MS Camping Conditions

The following are the cell requirements for normal MS cell camping (ref 1):

1. The cell should be one of the selected PLMN.
2. It should not be "barred". (This status is set by parameters CELL_BAR_ACCESS and CELL_BAR_QUALIFY, ref 2.)
3. It should not be in an LA which is in the list of "forbidden" LAs for roaming.
4. The radio path loss between MS and BTS must be below a threshold (ref 2) set by the PLMN operator. (This threshold is calculated from parameters obtained from the system broadcast.)
5. It should not be a SoLSA exclusive cell to which MS does not subscribe. This requirement is only valid for MSs supporting SoLSA. (SoLSA is Support of Localized Service Area.)

Some Practical Advice on Getting a Test Handset to Camp to Your BTS

The handset's decision to camp to a BTS is made in the handset. The BTS can send signals that can encourage a handset to behave one way or another, but in the end the BTS cannot force a handset to camp,
only offer an attractive invitation.

The handset will camp to whatever network its SIM is programmed to prefer, which is usually the network of the operator that issued the SIM, followed by its roaming partners. (A locked phone is one that will only accept SIMs from the carrier that locked it.) The only way sure to get the MS to camp to your BTS automatically is to be the only BTS available. Here are four ways to do that:

1. Use a single-band handset and be the only BTS in that band, or take a multi-band handset and disable the local bands. That's why, in North America, where all of the local GSM systems are 850 and 1900, we usually test in the 900 band and use handsets built or set to operate as 900-only. This works with Nokia DCT3s using field test mode. This works with Treo650's using the "network" menu. This probably works with most unlocked/unbranded multiband phones.
2. Go somewhere where there is no GSM coverage in any band. That's why we test OpenBTS systems at Burning Man.
3. Use a SIM from a carrier who has no roaming agreements with the carriers in your area and then use the network parameters that the SIM wants to see. For example, if you are outside of the UK, you might try Tesco SIMs, since Tesco has no roaming agreements outside the UK, and then advertise whatever MNC and MCC appear in the first 6 digits of the Tesco IMSI.
4. Make or program your own SIM and then match your network parameters to it. I haven't tried this either, but it should work.

Note that we DO NOT RECOMMEND using the network parameters from your local network and relying on proximity to the test BTS to get a phone to camp to it. First, that is much less reliable than the options
listed above. Second, that risks interfering with your local cellular service. If you distract a phone from the real network while someone is making an emergency call, you can find yourself in jail, just to offer an example of the kind of thing that can go wrong. So mimicking AT&T/Voda/BT/whomever is a BAD IDEA.

More Comments (From a List Posting by Ken Erney)

Camping depends heavily on a number of factors. Once a handset has registered with a network, it usually is quite happy to stay there until something prompts a change. In most cases, if you are using an operator's SIM, say AT&T, the handset will stay on the current network until its current connection quality drops, it moves, or it sees another AT&T signal or another signal in the SIM cards preferred provider list. Your BTS then either needs to be broadcasting the same NMC/MCC (i.e. spoofing...which has legal implications) or you need your own SIM card in the handset that is configured with the MCC/MNC of your BTS.

The other way to accomplish this is to set your OpenBTS to use the 001 test code for MNC. Most phones will attempt to camp on this code if its the best signal around and its not happy on its own network. This
works best if you are in a zero-coverage area and you are sending out the 001 test code.

In the end, unless you use your own SIM cards and you have the phone configured to use your BTS, it won't just jump over to you if its happy where it is....and certainly for operator SIM cards, the phone will keep to its preferred provider list. You should also be aware that if the phone is SIM locked then you can't even put your own SIM card in the device as it will only work with the network that locked it (i.e. if you have an ATT phone and its been locked to only use the ATT network, then it won't work at all when you change the SIM card).

References

1. 3GPP TS 03.22 V8.7.0
2. 3GPP TS 05.08 v8.23.0