tamius striatus tamius striatus


IS-95 A & B
and more

A few words of explanation for our humor impaired readers:

This family of communications technologies uses spread spectrum signaling of which the lowest level data elements consist of "chips".  Hence we show CHIPmunks, a standard North American ground squirrel (Tamius Striatus) which is also known to utilize sequences of chips for communications purposes.

The long & short of it

CDMA as used in this web page specifically refers to a particular family of mobile telephony standards developed and updated by Qualcomm since the 90s.  The primary U.S. carriers utilizing CDMA technology are Verizon and Sprint in addition to many deployments worldwide.

The original IS-95 standard was supplemented in the 90s (IS-95) and continued the evolution into the present 2.5G & 3G CDMA-2000 species.  Wikipedia has a nice set of articles on IS-95, CDMA2000, and even the extinct EV-DO.

We make no attempt to explain the air interface and instead refer the interested reader directly to the freely available standards at http://www.3gpp2.org.  Technical Specification Group C (TSG-C) is of particular interest.

CDMA Signal Acquisition and Tracking

We acquire the  CDMA signal by cross-correlating the over-the-air signal with short spreading sequences (PN-Q and PN-I) at a 1.2288MHz spreading rate.  These 32768 length sequences technically modulate Walsh channel zero, but since the associated Walsh sequence is all '1's we needn't bother with any Walsh related processing at this stage.

Sampling is done with a USRP with a decimation of 40 (1.6MHz sampling rate).  This gives us plenty of wiggle room for the worst case USRP DBSRX tuning offset and helps a little with the USRP FPGA CIC filtering band edges.  The data is resampled to 4x the chip rate (4.9152MHz) and the pilot is then acquired using a fast circular correlation corresponding in length to the entire short PN sequence.  As an optional pre-processing step one may automatically compensate for the USRP tuning offset by sweeping these circular correlations through a plausible range of offsets until the signal peak is maximized.

CDMA Cross Correlation Against Short PN Sequence

Above:  Successful detection and acquisition of a CDMA channel showing two separate active base station transmissions.  It turns out these are coming from the same base station but represent data beamed into different cells. 

At this point we could select the desired transmission by synchronizing the short PN sequence timing with the desired peak.  Lock is maintained using early/late correlation of the pilot.

Potential Application - Passive Radar?

Having achieved lock we must take a detour and look for multipath propagation.  After all, this is something the CDMA system was specifically designed to detect and exploit using rake receivers.  We take our signal and zoom in on a CDMA correlation peak; for good measure we plot this as a function of time:

Short code correlation as function of delay spread

Each multipath peak can be resolved to better than 1µS which corresponds to under 300 meters.
  Remember we are working with a nominal 1.25MHz bandwidth signal. 

We expect changes in reflectors (e.g. low flying helicopters) to produce shifts in target geometry that may then be reflected in changes of the multipath structure.  Of course target movement immediately makes one think of doppler.  So instead let us take a 160ms sample slice and plot a correlation against the short PN sequence that is a function of doppler shift and path delay:

Doppler vs Delay Spread Sample plot

Above:  Doppler bins are 6.25Hz wide which corresponds to a velocity of about 1m/s or 3½ km/h at the 1.9 GHz system frequency.  If there were any really strong reflections from nearby traffic we should have been able to resolve  it.

Disclaimer: the above figures show no readily discernible targets.  We also suspect some of the subsidiary peaks represent USRP / GNU Radio processing artifacts.

Issues for further work:

Also worthy of note:  Some base stations are set up to transmit their geographical coordinates which obviously comes in handy when doing path geometry calculations.  Sprint basestations in our neck of the 4103 SID are nice enough to do this but Verizon basestations couldn't be bothered.  Either that or all our Verizon basestations are swimming together off equatorial Africa at 0°N, 0
°W...  which in fact seems quite possible based on their network quality.

Potential Application - Receiving Signaling & Traffic Data

CDMA Walsh64 Code Power Density

Above:  Plot showing a CDMA channel after successful signal synchronization and passing through a Walsh64 transform stage.

The following channels are active:

Hypothetical USRP/GNU Radio Signal processing flow:

The Strange Politics of CDMA Monitoring

We note that intercept systems are available that monitor and record CDMA traffic in real time.  A few examples:


You may notice the above companies are all based outside of the U.S.  This may be because of title 18 of the U.S. Code, specifically section 18USC2512
.  This not only makes it illegal to sell items such as CDMA intercept systems to non-governmental users but also to advertise their existence.  This state of affairs suits mobile telephone service providers who can propagate less than accurate security assurances.   A few random examples:

The globalstar satellite system of interest because it is an IS-95 CDMA satellite system.  Unfortunately the S-Band satellite amplifiers are failing (or have completely failed).  There exists an interesting correlation between Globalstar S-Band amplifier output and the company stock price (ticker symbol GSAT).

Interesting work along related lines does of course occur in the U.S. as the following suggests:


A lot of this seems really irrelevant anyway since in the U.S. your calls will not be intercepted at the air interface level.  Instead your communications provider will happily run warrantless wiretaps on behalf of the U.S. government without appropriate judicial or constitutional oversight.


This web page constructed entirely out of recycled electrons (minimum 75% post consumer content) and recycled ideas (minimum 99.99% post consumer content).  No electrons or animals were harmed during the construction of this web page.

Back to radiorausch home page