Configuration
1xBTS uses a per-node config directory plus an optional radio-config override:
cargo run --release -p cdma-nib -- --config-dir config --radio-config config/radio_bladerf_micro2.jsonThe default config directory contains bts.json, bsc.json, msc.json, pcf.json, pdsn.json, hlr.json, smsc.json, and management.json.
Node Configuration
| File | Role |
|---|---|
bts.json | pilot/overhead parameters, downlink/uplink channel config, EV-DO carrier config, MCC/IMSI_11_12 digit-string defaults, BTS Abis signaling listener, local bearer address |
bsc.json | traffic assignment, paging retry, traffic retry, BSC Abis signaling target, BSC bearer peer config, optional HRPD AN A21 coordination endpoint |
msc.json | A1 listen address, MSC management endpoint, voice policy, voice gateway endpoint, welcome SMS policy |
pcf.json | packet-control endpoint, A8/A10 bearer endpoints, A11 signaling endpoint, and A11 security association toward the PDSN |
pdsn.json | packet gRPC listener, packet transport mode (tun, fou, or fou_tcp), A10 bearer endpoint, A11 signaling/security, mobile gateway, Mobile IPv4, and DNS supplied to phones |
hlr.json | HLR gRPC listener and PostgreSQL DSN for subscriber and registration-binding data |
smsc.json | SMSC gRPC listener and PostgreSQL DSN for SMS submissions and delivery attempts |
management.json | management facade listener, tokio-console flag, IQ capture directory |
Local Overrides
The configs in config/ are shared defaults. To customize one for your own setup without touching the checked-in file, drop a sibling <name>.local.json next to it:
config/bts.json # shared default (in git)config/bts.local.json # your overrides (gitignored)At load time the BTS reads the base file, merges your local file on top, and validates the result. Your local file only needs the fields you’re changing — anything you omit keeps the value from the base.
For example, to switch to a different CDMA channel and bump TX gain without touching anything else in bts.json:
{ "channel": { "band_class": "bc0", "band_subclass": 0, "cdma_channel": 283 }, "radio": { "tx_gain_db": 60 }}The BTS derives both TX and RX center frequencies from channel (via C.S0057-F band-class formulas). To force a non-standard TX tune for loopback or development work, set runtime.tx_freq_hz_override.
The same convention works for every config in config/: bts.json, bsc.json, msc.json, pcf.json, pdsn.json, hlr.json, smsc.json, management.json, voice-gw.json, and the radio profiles (e.g. radio_bladerf_micro2.local.json).
Merge behavior
- Nested objects are merged field by field; fields you don’t set keep the base value.
- Arrays in your local file replace the base array (they’re not appended).
- Setting a field to
nullremoves it, falling back to the struct default.
The stock BTS settings are for Verizon devices. Want to try Sprint? See Carrier Profiles to switch with one CLI flag while keeping your normal local configuration.
BTS Runtime
{ "channel": { "band_class": "bc0", "band_subclass": 0, "cdma_channel": 384 }, "runtime": { "spreading_rate": "sr1", "chip_rate_hz": 1228800, "tx_digital_backoff": 0.5, "realtime": { "enabled": true, "tx_priority": 80, "rx_priority": 75, "driver_priority": 70, "tx_cpu": null, "rx_cpu": null, "driver_cpu": null } }}channel is the single source of truth for RF tuning. The BTS supports all 23 band classes defined in C.S0057-F (bc0–bc22, except bc17 and bc22 which are “Not specified” in the spec). The band_subclass selects which spectrum-allocation profile is broadcast in handoff messages. The default (BC0 / subclass 0 / N=384) maps to 881.520 MHz TX / 836.520 MHz RX. See the Configuration Reference for the full per-band formula table.
The BTS also derives the SDR sample rates and RF bandwidths at startup. 1x-only uses a 4x chip-rate clock with 1.5 MHz bandwidth. When EV-DO is enabled in the default composite mode, the runtime chooses the smallest 4x, 8x, or 16x span that fits the configured 1x and HRPD carriers. HRPD-only mode is supported for EV-DO-only deployments and uses the 4x/1.5 MHz profile.
Real-time scheduling is enabled by default for the radio I/O threads. On
Linux, grant the process permission to use SCHED_FIFO if you want the
configured priorities to take effect; otherwise the BTS logs a warning and
continues with normal scheduling. Optional CPU fields pin the corresponding
thread by zero-based Linux CPU index. Leave them null unless you are tuning a
dedicated host.
Downlink Channels
| Channel | Walsh | Config |
|---|---|---|
| Pilot | W0 | Gain |
| Sync | W32 | 1200 bps, interleaver params |
| Paging | W1 | 9600 bps, overhead messages (SPM, APM, ESPM, CCLM, and NLM or ENLM according to the band) |
Extended System Parameters in bts.json carry the advertised MCC and IMSI_11_12 defaults as decimal digit strings, for example "mcc": "310" and "imsi_11_12": "55". The BTS encodes those strings into the C.S0005-E bit fields, and the BSC uses the same overhead values to reconstruct a complete class-0 registration IMSI when the mobile only sends the short IMSI fields on the access channel.
BSC / MSC / Packet Parameters
| Section | Controls |
|---|---|
bsc.traffic_assignment | supported forward/reverse RCs, preferred RC pairs, idle timeout, TCH MS Ack timeout, optional SO33 F-SCH rate |
bsc.paging_retry | paging ACK timeout and retry count |
bts.abis / bsc.abis | Abis TCP signaling bind/remote addresses; defaults wire the integrated runtime over localhost 127.0.0.1:5604 |
bts.bearer / bsc.bearer | Abis UDP bearer bind/remote addresses; defaults wire BTS 127.0.0.1:17014 to BSC 127.0.0.1:17022 |
msc.voice | supported SOs, answer/release timers, A2p bearer behavior, WAV fallback, MSC-owned voice gateway endpoint |
msc.welcome_sms | first-registration/inactivity welcome SMS text, originating number, and threshold |
pcf.packet_grpc_endpoint | BSC/PCF client endpoint for packet service RPCs; default http://127.0.0.1:17021 |
pcf.a8_bearer / pcf.a10_bearer | HRPD packet bearer endpoints between the AN, PCF, and PDSN |
pcf.a11 / pcf.a11_security | A11 signaling endpoint and security association toward the PDSN; keep the security fields matched with pdsn.json |
pdsn.packet_grpc_listen_addr | packet service gRPC listen address; default 127.0.0.1:17021 |
pdsn.a10_bearer | A10 bearer endpoint toward the PCF |
pdsn.a11 / pdsn.a11_security | A11 signaling endpoint and matching PCF/PDSN security association |
pdsn.ppp_session_timeout_secs | idle lifetime for cached open PPP/LCP/IPCP state across packet traffic-channel changes; default 1800 |
pdsn.packet | packet transport mode, FOU/FOU-TCP endpoints, mobile gateway IP, DNS supplied to phones, optional uplink/downlink VJ compression, and Simple IP/Mobile IPv4 setup |
hlr.grpc_listen_addr / smsc.grpc_listen_addr | HLR/SMSC service gRPC listen addresses; defaults 127.0.0.1:17019 and 127.0.0.1:17020 |
hlr.postgres_dsn / smsc.postgres_dsn | PostgreSQL connection strings |
For SO33 packet-data downlink, bsc.traffic_assignment.enable_f_sch enables F-SCH and f_sch_rate_bps selects 19200, 38400, 76800, or 153600.
RC2 must be present in both BSC supported-RC lists for QCELP 13K calls. The
MSC voice.supported_service_options list controls which implemented codecs
may be proposed for mobile-terminated calls; the first recognized option is
the default.
For EV-DO, bts.evdo.enabled starts the HRPD carrier, AN service, PCF A9 service, and PDSN A11 service in the integrated runtime. bts.evdo.channel is required when EV-DO is enabled, and bts.evdo.mode selects the default composite 1x + HRPD carrier mode or the supported hrpd_only EV-DO-only deployment mode. For EV-DO-only deployments, channels 589, 630, and 770 are good starting points. bts.evdo.advertise_on_1x controls whether hybrid 1x/EV-DO devices are told about the HRPD carrier on the 1x paging channel.
Access Channel
| Parameter | Default |
|---|---|
| Channels per paging channel | 1 |
| Access rate | 4800 bps |
| Frame duration | 20 ms |
| ARQ ACK timeout | 400 ms |
Radio Configuration
Hardware-specific SDR parameters.
UHD (USRP B200/B210)
{ "kind": "uhd", "device": "type=b200,num_recv_frames=1024,num_send_frames=1024", "channel": 0, "antenna": "TX/RX", "tx_gain_db": 65.0, "rx_antenna": "RX2", "rx_gain_db": 30.0, "rx_power_adj": 0.0, "rx_sample_delay": 50}LimeSDR (Native)
{ "kind": "lime", "device": "", "channel": 0, "tx_antenna": "BAND1", "tx_gain_db": 80, "rx_antenna": "LNAW", "rx_gain_db": 50, "rx_power_adj": 5.0, "rx_sample_delay": 97}rx_sample_delay compensates for LimeSDR-specific timing offsets in the receive path.
bladeRF (Native)
{ "kind": "blade_rf", "device": "", "channel": 0, "tx_antenna": "TXA", "rx_antenna": "A_BALANCED", "tx_gain_db": 60, "rx_gain_db": 35, "rx_reference_dbm": null, "rx_power_adj": 0.0, "rx_sample_delay": 82, "rx_batch_pcgs": 2, "num_buffers": 16, "buffer_size": 8192, "num_transfers": 8, "stream_timeout_ms": 3500}tx_antenna and rx_antenna select bladeRF RF ports; the current Micro 2.0 example uses TXA and A_BALANCED.
Environment Variables
| Variable | Purpose |
|---|---|
CDMA_CONFIG_DIR | Default config directory when --config-dir is omitted |
RUST_LOG | Log level (info, debug, trace) |
Next Steps
- First Registration — Start the BTS and register a handset
- Configuration Reference — Full parameter reference