FCC ID: A3LSMM-BMAA022000 Smart MBS (Smart Multi-modal Base Station)

1.0 Ver. LTE/CDMA Smart MBS System Description COPYRIGHT This description is proprietary to SAMSUNG Electronics Co., Ltd. and is protected by copyright. No information contained herein may be copied, translated, transcribed or duplicated for any commercial purposes or disclosed to the third party in any form without the prior written consent of SAMSUNG Electronics Co., Ltd. TRADEMARKS Product names mentioned in this description may be trademarks and/or registered trademarks of their respective companies. This description should be read and used as a guideline for properly installing and operating the product. This description may be changed for the system improvement, standardization and other technical reasons without prior notice. If you need updated manuals or have any questions concerning the contents of the manuals, contact our Document Center at the following address or Web site:

Address: Document Center 3rd Floor Jeong-bo-tong-sin-dong. Dong-Suwon P.O. Box 105, 416, Maetan-3dong Yeongtong-gu, Suwon-si, Gyeonggi-do, Korea 442-600 Homepage: http://www.samsungdocs.com 2012 SAMSUNG Electronics Co., Ltd. All rights reserved. LTE/CDMA Smart MBS System Description INTRODUCTION Purpose This description introduces characteristics, features, and structure for Smart MBS (Multi-

modal Base Station), which is the Samsung Multi-Modal system. Document Content and Organization This description consists of 4 Chapters and Abbreviation as follows. CHAPTER 1. Overview of Samsung Multi-Modal System Samsung Multi-Modal System Introduction Samsung Multi-Modal System Network Configuration Samsung Multi-Modal System Feature CHAPTER 2. Overview of Smart MBS Smart MBS System Introduction Smart MBS Main Feature Smart MBS Specification CHAPTER 3. Smart MBS System Structure Hardware Structure Software Structure CHAPTER 4. Message Flow CDMA, LTE Call Processing Message Flow Loading flow ABBREVIATION Provides definition for acronyms used in this description. Interface between the Systems SAMSUNG Electronics Co., Ltd. I INTRODUCTION Conventions The following types of paragraphs contain special information that must be carefully read and thoroughly understood. Such information may or may not be enclosed in a rectangular box, separating it from the main text, but is always preceded by an icon and/or a bold title. NOTE Indicates additional information as a reference. Revision History EDITION DATE OF ISSUE 1.0 2012. 02. REMARKS First Edition II SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description TABLE OF CONTENTS INTRODUCTION I Purpose .................................................................................................................................................. I Document Content and Organization..................................................................................................... I Conventions........................................................................................................................................... II Revision History..................................................................................................................................... II CHAPTER 1. Overview of Samsung Multi-Modal System 1-1 1.1 Introduction to Samsung Multi-Modal System.................................................................... 1-1 1.2 Samsung Multi-Modal System Network Configuration....................................................... 1-3 1.2.1 CDMA System Network Configuration.................................................................................1-4 LTE System Network Configuration .....................................................................................1-7 1.2.2 1.3 Samsung Multi-Modal System Feature .............................................................................. 1-10 1.3.1 CDMA System Feature.......................................................................................................1-10 LTE System Feature........................................................................................................... 1-11 1.3.2 CHAPTER 2. Smart MBS Abstract 2-1 2.1 Smart MBS System Introduction .......................................................................................... 2-1 2.1.1 CDMA System Feature.........................................................................................................2-3 LTE System Feature.............................................................................................................2-3 2.1.2 2.2 Smart MBS Main Feature....................................................................................................... 2-7 2.2.1 Physical Layer Processing Function ....................................................................................2-7 2.2.2 Call Processing Function.................................................................................................... 2-11 2.2.3 IP Processing Function.......................................................................................................2-13 2.2.4 Operation and Maintenance Function................................................................................2-13 2.3 Specifications ...................................................................................................................... 2-16 2.4 Interface between Systems................................................................................................. 2-18 2.4.1 CDMA Interface Structure...................................................................................................2-18 2.4.2 LTE Interface Structure.......................................................................................................2-20 2.4.3 Physical Interface Operation Method .................................................................................2-25 SAMSUNG Electronics Co., Ltd. III TABLE OF CONTENTS CHAPTER 3. Smart MBS Structure 3-1 3.1 Smart MBS Hardware Structure ..............................................................................................3-1 Internal Configuration of System (CDMA)............................................................................3-5 3.1.1 3.1.2 Internal Configuration of System (LTE) ................................................................................3-7 3.1.3 UADU....................................................................................................................................3-9 3.1.4 LRU.....................................................................................................................................3-14 3.1.5 Power Device......................................................................................................................3-16 3.1.5 Environment Devices..........................................................................................................3-18 Interface structure...............................................................................................................3-20 3.1.6 3.2 Smart MBS Software Structure ...........................................................................................3-24 3.2.1 CDMA Software Structure...................................................................................................3-24 LTE Software Structure.......................................................................................................3-29 3.2.2 CHAPTER 4. Message Flow 4-1 4.1 Call Processing Message Flow .............................................................................................4-1 4.1.1 CDMA Call Processing Message Flow ................................................................................4-1 LTE Call Processing Message Flow...................................................................................4-18 4.1.2 4.2 Loading Flow ........................................................................................................................4-29 ABBREVIATION I A ~ C....................................................................................................................................................... I D ~ F...................................................................................................................................................... II G ~ M.................................................................................................................................................... III N ~ P.....................................................................................................................................................IV Q ~ S......................................................................................................................................................V T ~ W ....................................................................................................................................................VI LIST OF FIGURES Figure 1.1 Network Configuration of Samsung Multi-Modal System .......................................1-3 Figure 1.2 CDMA System Network Configuration ...................................................................1-4 Figure 1.3 LTE System Network Configuration .......................................................................1-7 Figure 1.4 CDMA System Functional Structure.....................................................................1-10 Figure 1.5 Functions of E-UTRAN and EPC ......................................................................... 1-11 Figure 2.1 Protocol Stack between BTS and MS ..................................................................2-18 Figure 2.2 Protocol Stack between BTS and BSC ................................................................2-19 IV SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 Figure 2.3 Protocol Stack between BTS and BSM ............................................................... 2-19 Figure 2.4 LTE Interface Structure........................................................................................ 2-20 Figure 2.5 Protocol Stack between UE and eNB .................................................................. 2-21 Figure 2.6 Protocol Stack between eNB and EPC................................................................ 2-22 Figure 2.7 Protocol Stack between eNB and MME............................................................... 2-22 Figure 2.8 Protocol Stack between eNBs (User Plane) ........................................................ 2-23 Figure 2.9 Protocol Stack between eNBs (Control Plane) .................................................... 2-23 Figure 2.10 Protocol Stack between eNB and LSM.............................................................. 2-24 Figure 3.1 Smart MBS Configuration...................................................................................... 3-2 Figure 3.2 CDMA/LTE 3Sector Configuration......................................................................... 3-3 Figure 3.3 CDMA/LTE 4 Sector Configuration........................................................................ 3-4 Figure 3.4 CDMA/LTE 6 Sector Configuration........................................................................ 3-4 Figure 3.5 Internal Configuration of System (CDMA) ............................................................. 3-5 Figure 3.6 Internal Configuration of System (LTE) ................................................................. 3-7 Figure 3.7 UADU Configuration.............................................................................................. 3-9 Figure 3.8 Cooling Structure of the UADU (FANM-C4)......................................................... 3-13 Figure 3.9 Power Device Configuration................................................................................ 3-16 Figure 3.10 Power Structure................................................................................................. 3-17 Figure 3.10 Configuration of Environment Devices .............................................................. 3-18 Figure 3.11 Hardware Interface structure of UADU (CDMA) ................................................ 3-20 Figure 3.12 Hardware Interface structure of UADU (LTE) .................................................... 3-22 Figure 3.13 Hardware Interface structure of LRU-C2........................................................... 3-23 Figure 3.14 CDMA Software Structure ................................................................................. 3-24 Figure 3.15 CDMA Call Processing Software Structure........................................................ 3-24 Figure 3.16 CDMA OAM Software Structure ........................................................................ 3-25 Figure 3.17 CDMA Common Software Structure.................................................................. 3-27 Figure 3.18 LTE Software Structure ..................................................................................... 3-29 Figure 4.1 1X voice call origination......................................................................................... 4-2 Figure 4.2 1X voice call termination ....................................................................................... 4-4 Figure 4.3 1X packet data call origination............................................................................... 4-6 Figure 4.4 1X packet data call termination ............................................................................. 4-7 Figure 4.5 1X voice call soft handoff ...................................................................................... 4-8 Figure 4.6 1X call release by MS............................................................................................ 4-9 Figure 4.7 1X call release by WSS....................................................................................... 4-10 Figure 4.8 1xEV-DO Session setup.......................................................................................4-11 Figure 4.9 1xEV-DO MS authentication and PPP setup....................................................... 4-12 Figure 4.10 Transition to the 1xEV-DO Dormant state ......................................................... 4-13 Figure 4.11 Transition from 1xEV-DO Dormant status to the Active state by MS ................. 4-14 SAMSUNG Electronics Co., Ltd. V TABLE OF CONTENTS Figure 4.12 Transition from 1xEV-DO Dormant status to the Active state by network...........4-15 Figure 4.13 1xEV-DO softer handoff .....................................................................................4-16 Figure 4.14 1xEV-DO soft handoff ........................................................................................4-17 Figure 4.15 Attach Process...................................................................................................4-18 Figure 4.16 Service Request Process by UE........................................................................4-20 Figure 4.17 Service Request Process by Network................................................................4-21 Figure 4.18 Detach Process by UE.......................................................................................4-22 Figure 4.19 Detach Process by MME ...................................................................................4-23 Figure 4.20 X2-based Handover Procedure..........................................................................4-24 Figure 4.21 S1-based Handover Procedure..........................................................................4-26 Figure 4.22 Smart MBS Loading Message Flow ..................................................................4-30 VI SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description CHAPTER 1. Overview of Samsung Multi-Modal System 1.1 Introduction to Samsung Multi-Modal System As mobile telecommunication technology has experienced rapid growth from analog mobile telecommunication (1st Generation) to digital mobile telecommunication (2nd Generation) to CDMA2000 (3rd Generation), and into WiMAX/LTE (4th Generation), voice service is being expanded into data service. Especially, wire/wireless hybrid service and new type mobile terminal such as smart phone increased the demands for the high speed wireless technology. Along with the enhancement of various mobile telecommunication networks, it is now becoming common for a single terminal to support different mobile technologies. Samsung Multi-Modal System is multi-mode base station that will satisfy such needs of mobile telecommunication market by integrating voice (1X), data (1xEV-DO) and 4G generation equipment(for example, LTE) into a single base station equipment. Samsung Multi-Modal System mounts common Digital Unit (DU) platform, and Radio Unit (RU) per each frequency bandwidth that operator can decide to configure it with either single or multiple mobile technology. Samsung Multi-Modal System provides CDMA of Frequency Division Duplex (FDD) method and LTE FDD. In this case, Samsung Multi-Modal System supports the following telecommunication technologies and major features. Enhancement of CDMA Service Quality When Samsung Multi-Modal system is operating in CDMA mode, it provides EV-DO Rev0/RevA and 1X Advanced capabilities for an improved throughput and higher voice capacity. The 2branch Rx Diversity feature provides enhanced CDMA network coverage for the system. CDMA2000 1X/1X Advanced Enhanced Variable Rate Codec-B (EVRC-B), Reverse Link Interference Cancellation

(RLIC), Quasi Orthogonal Function (QOF) and New Radio Configuration (RC) are applied SAMSUNG Electronics Co., Ltd. 1-1 CHAPTER 1. Overview of Samsung Multi-Modal System to Samsung Multi-Modal system based on CDMA2000 1X. Therefore, Samsung Multi-

Modal system interworks with mobile terminal that Qualcomm Linear Interference Cancellation (eQLIC), Mobile Receive Diversity (MRD) and New RC are applied to, can support 1X Advanced that improves voice call capacity. CDMA2000 1xEV-DO Rev.0/Rev.A Samsung Multi-Modal system supports CDMA2000 1xEV-DO Rev.0/Rev.A for data service on CDMA network. Long Term Evolution (LTE) Samsung Multi-Modal system supports the service based on 3GPP LTE(a.k.a. LTE). It improves the existing 3GPP mobile telecommunication system (low data throughput, but high in cost) to a next generation wireless network system which provides a high speed data service with minimal cost. Samsung Multi-Modal system supports downlink Orthogonal Frequency Division Multiple Access (OFDMA) with either FDD, Uplink Single Carrier (SC) Frequency Division Multiple Access (FDMA), and scalable bandwidth (for various spectrum allocation) to provide high speed data service. Also, high-end hardware is implemented to improve system performance and capacity that various high speed data feature/service can be provided. Ease of Expanding 4G Service Samsung Multi-Modal system only requires minimal board replacements and software upgrades to provide a combined service of existing technology and 4G service from the existing DU-RU cabinet and battery cabinet. Samsung Multi-Modal system utilizes the existing cables, rectifiers, and batteries. The ease of 4G-installation and co-existence of technologies will bring about a lot flexibility and efficiency for the operator in network implementation, transition and expansion of future 4G service. Green Solution Samsung Multi-Modal system combines the equipment of 3G base station and the equipment of the next generation 4G base station into a single base station, and also contains the rectifier within the DU-RU cabinet. Samsung Multi-Modal system can reduce the number of the equipment Provides Efficient Backhaul Operation Samsung Multi-Modal system provides functionality that can operate multiple telecommunication technologies into a single physical backhaul network for reducing backhaul expenses. In addition, it supports an efficient backhaul operation by providing a per-technology sectional network operation by logically separating the backhaul, minimizing traffic interference between different technologies. 1-2 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 1.2 Samsung Multi-Modal System Network Configuration Samsung Multi-Modal system plays a role as CDMA/LTE base station in a network where CDMA and LTE systems co-exist. Samsung Multi-Modal System is configured as follows:

PDN DPI Sp PCRF Gx IMS-HSS LTE-HSS/SPR S6a PSTN SMS VMS SCP MAP MAP WIN RADIUS AAA AAA HLR MAP HA STP RADIUS PMIP HSGW/

PDSN EPC

(MME/S-GW/P-GW) S1 LTE Samsung Multi-Modal System A10/A11 WSS A1p A2p MGW BSC CDMA Figure 1.1 Network Configuration of Samsung Multi-Modal System When operating as CDMA, Samsung Multi-Modal system communicates with BSC

(CDMA controller), and operator may use BSM (EMS of CDMA) to control and manage CDMA portion of Samsung Multi-Modal system. Likewise, when operating as LTE, it communicates with EPC, and operator may use LSM-R (EMS of LTE) to control and manage LTE portion of Samsung Multi-Modal system. SAMSUNG Electronics Co., Ltd. 1-3 CHAPTER 1. Overview of Samsung Multi-Modal System 1.2.1 CDMA System Network Configuration CDMA system network consists of Access Networks (AN) for mobile terminal access, Voice Core Network (VCN) for voice service, and Packet Core Network (PCN) for packet data service. AN consists of Base Transceiver Station (BTS), Base Station Controller (BSC), and BSS System Manager (BSM) to manage these components. AN communicates with VCN

(MGW, WSS, etc.) and PCN (AN-AAA, PDSN, etc.) to provide voice/data communication service to mobile subscribers. CDMA network architecture of Samsung Multi-Modal system is as follows:

VCN MGW WSS A2p A1p Proprietary PCN A12 AN-AAA BSC A10, A11 Proprietary Proprietary Proprietary Internet PDSN AN EMS BSM BTS IS2000, IS856 BTS MS MS Figure 1.2 CDMA System Network Configuration 1-4 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 Base Transceiver Station (BTS) BTS is a system that handles wireless interface with mobile terminals(Mobile Station, MS) in accordance with CDMA2000 1X and 1xEV-DO standards as base station of CDMA. BTS receives data from MS and forwards it to core network through BSC, and receives data from core network via BSC and forwards it to MS. In order to play a role as wireless transceiver, BTS manages Radio Frequency (RF) resources such as Carrier Allocation (CA), Walsh codes. BTS also supports RF scheduling and power control functionality. Base Station Controller (BSC) Through various backhaul interfaces, BSC coordinates with multiple BTS, and provides resources that are required for communicating with BTS. BSC communicates with VCN to process voice/circuit data calls, and coordinates with PCN to process packet data calls. It also carries out operation/maintenance function in conjunction with BSM. It executes Radio Link Protocol (RLP) and Selection and Distribution Unit (SDU) function aiding handoff of MSs between BTSs. BSC also has Packet Control Function (PCF) SC/MM feature that provides Session Control and Mobility Management function in 1xEV-DO network. BSS System Manager (BSM) BSM provides operator interface that operators can control and manage BSC and BTS. For Operation and Maintenance of BSC and BTS, BSM provides required commands such as alarm/status/performance display, configuration management, and parameter control of the system. Packet Data Serving Node (PDSN) System PDSN is a system which connects PCN to CDMA2000 1X or 1xEV-DO, and it enables/maintains/disables the PPP to MS. PDSN particularly carries out functionality as Foreign Agent (FA) for Home Agent (HA) to provide mobile IP service. Access Network-Authorization, Authentication and Accounting (AN-AAA) AN-AAA is a server that performs access network authentication for subscribers in 1xEV-

DO network. AN-AAA executes authentication based on Network Access Identifier (NAI), and manages the mapping data of International Mobile Station Identity (IMSI) and MS NAI. Media Gateway (MGW) MGW is an equipment that provides bearer gateway functionality (media conversion and handling) in a CDMA network. MGW exchanges Pulse Code Modulation (PCM) data

(which is based on TDM) with PSTN, and exchanges voice frame (which is based on IP) with BSC. SAMSUNG Electronics Co., Ltd. 1-5 CHAPTER 1. Overview of Samsung Multi-Modal System Wireless Softswtich (WSS) WSS is a system component which provides switching role in CDMA voice network. It also provides additional services for connecting subscribers to additional equipments or other networks (PSTN). 1-6 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 1.2.2 LTE System Network Configuration LTE network of Samsung Multi-Modal system incorporates base station (eNB), packet core

(EPC), LSM. The LTE system consists of multiple base stations (eNB: Evolved UTRAN Node-B) and EPC(MME, S-GW/P-GW) provides functionality for UE to connect to external network as subnet of PDN. In addition, LTE system provides LSM and self-optimization function for operation and maintenance of eEB. LTE network architecture of Samsung Multi-Modal system is as follows:

PDN EPC Gz CG Gz TL1 P-GW S10 S5/S8 S11 S-GW MME S1-U S1-MME SNMP/FTP/UDP X2-C X2-U Gy Gx S6a S1 OCS PCRF Sp HSS/SPR Smart MBS Smart MBS Uu UE UE EMS LSM-C EMS LSM-R RMI MSS Figure 1.3 LTE System Network Configuration Evolved UTRAN Node-B (eNB) eNB is a system located between mobile terminal (User Equipment, UE) and EPC, and it handles the packet calls by connecting to UE wirelessly in accordance with LTE air standard. eNB executes various functions including Tx/Rx of wireless signal, modulation/demodulation of packet traffic, packet scheduling for efficient use of RF resources, Hybrid Automatic Repeat request (HARQ) and Automatic Repeat request

(ARQ) process, Packet Data Convergence Protocol (PDCP) of compressed packet header, and wireless resource control. Also, it synchronizes with EPC to execute handover. SAMSUNG Electronics Co., Ltd. 1-7 CHAPTER 1. Overview of Samsung Multi-Modal System Evolved Packet Core (EPC) EPC is a system between eNB and PDN. It incorporates MME, S-GW/P-GW. MME: MME handles control message with eNB via Non-Access Stratum (NAS) signaling protocol, and performs management of mobility for UE, management of tracking area list, control plane function such as bearer and session management. S-GW: S-GW plays role as anchor on user plane between 2G/3G access system and LTE system. S-GW manages/processes packet transmit layer of downlink/uplink data. P-GW: P-GW allocates IP address to UE, plays role as anchor for mobility between LTE system and non-3GPP access systems, manages accounting for different service levels, and handles management/modification of the throughput rate. LTE System Manager (LSM) LSM provides the following functions. LTE System Manager-Radio (LSM-R) The LSM-R provides an operator interface which the operator can use for operation and maintenance of the eNB. It also provides functions for software management, configuration management, performance management and fault management, and Self Organizing Network (SON) server. LTE System Manager-Core (LSM-C) The LSM-C provides an operator interface which the operator can use for operation and maintenance of the MME, S-GW and P-GW. Home Subscriber Server (HSS) The HSS is a database management system that stores and manages the parameters and location information for all registered mobile subscribers. The HSS manages key data, such as the mobile subscribers access capability, basic and supplementary services, and provides a routing function to the called subscriber. Master SON Server (MSS) MSS is a higher node of local SON server. MSS interworks with local SON server to optimize the interworking in regards to Multi-LSM. MSS is a function that is interworking with the operator Operations Support System (OSS), and the availability of this optional function will be decided after discussion with operator. Policy Charging & Rule Function (PCRF) The PCRF server creates policy rules to dynamically apply the QoS and accounting policies differentiated by service flow, or creates the policy rules that can be applied commonly to multiple service flows. The IP edge includes the Policy and Charging Enforcement Function (PCEF), which allows application of policy rules received from the PCRF server to each service flow. 1-8 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 Online Charging System (OCS) If subscribers (with online accounting information) makes call, subscribers accounting information is sent/received. Offline Charging System (OFCS) OFCS stores the offline accounting data, and provides accounting data per each subscriber. SAMSUNG Electronics Co., Ltd. 1-9 CHAPTER 1. Overview of Samsung Multi-Modal System 1.3 Samsung Multi-Modal System Feature 1.3.1 CDMA System Feature Following Figure shows CDMA system (BSC, BTS) based on 1X/1xEV-DO. BSC 1xEV-DO 1X Voice Voice Handler Paging Controller SUA Handler IP Packet Forwarding AN-AAA Client SC/MM A11 Handler A10 Handler Packet Classification RLP Handler BTS L3 ARQ Abis HARQ MAC PHY IP Packet Forwarding Packet Classification Figure 1.4 CDMA System Functional Structure BSC works with voice core equipments (MGW, WSS) to process signaling and bearer for voice service. SUA (SCCP User Adaptation) Handler: Responsible for Alp signaling with WSS Voice Handler: Voice Handler sends the voice bearer traffic to MGW. In addition, it works with PDSN for 1X data and 1xEV-DO data service. A10 Handler: A10 Handler manages the bearer traffic of 1X data and 1xEV-DO data service. A11 Handler: A11 Handler manages signaling of data service. RLP Handler: RLP Handler manages the ARQ functionality for data communication. AN-AAA client: AN-AAA client interworks with AN-AAA for authentication of 1x EV-DO terminal. Session Control/Mobility Management (SC/MM): SC/MM provides session control and mobility management for 1xEV-DO. Paging Controller: Paging Controller controls the paging for incoming call. IP Packet forwarding and Packet Classification: IP Packet forwarding and Packet Classification function on BSC and BTS together provides the packet prioritization and classification for implementing the QoS on Abis and air interface. 1-10 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 BTS is responsible for radio resource control and air interface communication with MS. Through Common Air Interface (CAI), it provides features such as high speed data service, multimedia service, handoff procedures and QoS in accordance with standards defined in 3GPP2 C.S0024-0_v4.0 and 3GPP2 C.S0024-A_v3.0. 1.3.2 LTE System Feature The eNB manages UEs which are in connected mode at the Access Stratum (AS) level. The MME manages UEs which are in idle mode at the Non-Access Stratum (NAS) level, and the P-GW manages user data at the NAS level as well as working with other networks. The functional architecture of E-UTRAN eNB, MME, S-GW, and P-GW according to the 3GPP standard is shown below. The eNB is structured in layers while the EPC is not. eNB Inter Cell RRM RB Control Connection Mobility Control Radio Admission Control eNB Measurement Configuration & Provision Dynamic Resource Allocation (Scheduler) RRC PDCP RLC MAC PHY E-UTRAN MME NAS Security Idle State Mobility Handling EPS Bearer Control S-GW S1 Mobility Anchoring P-GW UE IP address allocation Packet Filtering EPC Internet Figure 1.5 Functions of E-UTRAN and EPC eNB The eNB serves the Evolved UTRAN (E-UTRAN), a wireless access network in the LTE system. The eNBs are connected via the X2 interface whereas the eNB and EPC are connected via S1 interface. The eNBs wireless protocol layers are divided into Layer 2 and Layer 3. Layer 2 is subdivided into the Media Access Control (MAC) layer, Radio Link Control

(RLC) layer, and PDCP layer, each operating independently. Layer 3 has the RRC layer. The MAC sublayer distributes wireless resources to each bearer according to its priority, and carries out the multiplexing function and the HARQ function for the data received SAMSUNG Electronics Co., Ltd. 1-11 CHAPTER 1. Overview of Samsung Multi-Modal System from the multiple upper logical channels. The RLC layer performs the following functions. Segmentation and reassembly on the data received from the PDCP sublayer into the size specified by the MAC sublayer Restoration of the transmission by resending in case of transmission failure at lower-

level layers (ARQ) Integrity protection and verification of the control plane data Re-ordering of the HARQ operation of the MAC sublayer The PDCP layer carries out the following functions. Header compression and decompression Ciphering and deciphering of the user plane and control plane data Data transmission of data, including serial numbers Removing timer-based and duplicate data The RRC layer is responsible for managing mobility in the wireless access network, keeping and controlling the Radio Bearer (RB), managing RRC connections, and sending system information. Mobility Management Entity (MME) The MME works with the E-UTRAN (eNB), handling S1 Application Protocol (S1-AP) signaling messages in the Stream Control Transmission Protocol (SCTP) base to control call connections between the MME and eNB as well as handling NAS signaling messages in the SCTP base to control mobility and call connections between the UE and EPC. The MME also works with the HSS to obtain, modify and authenticate subscriber information, and works with the S-GW to request assignment, release and modification of bearer paths for data routing and forwarding using the GTP-C protocol. The MME can work with the 2G and 3G systems, SGSN, and MSC to provide mobility, Handover (HO), Circuit Service (CS) fallback, and Short Message Service (SMS). The MME is also responsible for managing mobility between eNBs, idle-mode UE reachability, Tracking Area (TA) list as well as for P-GW/S-GW selection, authentication, and bearer management. MME supports the handover between MMEs and provides the mobility for the handover between the eNBs. It also supports the SGSN selection function upon handover to a 2G or 3G 3GPP network. Serving Gateway (S-GW) The S-GW performs the mobility anchor function upon inter-eNB handover and inter-3GPP handover as well as routing and forwarding of packet data. The S-GW allows the operator to set a different charging policy by UE, PDN or QCI, and manages the packet transport layer for uplink/downlink data. The S-GW also works with the MME, P-GW, and SGSN to support the GPRS Tunneling Protocol (GTP) and Proxy Mobile IP (PMIP). 1-12 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 PDN Gateway (P-GW) The P-GW works with PCRF to carry out charging and bearer policies, and manage the charging and transmission rate based on the service level. It also provides packet filtering per subscriber, assigns IP addresses to UEs, and manages the packet transmission layer of the downlink data. SAMSUNG Electronics Co., Ltd. 1-13 CHAPTER 1. Overview of Samsung Multi-Modal System This page is intentionally left blank. 1-14 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description CHAPTER 2. Smart MBS Abstract 2.1 Smart MBS System Introduction Smart MBS is the Samsung Multi-Modal system. It is managed by packet core (BSC, EPC), and makes call to terminal to create CDMA/LTE links. It is controlled by the BSC(CDMA), DPC(LTE)for connecting CDMA/LTE calls to the mobile terminal. To this end, the Smart MBS provides the following functions:

modulation/demodulation of packet traffic signal, scheduling and radio bandwidth allocation to manage air resources efficiently and ensure Quality of Service (QoS), Automatic Repeat request (ARQ) processing, ranging function, connection control function to transmit the information on the Smart MBS and set/hold/disconnect the packet call connection, handover control, control station such as BSC/EPC interface function, power control function and system operation management function. The Smart MBS securely and rapidly transmits various control signals and traffic signals by interfacing with the BSC/EPC via the Fast Ethernet/Gigabit Ethernet backhaul. Physically, the Smart MBS consists of an Universal platform type A Digital Unit (UADU), which is a DU, and Local Radio Unit (LRU), which is a combined RF unit. UADU and LRU are mounted on the outdoor cabinet with rectifier. UADU is a digital part, which is a type of 19 in. shelf. It can be mounted onto outdoor 19 inch commercial rack, and one UADU can provide the following maximum capacity. Based on operators setup, it can be operated as omni type or sector type. CDMA 1X/EV-DO 1X : 2 Carrier/3 Sector(2br) 1xEV-DO : 2 Carrier/3 Sector(2br) LTE: 5 MHz 1 Carrier/6 Sector LRU cab be operated as follows as RF part. Advanced Wireless Services (AWS) band, 2Tx/2Rx RF path SAMSUNG Electronics Co., Ltd. 2-1 CHAPTER 2. Smart MBS Abstract Smart MBS also provided the following features:

Common Platform Digital boards of each wireless technology, to be mounted in Smart MBS, share the common DU platform. Therefore, different boards (for multiple technologies) may be mounted in a single DU, and operator can mount up to 2 UADUs in outdoor cabinet to implement various configurations. LRU of Smart MBS can simultaneously support multiple technologies in the same duplexing type with the same bandwidth. Loopback Test Smart MBS provides the loopback test function to check whether communication is normal on the baseband I/Q interface line between the UADU and LRU. Remote Firmware Downloading The operator can upgrade the LRU and its service by replacing its firmware. Without visiting the field station, the operator can download firmware to the LRU remotely using a simple command from the BSM/LSM-R. In this way, operators can minimize the number of visits to the field station, reducing maintenance costs and allowing the system to be operated with greater ease. Monitoring Port Operators can monitor the information for an LRU using its debug port. Smooth Migration The UADU of the Smart MBS supports migration from CDMA to 4G mobile communication such as LTE by adding traffic processor card/channel cards and upgrading the software. The LRU of the Smart MBS, on the other hand, only requires software upgrade for evolving into 4G mobile communication in the same frequency range or even simultaneous operation of 3G and 4G mobile communications. 2-2 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 2.1.1 CDMA System Feature Support for 1X Advanced Smart MBS supports 1X Advanced to improve voice call capacity and data rate. For this, 1X Advanced applies EVRC-B, RLIC, QOF, New RC, QLIC, MRD, etc. Tx/RX Diversity Support LRU of Smart MBS supports Time Division Transmit Diversity (TDTD) that transmit the output of CDMA modem(1Tx) to RF path of 2Tx to improve Tx performance on option. Also, the LRU support 2brach Rx diversity to improve Rx performance that provides 2 Rx path for each sector. 2.1.2 LTE System Feature OFDMA/SC-FDMA Technology Smart MBS can handle downlink OFDMA/uplink SC-FDMA channel processing that supports the Physical Layer of LTE standard. Downlink OFDMA can use sub-carrier, which are assigned to each subscriber, to simultaneously send data to multiple users. Also, in accordance with the requested data transfer rate, it can assign single (or multiple) sub-carrier to particular subscriber for data transmission. Also, when entire sub-carriers are shared by multiple subscribers, OFDMA can dynamically determine well-matched sub-carrier for each subscriber, so that resource can be assigned efficiently to enhance data throughput. Uplink SC-FDMA is basically similar to Mod/Demodulation algorithm of OFDMA. However, Discrete Fourier Transform (DFT) process is handled per each subscriber during Tx Modulation, then on contrary, Inverse Discrete Fourier Transform (IDFT) process is handled during Demodulation to minimize potential Peak to Average Power Ratio (PAPR) that can occur during the transmission. Also it is responsible for assigning the particular frequency resource to particular subscriber continuously. As a result, it will reduce the power that is dissipated by terminal. Support for Broadband Channel Bandwidth Smart MBS provides multiple bandwidth of 5 MHz, 10 MHz and high speed/high capacity packet service. Support for Multiple Input Multiple Output (MIMO) Smart MBS uses multi antenna to support 2Tx/2Rx MIMO. MIMO has following algorithms. Space Frequency Block Coding (SFBC)-Downlink Increases Link Reliability This technology implements Space Time Block Coding (STBC) on frequency domain rather than time domain. 2 Tx Case: STBC (Alamouti codes) algorithm is used. 4 Tx Case: SFBC and Frequency Switched Transmit Diversity (FSTD) are used SAMSUNG Electronics Co., Ltd. 2-3 CHAPTER 2. Smart MBS Abstract together. Spatial Multiplexing (SM)-Downlink This algorithm sends different data to different antenna path to increase peak data rate.

(each path uses same time/frequency resource) Single User (SU)-MIMO: This is the SM between base station and single mobile terminal. It increases the peak data rate of a single mobile terminal. Open-loop SM: If channel changes often, or channel information is not available because mobile terminal travels in high speed, this is the SM algorithm that works without Precoding Matrix Indicator (PMI) feedback. Closed-loop SM: If channel information is available because UE travels in low speed, this is the SM algorithm (codebook-based precoding) that works after receiving UEs PMI feedback from base station. UL Transmit Antenna Selection-Uplink This is the algorithm that indicates terminal to use 1 RF chain, 2 Tx antenna, and which antenna to use. (Closed-loop selection of Tx antenna) Multi-User (MU) MIMO or Collaborative MIMO-Uplink There is no increase in peak data rate of each mobile terminal, but this algorithm increases the total cell throughput. 2 mobile terminals transfers different data simultaneously using the same time/frequency resource for UL Smart MBS uses single Tx antenna, and selects two orthogonal terminals. QoS Support Smart MBS provides QoS for the EPS bearer/E-RAB based on the standard QCI and operator-specific QCI of the 3GPP TS. 23.203 specifications. Detailed techniques to provide QoS are:

QoS-based radio scheduling The scheduler allocates resources to provide the GBR based on QoS characteristics

(resource type, priority, PDB and PLER). The scheduler supports the Aggregate Maximum Bit Rate (AMBR) for non-GBR bearers. Backhaul QoS requirements. QoS mapping between the QoS class and DSCP IP DSCP and Ethernet COS markings are used to satisfy the carriers backhaul Transmission is controlled according to the priority by QoS classes, such as signaling, user traffic and O & M traffic. QoS-based CAC The CAC algorithm accepts calls only when the requested bit rate and QoS can be satisfied. 2-4 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 SON SON provides functions such as self-configuration, self-establishment and self-optimization. Self-Configuration & Self-establishment Self-configuration and the self-establishment allow system to configure radio parameters automatically, and to be powered up and have backbone connectivity without human interventions. This will reduce the cost of eNB installation and management. The detailed functions are as follows:

Self-configuration Initial Peripheral Component Interconnect (PCI) self-configuration Initial neighbor information self-configuration Initial Physical Random Access Channel (PRACH) information self-configuration Self-establishment Auto OAM connectivity Software and configuration data loading Automatic S1/X2 setup Self-Test Self-Optimization PCI auto-configuration The local SON server of the LSM provides the function for allocating the initial PCI in the self-establishment procedure of a new system, and the function for detecting a problem automatically and setting a proper PCI when a PCI collision/confusion occurs during operation with the adjacent cells. Automatic Neighbor Relation (ANR) optimization The ANR function dynamically manages the Neighbor Relation Table (NRT) according to neighbor cells growing/degrowing reduced so as to minimize the network operators efforts to maintain the optimal NRT. To maintain the optimal NRT, SON server is required to self-configure initial NRT of each system and to detect environmental changes during operation, such as cell growing/degrowing or new system installation. In other words, the ANR function updates the NRT for each eNB by automatically recognizing the topology change such as installing or removing a new adjacent cell or adjacent system and by adding or removing the Neighbor Relation (NR) to or from a new adjacent cell. Mobility robustness optimization Based on the moment before, after, or during handover caused by mobile terminal mobility within the system, the mobility robustness optimization function is to improve handover performance by recognizing problems that trigger handover at the incorrect time (e.g., too early or too late) or to the incorrect target cell and by optimizing the handover parameters according to the causes of the problems. RACH optimization The RACH Optimization (RO) function can minimize the network operators efforts to minimize access delay and interference by managing dynamically the parameters related to random access. The RO function is divided into the initial RACH setting SAMSUNG Electronics Co., Ltd. 2-5 CHAPTER 2. Smart MBS Abstract operation and the operation for optimizing parameters related to the RACH. The initial RACH setting is to set the preamble signatures and the initial time resource considering the neighbor cells. The parameter optimization related to the RACH is to optimize the related parameters by estimating the RACH resources, such as time resource and subscriber transmission power required for random access that changes by time during operation. Load balancing The Load balancing feature in a multi-carrier environment selects and hands over mobile terminal from a high-loaded carrier and to a low-loaded carrier. If all carriers in the same sector are highly loaded, it selects a low-loaded neighbor cell and the mobile terminal in the cell edge to perform handover. The mobile terminal selection algorithm tries to minimize the QoS degradation. Idle UE distribution function among carriers ensures that mobile terminals are camped in a way that they are distributed to low-loaded carriers, considering the active UE load distribution among the carriers in the same sector. Availability of System Features and Functions For availability and provision schedule of the features and functions described in this system description, please refer to separate documentations. 2-6 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 2.2 Smart MBS Main Feature Smart MBS is a base station that supports CDMA/LTE technology which provides physical layer, and call processing feature. Regardless of the operated technology, IP processing feature and operation/maintenance feature are integrated. 2.2.1 Physical Layer Processing Function 2.2.1.1 CDMA Physical Layer Processing Function 1X & 1xEV-DO Smart MBS can be operated in 1X (voice service) mode or 1xEV-DO(data service) mode by carrier for CDMA service. 1X 1xEV-DO Specification Peak data rate Frame Duration Traffic Channel 153.6 kbps 20 ms Fundamental/Supplemental BS Tx power Forward and Reverse Power Control Pilot channel Channel encoding Modulation Continuous pilot Convolution & turbo code BPSK(Binary Phase Shift Keying), QPSK(Quadrature Phase Shift Keying) 3.1 Mbps 26.67 ms(DO.0)/6.67 ms(DO.A) Forward and Reverse Traffic Channels Forward Full Power/Reverse Power Control Burst pilot Turbo code BPSK~16 QAM(Quadrature Amplitude Modulation) Channel Encoding/Decoding Smart MBS carries out the encoding for the downlink packet created in the upper layer by using convolutional code and Turbo code. On the contrary, it decodes the uplink packet received from the mobile terminal after demodulating. Modulation/Demodulation Smart MBS modulates for the downlink packet created in the upper layer after encoding. On the contrary, it decodes the uplink packet received from the mobile terminal after demodulating. RF Scheduler Smart MBS perform the RF scheduling function to distribute radio resource of system efficiently and ensure the quality of system. Call Admission Control (CAC)/Burst Operation Control (BOC)/overload control function are performed for 1X, Proportional Fair/Round Robin/QoS schedulers are performed for 1xEV-DO. SAMSUNG Electronics Co., Ltd. 2-7 CHAPTER 2. Smart MBS Abstract Power Control For maximizing system capacity, Smart MBS controls the output power of Smart MBS and mobile terminal to make receiving power of the mobile terminal be the equal level and have the minimum signal-to-interference ratio. 2.2.1.2 LTE Physical Layer Processing Function Downlink Reference Signal Generation and Transmission Reference Signal is used for demodulation of downlink signal at mobile terminal, and also utilized for measuring the channel characteristic for scheduling, link adaptation, and handoff. In case of sending Non-MBSFN (Multimedia Broadcast multicast service over a Single Frequency Network), there are two reference signals. Cell-specific reference signal: Cell-specific reference signals are used to measure the quality of the channel, calculate the MIMO rank, perform MIMO precoding matrix selection, and measure the strength of the signals for handover. UE-specific reference signal: UE-specific reference signals are used to measure the quality of the channel for data demodulation which is located in the PDSCH block of the specific mobile terminal in the beamforming transmission mode. Downlink Synchronization Signal Generation and Transmission Synchronization signal is used by mobile terminal when obtaining the initial synchronization before communicating with base station. It has two signals, namely Primary Synchronization Signal (PSS) and Secondary Synchronization Signal (SSS). Cell identity information can be identified by synchronization signal. Mobile terminal can obtain additional information (other than cell information) via Broadcast Channel. Synchronization signal and Broadcast channel are transmitted through the exact center of channel bandwidth of the cell, which is 1.08 MHz band. This is to allow mobile terminal to identify cells basic information such as cell ID regardless of base stations transmission bandwidth range. Channel Encoding/Decoding Smart MBS executes channel encoding/decoding function which is designed to correct the error generated on wireless channel environment. LTE uses turbo coding and 1/3 tail-biting convolutional coding. Turbo coding is generally used to send relatively large data of downlink/uplink, while convolutional coding is used for control data transmission

(downlink and uplink) or used as broadcast channel. Modulation/Demodulation In case of downlink, Smart MBS receive data from upper layer, process it with baseband of physical layer, and sends it out onto wireless channel. At this time, baseband signal is modulated to higher bandwidth in order to transmit it to longer distance. Also, in case of uplink, base station receives the data via wireless channel, demodulate it into baseband signal, and decodes it. 2-8 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 Resource Allocation & Scheduling With LTE, Smart MBS uses multi link scheme. OFDMA is used for downlink while SC-

FDMA is used for uplink. Both schemes allocate 2-dimensional (time & frequency) resources into multiple terminals (without overlapping to each other) that communication link is allocated to multiple terminals. In exceptional case of MU-MIMO mode, same resource can be shared among multiple terminals. Such allocation of resources onto multiple terminal, is referred to as scheduling, and individual scheduler of each cell can process this. LTE Scheduler of Smart MBS can analyze channel environment of each terminal, demanded data transfer rate, and various QoS to optimize the resource allocation to maximize the cells total throughput. Also, in order to reduce the interference with other cells, it can exchange information with other cells scheduler via X2 interface. Link Adaptation Wireless channel condition can change either rapidly or slowly, either improve or deteriorate. When channels condition can be expected, it can be used to increase the data transfer rate, or maximize the entire cells throughput. This is called Link Adaption. Particularly, MCS (Modulation and Coding Scheme) can adjust modulation scheme and channel coding rate at different channels conditions. For example, good channel environment will utilize high-order modulation (such as 64 QAM) to enlarge the number of transmitted bit per unit symbol, but bad channel environment will utilize low-order modulation and low coding rate to minimize the channel error. In channel environment where MIMO is supported, MIMO Mode is utilized to either increase the users peak data rate or cell throughput. In cases when channel condition is incorrectly reported, or if higher ordered modulation or coding rate is used, error can occur. This can be efficiently corrected by Hybrid-ARQ feature. H-ARQ H-ARQ is a physical layer retransmission scheme which utilizes stop-and-wait protocol. Smart MBS executes H-ARQ to minimize the potential impact due to change in either wireless channel environment or noise signal level. It improves throughput by retransmitting or combining the frame in physical layer. LTE uses H-ARQ technique based on Incremental Redundancy (IR), and considers Chase Combining (CC) scheme as one specific method of IR. In case of Downlink, Smart MBS uses asynchronous scheme, but uplink uses synchronous scheme. SAMSUNG Electronics Co., Ltd. 2-9 CHAPTER 2. Smart MBS Abstract Power Control When transmitting a specific data rate, too high a power level may result in unnecessary interferences and too low a power level may result in an increased error rate, causing retransmission or delay. Unlike other methods such as CDMA, power control is relatively less important in LTE. Nevertheless, adequate power control can enhance performance of the LTE system. For LTE uplink, since SC-FDMA is used, the near-far problems which occur in the CDMA do not occur. Nevertheless, high levels of interferences from nearby cells can degrade the uplink performance. Therefore, the mobile terminals should use adequate power levels for data transmission in order not to interfere with nearby cells. Likewise, the power level for each mobile terminal could be controlled for reducing the inter-cell interference level. For downlink in LTE, the Smart MBS can reduce inter-cell interference by transmitting data at adequate power levels according to the location of the mobile terminal and the MCS, enhancing overall cell throughput. Inter-Cell Interference Coordination (ICIC) Since mobile terminals within a cell in LTE use orthogonal resources with no interference between the mobile terminals, there is no intra-cell interference. However, if different mobile terminals in neighboring cells use the same resource, interference may occur. This happens more seriously between the mobile terminals located on the cell edge, resulting in serious degradation at cell edge. The technique used to relieve such inter-cell interference problem on the cell edge is Inter-

Cell Interference Coordination (ICIC). ICIC allows interference signals to be transmitted to other cells in the cell edge area in as small an amount as possible by allocating a basically different resource to each mobile terminal that belongs to a different cell and by carrying out power control according to the mobile terminals location in the cell. Smart MBS uses the X2 interface for exchanging scheduling information with one another for preventing interferences by resource conflicts at cell edges. If the interference of a nearby cell is too strong, the system informs the other system to control the strength of the interference system. Therefore, the ICIC function is used for enhancing the overall cell performance. MIMO Smart MBS has an architecture that can support 2Tx/2Rx or 4Tx/4Rx MIMO using multiple antennas. For this, the channel card of Smart MBS should have the baseband to process MIMO and the RF to handle each path separately. Smart MBS provides high performance data service by supporting several types of MIMO. 2-10 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 2.2.2 Call Processing Function 2.2.2.1 CDMA Call Processing Function Call Process and RF Resource Allocation Feature Smart MBS allows mobile terminal to connect to, or disconnect from the network for voice and data calls. When mobile terminal is request connected or disconnected from the network or call resource, Smart MBS communicates with mobile terminal using 3GPP2 1X/1xEV-DO interface and communicates with BSC using Samsung proprietary standard interface, to exchange signaling messages required for call processing. Execution of Handoff Smart MBS carries out the signaling and bearer processing for softer handoff between sectors, soft/hard handoff between base station. CAC Feature In order to maintain efficient use of radio resources and high performance service, Smart MBS provides CAC feature to accept/deny the demand of mobile terminal for a radio resource allocation. 2.2.2.2 LTE Call Processing Function Cell Information Transmission In the cell area being served, the Smart MBS periodically broadcasts a Master Information Block (MIB) and the System Information Blocks (SIBs), which are system information, to allow the mobile terminal that receives them to perform proper call processing. Call Control and Air Resource Assignment Smart MBS allows the mobile terminal to be connected to or to be released from the network. When the mobile terminal is connected to or released from the network, the Smart MBS sends and receives the signaling messages required for call processing to and from the mobile terminal via the Uu interface, and to and from the EPC via the S1 interface. When the mobile terminal connects to the network, the Smart MBS carries out call control and resource allocation required for service. When the mobile terminal is released from the network, it collects and releases the allocated resources. SAMSUNG Electronics Co., Ltd. 2-11 CHAPTER 2. Smart MBS Abstract Execution of Handover Smart MBS supports intra-frequency or inter-frequency handover between intra-eNB cells, X2 handover between eNBs, and S1 handover between eNBs, and carries out the signaling and bearer processing functions required for handover. At intra-eNB handover, handover-

related messages are transmitted via internal eNB interfaces; at X2 handover, via the X2 interface; at S1 handover, via the S1 interface. Smart MBS carries out the data retransmission function to minimize user traffic disconnections at X2 and S1 handovers. The source eNB provides two methods of using the X2 interface for direct retransmission to the target eNB and using the S1 interface for indirect retransmission. Smart MBS uses the data forwarding function to ensure that the UE receives the traffic without any loss at handover. Admission Control (AC) Function Smart MBS provides capacity-based admission control and QoS-based admission control for a bearer setup request from the EPC so that the system is not overloaded. Capacity-based AC There is a threshold for the maximum number of connected mobile terminals (new calls/handover calls) and a threshold for the maximum number of connected bearers that can be allowed in the Smart MBS. When a call setup is requested, the permission is determined depending on whether the connected mobile terminals and bearers exceed the thresholds. QoS-based AC Smart MBS provides the function for determining whether to permit a call depending on the estimated Physical Resource Block (PRB) usage of the newly requested bearer, the PRB usage status of the bearers in service, and the maximum acceptance limit of the PRB (per bearer type, QCI, and UL/DL). RLC ARQ Function Smart MBS carries out the ARQ function for the RLC Acknowledged Mode (AM) only. When receiving and sending packet data, the RLC transmits the SDU by dividing it into units of RLC PDU in the sending end and the packet is forwarded according to the ARQ feedback information received from the receiving side for increased reliability of the data communication. QoS Support Function Smart MBS should receive QCI (QoS Class Identifier) which defines QoS characteristics, GBR, Maximum Bit Rate (MBR), Aggregated Maximum Bit Rate (AMBR) from EPC. Also, it should provide QoS between wireless interface between mobile terminal and Smart MBS, and on the backhaul between Smart MBS and S-GW. Wireless interface should perform retransmission in order to satisfy rate control based on GBR/MBR/AMBR values, bearer priority defined in QCI, and scheduling considered packet delay budget, and Packet Loss Error Rate (PLER). For QoS in Backhaul, packet classification based on QCI, QCI to DSCP mapping, and marking should be executed. Queuing should be provided in accordance with the result of the mapping, and each Queues should send the packets to EPC per strict priority. In case of EMS, other than the previously defined QCI, configuration for operator specific QCI and QCI-to-DSCP mapping can be configured. 2-12 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 2.2.3 IP Processing Function IP QoS Feature Since Smart MBS supports Differentiated Services (DiffServ), it can provide the backhaul QoS in the communication with ACR. It supports 8-class DiffServ and supports the mapping between the DiffServ service class and the service class of the user traffic received from an MS. In addition, Smart MBS supports the mapping between Differentiated Services Code Point (DSCP) and 802.3 Ethernet MAC service class. IP Routing Function Since Smart MBS provides multiple Ethernet interfaces, it maintains a routing table to route IP packets to different Ethernet interfaces. Smart MBSs. routing table is configured by the operator similar to a standard router configuration. Smart MBS only supports static source routing, and does not provide routing feature for traffic received from external network and does not support any IP routing protocols. Ethernet/VLAN Interface Feature The TD-LTE Flexible system provides the Ethernet interface and supports the static link grouping function, Virtual Local Area Network (VLAN) function and Ethernet CoS function under IEEE 802.3ad for the Ethernet interface. At this time, the MAC bridge function defined in IEEE 802.1D is excluded. The TD-LTE Flexible system enables several VLAN IDs to be set in one Ethernet interface and maps the DSCP value of IP header with the CoS value of Ethernet header in Tx packet to support Ethernet CoS. 2.2.4 Operation and Maintenance Function Smart MBS interworking with the management system carries out the following maintenance functions: system initialization and restart, management for system configuration, management for the operation parameters, failure and status management for system resources and services, statistics management for system resources and various performance data, diagnosis management for system resources and services and security management for system access and operation. Graphic and Text based Interface BSM/LSM-R manages the each CDMA access system and LTE system by using Database Management System (DBMS) and Smart MBS interworks with this BSM/LSM-R. For operators convenience and working purpose, graphic-based and text-based interface is provided. The operator can carry out the retrieval and setup of the configuration and the operation information and monitoring about faults, status and statistics via this interface. Also, the operator can carry out grow/degrow of resources and setting of the neighbor list and paging group which have correlation between several NEs only via the BSM/LSM-R. SAMSUNG Electronics Co., Ltd. 2-13 CHAPTER 2. Smart MBS Abstract Operator Authentication Function Smart MBS provides an authentication and restricted management feature for the operator. The operator can access the Smart MBS via a console terminal with ID and Password, and Smart MBS acknowledges the security level of the corresponding user. Smart MBS then logs the history of login success, failure. On-line Software Upgrade When a software package is upgraded, the Smart MBS can upgrade the package while running old version of software package. The package upgrade is progressed in the following procedure: Add New Package Change to New package Delete Old Package. In package upgrade, the service is stopped temporarily because the old process is terminated and the new process is started in the Change to New package stage. However, since OS is not restarted, the service will be provided again within a few minutes. After upgrading software, the TD-LTE Flexible system updates the package stored in a non-volatile storage. In addition, the TD-LTE Flexible system can re-perform the Change to New package stage to roll back into the previous package before upgrade. Call Trace Function Smart MBS can support a call trace feature for specific mobile terminal. The operator can configure a trace for a specific mobile terminal via BSC/MME. Trace results (such as a signaling message) are then are sent to the BSM/LSM-R. Threshold Cross Alert (TCA) Control BSM/LSM-R defines under/over threshold for statistics. When a statistical value collected at a specified interval is lower than the under threshold, it generates an under TCA alarm. When the value is higher than the over threshold, it generates an over TCA alarm. TCA can enable or disable details of each statistical group and set a threshold per severity. IEEE 802.3ah Smart MBS provides IEEE 802.3ah Ethernet OAM for a backhaul interface. Although IEEE 802.3ah OAM pertains the PHY layer, it is located in the MAC layer so that it can be applied to all IEEE 802.3 PHYs. It creates or processes 802.3ah OAM frames according to the functions defined in the specification. Ethernet OAM continuously monitors the connection between links at each end, and also monitors discovery. It also includes remote loopback function, a link monitoring function which delivers event notification in the event of error packets over the threshold. Smart MBS supports 802.3ah Ethernet OAM passive mode such as responding to 802.3ah OAM which is triggered in external active mode entities and loopback mode operation, and sending event notification. 2-14 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 OAM Traffic Throttling Smart MBS provides a function that suppresses OAM related traffic which can occur in the system depending on the operator command. The OAM related traffic includes fault trap messages for alarm reports and statistics files that are created periodically. In a fault trap, the operator can use an alarm inhibition command to suppress alarm generation for all or some of system fault traps. This helps control alarm traffic. In a statistics file, the operator can use commands for statistics collection configuration to control the size of statistics file by disabling collection functions of each statistics group. SAMSUNG Electronics Co., Ltd. 2-15 CHAPTER 2. Smart MBS Abstract 2.3 Specifications Capacity Smart MBS can provide the following capacity. Classification Channel Bandwidth RF Bandwidth Number of maximum Carrier/Sector Per each UADU Number of UADU per cabinet Backhaul Interface Air Technology Output Optional System Capacity

- CDMA: 1.25 MHz

- LTE: 5 MHz CDMA/LTE

- Downlink: 2,130~2,140 MHz @ AWS Band

- Uplink: 1,730~1,740 MHz @ AWS Band

- CDMA 1X: 2 Carrier/3 Sector(2br) 1x EV-DO: 2 Carrier/3 Sector(2br)

- LTE: 5 MHz 1 Carrier/6 Sector Max. 2

- 100/1000 Base-T

- 1000 Base-SX/LX

- CDMA: 1Tx/2Rx or 2Tx/2Rx(TDTD)

- LTE: SIMO(1 2) or MIMO(2 2) Antenna port-based at the external of cabinet

- CDMA: 24 W/Carrier

- LTE: (12 W 2Tx)/Carrier @ 5 MHz channel BW or

- CDMA:(12 + 12 W)/Carrier

- LTE: (24 W 2Tx)/Carrier @ 5 MHz channel BW High Power Mode (3 dB Power boosting) RF Output Output of LTE can change depending on channel bandwidth. Power Input Following is the power specification for Smart MBS. Classification Standard Board and Module Input Voltagea) 27 VDC (Voltage Variation Range: 21~30 VDC) 2-16 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 Power Input Each of the UADU and LRU receives 27 VDC of power from the rectifier in the cabinet for its operation. Rack Dimension and Weight Following is dimension and weight of the Smart MBS. Classification Standard Size(W D H, mm) DU LRU Weight(kg) Outdoor Cabinet DU LRU Outdoor Cabinet 434 385 88

- L9VU: 70 380 435

- L9FU: 70 380 176.3 750 940 1800 About 12

- L9VU: 13

- L9FU: 8 390 or less(including UADU and LRU) Environmental Requirements Following indicates temperature, humidity, and other environmental requirements where Smart MBS can be operated on. Range Classification Temperaturea) Humiditya) 0~50C (32~122F) 5~95%

Assuming 1 kg of air contains water vapor NOT exceeding 0.024 kg.

-60~1,800 m(-197~6,000 ft) Zone 4 Commercial Transportation Curve 2 Altitude Quake Vibration Sound Pressure Level Max. 65 dBA at distance of 1.5 m (5 ft) and height of 1.0 m (3 ft) FCC Title47 Part15 Class A Electromagnetic Compatibility (EMC) US Federal Regulation FCC Title47 Part90 Standard GR-487-CORE Sec.3.26 GR-487-CORE Sec.3.34.2 GR-63-CORE Sec.4.1.3 GR-63-CORE Sec.4.4.1 GR-63-CORE Sec.4.4.4 FCC Title47 Part15 IEC 61000-4-X Series UL 60950-1 FCC Title47 Part27 a) The standards of temperature/humidity conditions are based on the value on the position where is 400 mm

(15.8 in.) away from the front of the system and in the height of 1.5 m (59 in.) on the bottom. SAMSUNG Electronics Co., Ltd. 2-17 CHAPTER 2. Smart MBS Abstract 2.4 Interface between Systems 2.4.1 CDMA Interface Structure The CDMA system interfaces with other NEs as follows:

Interface Section Mobile Station (MS) Smart MBS BSC BSM Interface Standards

- Physical connection: CDMA CAI

- Connection Protocol: IS-95, IS-2000, IS-856

- Physical connection: FE/GE

- Connection Protocol: IPC(Inter Processor Communication), Proprietary of Samsung

- Physical connection: FE/GE

- Connection Protocol: sFTP/SSH/IPC Protocol Stack between BTS and MS The protocol stack between BTS and MS is as follows:

APP(Data) TCP/UDP PPP APP(voice) RLP MAC PHY MS MAC PHY BTS Figure 2.1 Protocol Stack between BTS and MS 2-18 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 Protocol Stack between BTS and BSC The protocol stack between BTS and BSC is as follows:

Proprietary IPC Proprietary IPC UDP IP L2 L1 BTS UDP IP L2 L1 BSC Figure 2.2 Protocol Stack between BTS and BSC Protocol Stack between BTS and BSM The protocol stack between BTS and BSM is as follows:

sFTP TCP Proprietary IPC UDP sFTP TCP Proprietary IPC UDP IP L2 L1 BTS IP L2 L1 BSM Figure 2.3 Protocol Stack between BTS and BSM SAMSUNG Electronics Co., Ltd. 2-19 CHAPTER 2. Smart MBS Abstract 2.4.2 LTE Interface Structure The LTE system interfaces with other NEs as follows:

UTRAN Iu-PS SGSN S4 GERAN Gb S3 HSS PCRF S1-MME MME S6a S11 Gxc Gx Rx LTE-Uu UE Smart MBS S10 S1-U S-GW S5 P-GW SGi Operators IP Service X2 LTE-Uu UE Smart MBS SNMP/

FTP LSM-R EPC Interface Section Smart MBS User Equipment

(UE) MME S-GW eNB LSM-R Figure 2.4 LTE Interface Structure Interface Standards

- Physical connection: LTE PHY OFDMA

- Connection protocol: LTE Uu Interface

- Physical connection: FE/GE

- Signaling connection protocol: S1-MME(S1AP/SCTP/IP)

- Physical connection: FE/GE

- Bearer connection protocol: S1-U(GTP/UDP/IP)

- Physical connection: FE/GE

- Signaling connection protocol: X2-C(X2AP/SCTP/IP)

- Bearer connection protocol: X2-U(GTP/UDP/IP)

- Physical connection: FE/GE

- Connection protocol: SNMP/sFTP/SSH The LTE process consists of different protocol layers. Data to be transmitted enter the process as IP packets over the bearer. The IP packets go through several protocol entities explained below to be transmitted via the wireless interface. PDCP: The PDCP protocol compresses the IP header to decrease the number of bits transmitted over the wireless interface. The header compression is based on the standardized algorithm, Robust Header Compression (ROHC). The PDCP is also responsible for the ciphering and integrity protection of the data to be transmitted. The PDCP protocol on the receiving end carries out the process of deciphering and decompression. RLC: The RLC protocol performs segmentation/concatenation, retransmission control 2-20 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 and sequential transmission of data to higher layers. The RLC provides services for the PDCP as a radio bearer. MAC: The MAC protocol handles HARQ retransmission and uplink/downlink scheduling. The scheduling function is in the eNB which has a MAC entity per cell for the uplink and downlink. The HARQ protocol part exists on both the transmitting and receiving ends of the MAC protocol. The MAC provides services for the RLC as a logical channel. PHY: The PHY protocol is responsible for coding/decoding, modulation/demodulation, multi-antenna mapping and other common functions of the physical layer. The PHY layer provides services for the MAC as a transport channel. The protocol stack between NEs (Network Elements) in the Smart MBS is as follows:

Protocol Stack between UE and eNB The user plane protocol stack consists of PDCP, RLC, MAC, and PHY layers. The user plane is responsible for transmitting user data (e.g., IP packets) received from the higher layer. All protocols in the user plane are terminated in the eNB. The control plane protocol stack consists of NAS, RRC, PDCP, RLC, MAC, and PHY layers. Located above the wireless protocol, the NAS layer is responsible for UE authentication between the UE and MME, security control, and paging/mobility management of UEs in LTE idle mode. In the control plane, all protocols except the NAS signal are terminated in the eNB. NAS RRC PDCP RLC MAC L1 UE Relay S1-AP SCTP IP L2 L1 NAS S1-AP SCTP IP L2 L1 RRC PDCP RLC MAC L1 LTE-Uu eNB S1-MME MME Figure 2.5 Protocol Stack between UE and eNB SAMSUNG Electronics Co., Ltd. 2-21 CHAPTER 2. Smart MBS Abstract Protocol Stack between eNB and EPC A physical connection between the eNB and EPC is established through the FE and GE, and the interface standards should satisfy the LTE S1-U and S1-MME. The user plane uses the GTP-User (GTP-U) above the IP, and the control plane uses the SCTP above the IP. The user plane protocol stacks between the eNB and S-GW are shown below. User Plane PDUs User Plane PDUs GTP-U UDP IP L2 L1 GTP-U UDP IP L2 L1 eNB S1-U S-GW Figure 2.6 Protocol Stack between eNB and EPC The control plane protocol stacks between the eNB and MME are shown below. S1-AP S1-AP SCTP IP L2 L1 eNB SCTP IP L2 L1 S1-MME MME Figure 2.7 Protocol Stack between eNB and MME 2-22 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 Protocol Stack between eNBs A physical connection between the eNBs is established through the FE and GE, and the interface standards should satisfy the LTE X2 interface. The user plane protocol stacks between the eNBs are shown below. User Plane PDUs User Plane PDUs GTP-U UDP IP L2 L1 eNB X2 GTP-U UDP IP L2 L1 eNB Figure 2.8 Protocol Stack between eNBs (User Plane) The control plane protocol stack is shown below. X2-AP X2-AP SCTP IP L2 L1 eNB X2 SCTP IP L2 L1 eNB Figure 2.9 Protocol Stack between eNBs (Control Plane) SAMSUNG Electronics Co., Ltd. 2-23 CHAPTER 2. Smart MBS Abstract Protocol Stack between eNB and LSM A physical connection between the eNB and LSM is established through the FE and GE, and the interface standards should satisfy the FTP/SNMP interface. The interface protocol stacks between the eNB and LSM are shown below. FTP SNMP FTP SNMP TCP UDP TCP UDP IP L2 L1 IP L2 L1 eNB FTP/SNMP LSM Figure 2.10 Protocol Stack between eNB and LSM 2-24 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 2.4.3 Physical Interface Operation Method Smart MBS provides copper type or optic type interface and can select the type of interfaces depending on the network configuration. The number of interfaces can be optionally managed depending on the capacity and the required bandwidth of Smart MBS. The interface types supported are specified in table below. CDMA LTE Interface Type 100/1000 Base-T(RJ-45) 1000 Base-SX/LX(SFP) 100/1000 Base-T(RJ-45) 1000 Base-SX/LX(SFP) Number of port per each board 1 1 2 2 To enable transport of multiple technologies over a single backhaul network connection, the following features are supported. Scheme to separate network per Radio Access Network (RAN) technology Scheme to assign different VLAN ID per each RAN technology, and separate it into different logical NW. QoS Feature Ethernet CoS and DiffServ feature Minimal Traffic interference between RAN technology Traffic shaping feature per each RAN technology For Cell Sites with Smart MBS, in some cases, Cell Site Router (CSR) is mounted within the auxiliary space within the Smart MBS cabinet. In this case, backhaul interface aggregation is provided by CSR. Ethernet interface is static link aggregation based on 802.3ad (static), and multiple links are operated. The interface for general user traffic is shared to provide the interface for operation and maintenance, and is operated as in-band method. SAMSUNG Electronics Co., Ltd. 2-25 CHAPTER 2. Smart MBS Abstract This page is intentionally left blank. 2-26 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description CHAPTER 3. Smart MBS Structure 3.1 Smart MBS Hardware Structure Smart MBS is designed in a divided architecture that consists of UADU (digital unit) and LRU (combined RF module). UADU and LRU can be mounted on 19 inch outdoor cabinet. The configuration of Smart MBS is as follows:

SAMSUNG Electronics Co., Ltd. 3-1 CHAPTER 4. Smart MBS Structure Lamp switch Door switch LRU PDPU-O2C Rectifier PDPU-OC PDPU-O2E UADU #1 UADU #0 I/O module Fire sensor Lamp ECM/FCM L9FU L9VU Membrane filter FANM-G2 Membrane filter FANM-G2 Surge Protector L9FU L9VU LRU PDPU-O2C PDPU-OC PDPU-O2E ECM/FCM FANM-G2 UADU LTE eNB Filter Unit LTE eNB transceiver Unit Local Radio Unit Power Distribution Panel Unit-O2C Power Distribution Panel Unit-OC Power Distribution Panel Unit-O2E Environment Control Module/Fan Control Module Fan Module-G2 Universal Platform Digital Unit Figure 3.1 Smart MBS Configuration 3-2 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 Up to two UADUs can be mounted on the outdoor cabinet, and Smart MBS can be configured depending on the capacity as follows:

L9VU L9VU L9VU Blank Blank Blank LRU UADU #1 UADU #0 Blank L9CA-A2P CICA-D2 UAMA-A21 CIMA-A2 CDMA: 3 Carrier/3 Sector LTE: 1 Carrier/3 Sector L9CA-A2P CICA-D2 UAMA-A21 CIMA-A2 LTE eNB Channel card board Assembly-type A2P CDMA IP Channel card board Assembly-type D2 Universal platform Management board Assembly-type A21 CDMA Management board Assembly-type A2 Figure 3.2 CDMA/LTE 3Sector Configuration CDMA/LTE Multi Mode configuration CDMA/LTE Multi mode configuration is only supported in the first UADU position(UADU #0). When CDMA and LTE boards are simultaneously mounted, CIMA-A2 is mounted at main board location. SAMSUNG Electronics Co., Ltd. 3-3 CHAPTER 4. Smart MBS Structure L9VU L9VU L9VU L9VU Blank Blank LRU UADU #1 UADU #0 LRU UADU #1 UADU #0 Blank Blank CICA-D2 CIMA-A2 L9CA-A2P CICA-D2 UAMA-A21 CIMA-A2 CDMA: 3 Carrier/1 Sector CDMA: 3 Carrier/3 Sector LTE: 1 Carrier/4 Sector Figure 3.3 CDMA/LTE 4 Sector Configuration L9VU L9VU L9VU L9VU L9VU L9VU Blank Blank CICA-D2 CIMA-B L9CA-A2P CICA-D2 UAMA-A21 CIMA-B CDMA: 3 Carrier/3 Sector CDMA: 3 Carrier/3 Sector LTE: 1 Carrier/6 Sector Figure 3.4 CDMA/LTE 6 Sector Configuration 3-4 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 3.1.1 Internal Configuration of System (CDMA) Below are the internal configuration diagrams of the Smart MBS for CDMA service. L R U

(0) L R U

(1) L R U

(2) L R U

(3) L R U

(4) L R U

(5) GPS Rectifier Modules UADU CIMA-A2 FPGA

(CPRI) Power

(27 VDC) CICA-D2 #2 CICA-D2 #1 CICA-D2 #0 UCCM CPU Network Processor Ethernet Switch FE/GE BSC FPGA Combiner CPU Ethernet Switch Modem Index Data Traffic + Alarm/Control(Ethernet) Baseband I/Q and C & M(Optic) Power Clock Backhaul Alarm/Control Figure 3.5 Internal Configuration of System (CDMA) SAMSUNG Electronics Co., Ltd. 3-5 CHAPTER 4. Smart MBS Structure User Traffic Transmit path When user data is received from the BSC via the public network, it is routed through the network interface module and sent to the CICA-D2, which is a channel card, via the Ethernet Switch of the CIMA-A2. The data which is transmitted to the CICA-D2 is digitally processed, and is converted to Baseband I/Q and C & M format which is configured based on CPRI interface undergo Electrical to Optic(E/O) conversion. The converted data is transmitted to LRU via optic cable. The LRU converts the received optical data into Optic to Electrical (O/E). The converted baseband signal is then converted to an analog signal, and amplified. The amplified signal is band pass filtered and transmitted to antenna. Receive Path The RF signal is received, filtered and amplified via the LNA in the LRU. The signal is converted into the baseband signal by RF down-conversion and digital down conversion. This signal is Baseband I/Q and C & M format which is configured based on the CPRI interface, and is converted into E/O again. The converted signal is transmitted to CICA-D2 via CIMA-A2 through optic cable. In CICA-D2, this signal is converted to Ethernet frame after CDMA basebnad signal processing, and transmitted to CIMA-A2 again. The data is routed through the network interface module of CIMA-A2 and transmitted to the BSC. Clock The UCCM in the CIMA-A2 receives the GPS signal from the external GPS antenna. The UCCM converts the GPS signal to a synchronization clock signal and distributes it to the hardware modules in the system. When CIMA-A2 is configured for LTE, the clock signal is provided to the LTE digital boards. CIMA-A2 provides 10 MHz, PP2S, and System Frame Number (SFN) to each slot via the backplane. The boards which are mounted on the UADU use the clock signal to generate their internal clocks. Alarm CDMA alarms are generated on the CIMA-A2. CIMA-A2 collects alarms from the Smart MBS and reports them to the system. It can also provide a board reset if necessary. The LRU uses the CPRI optical interface to exchange alarm and control signals with the CIMA-

A2. 3-6 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 3.1.2 Internal Configuration of System (LTE) Below are the internal configuration diagrams of the Smart MBS for LTE service. L R U

(0) L R U

(1) L R U

(2) L R U

(3) L R U

(4) L R U

(5) GPS Rectifier Modules UADU L9CA-A2P #2 L9CA-A2P #1 L9CA-A2P #0 FPGA

(CPRI) Modem Power

(27 VDC) ECM UAMA-A21 Main Processor Index UCCM Ethernet Switch FE/GE EPC Analog 10 MHz 1 pps Data Traffic + Alarm/Control(Ethernet) Baseband I/Q and C & M(Optic) Power Clock Backhaul Alarm/Control Figure 3.6 Internal Configuration of System (LTE) Rectifier Rectifier is mounted inside the outdoor cabinet with UADU. Smart MBS interfaces with rectifier via ECM. SAMSUNG Electronics Co., Ltd. 3-7 CHAPTER 4. Smart MBS Structure User Traffic Transmit Path When User Data is received from EPC via public network, it goes through network interface module, and sent out to L9CA-A2P via ethernet switch. the transmitted data goes through digital processing of the baseband level, then converted to E/O

(Electrical to Optic) in form of Baseband I/Q and C & M interface which is based on CPRI interface. The converted signal is then sent out to LRU. LRU converts the received optic signal via O/E (Optic to Electrical) process. The converted broadband baseband signal is then converted to analog signal, and goes through amplifier for amplification. The amplified signal is then filtered through the band pass filter of the operating frequency, and transmitted from antenna. Receive Path The RF signal that was transmitted from Antenna is filtered by LRU, and amplified via LNA. This signal then goes through RF down-conversion and digital down-conversion to be converted into baseband signal. This signal is in form of Baseband I/Q and C &

M interface which is based on CPRI interface, and goes through E/O (Electrical to Optic) conversion once again. The converted signal is then sent to remote L9CA-A2P via fiber optic cable. After the data goes through OFDMA signal processing in L9CA-

A2P, it is converted into Gigabit Ethernet frame, and sent to EPC via network interface module. Clock UCCM of UAMA-A21 receives reference signal from GPS, and generate PP2S, Digital 10 MHz, SFN, and distribute them into L9CA-A2P in the system. L9CA-A2P then receives PP2s, Digital 10 MHz clock. It should use its own PLL to generate system clock (30.72 MHz), CPRI Reference Clock (122.88 MHz), and 10msec clock to distribute it to LRU. When UADU interworks with LRU, LRU receives the necessary system clock and sync clock that are required for CPRI interface, from L9CA-A2P. If LTE board is mounted UADU identical to CDMA, it is supplied the clock for operation from CIMA-A2 Alarm UAMA-A21 collects the alarm from Smart MBS, and reports it to upper layer, and can provide board reset. ECM is the module which is mounted on the inside of outdoor cabinet, collects the outdoor cabinets environmental alarm and battery monitoring information, and report to UAMA-

A21. LRU uses CPRI interface to exchange alarm and control signal with UAMA-A21. 3-8 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 3.1.3 UADU UADU provides OAM for Smart MBS, interworking with BSC(CDMA)/EPC(LTE)/LRU, and communication paths between various functional blocks within the system. UADU receives synchronization signal from GPS, creates signals for system synchronization (such as reference clock, Even, SFN, and supply synchronization signals to lower hardware blocks. UADU interfaces with LRU to exchange data/control traffic and also executes signal processing for subscriber signal. UADU can receive alarm from external devices (such as LRU, lower module, rectifier, or battery) and also provide interface/features to control these external devices. On the downlink, UADU receives traffic/control signal from the BSC/EPC, converts into optical signal via Baseband I/Q and C & M converter and sends it to the LRU for sending it over the air to the mobile terminal. On the uplink, UADU receives the Baseband I/Q and C & M signal from the LRU, demodulates it and sends it to the BSC/EPC. Main functions of UADU are as follows:

Baseband Signal processing (Modem) Fast Ethernet/Gigabit Ethernet interface with BSC/EPC Diagnosis, collection, and control of Alarm Alarm Reporting Feature Reference clock generation and distribution Management of Channel Resources Supporting interfacing with the LRU and loopback test Providing UDA and UDE function, and interfacing with external devices FANM

-C4 FANM

-C4 FANM

-C4 L9CA-A2P CICA-D2 UAMA-A21 CIMA-A2

[CDMA + LTE Multi Mode]

Blank Blank CICA-D2 CIMA-A2 L9CA-A2P CICA-D2 UAMA-A21 CIMA-A2

[CDMA + LTE Multi Mode(Two UADUs)]

Figure 3.7 UADU Configuration SAMSUNG Electronics Co., Ltd. 3-9 CHAPTER 4. Smart MBS Structure Board Name UADB Quantity

(Count) 1 CIMA-A2 1 UAMA-A21 1 CICA-D2 Max. 3 L9CA-A2P Max. 3 FANM-C4 1 Function Universal platform Digital Backboard

- UADUs backboard

- Handles Signal routing for Traffic, Control, Signal, Clock, and Power. CDMA Management board Assembly-type A2

- System management processor for CDMA

- Resource Assignment, OAM

- Alarm Collection, and report to BSM

- Backhaul Support (GE/FE) for CDMA

- Handles UADU FAN alarm

- Provides external environment alarm interface (EAIU4-U Sync)

- Generate and Distribute GPS clock (Sync In & out)

- Provide Loopback test between UADU and LRU. Universal platform Management board Assembly-type A41

- System management, traffic processor for LTE

- Resource Allocation and OAM

- Alarm Collection and LSM Report

- Backhaul Support (GE/FE) for LTE

- Provides non-volatile memory.

- Handles UADU FAN alarm

- Provide external environmental alarm interface (interfacing with ECM)

- Provide UDE and UDA

- Generate and Distribute GPS clock (Sync In & out) CDMA IP Channel card board Assembly-type D2

- CDMA subscriber signal processing

- 1X, 1X Advanced & EVDO Rev.0/A

- Supports simultaneously 1X Adv DL 1,280CE/UL 1,024CE and EV-DO DL 284 CE/UL 284CE per channel card

- Capacity: 4 Carrier/3 Sector(2Br) LTE eNB Channel card board Assembly-type A2P

- Call Processing, Resource allocation, and OAM for LTE

- OFDMA/SC-FDMA Channel Processing

- CPRI interface with LRU

- Provides Loopback test between UADU and LRU

- Capacity: 5 MHz 1 Carrier/6 Sector Fan Module-C4 UADU cooling fan module 3-10 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 CIMA-A2 CIMA-A2 executes function as main processor, GPS signal receiver and clock distributor, and as network interface. Main processor Function CDMA main processor of Smart MBS plays role as the highest layer in the card. It is responsible for communication path configuration between UE and BSC, Ethernet switching functionality for internal Smart MBS and System OAM. It also manages the entire hardware and software status within the Smart MBS, allocates/manages resources, and reports the status information to BSM. Network Interface Function CIMA-A2 directly synchronizes with BSC via Gigabit Ethernet/Fast Ethernet. In case of Ethernet, 1 Optic and 1 copper port are supported. Clock Generation and Distribution CIMA-A2s UCCM generates 10 MHz, Even, and SFN based on the sync signal

(received from GPS) and distributes reference signals to the hardware blocks of the system. The clock also maintains the internal synchronization of Smart MBS for system operation. CIMA-A2 can also provide Analog 10 MHz and 80ms signals for external devices such as measurement equipments. UCCM also provide the Time Of Day (TOD) signals to various blocks in the system. If GPS signal was not received for some reason, UCCM provides holdover feature for a 24Hr time period. Optical interface with LRU and Loopback Test CIMA-A2 exchanges Baseband I/Q and C & M signal with the LRU. CIMA-A2 also performs loopback tests in order to check the interfaces between CIMA-A2 and LRU. Combiner Function CIMA-A2 provides feature that collects digital baseband signals from different channel cards(CICA-D2) and forwards them to the same LRU. On the other hand, it also provides feature to receive digital baseband signal from LRU and distribute it to different channel cards(CICA-D2). UAMA-A21 UAMA-A21 plays role as main processor, GPS signal receiver and distributor, and as a network interface. Main Processor Function UAMA-A21, the main processor (LTE) of Smart MBS plays role as the highest layer. It is responsible for communication path configuration between mobile terminal and EPC, Ethernet switching functionality for internal Smart MBS, and system OAM. Also, it manages entire hardware and software status within the Smart MBS, allocates/manages resources, and collect/report the alarm status information to LSM. Network Interface Function UAMA-A21 is Gigabit Ethernet/Fast Ethernet, and it interfaces with EPC. Depending on the provided interface, UAMA-A21 can be classified as following types, and operator can choose the interface to use. SAMSUNG Electronics Co., Ltd. 3-11 CHAPTER 4. Smart MBS Structure 100/1000 Base-T Copper (RJ-45) 2 Ports 1000 Base-X Small Form factor Pluggable (SFP) 2 Ports External Interface Function UAMA-A21 can provide Ethernet interface for User Defined Ethernet (UDE) within UADU. Via Fast Ethernet interface of UADU, UAMA-A21 can provide paths to external alarm information (such as Rectifier alarm/control, battery monitoring data or UDE/UDA) that is collected by external environmental monitoring device (ECM). This alarm information is then sent to LSM. Clock Generation and Distribution UAMA-A21s UCCM generates 10 MHz, Even, and SFN (System Frame Number) based on the sync signal which was received from GPS, and distributes this to the Hardware block of the system. This clock maintains the internal synchronization of Smart MBS, and used for system operation. Also, UAMA-A21 can provide Analog 10 MHz, 1 PPS signal as support for external devices such as measurement equipments. UCCM can forward time data and location data via TOD Path. If GPS signal was not received for some reason, UCCM provides holdover feature that can maintain the normal clock for specified time period. CICA-D2 CICA-D2 provides following functions. Subscriber Channel Process CICA-D2 handles the baseband signal for CDMA service. CICA-D2 handles CDMA voice and data signal channels. CICA-D2 modulates the packet data (from upper layers), sends it out to CIMA (via backboard) and then to RF. On the other hand, it receives RF data from CIMA, demodulates it and converts it in accordance with the CDMA standard (physical layer standard) and sends it to upper layers for processing. CDMA Service Support CICA-D2 supports IS-95 and CDMA 2000 1X/1X Advanced service. Also, CICA-D3 supports CDMA2000 EV-DO service simultaneously. Clock Generation Feature CICA-D2 receives PP2S, digital 10 MHz clocks from CIMA, generates system clocks of 30.72 MHz and 1.25 ms using its internal PLL circuit and distributes it to internal components (modem and processors). L9CA-A2P L9CA-A2P provides following functions. Subscriber Channel Processing Function L9CA-A2P modulates the packet data (which was received from upper processor), and sends it to RF via CPRI. On the other hand, it demodulates the data received from RF, converts it into the type defined as in LTE Physical layer standard, to send it to upper processor. Optical interface with LRU and Loopback Test L9CA-A2P exchanges Baseband I/Q and C & M signal with the LRU. L9CA-A2P 3-12 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 also performs loopback tests in order to check the interfaces between L9CA-A2P and LRU. Clock Generation Feature L9CA-A2P receives PP2S, Digital 10 MHz clock from UAMA-A21, and generate system clock of 30.72 MHz, CPRI clock 122.88 MHz clock via its own PLL circuit, and distributes them to internal components (Modem, CPRI FPGA). FANM-C4 The UADU of Smart MBS maintains the inside temperature of the shelf at an appropriate range using a system cooling fans (FANM-C4), so that the system can operate normally when the outside temperature of the UADU shelf changes. The cooling structure of the UADU in the Smart MBS is as follows. Figure 3.8 Cooling Structure of the UADU (FANM-C4) SAMSUNG Electronics Co., Ltd. 3-13 CHAPTER 4. Smart MBS Structure 3.1.4 LRU The LRU is the RF part of Smart MBS. The LRU interfaces with UADU via Baseband I/Q and C & M interface, for this, 2.25Gbps CPRI interfaces(Max.2) are provided. The LRU receives clock from UADU, and exchanges alarm/control messages with UADU. Main Functions of LRU are as follows:

High-power amplification of RF transmission signal Interface for traffic, alarm, and control signal by interfacing with the UADUs channel cards(CICA-D2/L9CA-A2P ) in Baseband I/Q and OAM method Upconversion/downconversion of frequency Rx/Tx RF signal from/to an antenna Suppression of out-of-band spurious wave emitted from RF Rx/Tx signal Low noise amplification of band-pass filtered RF Rx signal FDD filtering function for RF Rx/Tx path The LRU is configured as follows:

Board Name L9FU Quantity

(Count) Max. 6 L9VU Max. 6 Function LTE eNB Filter Unit

- AWS band DL: 2,130~2,140 MHz UL: 1,730~1,740 MHz

- LNA function

- Suppression of out-of-band spurious wave emitted from RF Rx/Tx signal LTE eNB transceiver Unit

- Supports CDMA/LTE single mode or multi mode

- Supports 10 MHz 2Tx/2Rx CDMA : 1Tx/2Rx or 2Tx(TDTD)/2Rx operation LTE: 1Tx/2Rx or 2Tx/2Rx operation

- 60 + 60 W(Total 120 W)

- RF Up-conversion/Down-conversion

- RF amplification 3-14 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 The capacity and maximum output of LRU are as follows: (CDMA/LTE FDD) Capacity Quantity Max. RF Path Antenna Output

- CDMA: 3 Carrier/

Max. 6 1 Sector

- LTE: 1 Carrier/

1 Sector @ 5 MHz

- CDMA: 1T2R or 2T2R

- LTE: 1T2R(SIMO) or CDMA Output

- In case of CDMA 1Tx: 24 W/Carrier

- In case of CDMA Tx diversity: 12 +

2T2R(MIMO) 12 W/Carrier(total 24 W/Carrier) LTE Output

- In case of CDMA 1Tx: 12 + 12 W/

Carrier(total 24 W/Carrier)

- In case of CDMA Tx diversity: 24 +

24 W/Carrier(total 48 W/Carrier) In case of downlink signal, LRU receives baseband signal via optical Baseband I/Q and C

& M from channel card(CICA-D2/L9CA-A2P) of UADU, and converts it with O/E (Optic to Electrical). The converted signal is then sent through DAC (Digital to Analog Conversion) to be converted to analog RF signal, and amplified by amplifier.(L9VU) The amplified signal goes through filter and sent to antenna. (L9FU) At this time, the transmit RF power from antenna ports is as follows. In case of uplink signal, the signal is received after it goes through LRUs filter. It is then sent to LNA (Low Noise Amplifier) to change to lower frequency, and goes through ADC (Analog to Digital Conversion) and get converted to baseband signal. This baseband signal is in Baseband I/Q and C & M type. Then, this is converted as E/O, and sent to channel card(CICA-D2/L9CA-A2P) of UADU. Via Baseband I/Q and C & M interface, LRU receives UADU clock information, and exchanges alarm and control messages. SAMSUNG Electronics Co., Ltd. 3-15 CHAPTER 4. Smart MBS Structure 3.1.5 Power Device Power devices of Smart MBS are as follows :

PDPU-O2C Rectifier PDPU-OC PDPU-O2E Figure 3.9 Power Device Configuration Name DC Distribution

(PDPU-Oxx) Quantity

(Count) 1 Function DC Distribution receives DC power from a rectifier and distributes it to UADU, LRU and additional devices.

- PDPU-OC: Supplies the external power(AC 220 V) to rectifier

- PDPU-O2C: Supplies DC power which is supplied from rectifier to LRU

- PDPU-O2E: Supplies DC power which is supplied from rectifier to Rectifier 1 UADU and other devices

- Rectifier module can be mounted up to 10.

- Supplies DC power to system 3-16 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 The figure below shows the power layout indicating the type of the powers and their connection points:

AC 220 V PDPU-OC INPUT OUTPUT RECTIFIER 27 V(DC1) PDPU-O2E DC0 DC1 DC2 DC3 DC4 DC5 DC6 DC7 UADU #0 UADU #1 FCM SPARE SPARE SPARE ECM LAMP AC 220 V OUTLET/HEATER 27 V(DC2) 27 V(DC3) PDPU-O2C RU0 RU1 RU2 RU3 RU4 RU5 L9VU #0 L9FU #0 L9VU #1 L9FU #1 L9VU #2 L9FU #2 L9VU #3 L9FU #3 L9VU #4 L9FU #4 L9VU #5 L9FU #5 L V D Note.

- LVD: Low Voltage Disconnect device

- All fans are connected to FCM External Battery Figure 3.10 Power Structure Input power(220 VAC) is supplied to outlet via AC box, and converted +27VDC via rectifier. This +27VDC is supplied to DC distribution(PDPU-O2C, PDPU-OC, PDPU-

O2E), and the required voltage is distributed via circuit breaker of each DC SAMSUNG Electronics Co., Ltd. 3-17 CHAPTER 4. Smart MBS Structure 3.1.5 Environment Devices Environment devices are mounted on as figure below. Fire sensor ECM/FCM Door Sensor Membrane filter FANM-G2 Membrane filter FANM-G2 Temperature Sensor Flood Sensor Figure 3.10 Configuration of Environment Devices Name Quantity Function ECM 1

- Collects environment data through environment sensor inside of FCM FANM-G2 outdoor cabinet

- Monitoring the environment of rectifier

- Reports the alarm to upper system via UADU

- System cooling control device

- Fan control connecting with temperature sensor

- Reports alarm to ECM

- System cooling fan

- There are each 2 FANM-G2s to front door and rear door. 1 4 3-18 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0

(Continued) Name Quantity Function Membrane Filter Sensor 2 5 Protect the system from dust, water, etc.

- Fire sensor(1): Detects whether a fire break out.

- Door sensor(1): Detects whether door opens or close.

- Temperature sensor(2): Detects whether the temperature of system maintains within operation condition.

- Flood sensor(1): Detects whether the system is flooded. SAMSUNG Electronics Co., Ltd. 3-19 CHAPTER 4. Smart MBS Structure 3.1.6 Interface structure Following is each unit and boards external interface of the Smart MBS. UADU CIMA-A2 UDE0 UDE0

(RJ-45, FE/GE)

(RJ45, FE/GE) UDE1 UDE1

(RJ-45, FE/GE)

(RJ45, FE/GE) Debug

(USB, RS-232) Main Processing

(RET Control) GPS Receiver Backhaul E/O, O/E Conversion Channel Combining Network Processor

(Packet Routing) CICA-D2 Debug

(RS-232) Baseband Processing Power Filter & Distribution Figure 3.11 Hardware Interface structure of UADU (CDMA) GPS Antenna A10 M(10 MHz out) Sync(80 ms) CLK0(Clock in) CLK1(Clock out) Backhaul

(RJ-45, FE/GE) Backhaul

(SFP, GE) Baseband I/Q and C & M(Optic) from/to LRU 3-20 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 External Interface of CIMA-A2 Interface Type Connector Type Quantity Description UDE Debug GPS In Ref. Clock Out CLK0 CLK1 Copper Backhaul Optic Backhaul CPRI Reset LED RJ-45 USB SMA SMA SMA

-

-

RJ-45 SFP Optic Reset LED External Interface of CICA-D2 2 2 1 1 1 1 1 1 1 6 1 2 UDE(100/1000 Base-T) UART CPU/GPS GPS Input(to UCCM) Analog 10 MHz 80 ms Clock In Clock Out 100/1000 Base-T 1000 Base-LX/SX LRU Interface(CPRI 4.0) System reset SYS, GPS Interface Type Connector Type Quantity Description Debug Reset LED USB Reset LED 2 1 1 UART Debug Board reset SYS SAMSUNG Electronics Co., Ltd. 3-21 CHAPTER 4. Smart MBS Structure UDE0(RJ-45, FE/GE) UDE1(RJ-45, FE/GE) Rectifier Interface

(RJ-45, RS-485) Open/Short for UDA

(Champ, Rx: 9, Tx: 2) Debug(RJ-45) Debug(USB) Debug(RJ-45) Debug(USB) UADU UAMA-A21 Main Processing &

External Alarm

(RET Control) L9CA-A2P GPS Receiver Backhaul Baseband Processing Power Filter & Distribution GPS Antenna A10 M(10 MHz out) 1PPS(1PPS out) CLK0(Clock in) CLK1(Clock out) Backhaul

(RJ-45, FE/GE) Backhaul

(SFP, GE) Baseband I/Q and C & M from/to LRU

+27 VDC Input Figure 3.12 Hardware Interface structure of UADU (LTE) External Interface of UAMA-A21 Interface Type Connector Type Quantity Description UDE Rectifier IF UDA Debug GPS In Ref. Clock Out RJ-45 RJ-45 Champ RJ-45 USB SMA SMA SMA

-

-

CLK0 CLK1 Copper Backhaul RJ-45 Optic Backhaul Reset LED SFP Reset LED 2 1 1 1 1 1 1 1 1 1 2 2 1 2 UDE(100/1000 Base-T) RS-485 1 port User Defined Alarm(Rx: 9 port, Tx: 2 port) 100/1000 Base-T UART CPU GPS Input(to UCCM) Analog 10 MHz 1PPS Clock In Clock Out 100/1000 Base-T 1000 Base-LX/SX System reset SYS, GPS 3-22 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 External Interface of L9CA-A2P Interface Type Connector Type Quantity Description Debug CPRI Reset LED LRU 2Tx/Rx Ports to/

from Antenna RJ-45 USB Copper Reset LED 1 2 6 1 1 100/1000 Base-T UART DSP Debug LRU IF(CPRI 4.0) Board reset SYS RF Processing

(Transceiver/PA/Filter) Baseband I/Q and C & M Path(FPGA) Power Module Figure 3.13 Hardware Interface structure of LRU-C2 External Interface of LRU Interface Type Connector Type Quantity Description Antenna CPRI CPRI DC Power N-type female Copper Optic

-

2 1 1 1 2Tx2Rx CDMA UADU interface LTE UADU interface

+27 VDC Baseband I/Q and C & M(Optic) from/to UADU

+27 VDC Input SAMSUNG Electronics Co., Ltd. 3-23 CHAPTER 4. Smart MBS Structure 3.2 Smart MBS Software Structure 3.2.1 CDMA Software Structure CDMA software block of Smart MBS consists of application(Call Processing, OAM) and common software (system software and IP software). Smart MBS Application Call Processing OAM Common Software System Software IP Software LINUX Hardware Figure 3.14 CDMA Software Structure 3.2.1.1 Application Call Processing CDMA Call Processing software is composed of call processing software blocks of CDMA BTS and BSC (PCF). It is also responsible for connecting mobile terminal and IP network. On each NE, there are signal-processing software block and bearer-processing software block. In case of BTS, there are signal-processing BTS Resource Control (BRC) and DO Resource Handler (DRH), and bearer-processing DO channel Element Controller (DEC) and Channel Element Control (CEC). Call Processing 1X 1xEV-DO BRC CEC DRH DEC Figure 3.15 CDMA Call Processing Software Structure 3-24 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 BRC Allocates and manages internal and air resources in the BTS for 1X call establishment and maintenance. Processes signal messages related with BSC and 1X call establishment and release. Handles overhead channel configuration/release and operation; overhead message configuration and transmission. Operates the FSCH scheduler and performs RSCH rate decision. CEC Transfers messages related with allocation/release of the traffic and overhead channel from BRC to DSP, and handles message received from DSP. It also transfers messages received through the access channel to BRC. Transfers the forward voice/packet traffic received from SDU to DSP, and the reverse voice/packet traffic received from DSP to SDU. DRH Allocates and manages internal and air resources in BTS for EV-DO calls. Allocates wireless resources (e.g., Frequency and CE), link and frame offset, using information shared with the OAM for resource allocation/release requests from BSC. DEC Handles air interface with mobile terminal, and operates a channel card to handle EV-DO Rev.0/A physical layer and part of MAC layer. Decides whether to provide QoS service based on the air resources available for allocation per flow during QoS call establishment. OAM OAM of Smart MBS consists of Operating Processing (OP), and Maintenance Processing

(MA). OAM Software OP MP Configuration Loading Statistics UI Status Alarm Diagnosis Figure 3.16 CDMA OAM Software Structure SAMSUNG Electronics Co., Ltd. 3-25 CHAPTER 4. Smart MBS Structure OP OP is classified into Configuration, Loading, Statistics, and UI blocks. Configuration: Mounted on the BTS main processor, the configuration block controls the BTS startup flow according to information from the static database PLD, and controls reconfiguration when the configuration is changed. It also provides initialization information to the BTS processors and devices. The block receives configuration control information requested by the operator to update the information in PLD and provides configuration changes to the relevant blocks. Loading: For system operation, the operator is provided with the basic restart function to initialize the entire BTS or some of its processor boards or devices, if necessary. The operator can reload software by restarting the entire BTS or some of its processor boards or devices using this function. It also provides the online firmware update function and inventory management function for various boards in BTS. Statistics: The BTS Performance Measurement and Statistics function traces and records all meaningful events occurring in BTS, such as real-time call status by type or usage frequency of the BTS interface trunk, to provide information for status checks, maintenance, and performance evaluation of the system. UI: Provides the main, command and message UI as well as the dedicated UI per OAM function, such as expansion/reduction, statistics, faults and status UI. MP MP provides OAM feature in conjunction with Call Software, OP, and Common Software. Status: Detects, collects and analyzes the BTS processor, device or link status, and reports to call processing and other sub-systems to ensure the normal system operation. It also reports to the operator to take relevant actions. The operator can view the report as a response to a command or in graphic format. Faults: Detects, collects and analyzes all hardware and software faults occurring in BTS, and reports to the operator to take relevant actions. Faults are detected by the diagnostic and maintenance function, and graded according to the impact on the service, to notify the operator in forms of messages or graphics. Diagnosis: Detects faults in the various devices by testing the BTS links and devices and reports the status and faults for relevant actions to be taken. 3-26 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 3.2.1.2 Common Software Common Software consists of System software (which consists of Operating System, Middleware, and Device Driver), and IP software (which handles IP routing and Traffic) Common Software System Software IP Software OS MW D/D IPRS PPPD NPS Figure 3.17 CDMA Common Software Structure System Software OS Controls resource initialization of the hardware and software, and allows the application software to control hardware/software resources. Allows the application software to use the file systems, libraries and tools. Uses Linux 2.6.2x kernel, booter and the Root File System (RFS). MW messages. address. Provides services required for the application software to send and receive various Retrieves debugging information of the application software and relays commands. Provides functions to create, terminate, control and retrieve tasks. Handles hardware-dependent functions, such as access to hardwares physical Adds and manages various events, such as timers, and sends the events to relevant locations when needed. D/D Controls the Gigabit Ethernet Switch in BTS, and supports Layer 2 switching, link aggregation, VLAN, VLAN tagging, jumbo-frame support, flow control and QoS. Controls the CPRI block for communications between CIMA-A2 and LRU. SAMSUNG Electronics Co., Ltd. 3-27 CHAPTER 4. Smart MBS Structure IP Software Inter-Protocol Routing System (IPRS) Manages and sends to relevant protocols information, such as the interface IP address, static route and link aggregation settings. Provides firewalls and QoS using the Access Control List (ACL). Manages link aggregation settings information in accordance with IEEE 802.3ad. PPP Daemon (PPPD) Transmits link configuration packets, termination packets at link termination, and link maintenance packets. Manages data losses regarding packet drops caused by link noise, equipment failure and buffer overrun problems. Transmits configuration, enabling and disabling packets on the network layer used to send/receive IP packets. Network Processor System (NPS) Initialization, setup and management of all network processor (NP) devices, including initialization of NP devices in BTS, functional setup of the NP, establishment of the IP address and UDP port mapping table, status control, and statistics collection. 3-28 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 3.2.2 LTE Software Structure LTE eNB software is composed of Kernel Space (OS/DD), Forwarding Space (Network Processing Control, Network Processing), and User Space (IPRS, CPS, OAM, MW). Detailed description for each of components is shown below. IPRS IPRS IPSS User Space CPS ECMB GTPB ECCB PDCB SCTB RLCB OAM PM FM CM SNMP SwM TM/TrM DHCP CSAB MACB OSAB WEB/CLI MW THS MFS MDS DUS HAS ENS Kernel Space OS DD Forwarding Space NP Control NP Hardware Figure 3.18 LTE Software Structure 3.2.2.1 Kernel Space OS OS can initialize and control hardware devices, and allows software to operate on hardware devices. It is composed of Booter, Kernel, RFS, and Utility. Booter: It is a module that is responsible for initialization of board. It performs initialization of CPU, L1/L2 Cache, UART, MAC. Also, initialization of CPLD, and RAM devices are managed. Finally, u-boot is executed here. Kernel: It provides various primitives to efficiently utilize the limited resources, and manages the various software processes. RFS: Store and manage Binary, Library, and configuration files, which are required for software execution and operation, according to FHS (File-system Hierarchy Standard 2.2) standard. SAMSUNG Electronics Co., Ltd. 3-29 CHAPTER 4. Smart MBS Structure Utility: Provides feature to manage CPLD, LED, Watchdog, Environment and Inventory data management, CPU load measurement/display, and Fault data store in case of Processor Down. DD Device Driver allows Application to operate normally for particular devices which are not controlled by OS. It is composed of Physical Device Driver and Virtual Device Driver. Physical Device Driver: Provides interface where upper application can configure/

control/monitor hardware device which are outside of processor. (such as Switch Device Driver, or Ethernet MAC Driver) Virtual Device Driver: Abstract the physical network interfaces on Kernel, and allow upper application to control this abstracted interface rather than directly controlling the physical network interface. 3.2.2.2 Forwarding Space Network Processing Control (NPC) Network Processing Control interfaces with upper process (such as IPRS, and OAM) to create/manage various tables which are required for packet process. And it collects Network performance, and performs status management. Network Processing (NP) Network Processing is software that processes packet which is required for backhaul interface. It performs the following feature. Packet RX and TX Packet queuing and scheduling MAC filtering Link aggregation VLAN termination ACL IP Packet forwarding IP fragmentation and reassembly IPv4 and IPv6 3-30 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 3.2.2.3 User Space IP Routing Software (IPRS) IPRS is software that provides IP Routing and IP Security function in regards to eNB Backhaul. It is composed of IPRS, IP Security Software (IPSS), Dynamic Host Configuration Protocol (DHCP), and each function executes following feature. IPRS: Provides function to collect/manage System Configuration required for IP Routing, and generate Routing Data based on this information. Ethernet, VLAN-TE, Link Aggregation management feature Ethernet OAM Feature IP Address Management Feature IP Routing Data Management Feature QoS Management Feature IPSS: It is software that performs security for IP layer, and provides the filtering function based on IP Address, TCP/UDP port number and protocol type. DHCP: DHCP is software block that executes automatic IP address assignment, and provides the interfaces with DHCP server to automatically obtain IP. Call Processing Software (CPS) CPS is software subsystem which executes call processing in LTE eNB. It interfaces with mobile terminal, and EPC. CPS is responsible for data transmission in order to provide wireless data service such as MAC scheduling, air link control, ARQ processing, S1, and X2 message processing. eNB Common Management Block (ECMB) Setting/Releasing cell Transmitting the system information eNB overload control (according to the CPU load) Access barring control (controlling access barring parameters sent to SIB2) Resource measurement control (status measurement control of eNB resources such as PRB usage and PDB) Cell load information transmission (acting as the interface for the ICIC function, X2 load information message transmission between eNBs) eNB Call Control Block (ECCB) Radio resource management Idle to Active state transition Setting/changing/releasing bearer Paging MME selection and load balancing Call admission control Security function Handover control UE measurement control SAMSUNG Electronics Co., Ltd. 3-31 CHAPTER 4. Smart MBS Structure Stream Control Transmission protocol Block (SCTB) S1-C interfacing X2-C interfacing CPS SON Agent Block (CSAB) Mobility robustness optimization RACH optimization GPRS Tunneling Protocol Block (GTPB) GTP tunnel control GTP management GTP data transmission PDCP Control Block (PDCB) Header compression and decompression: ROHC only User and control plane data transmission PDCP sequence number maintenance DL/UL data forwarding at handover Ciphering and deciphering user data and control data Integrity protection for control data Timer based PDCP SDU discard Radio Link Control Block (RLCB) Transmission for upper layer PDU ARQ function used for AM mode data transmission RLC SDU concatenation, segmentation and reassembly Re-segmentation of RLC data PDUs In sequence delivery Duplicate detection RLC SDU discard RLC re-establishment Protocol error detection and recovery Medium Access Control Block (MACB) Mapping between the logical channel and the transport channel Multiplexing & de-multiplexing HARQ Transport format selection Priority handling between mobile terminals Priority handling between logical channels of one mobile terminal 3-32 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 Operation And Maintenance (OAM) For interface with LSM and Web-EMT, OAM provides standardized interface (SNMPv2c, SNMPv3, SFTP, HTTPs, or SSH) with improved security. Also, for OAM of LTE eNB, it performs call processing, collects performance data, manages system configuration and resource, manages software/hardware resources, manages alarm, and performs diagnosis. Detailed functions handled by the OAM are:

OAM SON Agent Block (OSAB) Self-configuration and self-establishment of system information Automatic Neighbor Relation optimization Energy saving management Performance Management (PM) Statistics collection Statistics storage Statistics transmission Fault Management (FM) Fault detection and alarm reporting Alarm retrieval Alarm filtering Alarm severity setting Alarm threshold setting Alarm correlation Configuration Management (CM) View and change configuration information SNMP (Simple Network Management Protocol) Interface with SNMP Manager Software Management (SwM) Download and installation of software and data files Hardware unit and system reset Monitoring the status of software unit in operation Software and firmware information management and update Software upgrade Inventory management Test Management (TM) Setting/Releasing OCNS Setting/Releasing MODEL PING test Tx/Rx output measurement Antenna VSWR measurement Trace Management (TrM) Call trace Call Summary Log (CSL) SAMSUNG Electronics Co., Ltd. 3-33 CHAPTER 4. Smart MBS Structure Web-based Element Maintenance Terminal (Web-EMT) Web server Interoperation with other OAM blocks to process commands CLI (Command Line Interface) CLI user management Command input and result output Fault/Status message output Middleware (MW) MW allows smooth communication between OS and Application under various hardware environments. For such purpose, it provides message delivery service, debugging utility service, event and notification service between applications. Also, it provides high availability service, task handling service for redundancy and data backup. Message Delivery Service (MDS): Provides entire service relating to sending and receiving messages. Debugging Utility Service (DUS): Provides function to send debugging data and commands between Application and User. Event Notification Service (ENS): Provides function to register various events (such as timer, etc), manage events, and send event message to target when necessary. High Availability Service (HAS): Provides Data synchronization and redundancy state management. Miscellaneous Function Service (MFS): Manages miscellaneous hardware-dependable functions. (such as accessing hardwares physical address) Task Handling Service (THS): Provides function to generate/termina7te, or display Task. 3-34 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description CHAPTER 4. Message Flow 4.1 Call Processing Message Flow 4.1.1 CDMA Call Processing Message Flow This chapter describes the call processing message flow of CDMA2000 1X and 1xEV-DO. SAMSUNG Electronics Co., Ltd. 4-1 CHAPTER 5. Message Flow 1X voice call origination The following shows the message flow of 1X voice call origination procedure. MS BTS BSC WSS 1) Origination Message 2) BS_ACK_Order 5) Resource Allocation 6) Null Traffic 7) Extended Channel Assignment 8) Reverse Pilot 9) BS Ack Order 10) MS Ack Order 11) Service Negotiation 12) Service Negotiation Complete 3) CM Service Request 4) Assignment Request 13) Assignment Complete Figure 4.1 1X voice call origination 4-2 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 Step 1)-2) 3) 4) 5) 6) 7) 8) 9)-10) 11)-12) 13) Description When the Mobile Station (MS) sends a origination message, the BTS transmits the message to the BSC and the BS ACK Order as a message acknowledgement response to the MS. Upon the reception of the message, the BSC requests Connection Management (CM) service to the WSS. The WSS performs the authentication for the corresponding UE and requests resource allocation to the BSC. Then, the resources such as the channel for the voice call are allocated. The BTS transmits the null traffic to the MS to allow the MS to detect the traffic channel easily. The BTS transmits the null traffic to the MS to allow the MS to detect the traffic channel easily. Through this message, the MS acknowledges that the BTS transmits the traffic channel. The MS notifies the BTS its message reception through the reverse pilot. The BTS and the MS transmit and receive response messages to check the traffic path between the BSS and the MS. If necessary, the BTS and the BSC perform service negotiation with the MS. The BSC notifies the WSS that the call is set up normally. SAMSUNG Electronics Co., Ltd. 4-3 CHAPTER 5. Message Flow 1X voice call termination The following shows the message flow of 1X voice call termination procedure. MS BTS BSC WSS 2) Paging Request 3) Paging Response 4) BS_ACK_Order 1) Paging Request 5) Paging Response 6) Assignment Request 7) Resource Allocation 8) Null Traffic 9) Extended Channel Assignment 10) Reverse Pilot 11) BS Ack Order 12) MS Ack Order 13) Service Negotiation 14) Service Negotiation Complete 15) Assignment Complete Figure 4.2 1X voice call termination 4-4 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 Step 1)-2) 3) 4)-6) 7) 8) 9) 10) 11)-12) 13)-14) 15) Description When the WSS requests paging to the BSC, the BSC transmits paging signal to the MS through the BTS. When the MS receives a paging signal, it sends the response for the signal to the BTS. The BTS transmits a paging response message of the MS to the BSC and a message acknowledgement response to the MS. Upon the reception of the message, the BSC transmits the paging response message to the WSS and the WSS requests resource allocation to the BSS depending on call process. Then, the resources such as the channel for the voice call are allocated. The BTS transmits the null traffic to the MS to allow the MS to detect the traffic channel easily. The BTS transmits the null traffic to the MS to allow the MS to detect the traffic channel easily. Through this message, the MS acknowledges that the BTS transmits the traffic channel. The MS notifies the BTS its message reception through the reverse pilot. The BTS and the MS transmit and receive response messages to check the traffic path between the BSS and the MS. If necessary, the BTS and the BSC perform service negotiation with the MS. The BSC notifies the WSS that the call is set up normally. SAMSUNG Electronics Co., Ltd. 4-5 CHAPTER 5. Message Flow 1X packet data call origination The following shows the message flow of 1X packet data call origination procedure. MS BSS WSS PDSN 1) Origination Message 2) CM Service Request 3) Assignment Request 4) Channel Assignment 5) Service Negotiation 6) Registration Request 7) Registration Reply 8) Assignment Complete Figure 4.3 1X packet data call origination Description When the MS transmits an outgoing message, the BSS requests the connection control to the WSS. The WSS performs the authentication for the corresponding UE and requests resource allocation to the BSS. Then, the BSS allocates resources to the MS. If necessary, the BTS and the BSC perform service negotiation with the MS. Configure the PDSN and R-P interface. When the R-P interface is configured, the BSS notifies the WSS that the call is set up normally. Step 1)-2) 3)-4) 5) 6)-8) 4-6 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 1X packet data call termination The following shows the message flow of 1X packet data call termination procedure. MS BSS WSS PDSN 5) Paging Message 6) Paging Response 9) Channel Assignment 1) PPP Framed IP Packet 2) BS Service Request 3) BS Service Response Request 4) Paging Request 7) Paging Response 8) Assignment Request 10) Registration Request 11) Registration Reply 12) Assignment Complete Figure 4.4 1X packet data call termination Description The IP packet in PPP is transmitted from the PDSN. The BSS requests a call service to the WSS and the WSS requests paging to the BSS. The BSS transmits a paging signal to the MS. When the MS transmits a paging response message to the BSS, the BSS relays the message to the WSS. Upon the reception of the message, the WSS requests resource allocation to the BSS. Then, the BSS allocates resources for the packet data call. If necessary, it performs service negotiation. Step 1) 2)-5) 6)-8) 9) 10)-12) Configure the PDSN and R-P interface. When the R-P interface is configured, the BSS notifies the WSS that the call is set up normally. SAMSUNG Electronics Co., Ltd. 4-7 CHAPTER 5. Message Flow 1X voice call soft handoff The following shows the message flow of 1X voice call soft handoff. MS Source BTS Target BTS BSC WSS 1) PSMM 2) BSAck 5) Handoff Direction Message 6) Handoff Completion Message 3) CE Assignment Request 4) CE Assignment Response 7) Handoff Performed Figure 4.5 1X voice call soft handoff Description When the MS is in handoff area, it transmits the Power Strength Measurement Message

(PSMM) to the source BTS and the source BTS relays it to the BSC to determine the type of handoff. The BSC transmits it to Source BTS and the Source BTS transmits it to MS. If the BSC determines the handoff as a soft handoff, it requests new source allocation to the BTS. The target BTS performs channel allocation and transmits the configuration of the allocated channel to the BSC. The BSC transmits a handoff direction message which requests an addition of the target BTS to the MS. When the MS reports a completion message of the process to the BSC, a cell addition is complete. Then, the BSC notifies the result to the WSS. Step 1)-2) 3)-4) 5)-7) 4-8 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 1X call release by MS The following shows the message flow of 1X call release procedure by MS. MS BTS BSC WSS 1) Release Order 4) Release Order 2) Clear Request 3) Clear Command 5) Resource Release 6) Clear Complete Figure 4.6 1X call release by MS Description When the MS requests a call release, the request message is relayed via the BTS and the BSC to the WSS. The WSS transmits the call release order, the BSC forwards the order to the MS through the BTS. Then, the allocated resources for the call are released. The BSC notifies the call release to the WSS. Step 1)-2) 3)-4) 5) 6) SAMSUNG Electronics Co., Ltd. 4-9 CHAPTER 5. Message Flow 1X call release by WSS The following shows the message flow of 1X call release procedure by WSS. MS BTS BSC WSS 2) Release Order 3) Release Order 1) Clear Command 4) Resource Release 5) Clear Complete Figure 4.7 1X call release by WSS Description The WSS transmits the call release order, the BSC forwards the order to the MS through the BTS and receives the response for the order. Then, the allocated resources for the call are released. The BSC notifies the call release to the WSS. Step 1)-3) 4) 5) 4-10 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 1xEV-DO Session setup The following shows the message flow of 1xEV-DO Session setup procedure. MS BTS BSC 1) UATI Request 2) UATI Assignment 3) UATI Complete 4) Connection Request 5) AllocTrafficChReq 6) AllocTrafficChRsp 7) Traffic Channel Assignment 8) Pilot + DRC 9) MobileAcquired 10) RTCAck 11) Traffic Channel Complete 12) Session Negotiation 13) Connection Close Figure 4.8 1xEV-DO Session setup Description When a MS configures a session, it sends a UATI Request message to the BSC and BTS. the BSC and BTS allocate UATI to the MS and prepares for session negotiation and authentication. The session negotiation between the MS and the BSC/BTS is performed. Step 1)-3) 4)-13) SAMSUNG Electronics Co., Ltd. 4-11 CHAPTER 5. Message Flow 1xEV-DO MS authentication and PPP setup The following shows the message flow of 1xEV-DO MS authentication and PPP setup procedure. MS BTS BSC PDSN AN-AAA 1) Connection Request 2) AllocTrafficChReq 3) AllocTrafficChRsp 6) MobileAcquired 4) Traffic Channel Assignment 5) Pilot + DRC 7) RTCAck 8) Traffic Channel Complete 9) PPP, LCP Negotiation and Chap Challenge 12) Chap Authentication Success 15) Establish PPP Session 10) A12-Access Request 11) A12-Access Accept 13) A11-Registration Request 14) A11-Registration Reply Accept Figure 4.9 1xEV-DO MS authentication and PPP setup Step Description 1)-11) 12)-15) Perform the authentication between the MS and the BSC/BTS. The BSC establishes the A10 connection to the PDSN. 4-12 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 Transition to the 1xEV-DO Dormant state The following figure shows the message flow of the transition procedure to the 1xEV-DO dormant state by BSC. MS BTS BSC PDSN 1. Inactivity timer expiration 2. Airlink Lost 3. Keep Alive Timeout 1) Connection Close 2) Connection Close 4) DeallocTrafficChReq 3) A11-Registration Request 6) DeallocTrafficChRsp 5) A11-Registration Reply Figure 4.10 Transition to the 1xEV-DO Dormant state Description If no data transmission or reception occurs for a certain period of time after the data service, a transition to the dormant state occurs, in which the wireless connection is released, but the PPP session is maintained. The transition is processed by sending the BTS disconnection message. The 1xEv-DO base station no longer maintains the connection information; the information is maintained in the BSC and the PPP session is maintained in the PDSN. Step 1)-6) SAMSUNG Electronics Co., Ltd. 4-13 CHAPTER 5. Message Flow Transition from 1xEV-DO Dormant status to the Active state by MS The following figure shows the message flow of transition procedure by MS from 1xEV-DO Dormant status to the Active state by BSC. MS BTS BSC PDSN HRPD Dormant Session 1) Connection Request 3) AllocTrafficChReq 5) AllocTrafficChReq 2) A11-Registration Request 4) A11-Registration Reply 6) Traffic Channel Assignment 7) Pilot + DRC 8) MobileAcquiredInd 9) RTC Ack 10) Traffic Channel Complete Figure 4.11 Transition from 1xEV-DO Dormant status to the Active state by MS Description If there is data to transmit from the MS, the MS requests a connection to the BSC and the wireless connection is re-established from the BTS and the MS. This is the same procedure for a general outgoing call configuration. Step 1)-10) 4-14 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 Transition from 1xEV-DO Dormant status to the Active state by network The following figure shows the message flow of transition procedure by network from 1xEV-DO Dormant status to the Active state by BSC. MS BTS BSC PDSN HRPD Dormant Session 2) Page 1) Transmitting packet data 3) Connection Request 5) AllocTrafficChReq 7) AllocTrafficChReq 4) A11-Registration Request 6) Transmitting packet data 8) Traffic Channel Assignment 9) Pilot + DRC 10) MobileAcquiredInd 11) RTC Ack 12) Traffic Channel Complete Figure 4.12 Transition from 1xEV-DO Dormant status to the Active state by network Step 1)-12) Description If there is data to transmit to the MS, the MS requests a connection to the BSC and the wireless connection is re-established from the BTS and the MS. This is the same procedure for a general outgoing call configuration. SAMSUNG Electronics Co., Ltd. 4-15 CHAPTER 5. Message Flow 1xEV-DO softer handoff The following shows the message flow of 1xEV-DO softer handoff procedure. MS BTS BSC 1) Route Update 2) AllocTrafficChReq 3) AllocTrafficChResp 4) Traffic Channel Assignment 5) Traffic Channel Complete Figure 4.13 1xEV-DO softer handoff Description The MS sends a Route Update message when a new pilot needs to be added to the Active Set. New wireless resources are allocated to the BTS. New Active Set is notified to the MS through the Traffic Channel Assignment message by BTS. The MS responses with a Traffic Channel Complete message. Step 1) 2)-3) 4)-5) 4-16 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 1xEV-DO soft handoff The following shows the message flow of 1xEV-DO soft handoff procedure. MS Target BTS Source BTS BSC 1) Route Update 2) Route Update 2) AllocTrafficChReq 3) AllocTrafficChResp 5) StartDRCLengthTransmission 4) StartDRCLengthTransmission 7) SetRTCMacSoftHOInfo 6) SetRTCMacSoftHOInfo 8) Traffic Channel Assignment 9) Traffic Channel Complete 10) Traffic Channel Assignment 11) Traffic Channel Complete Figure 4.14 1xEV-DO soft handoff Description The MS sends a Route Update message when a new pilot needs to be added to the Active Set. New wireless resources are allocated to the BTS. New Active Set is notified to the MS through the Traffic Channel Assignment message by BTS. The MS responses with a Traffic Channel Complete message. Step 1) 2)-7) 8)-11) SAMSUNG Electronics Co., Ltd. 4-17 CHAPTER 5. Message Flow 4.1.2 LTE Call Processing Message Flow Attach Process The figure below shows the message flow of the Attach procedure. UE eNB MME S-GW EPC 1) Random Access Procedure 2) RRCConnectionRequest 3) RRCConnectionSetup 4) RRCConnectionSetupComplete

(ATTACH REQUEST) 5) Initial UE Message

(ATTACH REQUEST) 6) Authentication/NAS Security Setup 7) Create Session Request 8) Create Session Response 10) UECapabilityEnquiry 11) UECapabilityInformation 13) SecurityModeCommand 14) SecurityModeComplete 9) Initial Context Setup Request

(ATTACH ACCEPT) 12) UE Capability Info Indication 15) RRCConnectionReconfiguration

(ATTACH ACCEPT) 16) RRCConnectionReconfiguration Complete Uplink data Uplink data 18) ULInformationTransfer 17) Initial Context Setup Response

(ATTACH COMPLETE) 19) Uplink NAS Transport

(ATTACH COMPLETE) 20) Modify Bearer Request Downlink data Downlink data 21) Modify Bearer Response Step 1 2-4 Figure 4.15 Attach Process Description The UE performs the random access procedure (TS 36.321, 5.1) with the eNB. The UE initializes the RRC Connection Establishment procedure (TS 36.331, 5.3.3). The UE includes the NAS ATTACH REQUEST message in the RRC INITIAL CONTEXT SETUP REQUEST message and sends it to the eNB. 4-18 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 Step 5 6 7-8 9 10-12 13-14 15-16 17 18-19 20-21 Description

(Continued) The eNB requests the MME from the RRC elements. The eNB includes the ATTCH REQUEST message in the INITIAL UE message, which is an S1-MME control message, and sends it to the MME. If there is no UE context for the UE in the network, the integrity for the ATTACH REQUEST message is not protected, or the integrity check fails, an authentication and NAS security setup must be performed. The UE performs the Evolved Packet System

(EPS) Authentication and Key Agreement (AKA) procedure (TS 33.401, 6.1.1) with the MME. The MME sets up an NAS security association with the UE using the NAS Security Mode Command (SMC) procedure (TS 33.401, 7.2.4.4). The MME selects the P-GW and S-GW. The MME sends the Create Session Request message to the S-GW. The S-GW adds an item to the EPS bearer table. From this step to step 20, the S-GW keeps the downlink packet received from the P-GW until the Modify Bearer Request message is received. The S-GW returns the Create Session Request message to the MME. The MME includes the ATTACH REQUEST message in the INITIAL CONTEXT SETUP REQUEST message, which is an S1-MME Control message, and sends it to the eNB. This S1 message also includes the AS security context information for the UE. This information starts the AS SMC procedure at the RRC level. If the UE Radio Capability IE value is not contained in the INITIAL CONTEXT SETUP REQUEST message, the eNB starts the procedure for obtaining the UE Radio Capability value from the UE and then sends the execution result to the MME. The eNB sends the Security Mode Command message to the UE, and the UE responds with the SecurityModeComplete message. In the eNB, downlink encryption must start after Security Mode Command is transmitted and the uplink decryption must start after Security Mode Complete is received. In the UE, the uplink encryption must be started after the SecurityModeComplete message has been sent, and the downlink decryption must be started after the SecurityModeCommand message has been received (TS 33.401, 7.2.4.5). The eNB includes the ATTACH ACCEPT message in the RRCConnectionReconfiguration message and sends it to the UE. The UE sends the RRCConnectionReconfiguration Complete message to the eNB. After receiving the ATTACH ACCEPT message, the UE can send uplink packets to both of the S-GW and P-GW via the eNB. The eNB sends the INITIAL CONTEXT SETUP RESPONSE message to the MME. The UE includes the ATTACH COMPLETE message in the ULInformationTransfer message and sends it to the eNB. The eNB includes the ATTACH COMPLETE message in the UPLINK NAS TRANSPORT message and relays it to the MME. After receiving both of the INITIAL CONTEXT RESPONSE message at step 17 and the ATTACH COMPLETE message at step 19, the MME sends the Modify Bearer Request message to the S-GW. The S-GW sends the Modify Bearer Response message to the MME. S-GW can send the stored downlink packet. SAMSUNG Electronics Co., Ltd. 4-19 CHAPTER 5. Message Flow Service Request Initiated by the UE The figure below shows the message flow of the Service Request procedure initiated by the UE. UE eNB MME S-GW EPC 1) Random Access Procedure 2) RRCConnectionRequest 3) RRCConnectionSetup 4) RRCConnectionSetupComplete

(SERVICE REQUEST) 5) Initial UE Message

(SERVICE REQUEST) 6) Authentication/NAS Security Setup 7) INITIAL CONTEXT SETUP REQUEST

(SERVICE ACCEPT) 8) SecurityModeCommand 9) SecurityModeComplete 10) RRCConnectionReconfiguration

(SERVICE ACCEPT) 11) RRCConnectionReconfiguration Complete Uplink data Uplink data 12) INITIAL CONTEXT SETUP RESPONSE 13) Modify Bearer Request 14) Modify Bearer Response Downlink data Downlink data Step 1 2-4 5 Figure 4.16 Service Request Process by UE Description The UE performs the random access procedure with the eNB. The UE includes the SERIVCE REQUEST message, which is an NAS message, in the RRC message that will be sent to the eNB, and sends it to the MME. The eNB includes the SERVICE REQUEST message in the INITIAL UE message, which is an S1-AP message, and sends it to the MME. 4-20 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0

(Continued) Step 6 7 8-11 12 13-14 Description If there is no UE context for the UE in the network, the integrity for the ATTACH REQUEST message is not protected, or the integrity check fails, an authentication and NAS security setup must be performed. The UE carries out the EPS AKA procedure

(TS 33.401, 6.1.1) with the MME. The MME sets up an NAS security association with the UE using the NAS SMC procedure (TS 33.401, 7.2.4.4). The MME sends the S1-AP Initial Context Setup Request message to the eNB. In this step, radio and S1 bearer are activated for all activated EPS bearers. The eNB sets up the RRC radio bearers. The user plane security is established at this step. The uplink data from the UE can now be passed by the eNB to the S-GW. The eNB sends the uplink data to the S-GW, which, in turn, passes it to the P-GW. The eNB sends the S1-AP Initial Context Setup Request message to the MME. The MME sends the Modify Bearer Request message for each PDN connection to the S-GW. Now, the S-GW can send the downlink data to the UE. The S-GW sends the Modify Bearer Response message to the MME. Service Request by Network The message flow for service request procedure by network is illustrated below. UE eNB MME S-GW EPC 1) Downlink Data Notification 3) Paging 2) Downlink Data Notification Acknowledge 4) Paging 5) UE triggered Service Request procedure Step 1-2 Figure 4.17 Service Request Process by Network Description When receiving a downlink data packet that should be sent to a UE while the user plane is not connected to that UE, the S-GW sends the Downlink Data Notification message to the MME which has the control plane connection to that UE. The MME replies to the S-GW with the Downlink Data Notification Acknowledge message. If the S-GW receives additional downlink data packet for the UE, this data packet is stored, and no new Downlink Data Notification is sent. SAMSUNG Electronics Co., Ltd. 4-21 CHAPTER 5. Message Flow Step 3-4 5 Description

(Continued) If the UE is registered with the MME, the MME sends the PAGING message to all eNBs which belong to the TA where the UE is registered. If the eNB receives the PAGING message from the MME, it sends the paging message to the UE. When the UE in Idle mode receives the PAGING message via the E-UTRAN connection, the Service Request procedure initiated by the UE is started. The S-GW sends the downlink data to the UE via the RAT which has performed the Service Request procedure. Detach Initiated by the UE The figure below shows the message flow of the Detach procedure initiated by the UE. UE eNB MME S-GW EPC 1) ULInformationTransfer

(DETACH REQUEST) 6) DLInformationTransfer

(DETACH ACCEPT) 8) RRCConnectionRelease 2) Uplink NAS Transport

(DETACH REQUEST) 5) Downlink NAS Transport

(DETACH ACCEPT) 3) Delete Session Request 4) Delete Session Response 7) UE Context Release Command

(Detach) 9) UE Context Release Complete Step 1-2 3 4 5-6 Figure 4.18 Detach Process by UE Description The UE sends the DETACH REQUEST message, which is an NAS message, to the MME. This NAS message is used to start setting up an S1 connection when the UE is in Idle mode. The active EPS bearers and their context information for the UE and MME which are in the S-GW are deactivated when the MME sends the Delete Session Request message for each PDN connection. When receiving the Delete Session Request message from the MME, the S-GW releases the related EPS bearer context information and replies with the Delete Session Response message. If the detachment procedure has been triggered by reasons other than disconnection of power, the MME sends the DETACH ACCEPT message to the UE. 4-22 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0

(Continued) Step Description 7 8 9 The MME sets the Cause IE value of the UE CONTEXT RELEASE COMMAND message to Detach and sends this message to the eNB to release the S1-MME signal connection for the UE. If the RRC connection has not yet been released, the eNB sends the RRCConnectionRelease message to the UE in Requested Reply mode. Once a reply to this message is received from the UE, the eNB removes the UE context. The eNB returns the UE CONTEXT RELEASE COMPLETE message to the MME and confirms that S1 is released. By doing this, the signal connection between the MME and eNB for the UE is released. This step must be performed immediately following step 7. Detach Initiated by the MME The figure below shows the message flow of the Detach procedure initiated by the MME. UE eNB MME S-GW EPC 1) DOWNLINK NAS TRANSPORT

(DETACH REQUEST) 3) Delete Session Request 4) Delete Session Response 2) DLInformationTransfer

(DETACH REQUEST) 5) ULInformationTransfer

(DETACH ACCEPT) 8) RRCConnectionRelease 6) UPLINK NAS TRANSPORT

(DETACH ACCEPT) 7) UE Context Release Command

(Detach) 9) UE Context Release Complete Step 1-2 3-4 5-6 7 8-9 Figure 4.19 Detach Process by MME Description The MME detaches the UE implicitly if there is no communication between them for a long time. In case of the implicit detach, the MME does not send the DETACH REQUEST message to the UE. If the UE is in the connected status, the MME sends the DETACH REQUEST message to the UE to detach it explicitly. These steps are the same as Step 3 and 4 in Detach Procedure by UE. If the UE has received the DETACH REQUEST message from the MME in step 2, it sends the DETACH ACCEPT message to the MME. The eNB forwards this NAS message to the MME. After receiving both of the DETACH ACCEPT message and the Delete Session Response message, the MME sets the Cause IE value of the UE CONTEXT RELEASE COMMAND message to Detach and sends this message to the eNB to release the S1 connection for the UE. These steps are the same as Step 8 and 9 in Detach Procedure by UE. SAMSUNG Electronics Co., Ltd. 4-23 CHAPTER 5. Message Flow LTE Handover-X2-based Handover The figure below shows the message flow of the X2-based Handover procedure. UE Source eNB Target eNB MME S-GW EPC Downlink/Uplink data Downlink/Uplink data 1) MeasurementReport 2) HANDOVER REQUEST 4) RRCConnection-

Reconfiguration

(mobilityControlinfo) 3) HANDOVER REQUEST ACKNOWLEDGE 5) SN STATUS TRANSFER Data forwarding 6) Synchronization/UL allocation and timing advance 7) RRCConnectionReconfigurationComplete Forwarded data Uplink data Uplink data 8) PATH SWITCH REQUEST 9) Modify Bearer Request Forwarded data Downlink data End marker 12) UE CONTEXT RELEASE End marker Downlink data 11) PATH SWITCH REQUEST ACKNOWLEDGE 10) Modify Bearer Response Down/Uplink data Down/Uplink data Step 1 2 3-4 Figure 4.20 X2-based Handover Procedure Description The UE sends the Measurement Report message according to the system information, standards and rules. The source eNB determines whether to perform the UE handover based on the MeasurementReport message and the radio resource management information. The source eNB sends the HANDOVER REQUEST message and the information required for handover to the target eNB. The target eNB can perform management control in accordance with the E-RAB QoS information received. The target eNB prepares the handover and creates an RRCConnectionReconfiguration message, containing the mobileControlInfo IE that tells the source eNB to perform the handover. The target eNB includes the RRCConnectionReconfiguration message in the HANDOVER REQUEST ACKNOWLEDGE message, and sends it to the source eNB. The source eNB sends the RRCConnectionReconfiguration message and the necessary parameters to the UE to command it to perform the handover. 4-24 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 Step Description

(Continued) To send the uplink PDCP SN receiver status and the downlink PDCP SN transmitter status of the E-RABs of which the PDCP status must be preserved, the source eNB sends the SN STATUS TRANSFER message to the target eNB. After receiving the RRCConnectionReconfiguration message containing mobileControlInfo IE, the UE performs synchronization with the target eNB and connects to the target cell via a Random Access Channel (RACH). The target eNB replies with an allocated UL and a timing advance value. After having connected to the target cell successfully, the UE notifies the target eNB that the Handover procedure has been completed using an RRCConnection-

ReconfigurationComplete message. The target eNB, using the PATH SWITCH REQUEST message, notifies the MME that the UE has changed the cell. The MME sends the Modify Bearer Request message to the S-GW. The S-GW changes the downlink data path into the target eNB. The S-GW sends at least one end marker to the source eNB through the previous path, and releases the user plane resources for the source eNB. The S-GW sends a Modify Bearer Response message to the MME. The MME acknowledges the PATH SWITCH REQUEST message by issuing the PATH SWITCH REQUEST ACKNOWLEDGE message. The target eNB sends the UE CONTEXT RELEASE message to the source eNB to notify the handover has succeeded and to make the source eNB release its resources. When receiving the UE CONTEXT RELEASE messages, the source eNB released the radio resource and the control plane resource related to the UE context. 5 6 7 8 9-10 11 12 SAMSUNG Electronics Co., Ltd. 4-25 CHAPTER 5. Message Flow LTE Handover-S1-based Handover The figure below shows the message flow of the S1-based Handover procedure. UE Source eNB Target eNB MME S-GW EPC Downlink/Uplink data Downlink/Uplink data 1) Decision to trigger a relocation via S1 2) HANDOVER REQUIRED 3) HANDOVER REQUEST 4) HANDOVER REQUEST ACKNOWLEDGE 7) HANDOVER COMMAND 9) eNB STATUS TRANSFER 5) Create Indirect Data Forwarding Tunnel Request 6) Create Indirect Data Forwarding Tunnel Response 10) MME STATUS TRANSFER Indirect data forwarding 8) RRCConnection-

Reconfiguration

(mobilityControlinfo) 10-1) Direct data forwarding 10-2) Indirect data forwarding 11) Detach from old cell/Synchronize to new cell 12) RRCConnectionReconfigurationComplete Forwarded data Uplink data Uplink data 13) HANDOVER NOTIFY 14) Modify Bearer Request 15) Modify Bearer Response Forwarded data Downlink data End marker End marker Downlink data 16) Tracking Area Update procedure 17) UE CONTEXT RELEASE COMMAND 18) UE CONTEXT RELEASE COMPLETE 19) Delete Indirect Data Forwarding Tunnel Request 20) Delete Indirect Data Forwarding Tunnel Response Downlink/Uplink data Downlink/Uplink data Figure 4.21 S1-based Handover Procedure 4-26 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 Step 1 2 3-4 5-6 7-8 9-10 11 12 13 14 15 16 Description The source eNB determines whether to perform S1-based handover to the target eNB. The source eNB can make this decision if there is no X2 connection to the target eNB or if an error is notified by the target eNB after an X2-based handover has failed, or if the source eNB dynamically receives the related information. The source eNB sends the HANDOVER REQUIRED message to the MME. The source eNB notifies the target eNB which bearer is used for data forwarding and whether direct forwarding from the source eNB to the target eNB is possible. The MME sends the HANDOVER REQUEST message to the target eNB. This message makes the target eNB create a UE context containing the bearer-related information and the security context. The target eNB sends the HANDOVER REQUEST ACKNOWLEDGE message to the MME. If indirect forwarding is used, the MME sends the Create Indirect Data Forwarding Tunnel Request message to the S-GW. The S-GW replies the MME with the Create Indirect Data Forwarding Tunnel Response message. The MME sends the HANDOVER COMMAND message to the source eNB. The source eNB creates the RRCConnectionReconfiguration message using the Target to Source Transparent Container IE value contained in the HANDOVER COMMAND message and then sends it to the UE. To relay the PDCP and HFN status of the E-RABs of which the PDCP status must be preserved, the source eNB sends the eNB/MME STATUS TRANSFER message to the target eNB via the MME. The source eNB must start forwarding the downlink data to the target eNB through the bearer which was determined to be used for data forwarding. This can be either direct or indirect forwarding. The UE performs synchronization with the target eNB and connects to the target cell via a RACH. The target eNB replies with UL allocation and timing advance value. After having synchronized with the target cell, the UE notifies the target eNB that the Handover procedure has been completed using the RRCConnectionReconfigurationComplete message. The downlink packets forwarded by the source eNB can be sent to the UE. The uplink packets can also be sent from the UE to the S-GW via the target eNB. The target eNB sends the HANDOVER NOTIFY message to the MME. The MME starts the timer which tells when the resources of the source eNB and the temporary resources used by the S-GW for indirect forwarding will be released. For each PDN connection, the MME sends the Modify Bearer Request message to the S-GW. Downlink packets are sent immediately from the S-GW to the target eNB. The S-GW sends the Modify Bearer Response message to the MME. If the target eNB changes the path for assisting packet resorting, the S-GW immediately sends at least one end marker packet to the previous path. If any of the conditions listed in section 5.3.3.0 of TS 23.401 (6) is met, the UE starts the Tracking Area Update procedure. SAMSUNG Electronics Co., Ltd. 4-27 CHAPTER 5. Message Flow Description

(Continued) When the timer started at step 13 expires, the MME sends the UE CONTEXT RELEASE COMMAND message to the source eNB. The source eNB releases the resources related to the UE and replies to the target eNB with the UE CONTEXT RELEASE COMPLETE message. If indirect forwarding has been used, when the timer started at step 13 expires the MME sends the Delete Indirect Data Forwarding Tunnel Request message to the S-GW. This message gets the S-GW to release the temporary resources allocated for indirect forwarding at step 5. The S-GW replies the MME with the Delete Indirect Data Forwarding Tunnel Response message. Step 17-18 19-20 4-28 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 4.2 Loading Flow Loading is the process where each processor and device downloads the required software and data from an Image Server (IS). In Smart MBS, Loading is executed during the system initialization. Also, if a particular board is newly mounted onto the system, or if a hardware reset is executed, loading will be executed. Loading can be classified into two types: loading using Non-volatile storage, or loading using a remote IS. At first system initialization, Smart MBS uses a remote IS to execute loading. At this time, it stores the corresponding data in its internal storage so that unnecessary loading will be prevented in the future. After first initialization, if loading is activated, versions will be compared. If the stored data is determined to be the latest version, remote loading will NOT be executed. If the stored data is NOT the latest version, remote loading will be executed from the BSM/LSM. Among other things, the loading file contains a software image consisting of executable files/script files and Programmable Loading Data (PLD) containing configuration data and operational parameters. Within the loading file, all the necessary data for the static routing function and initialization of Smart MBS is stored. Loading Procedure At initialization, the Smart MBS Loader first executes the following tasks. These tasks are referred to as Pre-Loading. Boot-up The Booter copies the kernel and Root File System (RFS) from flash ROM to RAM disk to execute the kernel. IP Configuration In order to communicate with the upper management system for the first time, the IP address data is obtained from flash ROM and configured. In the case of auto initialization, the Smart MBS automatically obtains Layer 3 information such as IP address, subnet mask, and gateway IP using DHCP. Registration The Network Element (NE) is registered using a registration server (RS) and the IP address of the IS is obtained during the registration process. Version Comparison Except for the case of forced loading, the software image and PLD versions stored in the remote IS are compared to determine where loading is required. File List Download This task downloads the list of files needs to be loaded on the required cards. SAMSUNG Electronics Co., Ltd. 4-29 CHAPTER 5. Message Flow Loading Message Flow After the Pre-Loading step has completed, the BSM /LSM should execute loading from either the corresponding IS or from its own storage array using SFTP. After this, the BSM/LSM-R loader now becomes the internal IS to lower boards (which is not main processor), and the rest of the loading can be executed. The loaded software version of the Smart MBS can be checked from the upper management system. Loading message flow is shown in the following diagram. BSM/LSM-R (RS/IS) Smart MBS Non-volatile storage Main Processor Registration Image Loading RS/IS Board Processor Figure 4.22 Smart MBS Loading Message Flow 4-30 SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description ABBREVIATION A B C AC ADC AM AMBR AN AN-AAA ANR ARQ AS AWS BOC BPSK BRC BSC BSM BTS BTS CA CAC CAI CAM CC CDMA CEC CICA-A CICA-D CICA-D2 CIMA-A CIMA-A2 CLI CM Admission Control Analog to Digital Conversion Acknowledged Mode Aggregated Maximum Bit Rate Access Networks Access Network-Authorization, Authentication and Accounting Automatic Neighbor Relation Automatic Repeat request Access Stratum Advanced Wireless Services Burst Operation Control Binary Phase Shift Keying BTS Resource Control Base Station Controller BSS System Manager Base Transceiver Station Base Transceiver Station Carrier Allocation Call Admission Control Common Air Interface Channel Assignment Message Chase Combining Code Division Multiple Access Channel Element Control CDMA IP Channel card board Assembly-type A CDMA IP Channel card board Assembly-type D CDMA IP Channel card board Assembly-type D2 CDMA Management board Assembly-type A CDMA Management board Assembly-type A2 Command Line Interface Configuration Management SAMSUNG Electronics Co., Ltd. I ABBREVIATION D E F CoS CPRI CPS CRM CS CSAB CSR D/D DAC DBMS DD DEC DFT DHCP DiffServ DMC DRH DSCP DU DUS E/O ECCB ECCB ECM/FCM ECMB EMS eNB ENS EPC E-UTRAN EVRC-B FA FANM-C4 FANM-G2 FDD FDMA FHS FM FSTD Class of Service Common Public Radio Interface Call Processing Software Call Resource Management Circuit Service CPS SON Agent Block Cell Site Router Device Driver Digital to Analog Conversion Database Management System Device Driver DO channel Element Controller Discrete Fourier Transform Dynamic Host Configuration Protocol Differentiated Services DO Media Controller DO Resource Handler Differentiated Services Code Point Digital Unit Debugging Utility Service Electrical to Optic eNB Call Control Block eNB Call Control Block Environment Control Module/Fan Control Module eNB Common Management Block Element Management System evolved UTRAN Node B Event Notification Service Evolved Packet Core Evolved UTRAN Enhanced Variable Rate Codec-B Foreign Agent Fan Module-C4 Fan Module-G2 Frequency Division Duplex Frequency Division Multiple Access File-system Hierarchy Standard 2.2 Fault Management Frequency Switched Transmit Diversity II SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 G H I L M GTPB HA HARQ H-ARQ HAS HO HSS HTTPs ICIC IDFT IMSI IMSI IPRS IPSS IR IS L9CA-A2P L9CA-B4T L9FU L9VU LNA LRU LSM LSM-C LSM-R LTE MA MAC MACB MBR MBS MBSFN MCS MDS MFS GPRS Tunneling Protocol Block Home Agent Hybrid Automatic Repeat Request Hybrid-ARQ High Availability Service Handover Home Subscriber Server Hyper Text Transfer Protocol over SSL Inter-Cell Interference Coordination Inverse Discrete Fourier Transform International Mobile Station Identity International Mobile Station Identity IP Routing Software IP Security Software Incremental Redundancy Image Server LTE eNB Channel card board Assembly-type A2P LTE eNB Channel card board Assembly-type B4T LTE eNB Filter Unit LTE eNB transceiver Unit Low Noise Amplifier Local Radio Unit LTE System Manager LTE System Manager-Core LTE System Manager-Radio Long Term Evolution Maintenance Processing Media Access Control Medium Access Control Block Maximum Bit Rate Multi-modal Base Station Multimedia Broadcast multicast service over a Single Frequency Network Modulation and Coding Scheme Message Delivery Service Miscellaneous Function Service SAMSUNG Electronics Co., Ltd. III ABBREVIATION N O P MGW MIB MIMO MM MME MRD MS MSS MW NAI NAS NP NPC NPS NR NRT O/E OAM OCS OFCS OFDMA OP OS OSAB OSS PAPR PCEF PCF PCI PCM PCN PCRF PDCB PDCP PDPU-O2C PDPU-O2E PDPU-OC PDSN P-GW PLER Media Gateway Master Information Block Multiple Input Multiple Output Mobility Management Mobility Management Entity Mobile Receive Diversity Mobile Station Master SON Server Middleware Network Access Identifier Non-Access Stratum Network Processing Network Processing Control Network Processor System Neighbor Relation Neighbor Relation Table Optic to Electrical Operation And Maintenance Online Charging System Offline Charging System Orthogonal Frequency Division Multiple Access Operating Processing Operating System OAM SON Agent Block Operations Support System Peak to Average Power Ratio Policy and Charging Enforcement Function Packet Control Function Peripheral Component Interconnect Pulse Code Modulation Packet Core Network Policy and Charging Rule Function PDCP Control Block Packet Data Convergence Protocol Power Distribution Panel Unit-O2C Power Distribution Panel Unit-O2E Power Distribution Panel Unit-OC Packet Data Serving Node PDN Gateway Packet Loss Error Rate IV SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description/Ver.1.0 PM PMI PMIP PPP PPPD PRACH PRB PSMM PSS PSTN QAM QAS QChat QCI QLIC QOF QoS QPSK RACH RAN RB RC RC RF RFS RLC RLCB RLIC RLIC RLP RO ROHC RRH RU S1-AP SC SC/MM SCTB SCTP SDU Q R S Performance Management Precoding Matrix Indicator Proxy Mobile IP Point to Point Protocol PPP Daemon Physical Random Access Channel Physical Resource Block Power Strength Measurement Message Primary Synchronization Signal Public Switched Telephone Network Quadrature Amplitude Modulation QChat Application Server Qualcomm Chat QoS Class Identifier Qualcomm Linear Interference Cancellation Quasi Orthogonal Function Quality of Service Quadrature Phase Shift Keying Random Access Channel Radio Access Network Radio Bearer Radio Configuration Radio Configuration Radio Frequency Root File System Radio Link Control Radio Link Control Block Reverse Link Interference Cancellation Reverse Link Interference Cancellation Radio Link Protocol RACH Optimization Robust Header Compression Remote RF Head Radio Unit S1 Application Protocol Single Carrier Session Control/Mobility Management Stream Control Transmission protocol Block Stream Control Transmission Protocol Selection and Distribution Unit SAMSUNG Electronics Co., Ltd. V SFBC SFN SFTP S-GW SIBs SM SMS SNMP SON SSH SSS STBC SU SUA SwM TA TCA TDD TDM TDTD THS TM TrM UADB UADU UAMA-A21 UAMA-A41 UE VCN VLAN Space Frequency Block Coding System Frame Number SSH File Transfer Protocol Serving Gateway System Information Blocks Spatial Multiplexing Short Message Service Simple Network Management Protocol Self Organizing Network Secure Shell Secondary Synchronization Signal Space Time Block Coding Single User SCCP User Adaptation Software Management Tracking Area Threshold Cross Alert Time Division Duplex Time Division Multiplex Time Division Transmit Diversity Task Handling Service Test Management Trace Management Universal platform Digital Backboard Universal Platform Digital Unit Universal platform Management board Assembly-type A21 Universal Platform Management board Assembly-type A41 User Equipment Voice Core Network Virtual Local Area Network Web-EMT WSS Web-based Element Maintenance Terminal Wireless Softswitch ABBREVIATION T U V W VI SAMSUNG Electronics Co., Ltd. LTE/CDMA Smart MBS System Description 2012 Samsung Electronics Co., Ltd. All rights reserved. Information in this description is proprietary to SAMSUNG Electronics Co., Ltd. No information contained here may be copied, translated, transcribed or duplicated by any form without the prior written consent of SAMSUNG. Information in this description is subject to change without notice. MPE Information Warning: Exposure to Radio Frequency Radiation The radiated output power of this device is far below the FCC radio frequency exposure limits. Nevertheless, the device should be used in such a manner that the potential for human contact during normal operation is minimized. In order to avoid the possibility of exceeding the FCC radio frequency exposure limits, human proximity to the antenna should not be less than1100cm during normal operation. The gain of the antenna is 20.7 dBi.The antenna(s) used for this transmitter must not be co-located or operating in conjunction with any other antenna or transmitter. SAMSUNG Electronics Co., Ltd.

FCC ID : A3LSMM-BMAA022000 1.1 ID Label Information Following is a copy of the label that will be placed on the rear side of the cabinet. Both the FCC ID and compliance statement are included in the product label Figure 1.1 PRODUCT LABEL Model No : SMM-BMAA022000 FCC ID : A3LSMM-BMAA022000 EUT Type : Smart MBS(Smart Multi-Modal Base Station) Serial No :

This device complies with part 15 of the FCC Rules. Operation is subject to the following two conditions :

(1) this device may not cause harmful interference , and

(2) this device must accept any interference received, Including interference that may cause undesired operation. SAMSUNG Electronics Co., Ltd. 416, Maetan-3dong, Yeongtong-gu, Suwon-si, Gyeonggi-do, Korea MADE IN KOREA 105-1, Jangam-ri, Majang-Myeon, Icheon-Si, Kyunggi-Do Korea TEL:+82 31 645 6467 FAX:+82 31 645 6401 www.hct.co.kr HCT CO., LTD. 1/2 FCC ID : A3LSMM-BMAA022000 1.2 Label Location Photos The label shown shall be permanently affixed at a conspicuous location on the device and be readily visible to the user at the time purchase.(Labeling requirements per 2.925) Figure 1.2 LABEL LOCATION LABEL 105-1, Jangam-ri, Majang-Myeon, Icheon-Si, Kyunggi-Do Korea TEL:+82 31 645 6467 FAX:+82 31 645 6401 www.hct.co.kr HCT CO., LTD. 2/2

SAMSUNG Electronics Co., Ltd. Date:April 18,2012 Compliance Certification Services Certification Division 561F Monterey Road Morgan Hill, CA 95037 To whom it may concern:

We, the undersigned, hereby authorize < HCT CO., LTD.>, to act on our behalf in all manners relating to application for equipment authorization, including signing of all documents relating to these matters. Any and all acts carried out by < HCT CO., LTD.> on our behalf shall have the same effect as acts of our own. We, t he undersigned, hereb y cert ify that we are n ot sub ject to a deni al of federal benefi ts, that includes FCC b enefits, pursuant to Section 5301 of the Anti-Drug Abuse Act o f 1988, 21 U.S.C. 853(a). In authorizing < HCT CO., LTD.> as our agent, we still recognize that we are responsible to:

a) comply with the relevant provisions of the certification program;

b) c) d) e) f) make all necessary arrangements for the conduct of the evaluation, including provision for examining documentation and access to all areas, records (including internal audit reports) and personnel for the purposes of evaluation (e.g. testing, inspection, assessment, surveillance, reassessment) and resolution of complaints;

make claims regarding certification only in respect of the scope for which certification has been granted;

do not use our product certification in such a manner as to bring the Certification Division into disrepute and not make any statement regarding our product certification which the Certification Division may consider misleading or unauthorized;

upon suspension or cancellation of certification, discontinue use of all advertising matter that contains any reference thereto and return any certification documents as required by the Certification Division;

use certification only to indicate the products are certified as being in conformity with specified standards;

g) h) i) j) endeavor to ensure that no certificate or report nor any part thereof is used in a misleading manner;

ensure that any reference to our product certification in communication media such as documents, brochures or advertising, complies with the requirements of the Certification Division;

keep a record of all complaints made known to the us relating to the products compliance with requirements of the relevant standard and to make these records available to the Certification Division when requested;

take appropriate action with respect to such complaints and any deficiencies found in products or services that affect compliance with the requirements for certification;

k) document the actions taken. This authorization is valid until further written notice from the applicant. Sincerely Yours, Address: 416, Maetan-3dong, Yeongtong-gu, Suwon-si, Gyeonggi-do, Korea Hwan-Chul Ryu / Principal Research Engineer REMARK:

1. This aut horization letter wi ll be sent along wi th yo ur application wh en fi ling wi th t he Certification Division. Please follow the format and type it on company letterhead and send original to us. 2.

SAMSUNG Electronics Co.,Ltd. 416, Maetan-3dong, Yeongtong-gu, Suwon-si, Gyeonggi-do, Korea I hereby appoint Hwan-Chul Ryu to sign letters and applications for any filings with regulatory agencies on our behalf, and to receive and exchange data between our company, the agents company and the agency in connection with certification for any products that our company owns or manufactures. 10/11/2011 To Whom It May Concern:

Sincerely,

Sang Kyung (Peter), Ra/ General Manager Samsung Electronics CO. LTD TEL: 310-900-5250 FAX: 310-537-5500 Date: May 02,2012

Request for Confidentiality Date: April 18,2012 Compliance Certification Services Fremont, CA 94538 RE:

FCC ID:

Confidentiality Request Pursuant to Sections 0.457 and 0.459 of the Commissions Rule, the applicant hereby requests confidential treatment of information accompanying this application as outlined below:

Certification Application A3LSMM-BMAA022000 CONFIDENTIAL AND SHORT-TERM CONFIDENTIAL LIST Exhibit Description CONFIDENTIAL SHORT-TERM CONFIDENTIAL 1 2 3 4 5 6 7 8 Block Diagram Parts Lists and Tune-up Procedure Schematics Operational Description External Photos Internal Photos Test-Setup Photos Users Manual We are also hereby request Short-Term Confidentiality for 180 days after the grant as outlined in Public Notice DA 04-1705. This provision will give SAMSUNG temporary confidentiality of commercially sensitive information prior to product release. The above materials contain trade secrets and proprietary information not customarily released to the public. The public disclosure of these matters might be harmful to the applicant and provide unjustified benefits to its competitors. The applicant understands that pursuant to rule 0.457 & 0.459, disclosure od this application and all accompanying documentation will not be made before the date of the GRANT for this application. Thank you for your attention in this matter. Applicants Company : SAMSUNG Electronics Co.,Ltd. Address: 416, Maetan-3dong, Yeongtong-gu, Suwon-si, Gyeonggi-do, Korea Hwan-Chul Ryu / Principal Research Engineer