexible way according to the specific
conditions in the calling place, hence attracting subscribers, and higher benefits for the
carriers.

 Malicious call tracing

-789-
Chapter 20 Introduction to ZTE cdma2000 ix Services

 This service is to prevent a caller subscriber from initiating malicious calls to a called
subscriber for purpose of disturbance or blackmail.

 With this service, information of the number (though caller number display barring has been
activated), route information, location of a caller subscriber who makes a malicious call can
be obtained via the network operation and maintenance console.

 After the malicious caller subscriber hooks on, his/her information will still be displayed on
the operation and maintenance console.

 For example: Malicious caller: “Please rush RMB100,000 to so-and-so park”

Via this service, the called subscriber will immediately know the information of the malicious
caller subscriber and the location, thus facilitating the police in cracking down the blackmail case.

 The service will minimize the damages caused by malicious calls.

19.1.3 Packet Data Service

The packet data service implemented by the ZTE cdma2000 1x mobile communications system
provides a reliable guarantee for entering the “Information highway”. Services of this type include:

 Personal door

 This service is launched on the basis of mobile Internet, realizing a real wireless door website
to provide services for the carriers and subscribers.

 The carriers can attract more subscribers via the door website introduction system.

 Accessing the web pages on the WAP website, receiving comprehensive news, weather
forecast, commercial reports, etc.

 Providing E-mails, information service, chat room, club, BBS, etc.

 Management can be exercised via a personal door website on personal information, such as
lottery, shopping, booking of cultural articles, auction, train ticket and air ticket service, horse
racing, etc.

 Mobile commerce

 Realizing electronic commerce, mobile shopping, mobile online banks, online securities,
foreign currency transaction, insurance and financial matters, etc.

-790-
 Chapter 20 Introduction to ZTE cdma2000 1x Services

 Offering understanding of, at any time, information of securities, financial institutions,

insurance/credit/real estate services, enterprise solutions, etc., so that you can grasp
commercial opportunities to win afar.

 Realizing mobile office (MO), mobile printing (including mobile VPN), mobile fax, etc., and
providing a mobile value-added service with independent network type and terminal
equipment.

 Multimedia service

 Providing multimedia information relating with entertainment, etc., online VOD/AOD,

movie/TV preview, MTV, etc.

 Providing multimedia information relating with games, etc., humor/caricatures/fiction,

luck/dream analysis/psychology, actor/actress information, marriage/appointments, etc.

 Providing information on learning, employment, sports/casual activities, news/weather

forecast, health/keeping fit, mobile magazines, convenient phone numbers, etc.

 Making available an educational system, providing mobile classrooms, network electronic

books, etc.

19.1.4 Short Message Services

Besides the basic services of point-to-point short messages, manual station, automatic station, etc., the
ZTE ZXSC100 CDMA short message center system also provides subscribers with abundant and
diversified short message value-added services. According to their features, short message value-added
services can be divided into interworking type, prompts, information, finance, broadcaste, and other
special services, mainly including:

 Interworking type
GSM/CDMA network interworking Paging dual network interworking
Short message international interworking
gateway
 Prompt
Welcoming speech to roaming subscribers Call charge service
Short message arrears reminding Missing conversation prompt
 Information type
News Weather and flight forecast

-791-
Chapter 20 Introduction to ZTE cdma2000 ix Services

Jokes English-Chinese translation

Various real-time services required by
Integrated information station
carriers
 Financial type
Mobile banks/securities Stocks service
 Broadcast type
Cell user broadcast All-user broadcast
Short message VPN
 Other value-added services
Closed-user group Prepaid subscriber short messages
Voice mailbox announcement Internet service
E-mail service GPS
EMS short messages (pictures, ringing
WAP gateway function
download)
Web subscription integrated information
Charge-free mobile phone set
station service
Automatic vendor Mobile phone lottery
Handwritten short messages Manual paging
Automatic paging Mobile QQ
Short message monitor

 GSM/CDMA network interworking

 Supporting short message interworking between the GSM mobile network subscribers and
the CDMA mobile network subscriber.

 Paging dual-network interworking

 To cater to the situation at present that China Unicom operates both the CDMA mobile
communications carriers and paging networks, ZTE has specially developed a CDMA short
message system and paging dual-network interworking software, allowing merging of the
China Unicom CDMA mobile communications network and paging network resources, so
that the integrated service superiority of China Unicom can be brought to full play.

 Short message international interworking gateway

 To satisfy the requirements on short message interworking by mobile communications

systems of many countries (such as: GSM, CDMA mobile communications networks}, ZTE

-792-
 Chapter 20 Introduction to ZTE cdma2000 1x Services

has succeeded in developing a short message international interworking gateway, which is

adaptive to mobile communications networks of different countries.

 Welcoming speech to roaming subscribers

 It refers to a short message that is issued to a mobile subscriber roaming to a new service
area, which welcomes the subscriber to the new service area, introduces information on the
local scenic spots and historic sites and various services.

 Making subscribers feel at home, so that more and more subscribers will join the cdma2000
1x mobile communications network system.

 Issuing information on the local tourism and commerce, etc. (more or less of advertisement
nature), allowing commercial benefits from the commercial advertisement.

 Charge service function

 Charge query,

 Subscribers will have a clear idea.

Such as: “Your charge just now is RMB2.00”

 Charge notification

 Helping subscribers control their charges.

 Call pilfering will be detected as soon as possible.

A short message for instance: “Your charge this month is RMB200, so you are kindly requested to
limit your conversation times”.

 Arrears reminding

 Reminding subscribers to pay as soon as possible.

 Reducing subscriber loss due to delayed payment.

 It is of special importance for guaranteeing carriers’ benefits.

A short message for instance: “You have RMB10.00 left as your credit. Please make your
prepayment”.

-793-
Chapter 20 Introduction to ZTE cdma2000 ix Services

 Dynamic reminding by short messages

 As prepay subscribers are keeping increasing, network carriers not only need to know how
subscribers pay their charges, but also hope that they can initially notify, in a timely manner,
subscribers the balance of the charges, and remind subscribers to effect timely payment.

 ZTE provides and implements a short message mode for this goal.

 Missing conversation prompt

 It refers to a non-connection due to called mobile subscriber off, no response to paging,

called busy, or other reasons, but when the mobile subscriber restarts to act, the system will
automatically generate a short messages to notify the mobile subscriber in a timely manner.

 The service function offers a reliable guarantee for mobile subscribers to attain information
and for smooth communications.

 News

 Via mobile phone short messages, wireless mobile phone subscribers are made capable of
understanding important news of the day and other important national and international
matters.

 Weather and flight forecast

 Via short messages, weather forecast is provided for mobile subscribers, facilitating their
outdoors activities.

 Via short messages, flight forecast is provided for mobile subscribers, facilitating their
business and trips.

 Jokes

 Capable of sending short jokes, humor, etc. in short message mode to mobile subscribers,
adding joy and pleasure to their daily work.

-794-
 Chapter 20 Introduction to ZTE cdma2000 1x Services

 English-Chinese translation

 Via short messages, bi-directional translation between English and Chinese is provided for
mobile subscribers.

 Integrated service information station function

 MO query service information

 Mobile subscribers may send special short messages to the short message center, selecting the
type and time, etc. of query service information, and the short message center will process
these short messages and then return information to the public.

 MO subscription service information

 Mobile subscribers may send special short messages to the short message center, selecting the
type and time, etc. of subscription service information, and the short message center will
process these short messages and then return the service information to the subscribers.

 Various real-time services carriers require

 For actual requirements, such as during college/university entrance examinations and post
graduate examinations, etc., real-time services are provided via short messages, for
subscribers’ convenience of query and carriers’ benefits alike.

 Mobile banking/security services

 Bank stock service

 Securities transaction query, capital query and stock query.

 Securities buying long, selling out, order withdrawing.

 Transfer between current accounts and security accounts.

 Bank account query

 Account balance query.

-795-
Chapter 20 Introduction to ZTE cdma2000 ix Services

 Historic account transaction query.

 Bank transfer

 Transfer from current account to fixed account, from margin to current, from margin to
margin.

 Payment via bank

 Payment query, payment.

 Security service

 Agency buying long, selling out, order withdrawing, transaction password modification.

 Capital query, share query, agency query, deal query.

 Expert stock review.

 Stocks service

 Stock quotations query

 Subscriber may query individual stock information and index information, so as to keep
abreast of the latest trend.

A short message for instance: “The ZTE stock will be RMB5.00 higher, so you can buy in”

 Real-time stock up/down alarm

 Subscribers can preset prices for stock buying in and selling out.

 Subscribers can receive real-time quotations of the preset stock market.

 More investment opportunities for subscribers.

A short message for instance: “The ZTE communications stock price is RMB40.00 now, reaching
your preset buying long/selling out level.”

 Cell Broadcast Short Message

 Cell broadcast is one of the major services provided by the CDMA mobile switching

-796-
 Chapter 20 Introduction to ZTE cdma2000 1x Services

networks, which is mainly used to send messages to users in a specific physical area.

 Users in a specific physical area refer to: All the mobile subscribers active in the special
physical area, including outside subscribers roaming to the area.

 Advantages of the ZTE CDMA short messages cell broadcast technology:

 Integrating the cell broadcast center into the short message center system, and via the mobile
switching center MSC, is connected with the BTS controller BSC, so as to implement control
on the BTS of the BTS controller, and no protocol conversion agent equipment is necessary
to be added into the BTS controller.

 The cell broadcast service processing flow does not pass through the short message service
processor, thus enhancing the system operation efficiency.

 Instances of the ZTE CDMA short messages cell broadcast

 Public information broadcast:

“A rainstorm is forecast today, so please take your umbrella and so on with you”.

“A thorough cleanup is to be held for the community, starting from 4 o’clock this afternoon, every
resident is requested to take part in it”

 Issuing commercial advertisement:

“On the coming Saturday, commodities in so-and-so shopping mall will be sold on greatly reduced
prices”

 Issuing service advertisement:

“Local news: In the local mobile communications company, the ZTE802 CDMA mobile phone
sets, the world first pattern of mobile phone sets with an independent card, are on sale.”

 All-user broadcast

 It transmits in a high-efficient way short messages of the same content to a group of users. It
is mainly used by an operator to transmit messages of announcement, advice, greeting
information, advertising and promotion information, etc. to a great mass of users.

 A group of users might mean: All users registered with the local SMC, all registered users
under a VSMC, all registered users in certain number segment, and any batch of users
selected randomly.

-797-
Chapter 20 Introduction to ZTE cdma2000 ix Services

 Short message VPN function

 Providing unified management on big user data, significantly enhancing the system data
security

 Authentication and authorization of information submitted by big subscribers reduce the

possibility of sending rubbish data by subscribers

 The system functions are implemented in two modes: Using a Web browse and mobile phone
short messages.

 In the Web browse mode, a unified IE browse is used at the Client for message submission
and transmission, significantly reducing the operation cost at the Client. The operation and
maintenance interfaces are unified and easy to operate.

 In the mobile phone mode, subscribers can directly send short message commands in a
certain format to the servers, to implement the group management and short message group
transmission function. The mode features easy and convenient use, and no additional
equipment will be necessary by subscribers

 Closed-user group

 A closed-user group (CUG) is a logic group. Members in the same CUG will enjoy
preference in charges when sending to/receiving short messages from each other.

 This is of significant importance for information secret maintenance in enterprise groups.

 Internal messages such as: “ZTE Corporation has put into service the cdma2000 1x mobile
communications system pilot office, the first in China, and the fourth in the world” can be
received by ZTE corporation CUG members only, while other subscribers cannot.

 Prepayment subscriber short messages

 In order to implement controlling and charging on the receiving/sending of wireless

intelligent network subscriber point-to-point short messages, ZTE has specially developed a
short message receiving/sending function that supports intelligent prepayment.

-798-
 Chapter 20 Introduction to ZTE cdma2000 1x Services

 Voice mailbox notifying function

 Reminding mobile phone subscribers to view new messages in their voice mailbox.

 Avoiding invalid query for mobile phone subscribers.

 For carriers, increasing subscriber conversation times and avoiding overstock of voice
information.

 Using a voice identifying technology, converting voice information into character

information, which will be sent to a mobile phone subscriber as a short message.

 Internet service function

 WEB sending short messages

 ZXSC100 SMC has opened the public Internet websites of carriers, so that subscribers can
send short messages through the WWW mode.

 WEB querying short messages

 Subscribers can query the related information of SMC by the WWW mode, including
querying the number of short messages that have not been sent, and the number of short
messages that are sent, etc.

 E-mail service function

 MS sending E-mails

 MSs submit E-mails to SMCs, where they are forwarded to subscribers through E-mail
servers.

 Redundancy of E-mail short message sending

 When subscribing the services, short message users can register and use “E-mail” as the
redundancy for sending short messages. If SMC fails in forwarding short messages, the E-
mail server will be used to forward the short message in the form of E-mails.

 E-mail notification

 After the short message center has confirmed there is E-mail for the subscriber, it will
generate a short message and notify the subscriber to view the mail.

-799-
Chapter 20 Introduction to ZTE cdma2000 ix Services

 GPS positioning function

 Dispatching vehicles for hire

 Monitoring special vehicles (such as bank note trucks, dangerous goods trucks, etc.)

 Vehicle burglary prevention and alarming

 Reporting road traffic information

 Transferring data of unattended devices (such as water meters, watt-hour meters, weather
forecast data collector, etc.)

 WAP function

 Borne on short messages, WAP is sent via short messages.

 EMS short messages

 The ZTE ZXSC100 short message center has developed relevant software modules,
supporting EMS short message functions, such as photo and ringer tone download, etc.

 WEB subscription of integrated information station services

 Subscribers can subscribe integrated service information they require, via WWW mode, such
as charge query, weather forecast query, stock information query, news and broadcast, etc.

 Charge-free mobile phone set

 Receiving a certain number of advertising short messages will allow a certain amount of free
charges for a subscriber.

 This is beneficial to the enterprise group and subscribers alike.

 It is more effective in terms of advertisement than the TV and newspapers.

-800-
 Chapter 20 Introduction to ZTE cdma2000 1x Services

Listening to a short message as follows, for instance:

Question: “By what famous communications product manufacturer is the world first mobile phone
set with an independent card successfully developed?”

If a mobile phone subscriber answers: “It is successfully developed by ZTE Corporation of China”

The subscriber will immediately receive a short message as follows: “Thank you for your concern
about ZTE communications development, and you will have RMB50.00 as your charge from ZTE”

 Automatic vendor

 A short message-based automatic shopping system jointly developed by carriers and

shopping malls/supermarkets and banks.

 Mobile phone set lottery

 A short message-based lottery system jointly developed by carriers and lottery issuing center,
etc.

 Handwritten short message service

 A short message related processing module added to the current short message system allows
subscribers to send hand-written short messages to other subscribers via the short message
center.

 Manual paging function

 Emergency call

 Short messages can be sent to subscribers via a preset emergency call ringer tone.

For example: “Please rush back to the company for something urgent”.

 Timing calls

 Such as: Every morning at 7:00, a ringer tone short message is sent.

 Group call

-801-
Chapter 20 Introduction to ZTE cdma2000 ix Services

 Short messages can be sent to a group of subscribers via a preset distribution list.

 Short message management

 Sorting out management of short messages can be exercised via a manual station. For
example: Short message priority, short message type, etc.

 Phone set owner service

 Messages

For example: “I have an important commercial meeting to attend today. Please make sure all the
callers to me have their messages in my voice mailbox”

 Query

For example: “I turned off yesterday. Any short messages for me?

 Replacing

For example: A short message “I’ll be back home Friday evening” that is not sent yet can be
replaced by “I’ll be back home Saturday afternoon”.

 Password modification

For example: The phone set owner sends a short message, modifying his password from “888888”
to “666666”.

 Deleting

Deleting short messages a subscriber has submitted. For instance, deleting the message “The stock
index will be up by RMB2:00.

Deleting short messages an external short message entity has submitted, such as: Deleting the
short message “The Middle-east peace is held up”.

 Secretary service

 Call agency

A phone set owner can have incoming calls for him/her transited to a manual secretary station,
where an operator will listen to the calls and send the contents of the calls to the owner in the form of a
short message.

 Telephone filtering

-802-
 Chapter 20 Introduction to ZTE cdma2000 1x Services

A phone set owner can have an incoming call for him/her transited to a manual secretary station,
where an operator will listen to the call and make an inquiry about the caller name and the content of
the call, and send this information to the owner in the form of a short message, and then, in case of an
important call, the owner will be connected.

 Scheduling

A phone set owner can inform a manual secretary station of his/her schedule, and then the manual
station will send a short message in a preset moment to remind the owner.

 Database

A phone set owner can inform a manual secretary station of information (such as a customer’s
name, telephone number, etc.), and then, when necessary, the owner will query the manual station, from
where an operator will send a short message with required information to the owner.

 Automatic paging function

 Replying the home set

 Replying the alien set

 Pre-defined messages

“Happy birthday”

“Happy holiday”

“Please go home as soon as possible”

“Please buy in as soon as possible”

 Mobile QQ

 The mobile QQ function allows chat and communications between PC subscriber and a
mobile phone subscriber in the form of a short message.

 Short message monitoring function

 Basic service functions

 Monitoring suspicious subscribers

-803-
Chapter 20 Introduction to ZTE cdma2000 ix Services

 Monitoring suspicious short messages

 Providing interfaces for a standby database

 Operation and maintenance functions

 Configuration for monitoring suspicious subscribers

 Configuration for monitoring suspicious short messages

 Report on monitor results

19.1.5 Locating Service

The wireless locating service is one of the important characteristic services provided by the cdma2000
1x mobile communications system. A few related key features of the cdma2000 1x mobile
communications system are used. For example: A series of locating services can be offered to
subscribers via GPS information provided by BTSs, distance determining by means of using code chip
time delay, etc., and adding entities of positioning entity (PDE), mobile positioning center (MPC), etc.

Various location -related services can be implemented by the ZTE cdma2000 1x system via
wireless positioning technology, which is used to attain information of the MS’s location (such as its
longitude and latitude, moving speed, etc.), which is sent to the mobile subscriber himself/herself, the
mobile communications networks and other external entities. The networking mode of the ZTE
cdma2000 1x wireless positioning service is shown in Fig. 20-1.

The ZTE cdma2000 1x wireless positioning system features high accuracy, simple network
upgrading, etc., hence capable of providing positioning service better than the GSM system.

Wireless positioning services the ZTE cdma2000 1x system implements are as follows:

 Emergency service E911  Materials tracing

 Advertisement service Vehicles dispatch
 Navigation service Children guardianship
 Personalized network service Friend seeking

Location-based extended positioning services the ZTE cdma2000 1x system can further provide:

 Location-based charging  Asset management and tracing

 Enhanced call routing  Position-based information service

-804-
 Chapter 20 Introduction to ZTE cdma2000 1x Services

Fig. 20-1 Networking mode of the ZTE cdma2000 1x wireless positioning service

 Location-based charging (LBC)

 Allowing subscriber rates to depend on the subscribers’ current locations, which can be the
areas for the subscribers to live or work in.

 So long as a subscriber enters a contract with the area, preferential rate will be available for
him/her in the related area. The subscriber can be either a personal subscriber or a group
subscriber.

 In case of a personal subscriber, the subscriber can define an area (when concluding a
contract) in which he/she wants the preferential rate, and the definition can be made flexibly
according to time, and preferential rate can be provided in a shop, a GOLF field, or a resort,
etc, where the subscriber is.

 For a commercial group subscriber, preferential rates can be provided to a campus, a working
area, or a commercial district, etc.

-805-
Chapter 20 Introduction to ZTE cdma2000 ix Services

 Tracing, asset management (FAM)

 Allowing management personnel to trace the location and status of an FAM member.

 FAM members can initially inform the management personnel of their location via a service
operation code, and the management personnel can add/delete an FAM member via service
operations.

 The typical applications include: A shop owner traces the location and status of his
employees and automatic vendors, and parents trace their children’s location, etc.

 The service can be provided in modes of a short message, voice query, website query and
electronic map display, etc.

 Enhanced call routing (ECR)

 It is a voice service in calling.

 Its objective is to attain the shortest location-related route, such as a gas station, a restaurant,
etc.

 Location-based information service (LBIS)

 LBIS (Location-Based Information Service) allows subscriber access to information services

the contents of which have been cut out according to the location where the subscriber
currently is.

 The contents include:

 Hotel service (finding a suitable hotel or restaurant)

 Tourist information service

 Roadside support service

 Yellow pages service

 Self-positioning service

 Traffic information service, cutting out information for a special subscriber, such as “At the
left corner of the main road”

-806-
 Chapter 20 Introduction to ZTE cdma2000 1x Services

 LBIS service is supported in three modes: Voice, supplementary service and short messages.

19.1.6 Intelligent Service

With an intelligent network service switching point (SSP) embedded in the ZTE cdma2000 1x mobile
communications system, the ZTE cdma2000 1x mobile communications system is capable of providing
all the IN services defined by the object network. The ZTE cdma2000 1x mobile communications
system intelligent network has the following features:

 In compliance with international universal standards and specifications, and supported widely
by mobile communications carriers;

 Open interfaces, capable of interconnecting and interworking with network devices of

multiple manufacturers, allowing whole network roaming;

 Capable of providing an intelligent and open platform, on which new services can be quickly
introduced by carriers;

 In conformity with the telecommunications technology development direction, capable of

being compatible with 2G mobile communications technologies.

Intelligent services that can be implemented at Phase I:

 Mobile PPC service  Mobile virtual dedicated network service

 Mobile advertisement service  Mobile freephone

 Mobile prepaid charging (PPC) service

 A typical “Charge before Service” service.

 Initiated in Europe, it now prevails all over the world because of its prominent features.

 Mobile PPC service functions

 Call charges prepaid, to be deducted in actual use in a real-time way

 Conversation will be limited in case of insufficient charge balance, and balance can be
queried at any time

 Daily and monthly quotas can be set

 To subscribers and carriers

-807-
Chapter 20 Introduction to ZTE cdma2000 ix Services

 Subscribers do not need to periodically pay their bills

 Subscribers can exercise effective control on their charges

 Carriers can recover their cost ahead of schedule

 Arrears of charges can be prevented

 Related concepts of PPC service

 The latest first dial time

 It refers to the latest first time a rechargeable card subscriber dials up the value charged
phone. The rechargeable card will be put in a frozen period if there is no call made after this
time.

 The date is set when an account is opened for the rechargeable card.

 Expiry

 It refers to a period during which a PPC subscriber can be either a caller or a called, and a
reserved period will begin beyond this expiry.

 A PPC subscriber can prolong the expiry by value charging.

 In case of the first dial, a subscriber will hear a welcoming speech, and the expiry will be set
the very day. After value charging, a new expiry will be formed on the basis of the original
expiry with an additional expiry of the rechargeable card.

 If the subscriber has used up the balance, the expiry will be set as the very day.

 Rechargeable card locking

 Carriers can lock the data in the rechargeable card via a management interface if necessary.
Once locked, a value0charged card can no longer be used to perform any operation.

 Data locking can be canceled.

 Rechargeable card invalid

 If rechargeable card data are locked or the card is in a loss-reported status, the prompt to the
subscriber will be “Rechargeable card invalid”. When locking or loss report is canceled, the
card will return to valid status from invalid status.

 Unallocated number

-808-
 Chapter 20 Introduction to ZTE cdma2000 1x Services

 If a rechargeable card has not yet been used for the first time, there are no data or the card is
in a frozen period, the mobile phone number will be deemed as being unused in the system,
and an “Unallocated number” prompt will be given to the subscriber calling that number.

 Reserved period

 When a rechargeable card is expired, there will be a period for the card to make calls via
value charging, and this period is called reserved period.

 If the balance in the subscriber account has been used up, the card will also enter a reserved
period.

 During a reserved period, the subscriber cannot make any call, but can perform operations of
value-charging, balance querying and calling an operator.

 The reserved period now is three months.

 Number expiry

 Every rechargeable card has a number expiry, beyond which the card, no matter what status it
is in, can no longer be used, and the number will be withdrawn by the telecommunications
department.

 Generally, the number expiry and service expiry are the same. At present, the expiry is preset
as 99 years after an account is opened.

 Service expiry

 A service expiry is set for management convenience. Beyond the service expiry, the entire
service will be stopped.

 At present, the expiry is preset as 99 years after an account is opened.

 Frozen period

 There will be four cases for a rechargeable card to enter the frozen period:

The rechargeable card is beyond the reserved period

The rechargeable card is not used after the latest first dial-up time

Beyond the number expiry

Service expiry

 Once entering the frozen period, a rechargeable card will be deemed as being withdrawn, and

-809-
Chapter 20 Introduction to ZTE cdma2000 ix Services

the related mobile phone number will also be withdrawn. To prevent anyone who knows the
number from disturbing the new subscriber, the withdrawn number will not be put into use by
a new subscriber until a certain period is passed, and this period is called the frozen period.

 Only after the frozen period can a withdrawn number be reused by a new subscriber.

 Rechargeable card

 It is a valued card with a certain value amount and an additional expiry in an IN service
system. A subscriber can buy a rechargeable card, and can have the value and expiry in the
card transferred to his/her own account via value recharging.

 Rechargeable card password

 It refers to a unique digital sequence identifying rechargeable card. A subscriber can use the
card via entering the password. At present, the password is printed on the scratch card of the
rechargeable card, covered by a sealant. The password will be available when the sealant is
removed from the card.

 Rechargeable card password can have 18 digits.

 Prefix of rechargeable card password

 The first two digits of a rechargeable card password indicate the card data storage location,
and these two bits are called the prefix of rechargeable card password.

 Rechargeable card expiry

 An expiry is set for the rechargeable cards when issued, and subscribers are requested to use
the rechargeable cards before the expiry date.

 Rechargeable card data locking

 Carriers can lock up the data of rechargeable cards via a management interface if necessary. A
rechargeable card cannot be used after being locked up.

 Data locked can be unlocked.

 Rechargeable card invalidity

 A rechargeable card will enter invalid status under the following three circumstances:

 Rechargeable card is in use.

 Rechargeable card data have been locked.

-810-
 Chapter 20 Introduction to ZTE cdma2000 1x Services

 Beyond rechargeable card expiry.

 Subscriber password

 A subscriber password is available when a rechargeable card is bought. The password can be
used to authenticate the subscriber authority on the card, and the subscriber can use the
password to report loss of a card, cancel the loss report or delete a black list, etc.

 A subscriber password usually has 8 digits.

 Mobile virtual private network (WVPN) service

 It is a private network established by the service providers, using public network resources.

 It is a virtual network, without fixed physical connections, and it is established only when
required by the subscribers.

 It is a private network constructed with public network facilities.

 Such a network has many advantages of both public networks and private networks, as it
combines the performance reliability and abundant functions of public networks with the
flexibility and high efficiency of private networks.

 WVPN enables clients to link dynamically their organizations scattered in different regions
using the public network resources, as sketched in Fig. 20-2.

Sales
Company
department headquarters Online client
database

Subsidiary

ＷＶＰＮ
Commercial
partner

Mobile work personnel

Fig. 20-2 Mobile virtual dedicated network service (WVPN)

-811-
Chapter 20 Introduction to ZTE cdma2000 ix Services

 The features are as follows:

 Intra-network calling, extra-network calling

 Simultaneously supporting big and small numbers

 Flexible charge rate setting

 Both incoming and outgoing calling authorities can be set

 Daily and monthly quotas can be set

 Powerful statistic function

 Shortcut dial-up modes are available to subscribers

 Charge expenses can be controlled inside a group

 Preferential rate is available for intra-group calls

 Network utilization ratio can be enhanced

 Mobile advertisement service (AD)

 It refers to operations of answering questions according to a prompt tone, after listening to a

commercial advertisement, performed by a caller subscriber who is connected to a designated
preset number. If he gives the correct answers to all the questions, he/she can obtain a certain
amount of call charge, and the caller subscriber does not have to pay for the current call no
matter whether he/she has listened to the complete advertisement or has given correct
answers to the questions.

 For example: The subscriber is connected, after pressing “133********”, to a designated

advertisement service, a voice prompt will ask “What is the famous manufacturer in China
that has first put into use the cdma2000 1x mobile communications system?”.

 If a subscriber answers: ZTE Corporation

 The voice prompt: “Your answer is correct, and you have won 500.00 yuan as your mobile
call charge from ZTE Corporation”.

 The AD service provides a brand new means for development by information to some
enterprises and individuals, so as to enlarge the enterprise’ range of activity in the market,
increase the information source for the enterprise, sharpen the enterprise’ competition edge,
attract potential customers, shorten the distance between the clients and the enterprise and

-812-
 Chapter 20 Introduction to ZTE cdma2000 1x Services

expand the market share.

 The AD service plays the most important role for the enterprise to elevate its image, exploit
services and promote sales.

 Free PHone service

 It refers to a mode in which the caller subscriber does not need to pay but the called will be
responsible to pay for the call.

 Free phone service has the following three functions.

 Password access function: After dialing the free-phone user number, the caller subscriber
must dial the correct password before the call can be put through. The password is composed
of 4 to 6 numerals, which can be modified according to the subscriber requirement. Of
course, if necessary, a password can be spared by the caller subscriber.

 Time-based number selection: The user subscribed for the free-phone service can accept
incoming calls based on different dates and time. If the called subscriber does not provide
this service within a specific period of time or certain days, the system will play a recorded
notice during the time to the free-phone calling subscriber.

 Call transfer on busy line or ringing timeout: A subscriber who has subscribed for the free-
phone service can preset several telephone numbers according to the requirement, so that the
system will transfer the call to a preset telephone number in case of busy line or ringing
timeout.

 The effect of free-phone service is basically the same as that of the AD service.

IN services of Phase II and Phase III

 AOC instant charging  Location-based services and charging;

 Enhanced paging and routing services.  Credit card calling
 Vote on telephone (VOT)  Personal number service
 Initial call screening  End call screening service
 Familiarity number service  Shielding service
 Service by time and by area  Dynamic location tracing service

 AOC instant charging

-813-
Chapter 20 Introduction to ZTE cdma2000 ix Services

 AOC instant charging service is used to send charging information to subscribers.

 Information can be sent either before a call, during a call or after a call.

 Information can be sent in audiovisual prompt mode.

 Contents sent include: call rate, change of call rate, accumulated charges or charge for a call
just finished, balance in an account, etc.

 For example, when a call is made when the subscriber roams to an area with a higher rate, a
video/audio prompt will be received during the call: a piece of information like “You are
making a call at a rate of RMB1.00/minute/local, you have spent RMB8.00, and there is
RMB20.00 left in your account”.

 AOC instant charging service allows subscribers to have an idea of the rate and charges, so as
to control their conversation duration and times.

 Location-based service and charging

 Location-based service and charging is a service of special rate.

 It allows settlement of subscriber charges according to different rates in different places

where subscribers are, different base transceiver stations (BTSs) or different sectors that are
connected to the CDMA network system.

 The rates can be either higher or lower than the ordinary rates.

 For example: A subscriber makes a call at the rate of RMB2.00/minute/toll for accessing the
network with BTS A in a certain place, whereas the rate is RMB1.00/minute/toll with BTS B
in the same place.

 Location information is sent via an IN protocol.

 Location-based service and charging allows flexible rates according to the actual conditions
of the area where a call is made. In so doing, more subscribers can be attracted, hence higher
benefits for carriers.

 Enhanced paging and routing services.

 This service offers subscribers a capability, establishing an outgoing call routing table for
subscribers.

-814-
 Chapter 20 Introduction to ZTE cdma2000 1x Services

 According to different outgoing call routing tables made with different accesses from
different areas where subscribers are, outgoing call routes (via a private network, a public
network, a virtual network or a combination of these all) can be designated.

 For example: a subscriber in Nanjing accesses: a private network; a subscriber in Beijing

accesses: a public network; and a subscriber in Shenzhen accesses: a virtual network.

 Via this service, subscribers will be able, when subscribing an IN service, to select routes fit
to their needs. With greater power to decide by subscribers themselves, more subscribers will
be attracted, hence higher benefits for carriers.

 Rural card service

 To encourage telephone consumption by subscribers in remote and less developed areas, and
to raise the utilization ratio of mobile network equipment, commitment has been given to
those areas that preferential rates will be given for calls initiated or terminated by subscribers
in those areas.

 For example: In Tibet, a rate of RMB0.40/minute/local is available.

 In this way, more and more subscribers will be attracted to the cdma2000 1x network, hence
higher benefits for carriers.

 Credit card service

 With a mobile phone set, and your credit card number and password entered, the mobile IN
system will perform authorization.

 It has the following features:

 All the functions of mobile PPC service.

 Function of transfer via a bank.

 Using the same number as the credit card.

 Using a password different from the credit card number.

 Using encryption algorithm to ensure transmission security.

 With a background noise function, interception of passwords can be prevented.

-815-
Chapter 20 Introduction to ZTE cdma2000 ix Services

 After establishment of relationships with the bank system services, services of telephone
payment, telephone shopping, etc. will be extended readily.

 Vote on telephone (VOT)

 VOT is a service provided to the society for soliciting opinions or performing a public
opinion poll.

 Enterprises or institutions using this service, (such as: a radio station, a newspaper office, a
group company, etc.) may apply for one or more VOT numbers from the network, to be used
for soliciting comments or opinions on some matters via mobile telecommunications
networks.

 In call the numbers for VOT, subscribers can air their opinions according to a recorded
prompt play, via related operations.

 The network will make statistics of the opinions, and forward them to competent enterprises
or institutions when the service is over (when a preset deadline expires).

 To make an inquiry to mobile phone manufacturers A, B and C in the world, dial

“133*********” to enter a related database. A best preset mobile phone will be selected via
dialing different numbers, and summary and statistics can be performed when the preset time
is up.

 Preferential processing can be performed to these service rates, so as to attract enterprises and
institutions, for higher benefits for carriers.

 Personal number service

 The subscriber establishes a call connection table according to the basic service number, i.e.,
a pre-defined number.

 It is connected to a mobile subscriber address according to the subscriber predefined

connection sequence. In case of no answer, it will be connected to the next address according
to the sequence until a cycle is completed.

 Caller or called call shielding is implemented according to the number and location
information.

 It is used for usable PIN code encryption, and the PIN code can also be modified.

-816-
 Chapter 20 Introduction to ZTE cdma2000 1x Services

 Initiated call screening

 Subscriber can preset some outgoing numbers barred.

 Barred numbers can be identified by a barred number table (or number series). It will also be
feasible to make out a table with outgoing numbers (or number series) allowed.

 Terminated call screening

 Called subscribers are allowed to designate, according to an end call prompt, a series of caller
numbers that can be processed (other numbers will be barred), or a list of caller attempt
numbers that are to be barred (other numbers are allowed to be processed).

 This service can be used to protect sensitive equipment from receiving calls of unauthorized
numbers (because only certain number are allowed).

 Familiarity number service

 It is a customized service whose rates are selected according to the called numbers.

 Frequently dialed numbers are recorded in a subscriber database, and a preferential rate will
be given to the subscriber when he/she dials a number in the table.

 More subscribers will be attracted, hence higher network equipment utilization ratio and
higher benefits for carriers.

 Service by time and by area

 This is a new mobile phone service that is based on PPC service and embodied in charging
performance.

 Its main feature is that charging will be flexibly conducted according to call time (by time)
and areas where the caller and called are situated (by area).

 Each day is divided into a few time segments, for which different rates are used: 7:00 AM-
9:00 PM, the rate is RMB0.80/minute/local; 9:00 PM-1:00 AM, the rate is
RMB0.60/minute/local; and 1: 00 AM-7: 00 AM, the rate is RMB0.50/minute/local.

-817-
Chapter 20 Introduction to ZTE cdma2000 ix Services

 Each big city exercises different rates, depending on different BTSs (locations) subscriber
accesses. Rates in a busy area can be higher than normal standard rates, and rates in a
relatively idle area can be lower than normal standard rates.

 Via this service, a dynamic balance of network operation will be implemented, allowing
higher network utilization ratio and carriers’ benefits.

 Shielding service

 It is more often used in a family or a company, in a bid to cock those services of higher rates,
and leave some special numbers for use.

 Dynamic location tracing service

 Via an intelligent network, the cdma2000 1x mobile communications network system may
trace a mass of mobile subscribers, for instance, cars can be traced via the ever-changing
location information the mobile phone sets in the cars issue.

 When a subscriber needs a car service, IN service application will make a comparison
between the caller location and locations of the cars, thus automatically transfer a call to a car
that is the nearest to the subscriber.

19.1.7 Characteristic Services of ZTE cdma2000 1x Mobile Communications

System

To meet the market demands and repay the support and concern of telecom carriers for ZTE, ZTE has
launched a series of CDMA characteristic services.

Perfect characteristic CDMA services that ZTE provides are as follows:

 BTS preferred ground circuit  PACA service

 Group dispatch service  Number portability service
 Equal access service  Virtual MSC
 Virtual HLR  Subscriber area service
 MSC, HLR support positioning  Integrated VPN
function
 Supporting 48-digit numbers  Caller number display irregularity
correction function

-818-
 Chapter 20 Introduction to ZTE cdma2000 1x Services

 Limited audio service  Function of switchover between IS95

and 1X
 Function of unidirectional or bi-  Local charging
directional suspension due to arrears
 Charging pulse additional  Charging pulse support VMSC
transmission

 BTS preferred ground circuit function

 By means of software upgrading, a time slot designated by a BTS (BS) can be preferably
used for a mobile switching center (MSC) when allocating voice path time slots for A-
interfaces during a call connection. In so doing, the connection success ratio can be enhanced,
and connection time shortened.

 This is helpful for enhancing the network system operation efficiency, sharpening carriers’
competition edge and attracting subscribers.

 PACA service

 PACA service can be provided to subscribers via software upgrading.

 If a subscriber is authorized to PACA service (by application), an air service channel will be
preferably allocated to the subscriber during the connection process, so as to ensure that the
call for the subscriber will be preferably put through.

 Group dispatch service

 Group dispatch service uses the CDMA mobile communications system to accomplish cluster
communications function, and extends the CDMA application range.

 The service is mainly used for user groups such as airports, container wharves, railways, big
companies, etc., realizing multicasting, priority dispatching, group conference dispatching,
dispatcher monitoring, etc.

 No separate cluster frequency bands will be necessary for a big group subscriber to use the
CDMA system cluster dispatching service, neither daily maintenance personnel will be
needed, for the carrier can do the maintenance instead.

 This is beneficial to subscriber groups and carriers alike.

-819-
Chapter 20 Introduction to ZTE cdma2000 ix Services

 Number portability service

 Number portability service allows subscribers to use, when they turn from other networks
(such as: GSM network) to the CDMA network, their original number as their called number
of r a period of time, say, three months or more.

 During the use, the system will inform the caller of the new number of the called.

 This is quite something to attract more subscribers to the CDMA network system, and to
enhance the competition edge of the CDMA network system.

 Equal access service

 The system will allocate each toll carrier a preset carrier identity code (hereinafter referred to
as CIC) to be written into the database.

 Subscribers can select to make a call through a carrier’s toll network by further dialing the
carrier’s CIC or a preset mode.

 Mobile subscribers are allowed to freely select toll carriers.

 Thus effectively solving the problem of competition between multiple toll carriers in a
country.

 This is helpful to equally providing services for the toll carriers.

 Virtual MSC

 At the beginning of network construction, a mobile switching center (MSC) covers two or
more cities.

 In order to conduct roaming charges of different service area and between different networks,
to each city there seems a virtual MSC serving the city, and there are signaling links and
channel trunks for the cities themselves to each service area communications network.

 The success of the MSC function will satisfactorily meet the requirements of the cdma2000
1x mobile communications network at the beginning of its construction.

-820-
 Chapter 20 Introduction to ZTE cdma2000 1x Services

 Virtual HLR

 In order to meet the requirement of using the same HLR by different administrative districts,
management on subscribers in different districts and management areas can be exercised
respectively.

 The ZTE cdma2000 1x mobile communications system supports the construction of as many
as 256 virtual HLRs.

 Subscriber area service

 Subscriber area is a concept of geographic location.

 Via software upgrading, services of different areas can be provided to subscribers in different
areas by the network side according to the requirements of carriers.

 MSC, HLR supporting positioning function

 To support relative location service, the ZTE CDMA mobile switching system has added a
relative location service, and the related MAP signaling and process processing functions.

 Integrated VPN

 In a bid to satisfy the requirements of certain carriers in the world to simultaneously operate
multi-system mobile communications network systems, such as: China Unicom operates
CDMA, GSM, PSTN communication networks simultaneously.

 ZTE has put forward an integrated VPN service, which uses the integrated IN service
platform and the original CDMA network, fixed networks and the GSM network SSP
resources to provide certain enterprises and groups with a logic dedicated network, so as to
help these enterprises and groups provide CDMA subscribers, GSM subscribers, PSTN
subscribers with services in the dedicated network.

 This service allows preferential rate to a certain extent to subscribers in a group, and
facilitates management on group and subscriber charges as well.

 This is helpful in attracting big group subscribers.

-821-
Chapter 20 Introduction to ZTE cdma2000 ix Services

 Supporting 48-digit numbers

 The ZTE cdma2000 1x mobile communications system supports continuous dialing of a 48-
digit number at the maximum.

 Caller number display irregularity correction function

 Since there are different network carriers in a certain service area in the world, irregular
caller numbers may appear in communications between different networks.

 The so-called “Caller number display irregularity correction” function is to translate calling
numbers from other communications networks into standard universal number formats, and
to provide them to the called subscribers.

 The ZTE CDMA mobile communications system provides the “Caller number display
irregularity correction” function on the basis of the system software upgrading, in a bid to
meet carriers’ requirements, ensure subscribers’ benefits and facilitate their use.

 Limited audio service

 According to carriers’ requirements, the ZTE CDMA mobile switching system implements
limit to audio services via software upgrading.

 Switching between IS-95 and 1X function

 When constructing the CDMA mobile communications networks, carriers usually construct,
based on the local subscriber requirements, the IS-95 CDMA and the cdma2000 1x mobile
communications networks in different stages.

 A seamless switchover is ensured between ZTE IS-95 and the cdma2000 1x CDMA mobile
communications system, thus enhancing the subscriber conversation quality.

 Local charging

 To meet carriers’ requirements, the ZTE CDMA mobile communications system is capable of
realizing a local subscriber CDR settlement function.

-822-
 Chapter 20 Introduction to ZTE cdma2000 1x Services

 Function of uni-directional or bi-directional service suspension due to arrears

 According to carriers’ requirement, the ZTE CDMA mobile communications system provides
a function of uni-directional or bi-directional service suspension due to arrears.

 By uni-directional service suspension function, we mean a subscriber can be a called party

only, but cannot be a caller, and bi-directional service suspension function allows a subscriber
to make no call at all, be it as a caller or a called.

 Pulse charging

 According to carriers’ requirement, the ZTE CDMA mobile communications system provides
a pulse charging function.

 Pulse charging refers to charging based on the metering charge at a certain time interval.

 Both the time interval and charging rate can be set by carriers themselves.

 Charging pulse additional transmission

 More charging pulses can be sent for certain calls within a time interval according to certain
carriers’ requirements.

 It will depend on the carriers’ requirements as to how many more pulses are to be sent.

 Charging pulse supports VMSC

 At the beginning of network construction, as a mobile switching center (MSC) covers two or
more cities,

 In order to meet the different charging requirements that may arise when a virtual MSC
serves different service areas, the ZTE cdma2000 1x mobile communications system
provides a pulse charging solution that is adaptive to different service areas.

Exercises

-823-
Chapter 20 Introduction to ZTE cdma2000 ix Services

1. Give a brief description of the basic services that the ZTE cdma2000 1x mobile
communications system can implement;

2. Give a brief description of the supplementary services that the ZTE cdma2000 1x mobile
communications system can implement

3. Give a brief description of the short message services that the ZTE cdma2000 1x mobile
communications system can implement

4. Give a brief description of the location services that the ZTE cdma2000 1x mobile
communications system can implement

5 Give a brief description of the intelligent services that the ZTE cdma2000 1x mobile
communications system can implement

-824-
 Chapter 21 ZTE Network Planning and Optimization Solution

Chapter 20 ZTE Network Planning and Optimization

Solution

20.1 Purpose, Principle and Workflow of Network Planning

20.1.1 Purpose of Network Planning

At the early stage of CDMA radio network system construction, radio network planning is of vital
importance. Specifically, it involves the following factors:

1. In a CDMA radio network, coverage varies dynamically with parameters such as system
load, mobile subscriber’s movement speed, and data rate. Increased load will lead to increased
interference, and will in turn result in a shorter reverse coverage radius; the higher the mobile
subscriber speed, the higher the Eb/Nt required for the demodulation on BTS side, and the smaller
the coverage radius; the higher the data service rate required by mobile subscribers, the less the
spread spectrum gain, which will lead to a shorter radius of the data service of a corresponding
rate than that of voice service or low-rate data service;

2. System capacity relates to factors such as forward/backward interference, soft handover

proportion, and QoS required, etc. Since CDMA is a kind of self-interference system, the
interference inside a BTS and between different BTSs will narrow down the system capacity.
Therefore, the control of intra-system interference and a rational construction of network
architecture are essential elements of network planning. Soft handover proportion relates closely
to the capacity utilization of the BTS system. An over-high proportion will result in waste of the
usable resource of the system to some extent, but an excessively low proportion will cause low
conversation quality at the boundary area of the cell and the consequent unsmooth soft handover
will lead to call drops. The difference between QoS required by voice service and data service
constitutes another important measure in improving system capacity.

3. Soft handover boundary is changeable. Since radio mobile network is developing with
increase of subscribers, the coverage radius of BTSs is comparatively large at the early stage of
construction since the subscribers are not many, but the coverage radius decreases with the growth
of subscribers. Therefore, the original soft handover areas change.

4. Data service and voice service coexist. Since the data service coverage is different from
that of voice service, and data service subscribers and voice service subscribers occupy the
resource together, the capacity requirements and coverage requirements of data service and voice
service of the area should be taken into full account in network planning.

-825-
Chapter 21 ZTE Network Planning and Optimization Solution

5. The actual system is rather complicated. In actual network planning, propagation loss
varies greatly with the difference of landforms, surface features, as well as radio propagation
models. Thereby, when selecting BTS sites in network planning, the influence of landforms and
surface features should be carefully considered.

The following objectives are to be implemented through network planning:

1. Achieving maximum radio coverage period and area in the service area;

2. Reducing the interference to the minimum to reach the QoS required and providing the
largest capacity possible;

3. Improving system capacity within a limited bandwidth;

4. Reasonably planning data service and voice serve and maximizing the data flow of BTSs
on condition that the voice service is guaranteed.

5. Optimizing the setting of radio parameters and achieving optimum QoS of the system;

6. Reducing system equipment units and cutting down the cost as much as possible on
condition that the capacity and QoS are reached;

7. Scientifically forecasting traffic distribution to determine the optimum BTS distribution

network.

20.1.2 Principle for Site Selection of Base Stations

A location survey should be carried out to select proper sites after completion of the preliminary
planning of the BTSs. The survey of optional sites should be conducted with the cooperation of
operators and engineering design personnel. We should get the consent from the houseowner if
their house is chosen as our urban BTS site. Then the operator can sign a contract with the
houseowner. The site must meet the following requirements:

1. Convenient traffic, reliable mains supply, safe environment, and small floor spaces are
required;

2. The sites selected at the initial stage when the BTSs are comparatively less should be able
to guarantee a good coverage of key subscribers and the urban areas with dense subscribers;

3. On condition that the BTS layout will not be affected, existing radio &television buildings,
telecom hub buildings, post offices, microwave stations should be used as BTS sites and their
equipment rooms, power supply, iron towers and other facilities should be made use of whenever
it is possible;

4. A BTS located at an UHF TV station should be avoided;

-826-
 Chapter 21 ZTE Network Planning and Optimization Solution

5. A BTS near a radar station should be avoided;

6. A BTS located on a high mountain should be avoided;

7. A BTS located in a forest should be avoided;

8. A mini-BTS in urban area should be located in a building over the average height of
buildings;

9. As for a BTS in urban area, a tall building in the front vicinity of the antenna should be
avoided for it may cause obstruction or reflection and impact the coverage of the base station;

10. A site may be affected by new buildings in the future should be avoided;

11. The BTS sites of CDMA system and GSM system should share the same sites or be
adjacent to each other if it is possible, especially when the stray radiation of CDMS system will
interfere GSM system;

12. Conditions necessary for setting up a BTS should be provided;

13. The equipment rooms with low renovation fee and the houses with less rent should be
chosen as BTS sites. The equipment rooms and office buildings of the exchanges or stations of the
telecom system should be chosen as the BTS sites whenever it is possible.

In the survey of BTSs, the coverage of BTSs, handover area with BTSs nearby, and possible
blind area and pilot pollution area should be estimated according to previous experience. Attention
should be paid to the influence of surface features within a range of 200 m, mainly the buildings,
as well as the influence of tall buildings or hill slopes in the line from the BTS to coverage area.

20.1.3 Instruments Required for Network Planning

1. The instrument to record altitude, longitude and latitude (GPS usually employed);

2. The instrument to measure the distance of a remote object or the height of a local building
or tower (an infrared or laser range finder usually employed);

3. A compass to measure direction;

4. The spectrum-measuring device to measure the ambient frequency spectrum environment;

5. The latest tourist map of the area;

6. The equipment to photograph the surroundings (digital camera or video camera).

-827-
Chapter 21 ZTE Network Planning and Optimization Solution

20.1.4 Pre-sales Network Planning Process

The network planning of XXX project in market exploitation period should be carried out as
according to the following processes:

1. Completing the demand analysis of network planning for the initial stage and producing
Demand Analysis Report on Network Planning of XXX Project through consultations with the
equipment buyer;

2. If frequency sweep is required by the equipment buyer, producing Frequency Sweep

Report of XXX Project upon completion of the work;

3. Completing the site survey of the network planning for the initial stage with the
cooperation of the equipment buyer and preparing BTS Configuration Information List upon
completion of the demand analysis;

4. Producing Radio Network Design Report of XXX Project after completing the site survey;
after that, all related documents should be delivered to the Network Planning Simulation
Department of CDMA Division for discussion; the Radio Network Design Report of XXX Project
and Frequency Sweep Report of XXX Project should be presented to the equipment buyer after
both parties reach an agreement. The specific process are shown in the following figure:

Accomplishing wireless design

Sweep and network planning
Requirement analysis report and sweep report to
site survey
submit to the equipment buyer

Discussion with personnel Submitting wireless design

from the Network Planning Need to modify? No report and sweep report to
Emulation Dept. the equipment buyer

Yes

Revising wireless design

report and sweep report

20.2 Typical Cases Analysis of ZTE Network Optimization and

Planning Solutions

20.2.1 Overview

Mobile communication is the development tendency of communications industry. As one of

cutting-edge mobile communications technologies, CDMA has drawn widespread attention.
Following current trend of telecommunications, Shenda Telephone Co., Ltd. is making vigorous
effort to prepare for the construction of CDMA network in Shenzhen for long-term benefit.

-828-
 Chapter 21 ZTE Network Planning and Optimization Solution

CDMA network planning is essential to CDMA network construction. This article is prepared
on the basis of large amount of earlier-stage work (such as site survey, communication and
investigation) in combination with the analysis of the simulation results of radio network planning
and optimization software. The solution described here gives effective guidance to implementation
of the project so as to minimize the waste of time and resource caused by unreasonable
construction of BTSs.

The solution involves business secrets and technical secrets of Shenda Telephone Co., Ltd.
and Shenzhen ZTE Corporation and both parties herein should keep the solution secrets.

20.2.2 Introduction to Geographical Environment

Shenzhen City is located along the central south coast of Guangdong Province, with Daya Bay on
the east, Pearl River Mouth on the west, Dongguan City and Huizhou City on the north, and Hong
Kong SAR on the south. Shenzhen City occupies a total area of 2,020 km 2, among which the
special economic zone amounts to 327.5 km2.

The city consists of 6 districts, among which 4 are within the territory of the special
economic zone (SEZ), namely, Luohu District, Futian District, Nanshan District, and Yantian
District, and 2 districts are outside of the SEZ, namely, Bao’an District and Longgang District. At
the end of 1998, the total population of the city reached 3.95 million, among which 1.85 million
were living within the SEZ.

Land within the SEZ stretches from east to west like a narrow strap, without obvious change
in topography. Most areas within the SEZ are crammed with tall buildings and dense population.

Areas within the SEZ are divided into four types as per the landforms:

Crowded urban areas: Huaqiang Road North area, Dongmen area, Railway Station area, and
civic buildings within the SEZ;

Common urban area: Standard residential areas and industrial areas;

Suburbs: Skirt areas of the SEZ;

Islands: Liantang, Shatoujiao, Dameisha, Xiaomeisha.

20.2.3 Existing Network Conditions

The fixed network of Shenda Telephone Co., Ltd. has been quite mature and the power supply and
transmission can be provided throughout the whole city. Presently, the company has established
over 41 PHS BTSs and possesses over 30,000 subscribers registered on the network. Outdoor

-829-
Chapter 21 ZTE Network Planning and Optimization Solution

coverage has been preliminarily implemented within the SEZ. But outdoor and indoor coverage
are not implemented in some areas. The current network can support subscribers of more than
50,000.

20.2.4 Demand Analysis

The planning is only a preliminary study of the CDMA network. It is required by Shenda
Telephone Co., Ltd. that BTS sites capable of a full coverage of the SEZ should be defined to meet
the anticipated traffic. Therefore, the solution is designed as per the requirements detailed below.

20.2.4.1 Coverage Requirements

Outdoor coverage should exceed 95% before October 2001;

Outdoor coverage should exceed 98% by the end of 2001;

Indoor coverage should conform to the indoor coverage range put forward by Shenda;

Indoor coverage of key buildings should be completed before October 2001;

All indoor coverage objectives should be fulfilled by the end of 2001.

20.2.4.2 Capacity Requirements

One carrier capacity should reach 100,000 lines before October 2001, excluding the capacity of
two carriers used in areas with high traffic;

The system capacity should reach 200,000 lines by the end of 2001, including the capacity of
two carriers in use.

20.2.4.3 GoS Requirements

GoS of network: GoS=2%;

Busy hour average traffic per subscriber: 0.03 Erlang.

20.2.4.4 System Parameters

1. Forward/backward service channel frame error rate: FER=1% (Eb/No=7 dB)

2. Encoding rate: 8 kbps EVRC =channel coding: 9.6 kbps

3. Voice activation coefficient:40%

-830-
 Chapter 21 ZTE Network Planning and Optimization Solution

4. Pilot Ec/Io least threshold: 0dB

5. Pilot pollution threshold: 0dB

6. Cell load: 50% (the actual load should prevail if it is less than 50%)

7. Forward signal power distribution: Pilot 20%

Page 15%

Sync 2%

8. Sensitivity of BTS receiver: -117 dBm

9. MS maximum power: 200 mW (23 dBm)

10. MS antenna gain: 0dB;

11. MS noise coefficient: 0dB

20.2.5 Network Planning Solution

20.2.5.1 Overview

In general, detailed scheme design and verification should be carried out before actual
construction of system, and CDMA system is no exception. The following objectives are to be
implemented through network planning:

Achieving maximum radio coverage in the service area in terms of time and place; reducing
the interference to the fullest extent to reach the QoS required; optimizing the setting of radio
parameters and achieving optimum QoS of the system; improving system capacity within a limited
bandwidth; reducing system equipment units and cutting down cost as much as possible on
condition that the capacity and QoS are reached.

As a kind of interference restricted system, CDMA is rather simple in respect of frequency

planning. However, particular attention should be paid to two aspects in actual network planning:
one is the relation between QoS and subscriber number; the other is the power consumption and
control. Due to the self-interference of the system, system interference and capacity vary with the
change of the number of subscribers and the adjustment of forward/reverse transmit power.
Therefore, the planning of spread-spectrum communication system is dynamic.

To meet the coverage and capacity requirements put forward by Shenda Telephone Co., Ltd.,
we perform the planning as the overall planning of the radio PHS project of Shenzhen City,
gradually satisfying the coverage and capacity requirements in Shenzhen.

-831-
Chapter 21 ZTE Network Planning and Optimization Solution

20.2.5.2 Outdoor Coverage Solution

On the basis of the existing network coverage of Shenzhen, an addition of around 60 BTSs
(including repeaters) will accomplish a coverage of 95% of the SEZ. Specific BTS sites are
specified in the summary of the article.

20.2.5.3 Indoor Coverage Solution

According to the statistics of European countries, the U.S. and the Hong Kong SAR, indoor traffic
occupies one third of the total traffic of mobile phones. Poor indoor coverage will result in a heavy
charging loss to operators. So the indoor coverage of key buildings should be guaranteed. High-
income people in tall buildings will make the area a hot spot of mobile communication. However,
the following problems may arise in these areas: On the ground floor, underground stores,
underground parking lots of large buildings, the signal is week and the mobile phones can hardly
work, forming blind areas or shaded areas of mobile communications; in middle floors, pilot
pollution areas may form due to the overlap of signals from different BTSs around and the
consequent frequent handover of mobile phones, resulting in call drops or even severely affecting
the use of mobile phones and QoS of network; in high floors of a building, poor coverage as a
result of height limit of the BTS antenna may also cause a blind area of mobile communication. In
addition, with the expansion radio local services, some buildings overcrowded with subscribers
may lead to channel congestion. These are all pressing problems to be solved.

In view of the problems described above, the following solutions are proposed:

Scheme 1: Microcellular BTSs are to be installed indoors and the microcell signals are to be
transmitted to coverage areas inside the building via antenna and feeder distribution system to
achieve effective indoor coverage. Since the system has no active equipment but passive devices
such as power splitter, coupler and antenna, it is simple in structure, quick to construct and easy to
maintain, without impact on the development of new services. This antenna and feeder system is
applicable to the coverage of medium-sized buildings, with small investment required and
immediate return gained.

Scheme 2: Microcellular BTSs are to be installed indoors and effective indoor coverage is
achieved through optical distribution system. Since the system involves active equipment, the
power supply and installation of optical local and remote equipment as well as splitting and fusion
of optical fibers should be taken into account. As a result, the system is rather complicated in
structure and the construction period is long. This kind of distributed system is more suitable for
the overall coverage of large and super-large buildings.

Scheme 3: Repeaters are to be installed and the effective indoor coverage is achieved via
antenna and feeder distribution system. The integrated network performance should be carefully
considered and the planning should be reasonable if repeaters are to be adopted in urban areas. It
should be noted that the introduction of repeaters in urban areas would undermine the quality of
network and help little in solving the congestion problem.

-832-
 Chapter 21 ZTE Network Planning and Optimization Solution

In the light of the principles of sustainable development and achieving satisfactory coverage
with minimum investment, we hold that the following solution may be adopted for indoor
coverage after comparing the above three schemes:

In this phase of project, scheme 1 is recommended for indoor coverage. It can prevent
deterioration of system performance (capacity decline, coverage of main BTS diminishing) caused
by the use of repeaters.

20.2.6 Electrical Measurement and Model Correction

20.2.6.1 Electrical Measurement

The radio wave propagation in some complicated propagation environments should be reviewed
before setting up base stations; the coverage of the BTS should be roughly learned via electrical
measurement; electrical measurement is also required for some BTSs to correct nontypical radio
wave propagation models so as to guarantee a more realistic simulation of planning software and a
more reliable result.

The general process of electrical measurement is as follows:

1. Site selection of electrical measurement

Not all BTSs require electrical measurement. The representative propagation environments of
the service area should be chosen whenever it is possible, and respective BTS sites for electrical
measurement should be established in different man-made environments such as crowded urban
area, common urban area, suburb, etc; the principle of choosing BTS sites is that it should be able
to cover sufficient types of surface features (as provided on electronic map); the antenna of the test
point should be at least 5 m higher than obstructions within a distance of 150 to 200 m; three or
more test points are recommended for each man-made environment to eliminate the interference
of location factors.

2. Selection of relative parameters of test point

Omni-directional antenna is recommended and the effective height of BTS antenna is 4 to 30

m; the buildings chosen should be around 15 m and the height of MS antenna should be 1 to 2 m;
besides, the longitude and latitude of test points, antenna height, antenna type (including pattern,
gain), feeder loss, transmit power of transmitter, and gain of receiver should be recorded as well as
whether there is any loss caused by human body and vehicle (there will be no loss caused by
human body or vehicle if field intensity testing vehicle is employed.) It should be ensured that the
testing frequency is clean.

3. Transmitter should be installed and antenna should be set up on the BTS where electrical
measurement is to be performed; then power on the transmitter and adjust the output power and

-833-
Chapter 21 ZTE Network Planning and Optimization Solution

frequency to an appropriate level.;

4. Defining test path and test rate

The route should be defined before the test for it has a direct bearing on accuracy of test data.
The following aspects should be taken into account when defining the test route: It is able to
obtain test data of different distances and from different directions and at least 4 to 5 test data at a
certain distance to eliminate the influence of location factors; a test route passing through different
surface features is recommended and highways and wide roads should be avoided if it is possible;

40 wavelength are usually adopted and samples should be taken from 36 to 50 sampling
points so that the deviation of the test data from the local average is less than 1 dB and a
reasonable test rate may be determined.

5. Carrying out the actual radio wave measurement while driving and carefully recording the
data. Tools usually used include:

•CW transmitter

GPS

•Viper

6. Analysis and disposal of test result

Invalid data will be filtered before analysis by means of power filtering and distance filtering.
The influence of street “wave guide effect” should be eliminated when analyzing the data through
data processing tool, e.g. OPAS32 (SAFCO). It should be checked whether the basic coverage
requirement is met, or whether the location of BTS is required to be adjusted. If yes, the BTS sites
should be determined again through consultation with the equipment buyer for electrical
measurement. The test result diagram should be printed out;

2.6.2

The data should be stored and inputted into the network analyzing software for propagation
model correction.

20.2.6.2 Model Correction

We have finally decided on Difu Hotel and South Daily newspaper office as the sites for electrical
measurement after carefully analyzing the geographic condition of Shenzhen. We have corrected
the propagation model based on the test data acquired on electrical measurement (after reasonable
deletion of invalid data) as detailed below:

BTS sites Testing frequency Number of test point Standard deviation

South Daily 1978.7 5MHz 5120 7.05

-834-
 Chapter 21 ZTE Network Planning and Optimization Solution

newspaper office and

Difu Hotel

The result of the model correction indicates that the electrical measurement has reached its
anticipated purposes.

20.2.7 Link Budget

The coverage of the BTS mainly depends on the antenna height, downtilting angle, transmitting
power, and especially the height and density of buildings in urban areas

Two mathematical models are usually employed to calculate the radio coverage of the BTS as
follows:

1. OKUMURAHATA model is usually adopted for the BTS with a coverage radius larger
than 1 km;

2. The Cost-231-Walfish-Ikegami propagation loss calculation model recommended by

European Research Association of Telecommunications Science and Technology may be adopted
for urban areas with dense high-rise buildings when the coverage radius of the BTS is no larger
than 1 km.

The coverage of each BTS may be basically forecasted on the basis of system parameters and
indices as well as the relative calculation model. However, the antenna height, antenna downtilt
angle and transmit power of each BTS should be adjusted in installation and commissioning so as
to meet the coverage requirements.

A preliminary forecast on radio service area can be conducted on the basis of the uplink and
downlink allowable loss, the basic propagation loss computing formula of mobile communication
recommended in CCIR report, while taking into account the additional losses as well as the actual
geographical environments. It is has to be pointed out that the radio coverage calculated through
mathematical model is only an approximate value based on theory and test result statistics. It can
be hardly described by an accurate mathematical model due to the varieties of actual geographical
environments. Therefore, actual coverage details should be based on the result measured.

At present, reverse link budget is usually employed for link budget in CDMA system. In
general, the normal fading parameter σ involved in the budgeting process is 8 dB. Normal fading
margin relates to border communication probability, and its quantitative relation is as follows:

Normal fading margin (75%): 0.67449σ = 5.40 dB

Normal fading margin (80%): 0.84162σ = 6.73 dB

-835-
Chapter 21 ZTE Network Planning and Optimization Solution

Normal fading margin (85%): 1.03643σ =8.29 dB

Normal fading margin (90%): 1.28155σ =10.25 dB

Normal fading margin (95%): 1.64485σ =13.16 dB

The communication probability in the coverage border is usually 75% and the corresponding
outdoor coverage is 95%. If the communication probability is to be 90%, a fading reserve of about
5 dB will be added in link budget, which will demand a considerable growth in investment of
operators. We adopt the index of 75% as the system index in urban area of Shenzhen. Specific link
budget is shown in the following table:

Table 21-1 Link budget table

Crowded
Transmission Open
Urban City Suburb Countryside Remarks
environment countryside
AREA
Normal transmission power
23.00 23.00 23.00 23.00 23.00
of mobile phone (dBm)
Antenna gain of mobile
0.00 0.00 0.00 0.00 0.00
phone (dBi)
Human body/vehicle loss
3.00 3.00 3.00 3.00 3.00
(dB)
ERP of mobile phone
20.00 20.00 20.00 20.00 20.00
(dBm)
BTS antenna gain (dBi) 15.70 15.70 15.70 15.70 15.70
BTS jumper loss (dB) 1.00 1.00 1.00 1.00 1.00 Including joints
BTS feeder loss (dB/100
6.00 6.00 6.00 6.00 6.00
M)
BTS feeder length (M) 50.00 50.00 50.00 50.00 50.00
E.g. Diplexer,
Other anticipated losses
1.00 1.00 1.00 1.00 1.00 lightning
(dB)
arrester
BTS antenna feeder loss
5.00 5.00 5.00 5.00 5.00
(dB)
Hot noise spectrum density
-174.00 -174.00 -174.00 -174.00 -174.00
(dBm/Hz)
Data speed (bps) 9600.00 9600.00 9600.00 9600.00 9600.00
Noise coefficient (dB) 5.00 5.00 5.00 5.00 5.00
Diversity gain
Eb/No 7.00 7.00 7.00 7.00 7.00
considered
Load 0.50 0.50 0.50 0.50 0.50
Interference margin (dB) 3.01 3.01 3.01 3.01 3.01

-836-
 Chapter 21 ZTE Network Planning and Optimization Solution

Crowded
Transmission Open
Urban City Suburb Countryside Remarks
environment countryside
AREA
BTS sensitivity (dBm) －119.17 －119.17 －119.17 -－119.17 －119.17
It is 0 if it is not
Soft handover gain (dB) 4.00 4.00 4.00 4.00 4.00
soft handover.
Normal fading variance
8.00 8.00 8.00 8.00 8.00
(dB)
Communication probability
0.75 0.75 0.75 0.75 0.75
on coverage border
Normal fading margin (dB) 5.40 5.40 5.40 5.40 5.40
Maximum allowable space
153.47 153.47 153.47 153.47 153.47
loss

Modified as per
Building penetration loss 28.00 20.00 15.00 10.00 6.00 electrical
measurement
Uplink loss 125.47 133.47 138.47 143.47 147.47
BTS height 35.00 40.00 50.00 50.00 50.00
MS height 1.50 1.50 1.50 1.50 1.50
RF center frequency 1925.00 1925.00 1925.00 1925.00 1925.00
Hata model landform Hata model
0.00 0.00 －12.15 －22.21 －32.34
modification employed
A (dB) 134.13 133.33 119.84 109.78 99.65 L=A+BlogR
A (dB) 34.79 34.41 33.77 33.77 33.77
BTS radius (km) 0.56 1.01 3.56 9.94 26.06

COST231 model landform COST231

3.00 0.00 －12.15 －22.21 －32.34
modification model
A(dB) 139.30 135.50 122.01 111.95 101.82
A (dB) 34.79 34.41 33.77 33.77 33.77
BTS radius (km) 0.40 0.87 3.07 8.58 22.47
As shown in the above link budget table, the effective indoor coverage radius is around 500
m in the crowded urban area of Shenzhen.

20.2.8 Capacity Analysis

Ready BTSs and their configuration are as follows:

-837-
Chapter 21 ZTE Network Planning and Optimization Solution

Number of base Configuratio Subscribers

Name of base station
stations n supported
1 Local Exchange Building S111 1317

-838-
 Chapter 21 ZTE Network Planning and Optimization Solution

Number of base Configuratio Subscribers

Name of base station
stations n supported
2 Shawei Equipment Building S11 878
3 Huafeng Building S111 1317
4 Nanyou Equipment Building S111 1317
5 Shahe Equipment Building S111 1317
6 New Nantou Equipment Building S11 878
7 Shatoujiao Equipment Room S111 1317
8 Xingang Building S111 1317
9 Harbor City S11 878
10 Dameisha Equipment Room O1 439
11 Liantang Base Station S111 2634
12 Donghu Base Station S111 1317
13 Tianbei Base Station S111 1317
14 Wenhua Building S11 878
15 Telecom Building Base Station S111 1317
Nanyuan Equipment Building Base
16 S111 1317
Station
17 Yuandong Parking Lot S111 1317
18 Jintang Street, Caiwuwei S111 1317
19 Meilin Equipment Building S111 1317
No. 27 building, the third company,
20 S111 1317
Zhuzilin
21 Huanggang Village S111 1317
22 Meilin Post Office S111 1317
23 South Daily Shenzhen Building S111 1317
24 Niuxiang Village, Fuxing Road S111 1317
25 Taifucang S111 1317
26 Jingtian Equipment Building S111 1317
Science and Technology Park
27 S11 878
Equipment Building
28 Xili Equipment Building S111 1317
29 Hua’ercheng S111 1317
30 Huada Building S11 878
No.23 Building, Frontier Inspection S111
31 No. 523 Building, Bagualing S111 1317
32 Difu Hotel S111 1317
33 Fuhua Comprehensive Market S111 1317
34 Cuiyuan Street S111 1317
35 Rose Garden S111 1317
36 Nancun Village W. S111 1317

-839-
Chapter 21 ZTE Network Planning and Optimization Solution

Number of base Configuratio Subscribers

Name of base station
stations n supported
37 Nanshan Education Base S111 1317
38 Jiangong Village, Nanshan S111 1317
39 Buxin Village S111 1317
40 Qingshuihe S111 1317
41 Taining Road S111 1317
Total subscribers
51802
supported

BTSs to be operated (sites determined) and their configurations are as follows:

Number of base Configuratio Subscribers
Name of base station
stations n supported
1 Chegongmiao 2-sector BTS 878
2 Qingshuihe 3-sector BTS 1317
3 Mumian Village 3-sector BTS 1317
4 Huangbeiling 2-sector BTS 878
5 Beijing Building 3-sector BTS 1317
6 Moon Bay 3-sector BTS 1317
7 Zhonglv Warehouse 3-sector BTS 1317
8 Jiangong Village 3-sector BTS 1317
9 Shangbaishi 3-sector BTS 1317
10 Songpingshan 3-sector BTS 1317
11 Zhenhua Road 3-sector BTS 1317
12 Zhenxing Road 3-sector BTS 1317
13 Sungang Zone 3-sector BTS 1317
14 Nigang Village 3-sector BTS 1317
15 Border Inspection W. 3-sector BTS 1317
16 Shekou Bus Station 3-sector BTS 1317
17 Shixia New Village 3-sector BTS 1317
18 Shuiwei Village 3-sector BTS 1317
19 Huaqiang Road S. 3-sector BTS 1317
20 Baishaling Parking Lot 3-sector BTS 1317
21 Gangxia 3-sector BTS 1317
22 Shangsha Village 3-sector BTS 1317
23 Shaiwei Village 3-sector BTS 1317
24 Badeng Village 3-sector BTS 1317
25 Economic Daily Road 3-sector BTS 1317
26 Xiangmei Market 3-sector BTS 1317
27 Xinxiu Village 3-sector BTS 1317
28 Education Bureau 3-sector BTS 1317

-840-
 Chapter 21 ZTE Network Planning and Optimization Solution

Number of base Configuratio Subscribers

Name of base station
stations n supported
29 Dushu Village 3-sector BTS 1317
30 Longyuan Mountain Villa 3-sector BTS 1317
31 Chunfeng Road 3-sector BTS 1317
32 Honghu 3-sector BTS 1317
33 Guiyuan Road 3-sector BTS 1317
34 Tianxin Village 3-sector BTS 1317
35 Taoyuan Village 3-sector BTS 1317
36 Tanglang Village, Xili 3-sector BTS 1317
37 Vocational College 3-sector BTS 1317
38 Nanshan Village 3-sector BTS 1317
39 Dachong 3-sector BTS 1317
40 Lianhua Road W. Repeater 0
41 Lianhuabei Repeater 0
42 Meilin No. 1 Village 3-sector BTS 1317
43 Honggang Road Repeater 0
44 Luofang Village Repeater 0
45 Xilingxia Repeater 0
46 Yinhu Bus Station Repeater 0
47 Pingshan Village Repeater 0
48 Changyuan Village Repeater 0
49 Dakan Village Repeater 0
50 Fuguang Village Repeater 0
51 Xiaomeisha Repeater 0
52 Zhongying Street Repeater 0
53 Tunnel Mouth Repeater 0
54 Haiwang Building Repeater 0
55 Yantian Bonded Area Repeater 0
56 Bijia Mountain Repeater 1317
57 Fairy Lake Repeater 0
Subscribers supported 53119

As shown in the above tables, 98 BTSs (including repeaters) have been planned with a total
capacity of 104,921 subscriber lines. After all above BTSs have been put into operation, basic
outdoor coverage of the SEZ will be achieved. Besides, indoor coverage in some buildings will be
required. Among all 51 buildings for indoor coverage proposed by Shenda Telephone Co., Ltd.,
we will check them one by one and present a list of buildings where the indoor coverage is
required to Shenda Telephone Co., Ltd. We expect that 80 to 100 microcells will be added in the
SEZ, which will be able to support 40,000 subscribers or so. It will be able to meet the capacity
requirement at the end of October proposed by Shenda Company. After a full coverage of the SEZ

-841-
Chapter 21 ZTE Network Planning and Optimization Solution

is accomplished, the capacity requirement of 200,000 by the end of 2001 will be satisfied by
adding carrier frequency (the total subscribers will arrive at 250,000).

20.2.9 Coverage Simulation Forecasted Result

20.2.9.1 Simulation Input

Following data should be made available before the simulation analysis:

1. Preliminarily determined data of each base station, such as longitude, latitude, height,
direction, transmit power, etc;

2. Electronic map data, including height, surface features, and various vector diagrams;
translation will be conducted if it is required;

3. Setting of transport parameters and CDMA parameter file; some parameters will be
modified according to local conditions and capacity of BTS system;

4. Data of electrical measurement, for the use of correction model;

5. Other auxiliary data, such as local scanned picture, which will be inputted into the
simulation software as Overlay, Picture and Image for the convenience of visual analysis and
positioning.

20.2.9.2 Simulation Analysis

Our network planning simulation software is employed, first of all, for the correction of
propagation model. Data collected from electrical measurement will be adopted for the correction
of the propagation model for complicated landforms so as to achieve more accurate subsequent
simulation results. The subsequent CDMA simulation analysis mainly includes:

CDMA pilot channel analysis

It is mainly to analyze the coverage of pilot signal of each BTS.BTS. Forward link analysis:
it is mainly to analyze the coverage probability, FER and maximum b
E / N t value of forward
links in various handover cells and non-handover cells.

Reserve link analysis

It is mainly to analyze the coverage probability of the reserve link and the maximum transmit
power of mobile phone in various handover cells and non-handover cells.

PN interference analysis

-842-
 Chapter 21 ZTE Network Planning and Optimization Solution

It is mainly to analyze the influence of PN interference and conduct the PN offset planning
for each BTS.BTS.

CDMA distribution analysis

It is mainly to figure out the influence of different distribution of MS in the cell on the
analytic results of CDMA.

20.2.10 Planning Summary

The radio network design objectives proposed by Shenda will be achieved by means of
comprehensively using large BTSs, microcells, as well as adding carrier frequencies.

20.2.11 Network System Indices

20.2.11.1 Overall Performance of the System on Busy Hour

bsc0

Busy hour: 2002-3-1 17:00-18:00 Traffic (Erl) 1397.7183

Call
Effective call Blocking
Main completion 98.33% 96.25% 0.61%
completion rate rate
performance rate
indices Handover
99.65% Call drop rate 1.86% BHCA 92,591
(busy hour) success rate
CPU utilization of CPM peak value/mean
42/34 (CPM755)
value (755)
Soft Handover-out Handover process setup
6236 / 99.66% 3182/99.28
handover times/success rate times/success rate
between
Handover-in Handover process release
BSSs (Busy 6561 / 99.56% 3182/99.28
times/success rate times/success rate
hour)

bsc1

Main Busy hour: 2002-2-26 17:00-18:00 Traffic (Erl) 1178.9047

performance Call 97.49% Effective call 97.91% Blocking 2.31%
indices completion completion rate rate
(Busy hour) rate

-843-
Chapter 21 ZTE Network Planning and Optimization Solution

Handover
99.34% Call drop rate 1.04% BHCA 77,466
success rate
CPU utilization of CPM peak value/mean
34/27.5 (CPM755)
value (755)
Soft Handover-out Handover process setup
5619 / 99.57% 2385/ 99.45%
handover times/success rate times/success rate
between
Handover-in Handover process release
BSSs (Busy 5626 / 99.73% 2385 / 99.45%
times/success rate times/success rate
hour)

20.2.11.2 Busy Hour Traffic Diagram

-844-
 Chapter 21 ZTE Network Planning and Optimization Solution

20.2.11.3 Busy Hour Soft Handover Proportion

20.2.11.4 Busy Hour Blocking Rate

-845-
Chapter 21 ZTE Network Planning and Optimization Solution

20.2.11.5 Average Call Drop Rate

20.2.11.6 Average Call Completion Rate

-846-
Part 3 Typical Case Analysis

ZTE Corporation

847
 Preface
This part is mainly to describe the typical configuration and networking modes of BTS system on
the basis of ZTE products. It finally analyzes the typical cases of the application of ZTE products
in WLL and cdma2000 1x, including deep coverage and wide coverage.

The first chapter describes the typical configuration and basic networking modes and then
gives an account on the typical cases of the application of ZTE products in Shenzhen WLL in
respect of deep coverage. The second chapter describes the typical cases of the application of
cdma2000 1x in Wanzhou, Fuling, and Qianjiang, including deep coverage and wide coverage.

After learning this part, the reader should be able to understand the basic networking modes
and typical configuration of ZTE products and explain the characteristics and merits of the
solution on the basis of typical application examples of ZTE products.

848
Chapter 22 Networking Configuration Analysis with Typical WLL Cases

Chapter 21 Networking Configuration Analysis with Typical

WLL Cases

Objectives

 Understand the networking mode of ZXC10-BSS

 Understand the phase II construction scheme of China Unicom

 Fully understand ZTE C++ solution

Introduction

This chapter introduces typical WLL networking and configuration with reference to ZXC10-BSS
(V5.0) and then gives typical examples. After learning the chapter, the reader should be able to
understand the typical basic configuration modes and explain the characteristics of ZTE WLL solution.

21.1 ZXC10-BSS (V5.0) Networking Mode

XC10-BSS (V5.0) usually adopts the following networking modes: Star networking, ring networking,
chain networking and hybrid networking.

21.1.1 Star Networking Mode

ZXC10-BSS (V5.0) star networking mode is shown in Fig. 22-1.

BTS0

BTS1
BSC
BTS2

BTS3

Fig. 22-1 Schematic diagram of star networking

850
 Chapter 22 Networking Configuration Analysis with Typical WLL Cases

In star networking, n E1 PCM links are led into each SITE directly by BSC. The BTS device on
each site is an end device. The networking mode is simple, and the construction and maintenance are
convenient. Signals go through few links, which enhances the line reliability. This kind of networking
mode is generally employed in populous urban areas.

21.1.2 Ring Networking Mode

ZXC10-BSS (V5.0) ring networking mode is shown in Fig. 22-2:

BTS0

BTS1
BSC
BTS2

BTS3

Fig. 22-2 Schematic diagram of ring networking

In ring networking, there are two sets of active/standby links. Each node in the ring has two upper-
level nodes, which enhances the reliability of the links. If one SITE is damaged or if one link fails, then
subordinate nodes can select the other one as an active link.

21.1.3 Chain Networking Mode

ZXC10-BSS (V5.0) chain networking mode is shown in Fig. 22-3:

BTS0 BTS1 BTS2

BSC

Fig. 22-3 Schematic diagram of chain networking

851
Chapter 22 Networking Configuration Analysis with Typical WLL Cases

Chain networking is also applicable to the one-site multi-BTS situation. Since signals go through
many links, so the line reliability is relatively poor. This networking mode is applicable to the areas
with band-like distribution and only a small population, thus saving a large number of transmission
devices.

During actual networking engineering, since the stations are scattered around, different
transmission devices are usually used between BSC and BTS as the intermediate connection. Common
transmission modes include microwave transmission, optical cable transmission, HDSL cable
transmission and coaxial cable transmission etc.

21.1.4 Star-chain Hybrid Networking Mode

ZXC10-BSS (V5.0) star-chain hybrid networking mode is shown in Fig. 22-4:

BTS0 BTS1 BTS2

BSC BTS3

BTS4

Fig 22-4 Schematic diagram of star-chain hybrid networking

21.2 Analysis on ZTE CDMA WLL Application Example

ZTE CDMA WLL network solution is a kind of radio access solution advanced by ZTE Corporation on
the basis of actual market demand. At present, it has been applied in Shenzhen, Yunnan, Guizhou, and
Heilongjiang, providing a large number of subscribers with mobile and radio high-speed data services.
The following text will illustrate how ZTE CDMA is to implement the deep coverage in an adversary
environment crowded with tall buildings and to provide operators with excellent network services with
reference to CDMA WLL network solution in Shenzhen.

852
 Chapter 22 Networking Configuration Analysis with Typical WLL Cases

21.2.1 Case: Shenzhen 1.9G CDMA WLL

The following is the real picture of Shenzhen 1.9G CDMA WLL network. Capacity: 300,000; number
of base stations: 146; allocated numbers: more than 160,000. Since the landforms and subscriber
density in the coverage area vary greatly, experience network planning personnel have been assigned
by ZTE to conduct the location survey and measurement and prepare a purpose-designed solution to
solve problems such as poor signal coverage and low conversation quality.

Fig. 22-5 Real picture of Shenzhen 1.9G CDMA WLL network

21.2.2 Case Analysis

Shenzhen High-tech Fair Exhibition Center, with a building height of 30 m and many indoor
subscribers, had poor signal coverage with signal strength of －108dBm before network planning and
optimization and the implementation of deep coverage solution. It then had many problems such as
discontinuous voice, frequent call drops, and difficulty in making a call. In accordance with the actual
conditions, a distributed indoor coverage system had been installed and the antenna positions of the
said system had been optimized so as to minimize the influence on outdoor radio environment. After
the optimization, the signal strength exceeds -80dBm and the conversation quality is greatly improved.

Corresponding product mix has been employed in several other places so as to implement the deep

853
Chapter 22 Networking Configuration Analysis with Typical WLL Cases

coverage and enhance network quality on the basis of actual conditions measured. E.g. the conversation
quality inside the local exchange building of Shenzhen due to severe pilot pollution; our network
planning engineers have installed the indoor coverage system in the building and optimized the
positions of the antennas so as to minimize the influence on the outdoor radio environment; the
conversation quality is greatly improved upon completion.

Eq uipmen t
ro om

50m

Hall A

150m

50m
Between
room
Air-conditioner
room

50m

50m Hall E
50m

50m

30m 30m

Hall F2
Hall F1
Antenna Power distributor
30m
30m
-7dB Coupler -10dB Coupler
40m 40m
40m
7/8" NDREW Coaxial cable
30m Hall D
1/2" ANDREW Coaxial cable

Fig. 22-6 Indoor coverage system diagram in Shenzhen Hi-Tech Fair Exhibition Center

21.2.3 Equipment Adopted in Deep coverage

Equipment adopted in ZTE CDMA WLL deep coverage solution include:

 Common micro base station: Supporting single carrier single sector or multiple carrier single
sector configuration; supporting cross-carrier/sector channel sharing; applicable to deep layer
indoor coverage of buildings to increase the capacity.

 Remote RF base station: Supporting single carrier single sector or multiple carrier single
sector configuration; supporting baseband processing pool of the remote module shared main
cabinet; no GPS required; outdoor type design and installation near antenna feeder allowed so

854
 Chapter 22 Networking Configuration Analysis with Typical WLL Cases

as to enhance coverage performance.

 Repeater: Networking in RF or optical fiber mode, accompanied by flexible network

construction; modular design, flexible and convenient combination into various types
according to different configuration. It can be adopted to solve the problems such as the
excessively long distance between equipment room and the installation site of antenna, as
well as the coverage in special environments including tunnels and subways.

 Trunk amplifier: Simple and flexible networking; feed source accommodating micro BTS or
repeater; applicable to small and medium-sized places.

 Optical fiber indoor coverage system: Simple and flexible engineering networking;
supporting 24 network nodes; balanced signal, MS working at a comparatively low level of
transmit power in most of the coverage area of MS; flexible system structure and easy for
future expansion; neat equipment and antenna minimizing the influence on environment;
applicable to large-size buildings.

 Active distributed indoor coverage system: Supporting 128 nodes at most, flexible
networking, RF signals evenly distributed on every corner of the building via such
transmission media as cable or optical fiber to eliminate the problems including blind area,
weak -signal area and call drops.

After survey of local conditions, ZTE network planning personnel select ZTE serial products and
formulate a purpose-designed solution to achieve the effect of deep coverage. As a result, the network
quality requirement is satisfied and the user satisfaction is enhanced.

For example: Before deep coverage, call drops and network access failure of mobile phones often
occur in the meeting room of hotel among tall buildings due to the weak signal. Once a micro BTS is
installed in the meeting room, the above problems are well solved the conversation quality becomes
fairly good. Another example, the signal of the macrocellular BTS cannot reach the platform of subway
before the implementation of deep coverage. Once the micro BTS and remote RF BTS is installed, the
coverage can be well implemented and the conversation quality becomes fairly good, causing no
negative effect on surrounding radio coverage.

21.2.4 Characteristics of ZTE CDMA WLL Deep coverage Solution

It can support cdma2000 1x as well as cdma2000 1x EV/DO to be launched soon.

Network construction quality is fully ensured: ZTE CDMA technology is developing in step with
the most advanced CDMA technology of the world. After years of large-scale commercial operation,
we have accumulated rich experience in network planning and optimization.

855
Chapter 22 Networking Configuration Analysis with Typical WLL Cases

Low construction cost: ZTE solution adopts the series products independently developed by
ourselves. The WLL network can be directly upgraded to cellular mobile network once the conditions
of customers permit.

856
 Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

Chapter 22 Networking Configuration Analysis with Typical

cdma2000 1x Cases

The typical cases of the application of the ZTE cdma2000 1x will be introduced in this chapter. Readers
should master the typical basic configuration modes, and be able to describe the features of the ZTE
cdma2000 1x scheme via application example.

22.1 Phase II cdma2000 1x Network Construction Scheme of Hainan

Unicom

ZTE is the first domestic corporation that introduced the CDMA commercial system. The core network
part (including circuit domain and packet domain), radio network part and mobile data service have
been tested as was required in China Unicom CDMA 1X Test Network Project Overall Scheme, China
Unicom CDMA 1X Test Network Project Test Specifications and Rules for Implementation of China
Unicom CDMA 1X Test Network Acceptance Test (in Haikou) and ZTE passed the tests with excellent
results－ This shows: the ZTE CDMA 1X system can provide high-quality data services as well as high-
quality voice services. The maximum data service transmission rate of a single user is up to
163.2(153.6+9.6) kbps. It also reflects that the system is of good coverage capability. The voice user
capacity of a single sector is up to 61, which is increased by 50% compared with that of IS-95A; in
single BS environment, the forward/backward data service bandwidth of single carrier sector CDMA
1X is up to about 410 kbps; in the cellular environment where its adjacent cell is under 50% load, and
the forward/backward valid data service throughput of single carrier sector is about 245 kbps. All these
fully prove the ZTE’s technology strength in the CDMA 1X field.

22.1.1 Overall Construction Concepts of the Phase II Network of Hainan

Unicom

The CDMA 1x technology standard will be adopted in the Phase II CDMA project. In principle, no
more IS-95A equipment shall be added to the system. According to the construction scales in different
provinces, for the regions without requirements of data service, the existing 95A equipment is
maintained or the capacity is properly expanded using the 95A equipment replaced in 1x coverage area;
for the newly added BS, only the 1x equipment needs to be added under the prerequisite that the
replaced 95A equipment in the 1x coverage area is used as much as possible.

857
Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

22.1.2 Overview of Hainan Unicom Phase I Network

The construction of the Phase I CDMA network is planned and designed according to the general
principle of “Small capacity and large coverage”. After the completion of the Phase I network
construction, the coverage of Hainan Unicom Network has already fulfilled the Phase I network
coverage requirements through network optimization. The network coverage states of three service
areas in Hainan are listed as follows, which include: Coverage areas of Haikou, Sanya, Danzhou,
Qionghai, Wanning, east line and west line.

The coverage states of the Phase I network of Hainan Unicom is shown in Table 23-1:

Table 23-1 Coverage states of the Phase I network of Hainan Unicom

Forward
Forward square
Names of main cities and Backward square frame
coverage rate Remarks
counties coverage (Tx) error rate
(Ec/Io)
(FER)
Haikou 98.34% 99.92% 96.31%
Sanya 99.56% 100% 98.92%
Danzhou 100% 99.78% 96.66%
Qionghai 97.43% 99.57% 96.54%
Wanning 98.68% 100% 98.68%
East line 98.74% 95.75% 92.19%
West line 95.25% 85.75% 85.50%

After the completion of the Phase I CDMA project of Hainan Unicom, the coverage rate of the
administrative counties is up to 100%, and that of administrative villages is only up to 26%. From the
coverage quantity and coverage rate of administrative villages, the quality of the Phase I network of
Hainan Unicom is lower than the average level. Therefore, it is necessary to extend the network
coverage area in the Phase II project, and adopt the macro BS, micro-wave, radio frequency extension
and indoor coverage system products etc. to implement the deep coverage of the urban areas and wide
coverage of counties and villages to get leading in high-quality CDMA network and make more
benefits for Hainan Unicom.

22.1.3 Overall Construction Principle of Phase II Network of Hainan Unicom

In view of the overall construction concept of the Phase II network of Hainan Unicom, the construction
of the CDMA 1x network should be different from that of the Phase I IS-95A network. The
construction principle of the Phase I the IS-95A network is “large coverage and small capacity”, while
the construction of the Phase II CDMA 1x network should implement expansion of capacity and update

858
 Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

of the whole network step by step on the basis of sufficient market research and analysis and forecast,
and should comply with the following principles as much as possible:

 The extension and depth of the network coverage should be further improved to improve the
network quality;

 The market requirements of the 1x data service in various service areas should be correctly
forecasted as much as possible;

 For the regions with some market requirements for data service, the 1x network is first
deployed to ensure the valid coverage;

 For the regions with few or even no requirements for data service, the existing IS-95A
equipment is still maintained; if the service requirement is increased, the capacity can be
expanded by using the replaced IS-95A equipment. The system resources can be fully used
through equipment adjustment and configuration.

 The newly added 1x system should be organically combined with the existing IS-95A system
to implement the smooth transition from the IS-95A to 1x, and should make full use of the
existing IS-95A network infrastructure (facilities, equipment room, iron tower and power
supply etc.) to avoid repeated investment;

 The construction mode should facilitate the engineering implementation and cutover to
minimize the system cutover risks;

 The radio network planning should be enhanced to improve the overall performance
specifications;

 The construction of the radio network should facilitate the sustainable network development.

22.1.4 Core Network Circuit Domain Construction Scheme

22.1.4.1 Voice Channel Network

According to the scale of the Phase I CDMA Network of Hainan Unicom, and the technical
specification requirements of the Phase II CDMA network construction of Hainan Unicom, ZTE put
forward the following voice channel network construction schemes.

TMSC2 Office

The capacity of the existing Haikou TMSC2/MSC serving as level 2 tandem office and terminal
mobile switching center in Hainan province is expanded. The Haikou TMSC2/MSC, connected to a

859
Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

pair of TMSC1s in Haikou, is responsible for forwarding inter-province services. Serving as CDMA
CGW, it can also be connected to Haikou Mobile GSM MSC, Haikou Telecom gateway, Danzhou
Telecom gateway, Haikou Unicom GSM MSC and Unicom toll exchange etc., and used as the
interconnection point between Hainan Unicom CDMA network and other networks. Moreover, it is
connected to the newly built Sanya MSC, Haikou HLR, Provincial customer service center, integrated
SCP and SMSC to implement the call handover of the subscriber roaming within the province and the
access to the manual and automatic traffic and SMS voice stations of the customer service center in the
whole province.

Terminal MSC

In this phase of project, 1 MSC with the capacity of 50,000 subscribers will be built in Sanya. It is
also used as GMSC and SSP to serve the mobile subscribers in Sanya service areas, and to connect
Sanya Mobile GSM MSC, Sanya Unicom GSM MSC, Sanya Telecom gateway and Unicom toll
exchange etc. as the interconnection point between Sanya CDMA network subscribers and other
networks. Refer to the following table for the capacities and service scopes of various MSCs.

The MSC construction scale in this phase of project is shown in Table 23-2:

Table 23-2 Hainan MSC construction scale

S.N. MSC Switching Capacity (10 K) Office Type Service

The The newly
Name existing added In total Scope
number number
1 Haikou MSC 8 2 10 Expanded Haikou and Danzhou
2 Sanya MSC 0 5 5 Newly built Sanya
In total Haikou 27 57 15
HLR

In this phase of project, the capacity of Haikou HLR will be expanded by 130,000 subscribers. Its
total capacity is up to 250,000 subscribers.

After the completion of this phase of project, the voice channel network structure is shown in Fig.
23-1:

Inter-network Interconnection Scheme

In this phase, all terminated MSCs is also used as GMSC, and connected to other telecom carriers’
GMSCs or interface offices such as the local China Mobile and China Telecom etc. to implement the
interconnection between networks. The interconnection project of Hainan Unicom is under
construction so as to implement the interconnection of all Unicom communication networks with other
telecom carriers via a network layer. At that time, the interconnection with other telecom carriers’

860
 Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

networks can be implemented by the integrated interface offices or the reconstructed IP front-end
processor.

Guangzhou Guangzhou

Haikou P STN

Sanya P STN
Danzhou P STN
Haikou
Sanya Mobile
Haikou Mobile
GSM
Haikou GSM
Sanya Unicom
Haikou
GSM
UnicomGSM
Unicom/National
Communications Unicom/National
paging Commun ications
Sanya paging

Unicom toll
Unicom toll
office
office
Unicom IP
gateway Unicom IP
gateway

Unicom Unicom
customer service customer service

Sanya BSS Haikou/Danzhou

BSS

Miscelaneous Miscelaneous

Fig. 23-1 Voice channel network of Phase II network construction of Hainan Unicom

22.1.4.2 Signaling Network

Signaling network structure

At present, the CDMA signaling network of Hainan Unicom is composed of two levels. That is, an
LSTP, which Haikou MSC/TMSC2 serves as, is set up in Haikou. It is connected to a pair of HSTPs in
Guangzhou to decongest inter-province signaling transfer service; other MSC, HLR, SMSC and VMS
within Hainan province are all connected with 1 LSTP in Haikou as SP, and LSTP is responsible for the
signaling transfer service between SPs. The signaling link adopts the 2 Mbps associated mode.

The signaling network structure in this phase of project is shown in Fig. 23-2:

Signaling Network SCCP Message Addressing mode

According to the overall construction scheme of China Unicom CDMA network, for the
addressing of MSC/VLR, HLR/AC, SCP and MC etc. in signaling network, the GT addressing mode is
adopted for intra-province service, domestic service and international service. The intra-province and
inter-province translation place of GT is LSTP; three GT translations are used for international GT, i.e.,
LSTP, HSTP and ISTP translations.

861
Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

Guangzhou Guangzhou

Haikou P STN

Sanya P STN
Danzhou P STN
Haikou
Sanya Mobile
Haikou Mobile
GSM
Haikou GSM

Sanya Unicom Haikou

GSM UnicomGSM
Unicom/National
Communications Unicom/National
paging Communications
Sanya paging

Unicom toll
Unicom toll
office
office
Unicom IP
Unicom IP
gateway
gateway

Unicom Unicom
customer service customer service

Sanya BSS Haikou/Danzhou

BSS

Miscelaneous Miscelaneous

Fig. 23-2 Signaling network of the Phase II network construction of Hainan Unicom

Signaling point code

According to Unicom technology system, the signaling point in CDMA mobile network adopts
24-bit codes, which is the same as that in China SS7 Network. The primary signaling area code is 253,
and the secondary signaling area codes 001-174 are assigned to each branch of China Unicom based on
provinces. The secondary signaling area codes are 105-109.

22.1.4.3 Other Network Structures

Intelligent network

CDMA intelligent network is composed of service switching point (SSP), service control point
(SCP), intelligent peripherals (IP), service management system (SMS), service creation environment
(SCE), service management access point (SMAP) and voucher center (VC).

The SSP in this phase of project adopts the integrated setting mode, which is directly embedded in
each MSC and GMSC. That is, all MSCs and GMSCs support the SSP function. In this phase of
project, the IP is mainly used to receive the subscribers’ DTMF information and send record
announcement, and these information is received via SSP. Therefore, the IP is integrated in each
MSC/SSP. If the voice synthesis and voice identification are required in the future, the setting of a
special IP can also be considered. The construction of SCP, SMP, VC and SCE will be listed in separate
projects, excluding in this phase of projects.

862
 Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

In this phase of project, the interconnection between SSP and SCP, SSP and HLR, SCP and HLR
and VC and SCP is implemented via SS7 network to ensure the real-time network control.

Network management system (NMS)

Since ZTE has already established a set of local operation management center (LOMC) in Phase I
project, its capacity needs to be expanded accordingly in this phase to improve its performance, and the
software of the operation and maintenance system should be upgraded. LOMC communicates with
various NEs via TCP/IP. It is placed in the same equipment room with Haikou MSC, OMC-R and
HLR, and connected to them via Ethernet. For the system equipment in other cities, as they are placed
in different locations, they must be connected to the LOMC system via routers.

Three NEs will be added in this phase of project: one Danzhou BSC NE in Haikou and one
MSC/GMSC/SSP NE and one Sanya BSC NE in Sanya. Accordingly, it is necessary to add a set of
local NE management respectively, used for the management of the local NE equipment. The newly
added systems are accessed to the centralized NM center in Haikou via WAN or LAN. After the
completion of the Phase II project, the number of NEs managed by the ZXCOMC in Haikou includes 2
MSC, 1 HLR and 3 BSC.

Digital synchronization network

Hainan Unicom CDMA network and Hainan Unicom GSM network shares the digital
synchronization network. The level 2 class A BITS is adopted as synchronization references of level 1
tandem mobile-service switching center (TMSC1) and level 2 tandem mobile-service switching center
(TMSC2); BSC fetches clock from the data stream from MSC, and no dedicated synchronization link
will be set separately; refer to the related intelligent equipment specifications for the transmission clock
synchronization level of the intelligent network equipment.

22.1.5 Core Network Packet Domain Construction Scheme

155 macro BSs and 40 micro BSs are added in this phase of project. The total number of BSs in the
network is up to 300, among which, there are 155 1X BSs, which are distributed to Haikou, Danzhou
and Sanya. After the completion of the Phase II project, the number of wireless subscribers in Hainan
province will be up to 190,000, of which the data service subscribers is up to about 13,000.

In the BSC/PCF configuration scheme, the existing BSC in Haikou is still adopted, and another set
of BSC will be built in Haikou and Sanya respectively. That is, there are three sets of BSC in total in
the whole network. The three BSC/PCFs share evenly the traffic in Hainan province, and the data
subscriber area is divided into three equally-sized parts, which will greatly benefit the future network
organization and maintenance and management.

As the data subscribers are few at present, it is recommended that only one set of PDSN and AAA

863
Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

servers be built in Haikou.

22.1.6 Radio Network Construction Scheme

22.1.6.1 Network Construction Policy and Goal

1.1.1.1.16 Coverage area category and goal

According to subscriber density and level, different coverage area categories in Hainan province is
shown in Table 23-3:

Table 23-3 Coverage area category in Hainan Province

Outdoor Indoor Data Service

Category Description
Coverage Rate Coverage Rate Requirements
With high population density,
high traffic density, many
high-end subscribers, and
Class 1 area 97~98% 85~88% Many
high-speed data service
requirements, e.g., Haikou
and Sanya.
With large population, heavy
traffic, many common
subscribers and few
requirements of data service,
Class 2 area 90~97% 75~85% Few
e.g., such developed regions
as Danzhou, Wenchang etc.
and some tourism hotspot
regions.
With small population, light
traffic and requirements for
coverage, including small- None for the time
Class 3 area0 70~80% 60~70%
scale counties, some tourism being.
areas, highways, state roads
and provincial roads.
With low population density,
very small traffic and only None for the time
Class 4 area Coverage focus 50%
low-end subscriber. e.g., being.
mountainous area and some

864
 Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

Outdoor Indoor Data Service

Category Description
Coverage Rate Coverage Rate Requirements
developing regions.

The coverage of main communication trunks should satisfy the requirements as shown in Table
23-4:

Table 23-4 Category of main communication trunks in Hainan

Type Coverage rate

Main trunks and viaduct in city areas 99%
Highways and around-city roads 90%
State road, provincial roads, railways, city tunnels and channels. 80%
Main communication trunks between cities and counties. 50%

Indoor coverage requirements of the important buildings:

Table 23-5 Indoor coverage category of important buildings:

Coverage Area Scope Coverage Quantity

Coverage of the whole building,
Hotels of three starts or including lobby, restaurant, recreational
All
above facilities, guest room, guest lift and
underground parking lot etc.
High office building, large- Coverage of the whole building, To be determined
scale corporation or group including guest lift and underground according to the actual
user’s building in city area parking lot etc. circumstances
Large department store, Coverage of the whole building, To be determined
restaurant and recreational including guest lift and underground according to the actual
facility parking lot circumstances
Airport and railway station All airports and city at
etc. Airport lounge building and waiting hall prefecture level
Communication hub facility Railway station
Coverage of the whole building, All province and city
Government office building including guest lift and underground government office
parking lot buildings

865
Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

1.1.1.1.17 1x data service coverage

Under the condition that the 1x data service coverage of China Unicom CDMA network is larger than
or approximate to that of the mobile networks able to provide packet data service, according to the
economic development states in Hainan province, the 1x service in developed cities is in the focus of
coverage, and other service areas should also be in the coverage range, and local areas should be
covered together as much as possible.

For the regions with few or even no requirement of 1x data service, the existing 95A equipment is
maintained or the capacity is properly expanded by using the replaced 95A equipment in 1x coverage
area; for newly added BS, only the 1x equipment is added by using the replaced 95A equipment in 1x
coverage area as much as possible. That is, even for the regions without coverage requirement of 1x
data service, the 95A equipment will be purchased as little as possible in this phase of project.

Within 1x data service scope, different service levels should be provided according to the
requirements for data service. For the city center system with large data requirements, the high-speed
packet data service should be provided; for the suburbs with small requirements, only the low-speed
packet data service or circuit data is provided according to capacities. Therefore, it is recommended to
provide the following maximum data rates at the cell edge of 1x service area:

 Central business districts: >76.8 kbps

 Other regions in big cities and medium cities: >38.4 kbps

 Other regions: >19.2 kbps

 Communication trunks and towns and villages: >9.6 kbps

22.1.6.2 Perfect Network Coverage Solution

1.1.1.1.18 Deep coverage solution

In the Phase II construction project, China Unicom headquarters once required: the coverage depth
should also be strengthened. In the Phase II CDMA construction project, proper measures should be
taken to improve the indoor coverage quality of such buildings as luxury hotels, large-scale office
buildings, large department stores, airports and railway stations etc. in developed cities”

China Unicom CDMA network is a high-end user oriented elaborate mobile network, and the
high-end users are distributed in the big and medium cities, and they live a daily life mainly in some
buildings in big and medium cities, where the CDMA 1x new services, such as high-speed Internet
access, mobile business, mobile office, mobile multimedia are mainly used. Along with the rapid
development of city construction, the tall buildings are continuously increased. Only the common

866
 Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

macro cell BS is not enough for the coverage of local hot spot areas, such as the coverage of blind areas
inside the tall buildings. In addition, it is very difficult to solve the problem of underground building
coverage and the coverage of places where no equipment room is provided for BS installation by macro
cell. It is also very necessary for the perfect coverage of the radio network to flexibly satisfy the
requirements of different coverage environment for BS product series.

In the Phase I CDMA network project of China Unicom, a certain number of repeaters are adopted
to solve the indoor coverage problem. Since there are many repeater suppliers and the power of the
selected repeater is strong in the first phase of the project, after the repeater is used for mixed
networking, on one hand, the interference on sink BS is increased, and on the other hand, the network
topology structure is changed, it is not an ideal product. In fact, although a great number of repeaters is
adopted in Korea CDMA network, the low-power repeater of below 1W is commonly selected for
solving the problem of indoor coverage, and only one supplier’s equipment is adopted in the whole
network, therefore, it is convenient for coordination and system parameter setting. While, in China
Unicom CDMA network, different manufacturers’ repeaters and BSs are selected, it is very difficult for
coordination.

To better fulfill different requirements of hot spot areas in cities for China Unicom CDMA
network service, coverage and capacity, ZTE develops the latest CDMA network “deep coverage”
solution. Through the adopting of mini microcell BS (Micro BTS) with CDMA 1x functions, which is
of low cost and easy for installation and maintenance and the auxiliary indoor distribution systems, the
requirements of coverage inside main buildings in big and medium cities, capacity and 1x service
expansion can be completely fulfilled.

The “deep coverage” solution of ZTE CDMA network is composed of microcell BS and indoor
distribution systems. Compared to the indoor coverage solution in which the repeater is adopted, the
advantages of the “deep coverage” solution is that it can provide large system capacity to satisfy the hot
spot areas’ traffic requirements, and decrease the interference on the adjacent BS. With good network
planning, the RF signals of the “deep coverage” system will be centralized in the buildings instead of
being leaked out to form an obvious handover area with the surrounding BS.

1.1.1.1.19 Wide coverage solution

In the Phase I CDMA network construction project of Hainan Unicom, the whole coverage of the cities
at prefecture level and the administrative counties has been implemented. However, the administrative
villages, rural areas and the areas along the road and railway lines have not been well covered. As the
population of mobile subscribers in China are swiftly increasing, and due to the competition with China
Mobile GSM, China Unicom has to rapidly construct a CDMA network with perfect coverage.

Here, we refer to these areas that need wide coverage as “edge network”. The edge network
includes three layers. The first layer is the CDMA network covering counties and villages, the second
layer refers to a local network with the traffic of less than 500Erl, and the third layer is used for indoor

867
Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

coverage in cities. The population density is low in towns and villages, and the hot spot is usually not
obvious, therefore, the large coverage with the radius of about 5~10 km can be adopted in the town and
village cells. Due to the distance between towns and villages is comparatively far, little interference is
imposed on other cells. In hilly and mountainous areas, many towns and villages are located in the
center of small basins, there will be coverage in isolated island form. Trough careful analysis, we find
that these areas almost have the same features:

 Complicated landform

 Few mobile subscribers and low traffic

 Small requirements for data service

 Low mobile phone moving speed and infrequent mobile phone movement

 Big cell coverage radius

 Extensive distribution of BS, difficult for operation and maintenance

As the construction of the CDMA network is a system project, and there are wide areas,
complicated landforms and many scattered BSs in the edge network, a overall and detailed planning
must be provided, such as the considerations of overall construction mode, site selection, type
selection, frequency planning, engineering construction, network operation and maintenance,
transmission, power supply, equipment room and future network development. To better solve the
problem of wide coverage of edge network in the phase II network construction of China Unicom, ZTE
develops a series of products such as macro cell, micro cell, optical fiber outdoor unit, tower top
amplifier, repeater etc., which can be conveniently combined according to different environment to
achieve the final goal of low cost, wide coverage and high income.

1.1.1.1.20 Contrasts between micro cell and repeater

Comparing with the macro cell, the micro cell features low transmitting power, low cost, and flexible
networking. The micro cell cost of single carrier and single sector is lower than that of macro cells with
the same configurations, and it can provide the same service capacity. As the micro cell is installed
outdoors, and the network can be constructed rapidly, it can greatly save the carrier’s investment in
equipment room construction. In addition, the layout of micro cells is more flexible. The optimum BS
can be selected according to network planning data to achieve the optimum coverage.

Since in the actual networking application, there are many similarities between the micro cell and
the repeater, and a repeater is of low cost, whether a repeater has more advantages in the CDMA
network construction? It is analyzed in detail as follows.

Comparing with the repeater, micro cell has the following disadvantages:

868
 Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

 To achieve the same coverage square, the investment in repeater is rather low;

 Micro cell must be connected to the BSC produced by the same manufacturer, while there is
no such a requirement for repeater;

 Micro cell requires a transmission link for the connection to BSC, while no transmission
construction is required for the RF coupling repeater.

In the above analysis, the cost of micro cell is obviously higher than that of repeater. Due to the
unopeness of the Abis interface, micro cell can only be connected to the equipment of a manufacturer.
At present, the standardization of the Abis interface has been put forward to the agenda of the
standardization organization. In the near future, different manufacturers’ BSs and BSCs can be
interconnected. Comparing to the construction of fiber repeater, there are no more difficulties in
transmission construction for micro cell. On the contrary, micro cell has the following advantages:

 Micro cell can provide service capacity, which is also the reason why the micro cell cost is
higher than that of repeater;

 Micro cell imposes a little influence on system, while repeater will affects the CDMA system
from the following two aspects: Rising of BS hot noise level and uplink equivalent serial
noise coefficient.

The rising of BS hot noise level means that the sensitivity of the BS receiver will be decreased,
which will greatly affect the subscribers within the sink BS coverage area.

The excessive uplink equivalent serial noise coefficient will affect the backward coverage of
repeater;

 Most of the broadband radio repeater will amplify all the received BS signals. However,
excessive repeaters will inevitably result in the pilot pollution, and make it more difficult for
network optimization; while there is no such a problem for micro cell.

 Micro cell itself can be included in the BS NMS, while it is very difficult to implement a
repeater NM. Generally, a built-in handset or a cable/wireless MODEM is adopted in a
repeater, but its prices is rather high, which makes it very difficult for the monitoring of
repeater to be smoothly embedded to the BS maintenance system, especially under the
condition that the BS and repeater are provided by different manufacturers.

 If a repeater excites itself or there is an interference source nearby, it will result in severe
influence on the system, and a repeater may extend the interference square and block the
nearby BS.

Based on the above analysis, if the traffic, engineering cost and maintenance cost are taken in
account, the overall cost of a micro cell is not necessarily higher than that of a repeater. It is

869
Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

recommended to select a micro cell or a repeater according to different cases. For areas with small
traffic and coverage of the network edge or areas with a good separation from the existing network,
such as underground parking lots, remote rural areas and remote suburbs etc., a repeater can be
adopted. However, the total number of repeaters in network should be controlled at a low proportion. In
big and medium city areas and suburb and rural areas with a growth trend of traffic, it is recommended
to adopt a micro cell to implement the coverage.

22.1.7 Construction Scheme for Phase II Network of Hainan Unicom

At the initial construction stage of Hainan Unicom CDMA network, only 1 set of BSC equipment is set
in Haikou to control 105 IS-95BSs. In consideration of equipment load, network security and
convenience for future network expansion etc., in this phase of Hainan Unicom CDMA system project,
a number of BSCs should be added as well as PCF functional modules. As to the software, the CDMA
1X data subscriber access should be supported.

BSC/PCF configuration scheme: The existing BSC in Haikou is still adopted, and another set of
BSC will be built in Haikou and Sanya respectively. That is, there are three sets of BSC in total in the
whole network. The BSC1 in Haikou controls the 98 BSs in Haikou, the BSC2 in Sanya manages the
70 BSs in Sanya, and the BSC3 in Danzhou manages 132 BSs in Danzhou.

BS scale: In Phase II, 155 macro BSs and 40 micro BSs will be added on the basis of the 105 BSs
built in Phase I, among which 32 macro BSs and 11 micro BSs are added in Haikou service area; 90
macro BSs and 21 micro BSs are added in Danzhou service area; 33 macro BSs and 8 micro BSs are
added in Sanya service area.

After completion of the Phase II network of Hainan Unicom, the overall network is shown in Fig.
23-3:

(Haikou )
Sanya (Haikou )

BSC3 Danzhou
BSC2 Sanya BSC1 Haikou

29 BT Ss+33 55 BT Ss+32 21 BT Ss+21 MIs+90 BT S

BT Ss+8 MIs BT Ss+11 MIs

Sanya service area Haikou service area Danzhou service area

Fig. 23-3 Overall view of Phase II network of Hainan Unicom

870
 Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

BS type and number of subscribers are shown in Table 23-6:

Table 23-6 BS type and number of subscribers in Phase II network of Hainan Unicom

Number of BSs Number of Subscribers

Type S111 S11 O1 M1 Total Total Number of Subscribers Number of Data Subscribers
Haikou 79 7 1 11 98 82856 6045
Danzhou + Qionghai 91 19 1 21 132 69755 3954
Sanya 40 20 2 8 70 38395 2514
Total 300 191006 12513

22.2 ZTE “C++” Elaborate Network Solution

22.2.1 Overview of ZTE “C++” Network

“C++” network, an integrated solution of CDMA network put forward by ZTE on the basis of current
status of China Unicom CDMA network, includes a radio network solution and a service solution. The
first “+” of “++” means to further optimize the coverage quality of the existing CDMA network
through a radio network solution so as to implement the seamless coverage of CDMA network, thus
actually achieving the final goal of establishing a CDMA “elaborate network” of China Unicom. The
second “+” of “++” means to further exploit the potentiality of CDMA network through an integrated
solution to improve the overall competitive power in market and bring substantial profits for carriers.

With continuous growth and improvement of CDMA network construction, CDMA carrier and
equipment supplier more concerns about a network with deeper and wider coverage, more abundant
and convenient services and a win-win solution for subscriber and carrier. Depending on its profound
understanding of CDMA technology and powerful strength, ZTE works all out to build a ZTE CDMA
elaborate “C++” network. This network integrates cdma2000 1x, WLAN and HDR technologies, and
further optimizes the coverage quality of the existing CDMA network and implements the seamless
coverage of CDMA network by using radio network solution, thus actually achieving the final goal of
establishing a CDMA “elaborate network” of China Unicom. In addition, it further improves the
comprehensive competitive power of CDMA network in market and brings substantial profits for
carriers through an integrated service solution. “C++” network features low construction cost,
convenient maintenance, flexible networking and abundant services, and is the best choice for the
construction of CDMA network of China Unicom.

871
Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

22.2.2 ZTE “C++” Network Solution

 Wide coverage of edge areas in counties and villages through “C++” network

Due to the typical characteristics such as low population density, unobvious hot spots, wide
coverage and small traffic, the coverage radius of edge area is often between 5 and 10 km. When the
ZTE outdoor micro BS equipment and remote RF unit with low requirements for auxiliary facilities is
used for coverage, on one hand, the investment in auxiliary equipment and comprehensive construction
cost can be greatly cut down, and on the other hand, the network construction speeds up and the
network coverage can be improved.

 Super-wide coverage of special areas such as local sea areas in coastal region, inland
plain, desert and forest etc. through “C++” network

The population is comparatively scattered in this kind of areas, and the requirement for traffic is
rather low, the coverage radius is often between 40 and 100 km. The ZTE small 40 W BS or 40 W
remote RF unit of super-wide coverage can be used for flexible networking.

 Deep coverage of tall buildings in big and medium cities through “C++” network

In this kind of areas, the population density is high, and the requirements for traffic and data is
large. The ZTE CDMA indoor distribution system and micro BS, low-power repeater signal sources
etc. can be used for deep coverage.

22.2.3 ZTE “C++ network” Integrated Service Solution

 WLAN+cdma2000 1x and WLAN+ cdma2000 1x EV/DO

With cdma2000 1x network used as a solution to small coverage of radio LAN and WLAN used as
a solution to low data transmission rate of cdma2000 1x, the complementary advantages of radio
cellular network and radio LAN are actually implemented. It is applicable to such places as hotels and
airports with requirements for large traffic.

 Locating service

It provides personal terminal users with brand new life experiences and safe service guarantee, and
facilitates group users’ management over logistics and assets etc.

 Trunking Dispatching service

With fast access, group call, private call, scheduling, forced insertion, forced release, offline
functions etc., it can satisfy the special communication requirements of professional group users under
modern economy conditions. It is widely applicable to water conservancy, public security,

872
 Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

communication, railway, civil airport, electric power and oil department etc.

 SMS-based value added services (call drop prompt, short message VPN etc.)

Call drop prompt, in effective combination with functions of the existing network resources and
short message platform, makes the short message service more convenient for subscribers. Short
message VPN service is a good solution to office management and customer service etc. of group users
via short message platform.

 Mobile public telephone

Using the wide coverage feature of mobile network, the problems of difficulties in public
telephone installation and high cabling cost in some areas are solved, and the public telephone
teledensity is improved.

The integrated service solution of ZTE “C++” network, integrating the existing comprehensive
network resources, not only satisfies personal terminal users’ requirements for personalized mobile
network services to a certain extent, more importantly, but also exploits the advantages of mobile
communication network to fullest extent for group users, thus actually realizing the differential services
of CDMA network, and improving the competitive power of CDMA network in markets.

22.2.4 Overview of On-site Demonstration of ZTE “C++ network” in Haikou

In Dec. 17-19th, 2002, the on-site demonstration and report meeting of ZTE “C++ network” was held
in Haikou city of Hainan province. The concerned leaders and experts from China Unicom
headquarters, from Hainan provincial government, Hainan Unicom and China Unicom branches in
other provinces attended this meeting, and some overseas carriers also attended this meeting. At the on-
site demonstration meeting, ZTE introduced the new concepts of CDMA network: C++ network, and
conducted the related service demonstrations.

It is reported that the CDMA network coverage of China Unicom is the concerns of the telecom
industry. China Unicom will next mainly undertake the construction of an increasingly mature and
perfect network with wider and deeper coverage, so as to provide more abundant and faster services
and create a double win solution for the subscribers and the carriers. Depending on the profound
understanding of CDMA technology and integrating the CDMA 1X, WLAN and HDR technologies,
ZTE goes for building a “C++ network”, which will contribute a lot to the construction of China
Unicom CDMA network.

Super-wide coverage solution of “C++” network is the focus of on-site demonstration in Hainan.
The offshore voice and data service demonstration on tourist boat nearby Haikou and outshore locating
service demonstration are quite new and brings fantastic experiences for the person attending the
meeting. The ZTE “C++” network wide coverage solution is of strong pertinence. It is mainly oriented

873
Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

to some special application environments such as offshore areas, plain, grassland, desert etc., and can
economically solve the problem of signal coverage in the above areas. The coverage distance in this
site test exceeds 80 km, and is of good effect, completely satisfying the communication requirements of
the marine workers in offshore waters. In this site demonstration meeting, for the new services and
profitability concerned by carriers, ZTE also conducted a demonstration of and introduction to “C++
network” new services.

22.3 Chongqing (Wanzhou, Fuling and Qianjiang) Radio Network

Coverage Solution

22.3.1 Wanzhou Coverage Solution

22.3.1.1 Deep Coverage

In accordance with the outdoor coverage and indoor pre-defined position test results in Wanzhou urban
area, at present, a macro cell and micro cell should be adopted to solve the problem of indoor deep
coverage in this area. In this phase of the project, deep coverage in Wanzhou should reach the
following target: The deep coverage of Wanzhou urban area, local suburbs and other eight counties
should reach or even exceed the existing coverage level of China Unicom GSM network.

Due to special circumstances such as crowded prosperous downtown areas, high terrain drop
height and dense buildings in Wanzhou urban area, after completion of the Phase I project, the outdoor
signal becomes good. However, the indoor signal attenuation of many commercial buildings and
residential areas is very large, the signal can be hardly received. In the Phase I supplementary project,
“Square” BS is added to solve the deep coverage problem of Telegraph Road; “Mingyi Group” BS is
added to enhance the indoor coverage of this road; “Shuanghekou” BS is added to solve the coverage
problem of Shuanghekou residential areas and Wanliang highway entrance in the vicinity of city
suburb.

It is recommended to add the following BSs in urban area:

A three-sector BS is added near the zoo and Xishan Park to implement deep indoor coverage of
some importance buildings like Friendship hotel etc.;

At the both sides of Baiyan road and Guoben road is a consumption street with crowded
restaurants. Due to the high terrain drop height, Yimin and Huayuan BSs cannot implement a good
coverage of it, therefore, the coverage of important buildings nearby should be implemented by adding
an indoor distribution system in cooperation with micro cell;

A three-sector BS is added near Sanxia College to solve the deep coverage problem of Pailou

874
 Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

community and Suote Hotel near Shalong Road;

A three-sector BS is added in Mingheng community to solve the indoor deep coverage problem of
Mingheng community and Tianzicheng;

A three-sector BS is recommended to be added near Wuqiao to solve the coverage problem of

West of Wuqiao;

In addition, for Wanzhou urban area, an additional number of micro cells should be added to
replace the repeater system built in Phase I, which can be moved to remote areas to extend the
coverage.

22.3.1.2 Wide Coverage

After completion of the Phase I network construction in Wanzhou, the network implements the
coverage effect. From the test result, in the Phase II network construction in Wanzhou, the construction
of towns and villages and roads should be enhanced. Fig. 23-4 shows us the estimated coverage effect
of the existing network by simulation. The estimated results show that the wide coverage in Wanzhou
needs to be further enhanced.

Fig. 23-4 Whole network coverage forecast in Wanzhou

For the coverage of main towns and counties, in the Phase II project, BSs should be added in the
eight counties to extend coverage areas and strengthen coverage depth. Additional BSs will be added in

875
Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

the developed urban areas of the four counties, Liangping, Zhongxian, Yunyang and Kaixian to ensure
the coverage of urban areas.

For roads, the coverage of 318 state road, Wanliang highway (under construction) and Changjiang
main trunks should be continuously improved. The extension of coverage is mainly implemented by
micro cell and RF extension. The schematic diagram is shown in Fig. 23-2. For the coverage of roads,
the appropriate site height should be selected as much as possible to implement the requirements of
wide coverage. To facilitate the network optimization, the sector splitting method can be adopted. For
the coverage of towns and villages, the sector splitting should be selected according to the actual
conditions.

For the coverage of some individual areas, in view of the cost performance ratio, in network
optimization phase, some fiber repeaters can be adopted.

Suburbs Extension by
fiber

Urban area
Extension by fiber

Extension by fiber

Extension by fiber

Fig. 23-5 Optical fiber extension

22.3.2 Coverage Solution in Fuling

22.3.2.1 Deep Coverage

In accordance with the outdoor coverage test results in Fuling urban area, at present, macro cells and
micro cells should be adopted to solve the problem of indoor deep coverage in this area.

Due to special circumstances such as crowded prosperous downtown areas, high terrain drop
height and dense buildings in Fuling urban areas, after completion of the Phase I project, the site test is
provided, and the outdoor signal becomes good. However, the indoor signal attenuation of many
commercial buildings and residential areas (including the newly built one) is very severe. Some
buildings and residential areas is about 400 m away from the nearby BS, but the terrain drop height is

876
 Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

up to 60 m, leading to the great attenuation of signal. The indoor Ec/Io value is lower than –12 dB,
which is already not able to ensure normal conversation. The coverage of some prosperous downtown
areas, newly developed residential areas and crowded streets in prosperous areas is still to be
strengthened.

It is recommended to add the following BSs in urban area:

A three-sector BS is added near Xinhua garden and Xinghua garden to implement the coverage of
them;

A three-sector BS or an indoor distribution system is added near Nanmenshan;

A three-sector BS is added near the Fuling Changjiang guidance tower to implement the coverage
of nearby markets;

The existing repeater indoor distribution system in Fuling urban area should be replaced with a
source substitute repeater by importing a micro cell, so as to impose less influence of the repeater
system on the existing network.

In addition, we suggest:

The Beishanping and Liangtouwang BSs be moved, for the heights of BSs at these two sites are
too high, they form a complete coverage of Fuling urban area, thus imposing strong interference on this
area.

22.3.2.2 Wide Coverage

Comparing with China Unicom G network, after the Phase I construction, China Unicom CDMA
network in Fuling service areas mainly covers Fuling urban area, four counties and a few important
towns and communication trunks. Due to short term construction and small scale, its coverage depth in
urban area and coverage width in suburb is inferior to those of GSM network, which limits the network
mobility. The network coverage is still to be improved.

For towns and villages, the coverage of Changfu highway, S120 road, Yuwan highway and S303
provincial road should be strengthened. For important towns and villages, the omni-directional BS can
be adopted to implement the coverage. For the coverage of roads, the appropriate site height should be
selected as much as possible to implement the requirements of wide coverage. To facilitate the network
optimization, the sector splitting method can be adopted. For the coverage of towns and villages, the
sector splitting should be selected according to the actual conditions.

877
Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

22.3.3 Qianjiang Coverage Solution

22.3.3.1 Deep Coverage

The urban area of Qianjiang is comparatively small. At present , there are only two BSs: Qianjiang
Garden and Textile Building. In accordance with the outdoor coverage test results, the coverage of the
urban area is comparatively good at present. A BS can be added between Qianjiang and its suburb to
enhance the coverage.

22.3.3.2 Wide Coverage

In Qianjiang district, the wide coverage problem to be immediately solved is the coverage of counties
and roads. Here, the roads include: 319 state road, 202 provincial road, 304 provincial road etc.; the
important counties include: Shizhu and Pengshui etc.

The continuous coverage of 319 state road can be implemented by using multiple solutions. As the
complicated landforms, small traffic and small data requirements in Qianjiang requires large coverage
radius of BS and convenient maintenance, the continuous coverage can be implemented by using
macrocell omni-directional BS plus multiple remote modules or directly by micro cell plus RF
extension. For the coverage of roads, the appropriate site height should be selected as much as possible
to implement the requirements of wide coverage. To facilitate the network optimization, the sector
splitting method can be adopted. For the coverage of towns and villages, the sector splitting should be
selected according to the actual conditions.

22.3.4 Characteristics of Wide Coverage

 Supporting packet data service and various radio value-added services.

 Fully guaranteeing network quality. ZTE has rich experiences in network planning, network
optimization and practical engineering, and can formulate feasible solutions according to
different radio transmission environment and complicated landforms and geographic features.

 Low construction cost. In ZTE solution, the serial products such as wide-area macro BS,
micro BS of super-wide coverage are adopted, which can be configured flexibly according to
the actual conditions.

 As landforms and geographic features differ greatly, for each engineering project, the
experienced network planning personnel conduct the site survey and measurement and
formulate the specific solution.

878
 Chapter 23 Networking Configuration Analysis with Typical cdma2000 1x Cases

22.3.5 Characteristics of Deep Coverage

 Supporting cdma2000 1X packet data service. With CDMA 1X-based “deep coverage” of
micro cell, the greatest advantage is that large system capacity can be provided to satisfy the
traffic requirements in hot spot area and to reduce the interference on the adjacent BS. By
means of good network planning, RF signals of “deep coverage” system will be centralized
within buildings instead of being leaked out to form a large handover area with the
surrounding BS.

 Fully guaranteeing network construction quality: ZTE CDMA technology is developing in

step with the most advanced CDMA technology of the world. With years of large-scale
commercial operation, we have accumulated rich experiences in network planning and
optimization.

 Effectively controlling the construction cost: In ZTE communication solution, the self-
developed serial products such as micro BS, remote RF unit, repeater and indoor distribution
system are adopted, which make it possible for the flexible networking and network
optimization network based on different network application environment and features, and
make it easy for engineering and operation and maintenance.

 ZTE indoor distribution system NM can be integrated in micro BS system to implement the
comprehensive and centralized remote monitoring of coverage scope, thus greatly cutting
down the maintenance cost.

879
880
 Reference

Reference

 Part 1, Chapter 2 CDMA Principle

“CDMA Principles of Spread Spectrum Communication”

Reference Web Sites

“http://www.qualcomm.com/” QUALCOMM

“http://www.cdg.org/” CDMA Development Group

“http://www.wow-com” World of Wireless Communications

“http://www.fcc.gov” Federal Communications Commission

“http://www.ansi.org/” American National Standards Institute

“http://www.doc.gov/” US Department of Commerce

 Part 1, Chapter 3 IS-95 System Principle

1. Viterbi, Andrew J. (1995), CDMA Principles of Spread Spectrum Communication,

Addison-Wesley, ISBN 0-201-63374-4 .

2. Lee, William.C.Y. (1995), Mobile Cellular Telecommunications, 2nd Edition, McGraw

Hill, ISBN 0-07-038089-9

3. Gilhousen, K.S., Jacobs, I.M., Padovani, R., Viterbi, A.J., Weaver, L.A. and Wheatley, C.E.
(1991), “On the Capacity of a Cellular CDMA System”,” IEEE Trans. on Vehicular Technology
40(2), 303-312.

4. Rappaport, T.S.; Wireless Communications Principles and Practice; Prentice-Hall; 1996;

ISBN 0-13-375536-3.

5. TIA/EIA Interim Standard 95A and ANSI J-STD-008

 Part 1, Chapter 4 1xRTT Working Principle

1. TIA/EIA/IS-2000.1. Introduction to cdma2000 Standards for Spread Spectrum Systems

881
Reference

2. TIA/EIA/IS-2000.2. Physical Layer Standard for cdma2000 Spread Spectrum Systems

3. TIA/EIA/IS-2000.3. Medium Access Control (MAC) Standard for cdma2000 Spread

Spectrum Systems

4. TIA/EIA/IS-2000.4. Signaling Link Access Control (LAC) Standard for cdma2000 Spread
Spectrum Systems

5. TIA/EIA/IS-2000.5. Upper Layer (Layer 3) Signaling Standard for cdma2000 Spread

Spectrum Systems

6. TIA/EIA/IS-2000.6. Analog Signaling Standard for cdma2000 Spread Spectrum Systems

7. TIA/EIA/IS-707-A. Data Service Options for Wideband Spread Spectrum Systems

882
 Appendix A Abbreviations

Appendix A Abbreviations

Abbreviations Full name

 /4-QPSK  /4-offset quadrature phase shift keying
1X EV 1X Evolution
1X EV-DO 1X Evolution Data Only
1X EV-DV 1X Evolution Data & Voice
2G BTS 2G BTS Transceiver
3G The third generation mobile communications
3G BTS 3G BTS Transceiver
3GPP2 3rd Generation Partnership Project 2
3WC 3 way conference calls
A/D Analog-digital converter
A_key Authentication key
AAA Authentication, Authorization and Accounting
AAL5 ATM Adaptation Layer type 5
Abis Interface between BSC and BTS
ACF Authentication function
AD Advertisement
AH Authentication Header
Ai Interface between MSC and PSTN
A-interface Interface between MSC and BSC
AMI Alternate mark inversion
AMPS Advanced Mobile Phone Service
AOC Accountants on call
AOD Audio on demand
APB ATM Process Board
ASIG Analog signal
ATM Asynchronous Transfer Mode
AUC Authentication center
B-BDS Backplane of Baseband Digital Subsystem
BCSN Backplane of Circuit Switch Network
BCTC Backplane of Control Center
BCTL Back control
BDS Baseband Digital Subsystem
BIB Back unit indicating bit

883
Appendix A Abbreviations

BIOS Basic input/output system

BPSK Binary Phase Shift Keying
BPSN Backplane of Packet Switch Network
BS Base station
BSC BTS controller
BSCM Basic service concept module
BSID BTS identify
BSM BTS Management
BSN Backward sequence number
BSP Board Support Package
BSS BTS System
BTM BTS Test Module
B-TRX Backplane of Transceiver
BTS Base transceiver station
BUSI Bus-interface
BUSN Backplane of Universal Switch Network
CAVE Cellular authentication & voice encryption algorithm
CBC Cell broadcast center
CC Call control
CCF Call control function
CCM Communication Control Module
CDMA Code Division Multiple Access
CDSU Channel/Data Service Unit
CE Channel Element
CELP Code Excited Linear Prediction
CFB Call forward busy
CFD Call forward default
CFNA Call forward no answer
CFU Call forward unconditional
CHAP Challenge Handshake Authentication Protocol
CHM Channel Processing Module
CHUB Control HUB
CIC Carrier identification
CK Check bits
CKDR Clock driver
CKI Clock benchmark interface
CLKD CLOCK Distributor
CLKG CLOCK Generator
CMB Combiner
CMIP Common Management Information Protocol
CMIS Common Management Information Service

884
 Appendix A Abbreviations

CNIP Call number identification presentation

COA Care of Address
COMM Communication
CPM Central Process Module
CPP Core Processor Part
CPS Call Processing Subsystem
CPU Center processing unit
CR Connection request
CRC Cyclic redundancy check
CSCF Call state call control function
CSL Component sub-layer
CSM Center switch module
CSU/DSU Channel / Digital Service Unit
CT Call transfer
CTI Computer telephone integrated server
CTRL Control
CUG Closed user group
CW Call waiting
CWTS China wireless telecommunication standard
D_K D_Kernel
D_M D_Method
D_S D_Service
D_V D_View
DB Database
DBS Database Subsystem
DDN Data digital network
DHA Dialogue handling architecture
DHCP Dynamic Host Configuration Protocol
DID Dialogue identification
DiffServ Differentiated Service
DIU Digital Interface Module
DLC Data Link Control
DMA Direct memory access
DMM Data management module
DN Data number
DND Do not disturb
DO Date only
DPC Destination point code
DPRAM Double port random access memory
DRAM Dynamic random access memory
DS Direct Sequence Spread Spectrum

885
Appendix A Abbreviations

DS-CDMA Direct sequence-CDMA

DSM Data Service Module
DSN Digital service network
DSNI Digital service network interface
DT Digital trunk
DTB Digital Trunk Board
DTI Digital trunk interface
DTMF Dual-tone multi-frequency
DTU Digital trunk unit
DV Date and voice
DWDM Dense wave division multiplexing
ECDT Echo digital trunk
ECR Enhanced calling route
EIR Equipment identify register
EMS Enhanced message service
EPLD Erasable programmable logic device
ESME Extension short message entity
ESN Electric serial number
EV Evolvement
F Flag
FA Flexible alert
FAM Fleets asset management
F-BCH Forward Broadcast channel
FBI Fiber interface
FC Feature code
F-CACH Forward Common Assignment Channel
F-CCCH Forward Common control Channel
F-CPCCH Forward Common Power Control Channel
FDC Floppy disc controller
FDC Floppy disc controller
F-DCCH Forward Dedicated Control Channel
FDD Frequency division Duplexing
FDM Frequency Division Multiplexing
FDMA Frequency Division Multiple Access
FE Front End
FER Forward Error Rate
F-FCH Forward Fundamental Channel
FFT Fast fourier transform
FIB Forward unit indicating bit
FIFO First-in first-out
FIM Feature interaction manager
FISU Fixed signaling unit

886
 Appendix A Abbreviations

FM Frequency modulation
F-PCH Forward Paging Channel
FPH Free Phone
F-QPCH Forward Quick Paging Channel
FS Frequency Synthesizer
F-SCH Forward Supplemental Channel
FSN Forward serial number
FTAM File transfer access management
FTP File transfer protocol
GLI GE Line Interface
GMSC Gateway mobile-services switching center
GMSK Gaussian filtered minimum shift keying
GOS Grade of Service
GPCM General Purpose Chip-select Machine
GPS Global positioning system
GPSTM GPS Timing Module
GRE Generic Routing Encapsulation
GSM Global System for Mobile Communication
GT Global title
HA Home Agent
HD Hard disk
HDLC High-level data link control
HDM HLR digital processing module
HIRS High-speed Interconnect Router Subsystem
HLR Home location register
HLR/AUC
HPA High Power Amplifier
HPSK Hybrid Phase Shift Keying
HRPD High Rate Packet Data
HSM HLR service processing module
HSS Home subscriber server
HW High speed data way, Highway
I/O Input/Output
I2C Integrated Circuit Interface Circuit
ICMP Internet Control Message Protocol
IDE Interface of hard disk equipment
IETF Internet Engineering Task Force
IKE Internet Key Exchange
IMAB IMA Board
IMSI International Mobile Station Identity
IMT-2000 International Mobile Telecom 2000

887
Appendix A Abbreviations

IntServ Integrated Service

IP Internet protocol
IPB IP Process Board
IPCP IP Control Protocol
IPsec IP Security
IPv6 IP Version 6
ISA Industry standard architecture
ISAKMP Internet Security Association and Key Management Protocol
ISDN Integrated service digital network
ISM Interior software mapper
ISO International standardizations organization,
ISUP ISDN user part
ITC Interrupt controller
ITU International Telecommunications Union
IW/GMSC Gateway/Interworking MSC
IWF Inter Work Function
IWFB IWF Board
L1 layer 1
L2 layer 2
L2TP Layer2 Tunnel Protocol
LAES Lawfully Authorized Electronic Surveillance
LAI Location area information
LAN Local Area Network
LBC Location based charge
LBIS Location based information service
LCP Link Control Protocol
LE Local exchange
LED Light emitting diode
LI Length indication
LMT Local Management Terminal
LNA Low Noise Amplifier
LOMC Local operation maintenance center
LPA Linear Power Amplifier
LRF Local register function
LS Local switching
LSSU Link state signal unit
LSTP Low signaling transfer point
MAC Medium Access Control
MACF Mobile access control function
MAF Management Applications Function
MAH Mobile access hunting

888
 Appendix A Abbreviations

MAP Mobile application part

MC Message center
MC-CDMA Multiple carrier-CDMA
MD Message distribute
MDN Mobile data number
MFC Multi-frequency control
MIF Management Information Function
MIN Mobile station identify number
MIP Mobile IP
MIT MO Instance Tree
MML Man Machine Language
MNC Mobile network code
MNIC Multi-service Network Interface Card
MO Mobile originated
MO Mobile office
MON Monitor
MONB MONIOTR BOARD
MP Module processor
MPB Main Process Board
MPC Mobile positioning center
MPM MSC/VLR/SSP processing module
MRB Media Resource Board
MS Mobile Station
MSC Mobile switching center
MSC/VLR
MSID Mobile Station Identifier
MSM Message switch module
MSS Mobile switching system
MSU Message signal unit
MSU Message signal unit
MT Mobile terminated
MTP Message transfer part
MTP1 Message transfer part-layer 1
MTP1 Message transfer part-layer 1
MTP2 Message transfer part-layer 2
MTP3 Message transfer part-layer 3
MTSI Master To Slave Interface
MTSO Mobile Telephone Switching Office
MTV Music TV
MWN Message waiting notice
NAF Net Adaptor Function

889
Appendix A Abbreviations

NAI Network Access Identifier

NCM Network Control Module
NCP Network Control Protocol
NETU Network unit
NID Network identify
NIM Network Interface Module
NMC Network Management Center
O_AMP O_AlarmManagementPart
O_CMP O_ConfigurationManagementPart
O_PMP O_PerformanceManagementPart
O_RMP O_RightManagementPart
O_TMP O_TestManagementPart
OMC Operations & maintenance center
OMC-R Operations & maintenance center-radio
OMC-S Operations & maintenance center-switch
OMS Operation Maintenance Subsystem
OQPSK Offset Quadrature Phase Shift Keying
OSS Operating System Subsystem
OTD Orthogonal Transmit Diversity
PACA Priority access and channel assignment
PAD Packet assembly/disassembly
PAM Power Alarm Module
PAP Password Authentication Protocol
PCA Password calling access
PCB Printed circuit board
PCF Packet Control Function
PCI Peripheral controller interface
PCM Pulse code modulation
PDE Position determination entity
PDSN Packet Data Service Node
PEC Power & Ethernet Connector board
PEPD Peripheral environment parameter detection
PIN personal identification number
PL Preferred language
PLI POS Line Interface
PLMN Public lands mobile network
PN Pseudonoise
POMC Province operation maintenance center
PP Peripheral module process
PPC Pre-paid charging
PPP Point to Point Protocol

890
 Appendix A Abbreviations

PPTP PPP Tunnel Protocol

PSI PCF Session Identity
PSK Phase-shift keying
PSM Peripheral switch module
PSN Packet Switch Network
PSPDN Packet switched public data network
PSTN Public switched telephone network
PWRD POWER Distributor
QAF Q3 Adaptor Function
QCELP Qualcomm Code Excited Linear Prediction
QOF Quasi-Orthogonal Functions
QoS Quality of Service
QPSK Quadrature Phase Shift Keying
R_FMP File Management Part
R_SCP System Control Part
R-ACH Reverse Access Channel
RADIUS Remote Authentication Dial in User Service
RAN Radio Access Net
RAND Random number
RAS Remote access service
RC Radio Configuration
R-CCCH Reverse Common Control Channel
RCF Radio control function
RCM RF Control Module
RCMP Router subsystem Control Main Processor
R-DCCH Reverse Dedicated Control Channel
R-EACH Reverse Enhanced Access Channel
RF Radio Frequency
RFC Remote feature control
R-FCH Reverse Fundamental Channel
RFCM RF Control Module
RFE Radio frequency Front End
RFF RF Filter
RFIM RF Interface Module
RFS Radio frequency Subsystem
RIM RF Interface Module
RLP Radio Link Protocol
RN Radio Node
RNC Radio Node Controller
RPB Router Protocol Process Board
RS1 Rate Set 1

891
Appendix A Abbreviations

RS2 Rate Set 2

R-SCH Reverse Supplemental Channel
RSM Reverse Switch Module
RSVP Resource Reservation Protocol
RTF Radio terminate function
RTF Radio terminate function
RTOS Real Time Operate System
RTT Radio transmission technology
Rx Receiver
S_BSSAP BTS System Application Part
S_CCHSP Control Channel Signaling Process
S_CEC Channel Element Control
S_CEM Channel Element Modem
S_MTP Message Transfer Part
S_RCM Radio Channel Management
S_SCCP Signaling Connection Control Part
S_SVLP Selector Vocoder Low-Layer Process
S_TCHL2P Traffic Channel Layer 2 Process
S_TCHL3P Traffic Channel Layer 3 Process
SAM Site Alarm Module
SC Short message center
SCA Select calling access
SCC Serial Communication Controller
SCCP Signaling connect control part
SCE Service create environment
SCEP Service create environment point
SCF Service control function
SCH Supplemental Channel
SCM Sub-BDS Control Module
SCMG SCCP management
SCP Service control point
SCRC SCCP routing control
SCSI Small computer system interface
SDF Service database function
SDH Synchronous Digital Hierarchy
SDHB SDH Board
SDL Specification & description language
SDM Service database module
SDTB Sonet Digital Trunk Board
SF State field
SFM Switch Fabric Module

892
 Appendix A Abbreviations

SI Service indication
SID System identify
SIE Sector Interface Element
SIF Signaling information field
SIM Subscriber identity module
SLP Service logic point
SMAF Service management access function
SMAP Service management access point
SMC Serial Management Controller
SME Short message entity
SMEM Shared memory
SMF Service management function
SMP Service management point
SMPP Short message peer to peer protocol
SMS Short message service
SMSDPF SMS delivery pending flag
SNM Service network module
SP Subscriber processor
SPAC Signaling point allowed accessing control
SPB Signaling Process Board
SPC Signaling point code
SPCC Signaling point crowding level control
SPINA Subscriber PIN access
SPINI Subscriber PIN interrupter
SPLL System Phase Lock Loop
SPPC Signaling point prohibited accessing control
SPS Service Process Subsystem
SR Spreading Rates
SRF Special resource function
SS7 Signaling system SS7
SSAC Sub-system allowed accessing control
SSD Shared secret data
SSF System Support Function
SSM Service switching processing module
SSP Service switch point
SSPC Sub-system prohibited accessing control
SSTC Sub-system testing control
STB Signaling terminator board
STM Synchronous Transfer Mode
STP Signaling transfer point
STS Space Time Spreading

893
Appendix A Abbreviations

SVICM Selector & Vocoder Interface Control Module

SYCK Synchronization clock
T Time switching module
TCAP Transaction capability application part
TCP Transfer control protocol
TDM Time Division Multiplexing
TDMA Time Division Multiple Access
TFI TDM Fibre Interface
TFM Timing Frequency Module
TLDN Temporary location digital number
TM Transfer module
TMB Traffic Manage Board
TMN Telecommunication Management Network
TMSC Total MSC
TMSC Tandem MSC
TNET Timed & network
TOS Type of Service
TRX Transceiver
TS Time slot
TSL Transaction sublayer
TSM Transmit Switch Module
TSNB TDM Switch Network Board
TT Transfer type
TUP Telephone user part
UART Universal asynchronous receiver/transmitter
UDP User Datagram Protocol
UDR User Data Record
UIM Universal Interface Module
VLR Visitor location register
VM Voice mailbox
VMR Voice message retrieval
VMSC Virtual mobile switching center
VOD Video on demand
VPN Virtual Private Network
VTC Voice Transcoder Card
VTP Virtual Tunnel Protocol
WAN Wide Area Network
W-CDMA Wide band-CDMA
W-CDMA Wideband CDMA
WIN Wireless intelligent network
WLAN Wire LAN

894
 Appendix A Abbreviations

WPB Wireless Protocol Process Board

WSF Workstation Function
WVPN Wireless virtual private network
ZXPDSS Packet Data Service System

895
Appendix B FAQ

Appendix B FAQ

 CDMA BTS Side Questions

1. What are the typical application occasions for RF extension?

Answer:

 Occasion 1: When site selection of macrocellular equipment room is restricted and the
desirable locations cannot be used, the RF extension technology is employed to locate
the RF module at the desired site so as to avoid difficulty in network plan due to the
restriction of equipment rooms and adding BTS sites unnecessarily;

 Occasion 2: When the capacity in the urban area has a surplus and the coverage of a
certain zone in the urban area is to be improved, the RF extension technology is
employed to improve the network coverage and make the best use of the existing
capacity;

 Occasion 3: When excessively long feeder cables result in a reduced coverage in the
application of macrocell, the RF extension technology is employed to improve coverage;

 Occasion 4: The RF extension technology is employed to expand coverage in the case of

road coverage. E.g. when macrocell is employed to cover part of the road and the
existing fiber resources can be used to extend the coverage to both sides via RF
extension, so as to reduce the equipment rooms and auxiliary transmission facilities;

 Occasion 5: RF extension technology is employed to expand coverage and capacity

(temporary capacity expansion of base station) in some temporarily hot spots, e.g.
exhibition center, gymnasium, etc.

In short, RF extension technology is usually employed with the cooperation of optical fiber
resources (except that the distance from the BTS is less than 2 km).

2. Is soft handover only conducted between sectors or BTSs of the same frequency?

Answer: Yes. Same frequency is the precondition of soft handover. Handover of mobile
phone between different frequencies is hard handover, that is, the original frequency signal will be
terminated and the signal will be received or transmitted on the new frequency. The mobile phone
is informed of the new frequency by BTS via signaling process and the mobile phone is instructed
to conduct hard handover.

896
 Appendix B FAQ

3. What are the merits of soft handover?

Answer: It can lower call drop rate and improve conversation quality.

4. How many types are involved in reverse power control?

Answer: It includes open loop power control, closed loop power control, and outloop power
control.

5. What parameters are adjusted to implement reverse outloop power control?

Answer: It is to be implemented via FER detection and Eb/No adjustment.

6. What are advantages of CDMA system?

Answer: High system capacity, high conversation quality, soft handover, strong anti-
interference capacity, excellent privacy protection and anti-interception performance, soft capacity
limit, etc.

7. What are effective paging success rate, paging responsivity and completion rate?

Answer: Effective paging success rate = successful paging times / paging response times;

Paging responsivity = paging response times / paging times;

(Global, cell) completion rate = (global, cell) times of successful call / (global, cell) total
times of call attempts;

Total times of call attempts = successful calls + (failed calls).

8. What are the names of interfaces between MSC, MS, BSC, and BTS?

Answer: MSC---BSC: A interface

BSC---BTS: Abis interface

BTS---MS: Um interface

 CDMA Switching Side Questions

9. Is it possible to set several System IDs for virtual MSC?

Answer: MSC has only one SID and NID. Several IDs will be assigned for different service
areas by BSC. The coordination between MSC and BSC is equivalent to supporting several
System IDs.

897
Appendix B FAQ

10. What standards are location services based on?

Answer: Location service are based on the following standards:

J-STD-036 Emergency Services Phase II;

PN4747 Location Services Enhancement; and

PN-4818 Wireless Intelligent Network Capabilities For Location Based Services.

11. How does multi-module processing capacity relates to CSM? Why BHCA is approximate
linear growth?

Answer: In the case of multi-module, services of peripheral modules are to be processed by

their respective MPs. CSM is only responsible for processing the voice channel connection and
message between modules, with a processing capacity of 10 peripheral modules, which is limited
by the capacity of T network. Therefore, within the allowable range of modules, the processing
capacity of multi-module = processing capacity of a single module * number of modules. BHCA
is approximate linear growth.

12. What have been changed on data configuration of virtual MSC? Will the virtual MSC
subscribers dial the area code when making a local urban call?

Answer: Virtual MSC is determined in accordance with LAI or CI of MS and it is identified

by VMSCID. Virtual MSC, lick real MSC, fulfills all services independently. Only one System ID
is required on network side and the System ID of BTS is set according to the coverage of service
area. MS determines whether it is in roaming state by receiving broadcast System ID. Virtual MSC
subscribers (local or roaming) needn’t dial the area code when making a local urban call.

 Network Planning Questions

13. How to solve the problem of traffic imbalance between different sectors?

Answer: Based on the self-interference principle of CDMA, the angle of antennas can be
adjusted so as to regulate the transmit power of the cell or adjacent cell.

14. Is it true that the higher the moving speed of MS, the smaller the coverage radius?

Answer: No, the coverage is poorest at the speed of 30 km/h. When MS moves at a low
speed, the fading is slow and the power control will work; when MS moves at a high speed, the
fading is quick and the interleaving device will function; when MS moves at a medium speed, the
functions of power control and interleaving device will be reduced and a higher demodulation
SNR is required. As a result, the system capacity becomes lower and the coverage radius becomes
smaller.

898
 Appendix B FAQ

 Engineering Questions

15. How to ensure the effect reaches that of the early planning in a moved area, at least in a
short period time? Since places available for antenna installation are few in urban area, how to
share the antenna with the equipment of other manufacturers of phase 1 in the process of move?

Answer: To share the same antenna and feeder system in the process of BTS move, our BTS
can be set as another carrier frequency firstly; then the following schemes may be adopted in
according with different situations:

 If the structure and indices of the other BTSs are similar to those of our base station, e.g.
the LNA output of the other side has at least two ways and LNA gain is around 30 dB,
we can direct use the diversity antenna of the original system and connect our DUP to it;
then we can connect one LNA output of the BTS of the other side to a Rx input port of
our TRx., and one LNA output of our BTS to a Rx input port of the TRx of the other
side. It means that the BTS site has two-carrier transmission and the two antennas in
each sector act as mutual diversities. It will work to connect the original shared
transceiver antenna to DIV of our BTS when the BTS of the other side is moved out.
This scheme is easy and simple, causing almost no negative effect on existing coverage
and other performance.

 A duplexer with a received branch will be added to the original antenna and feeder
system without altering the connection of the BTS of the other side; the transmit channel
of the other side should be connected to the DUP of our BTS and the receive channel to
the DIV of the original BTS. The general insertion loss of the duplexer is 1.5 dB.
Therefore, the influence of this scheme on the forward and reverse links of the original
system and ZTE BTS is 1.5 dB. The link is shown in the following figure:

Original shared Original receiving

transceiver antenna antenna

Adding module Adding module

Duplexer Filter DUP DIV

Original factory base

ZT E base station
st ation

899
Appendix B FAQ

 That is, two duplexer modules will be added in each sector and the antenna and feeder
connection can be resumed normal after the BTS is moved. In the case of the BTS with
coverage surplus and less subscribers, a transition scheme without diversity may be
adopted, that is, the original diversity antenna is directly connected to DUP of our BTS
without other alterations. In this way, a diversity gain of 2.5 to 3 dB will be reduced for
these two systems, the reverse coverage will decrease, but the forward coverage will not
be affected. This scheme is recommended under most circumstances for it is the easiest
and simplest method.

900