1xBTS 1xBTS

Configuration

1xBTS uses a per-node config directory plus an optional radio-config override:

Terminal window
cargo run --release -p cdma-nib -- --config-dir config --radio-config config/radio_bladerf_micro2.json

The default config directory contains bts.json, bsc.json, msc.json, pcf.json, pdsn.json, hlr.json, smsc.json, and management.json.

Node Configuration

FileRole
bts.jsonpilot/overhead parameters, downlink/uplink channel config, EV-DO carrier config, MCC/IMSI_11_12 digit-string defaults, BTS Abis signaling listener, local bearer address
bsc.jsontraffic assignment, paging retry, traffic retry, BSC Abis signaling target, BSC bearer peer config, optional HRPD AN A21 coordination endpoint
msc.jsonA1 listen address, MSC management endpoint, voice policy, voice gateway endpoint, welcome SMS policy
pcf.jsonpacket-control endpoint, A8/A10 bearer endpoints, A11 signaling endpoint, and A11 security association toward the PDSN
pdsn.jsonpacket gRPC listener, packet transport mode (tun, fou, or fou_tcp), A10 bearer endpoint, A11 signaling/security, mobile gateway, Mobile IPv4, and DNS supplied to phones
hlr.jsonHLR gRPC listener and PostgreSQL DSN for subscriber and registration-binding data
smsc.jsonSMSC gRPC listener and PostgreSQL DSN for SMS submissions and delivery attempts
management.jsonmanagement facade listener, tokio-console flag, IQ capture directory

Local Overrides

The configs in config/ are shared defaults. To customize one for your own setup without touching the checked-in file, drop a sibling <name>.local.json next to it:

config/bts.json # shared default (in git)
config/bts.local.json # your overrides (gitignored)

At load time the BTS reads the base file, merges your local file on top, and validates the result. Your local file only needs the fields you’re changing — anything you omit keeps the value from the base.

For example, to switch to a different CDMA channel and bump TX gain without touching anything else in bts.json:

{
"channel": {
"band_class": "bc0",
"band_subclass": 0,
"cdma_channel": 283
},
"radio": {
"tx_gain_db": 60
}
}

The BTS derives both TX and RX center frequencies from channel (via C.S0057-F band-class formulas). To force a non-standard TX tune for loopback or development work, set runtime.tx_freq_hz_override.

The same convention works for every config in config/: bts.json, bsc.json, msc.json, pcf.json, pdsn.json, hlr.json, smsc.json, management.json, voice-gw.json, and the radio profiles (e.g. radio_bladerf_micro2.local.json).

Merge behavior

  • Nested objects are merged field by field; fields you don’t set keep the base value.
  • Arrays in your local file replace the base array (they’re not appended).
  • Setting a field to null removes it, falling back to the struct default.

The stock BTS settings are for Verizon devices. Want to try Sprint? See Carrier Profiles to switch with one CLI flag while keeping your normal local configuration.

BTS Runtime

{
"channel": {
"band_class": "bc0",
"band_subclass": 0,
"cdma_channel": 384
},
"runtime": {
"spreading_rate": "sr1",
"chip_rate_hz": 1228800,
"tx_digital_backoff": 0.5,
"realtime": {
"enabled": true,
"tx_priority": 80,
"rx_priority": 75,
"driver_priority": 70,
"tx_cpu": null,
"rx_cpu": null,
"driver_cpu": null
}
}
}

channel is the single source of truth for RF tuning. The BTS supports all 23 band classes defined in C.S0057-F (bc0bc22, except bc17 and bc22 which are “Not specified” in the spec). The band_subclass selects which spectrum-allocation profile is broadcast in handoff messages. The default (BC0 / subclass 0 / N=384) maps to 881.520 MHz TX / 836.520 MHz RX. See the Configuration Reference for the full per-band formula table.

The BTS also derives the SDR sample rates and RF bandwidths at startup. 1x-only uses a 4x chip-rate clock with 1.5 MHz bandwidth. When EV-DO is enabled in the default composite mode, the runtime chooses the smallest 4x, 8x, or 16x span that fits the configured 1x and HRPD carriers. HRPD-only mode is supported for EV-DO-only deployments and uses the 4x/1.5 MHz profile.

Real-time scheduling is enabled by default for the radio I/O threads. On Linux, grant the process permission to use SCHED_FIFO if you want the configured priorities to take effect; otherwise the BTS logs a warning and continues with normal scheduling. Optional CPU fields pin the corresponding thread by zero-based Linux CPU index. Leave them null unless you are tuning a dedicated host.

ChannelWalshConfig
PilotW0Gain
SyncW321200 bps, interleaver params
PagingW19600 bps, overhead messages (SPM, APM, ESPM, CCLM, and NLM or ENLM according to the band)

Extended System Parameters in bts.json carry the advertised MCC and IMSI_11_12 defaults as decimal digit strings, for example "mcc": "310" and "imsi_11_12": "55". The BTS encodes those strings into the C.S0005-E bit fields, and the BSC uses the same overhead values to reconstruct a complete class-0 registration IMSI when the mobile only sends the short IMSI fields on the access channel.

BSC / MSC / Packet Parameters

SectionControls
bsc.traffic_assignmentsupported forward/reverse RCs, preferred RC pairs, idle timeout, TCH MS Ack timeout, optional SO33 F-SCH rate
bsc.paging_retrypaging ACK timeout and retry count
bts.abis / bsc.abisAbis TCP signaling bind/remote addresses; defaults wire the integrated runtime over localhost 127.0.0.1:5604
bts.bearer / bsc.bearerAbis UDP bearer bind/remote addresses; defaults wire BTS 127.0.0.1:17014 to BSC 127.0.0.1:17022
msc.voicesupported SOs, answer/release timers, A2p bearer behavior, WAV fallback, MSC-owned voice gateway endpoint
msc.welcome_smsfirst-registration/inactivity welcome SMS text, originating number, and threshold
pcf.packet_grpc_endpointBSC/PCF client endpoint for packet service RPCs; default http://127.0.0.1:17021
pcf.a8_bearer / pcf.a10_bearerHRPD packet bearer endpoints between the AN, PCF, and PDSN
pcf.a11 / pcf.a11_securityA11 signaling endpoint and security association toward the PDSN; keep the security fields matched with pdsn.json
pdsn.packet_grpc_listen_addrpacket service gRPC listen address; default 127.0.0.1:17021
pdsn.a10_bearerA10 bearer endpoint toward the PCF
pdsn.a11 / pdsn.a11_securityA11 signaling endpoint and matching PCF/PDSN security association
pdsn.ppp_session_timeout_secsidle lifetime for cached open PPP/LCP/IPCP state across packet traffic-channel changes; default 1800
pdsn.packetpacket transport mode, FOU/FOU-TCP endpoints, mobile gateway IP, DNS supplied to phones, optional uplink/downlink VJ compression, and Simple IP/Mobile IPv4 setup
hlr.grpc_listen_addr / smsc.grpc_listen_addrHLR/SMSC service gRPC listen addresses; defaults 127.0.0.1:17019 and 127.0.0.1:17020
hlr.postgres_dsn / smsc.postgres_dsnPostgreSQL connection strings

For SO33 packet-data downlink, bsc.traffic_assignment.enable_f_sch enables F-SCH and f_sch_rate_bps selects 19200, 38400, 76800, or 153600.

RC2 must be present in both BSC supported-RC lists for QCELP 13K calls. The MSC voice.supported_service_options list controls which implemented codecs may be proposed for mobile-terminated calls; the first recognized option is the default.

For EV-DO, bts.evdo.enabled starts the HRPD carrier, AN service, PCF A9 service, and PDSN A11 service in the integrated runtime. bts.evdo.channel is required when EV-DO is enabled, and bts.evdo.mode selects the default composite 1x + HRPD carrier mode or the supported hrpd_only EV-DO-only deployment mode. For EV-DO-only deployments, channels 589, 630, and 770 are good starting points. bts.evdo.advertise_on_1x controls whether hybrid 1x/EV-DO devices are told about the HRPD carrier on the 1x paging channel.

Access Channel

ParameterDefault
Channels per paging channel1
Access rate4800 bps
Frame duration20 ms
ARQ ACK timeout400 ms

Radio Configuration

Hardware-specific SDR parameters.

UHD (USRP B200/B210)

{
"kind": "uhd",
"device": "type=b200,num_recv_frames=1024,num_send_frames=1024",
"channel": 0,
"antenna": "TX/RX",
"tx_gain_db": 65.0,
"rx_antenna": "RX2",
"rx_gain_db": 30.0,
"rx_power_adj": 0.0,
"rx_sample_delay": 50
}

LimeSDR (Native)

{
"kind": "lime",
"device": "",
"channel": 0,
"tx_antenna": "BAND1",
"tx_gain_db": 80,
"rx_antenna": "LNAW",
"rx_gain_db": 50,
"rx_power_adj": 5.0,
"rx_sample_delay": 97
}

rx_sample_delay compensates for LimeSDR-specific timing offsets in the receive path.

bladeRF (Native)

{
"kind": "blade_rf",
"device": "",
"channel": 0,
"tx_antenna": "TXA",
"rx_antenna": "A_BALANCED",
"tx_gain_db": 60,
"rx_gain_db": 35,
"rx_reference_dbm": null,
"rx_power_adj": 0.0,
"rx_sample_delay": 82,
"rx_batch_pcgs": 2,
"num_buffers": 16,
"buffer_size": 8192,
"num_transfers": 8,
"stream_timeout_ms": 3500
}

tx_antenna and rx_antenna select bladeRF RF ports; the current Micro 2.0 example uses TXA and A_BALANCED.

Environment Variables

VariablePurpose
CDMA_CONFIG_DIRDefault config directory when --config-dir is omitted
RUST_LOGLog level (info, debug, trace)

Next Steps