1. AP-6000

2. PRMT Confidential Proprietary 1

3. 2 Main Characteristics & Benefits

4. PRMT Confidential Proprietary 3 The AP-6000 is designed to analyze the air interface (Uu) in WCDMA Networks DL – Downlink UL – Uplink Uu – UE/UTRAN Interface Iub – Node B/RNC Interface Iu CS/PS Node B RNC Iub UL DL UL DL Traced UE AP-6000 Air Protocol Analyzer Node B Does not require any physical connection to UE, Node B or target Network Uu

5. PRMT Confidential Proprietary 4 Displays the signaling and information of Layers 1, 2 and 3 of the UTRAN Air Protocol Provides Control Plane and User Plane information Compliant with 3GPP specifications – WCDMA, HSUPA, HSDPA, HSPA+

6. PRMT Confidential Proprietary 5 UE & BTS vendor Independent Auto & Manual modes Follows UE throughout the whole communication process by decoding RRC messages

7. PRMT Confidential Proprietary 6 Allows a complete analysis of the Uu protocol as well as data for higher level applications Auto mode: a fast way to find a Cell, UE and start analysis Manual mode: parameter setting provides R&D engineers with a flexible and powerful tool to analyze a wide range of scenarios

8. PRMT Confidential Proprietary 7 Provides an independent and reliable source for protocol analysis between UE and Node B Off ‑ line analysis provides R&D and IOT engineers critical data: –Form L1 signaling to L2, L3 messages, C ‑ plane and U ‑ plane  Reduce testing time & time to market

9. PRMT Confidential Proprietary 8 AP-6000 basics HW and SW

10. PRMT Confidential Proprietary 9 The Main Unit requires the Console PC for configuration and operation Off-line data is analyzed in console PC Full stand alone operation of Main Unit is under development. It’ll use the Touch Screen LCD for Main Unit configuration and call capture LAN Connection Main Unit On Board PC & Boards IQ Inputs RF Inputs Touch Screen LCD Console PC

11. PRMT Confidential Proprietary 10 Integrated RF units monitor WCDMA, GSM/GPRS/EDGE and InterRAT calls Each RF units captures the UL and DL radio signals between UE and Node Bs RF Unit 2 – DL & UL WCDMA RF Unit 1 – DL & UL WCDMA RF Unit 3 – DL & UL GSM (Optional)

12. PRMT Confidential Proprietary 11 WCDMA: Dual RF / Quad Band units provide the capacity to follow inter-frequency HO GSM/GPRS/EDGE Option

13. PRMT Confidential Proprietary 12 The AP-6000 has an on-board PC to control all the Main Unit’s functions 4 Standard WCDMA Boards + 1 Optional GSM Board Call information is stored in Console PC GSM Board (Optional) WCDMA HSDPA Board WCDMA DL Board 2 (RF Unit 2) WCDMA DL Board 1 (RF Unit 1) WCDMA UL Board On-board PC

14. PRMT Confidential Proprietary 13 Board’s configuration is stored in CF memories HSUPA option does not require a separate board Each board stores its configuration and code in CF memories On-board PC

15. PRMT Confidential Proprietary 14 The AP-6000 provides input and output interfaces to synchronize with other equipments Output: 10msec pulse controlled by DL or UL RRC messages Input: 10msec or 100µsec pulse Sync In Sync Out

16. PRMT Confidential Proprietary 15 Understanding AP-6000’s operation and basic features

17. PRMT Confidential Proprietary 16 The AP-6000 has three main steps in its operation: –Configuration –Real Time Capture –Off-line Analysis

18. PRMT Confidential Proprietary 17 –Configuration Allows to set up parameters on how the AP is going to work Band & Frequency Auto or Manual modes Which UE to follow

19. PRMT Confidential Proprietary 18 –Real Time Capture Trace a particular UE following RRC messages –Off-line Analysis The console software provides several ways to display signaling information as well as control and user plane data Allows to export data such as SIB, TPC at frame and time slot level, U-plane data

20. PRMT Confidential Proprietary 19 The first step is to create a SCENE and configure basic parameters The SCENE will contain all the calls we record A file is created with each SCENE and the calls are automatically saved Auto or Manual Mode Band and DL Frequency # of cells to be detected (idle mode)

21. PRMT Confidential Proprietary 20 Once the Band and Frequency have been set, the SCH can be detected SCH Profile * Node Bs detected with: SCH strength in dBm * Primary SCR Code * * The information displayed here is from a simulation.

22. PRMT Confidential Proprietary 21 Configure if the call is going to be carried out in one or two frequencies (Inter-Freq HO) In the case of Inter-Freq HO, AP only needs to know the first DL Freq. Changes in Freq are followed according to InterFreqMeasurmentInfo, or RRC messages containing info on the second Freq. Single or Multiple Freq

23. PRMT Confidential Proprietary 22 There are three ways to trace a UE –First FACH –First RACH –Specify a UE ID by its IMSI, TIMSI, P-TIMSI or IMEI The console SW allows to store the 16 most used UEs Way to trace a UE

24. PRMT Confidential Proprietary 23 AP has built in the KASUMI algorithm used for encryption in UMTS In order to properly decode all messages the AP needs to know the CK used by the UE Four options: –USIM reader –Use a Test USIM and enter the K value –Enter the CK values –Use the RS-232 port in the Console PC to enter the CK values from the UE as they change during the call. Ciphering Options Note: If CKs are unknown it is possible to decode the common channels but not dedicated channels

25. PRMT Confidential Proprietary 24 Start recording a call –Once the configuration is done, it is time to record a call Recording a call is known as a TAKE There can be many TAKES in on SCENE file Each individual TAKE can be saved without the need of keeping the original SCENE file Start a Take

26. PRMT Confidential Proprietary 25 Real time Window –Physical and Transport Channel signaling is shown during a Take HSDPA Channels HSUPA Channels WCDMA Channels RRC Messages

27. PRMT Confidential Proprietary 26 Real time Window –The yellow vertical timeline advances with every frame, that is every 10msec –For WCDMA channels, each line represents a Transport Channel –For HSDPA/HSUPA channels, each line represents a 2msec sub-frame Timeline Tr Channels Timeline 2msec sub-frames Note: Green:CRC-OK or ACK* Red:CRC-Error or NACK* Yellow:Data w/o CRC or None* * Depending on the type of channel

28. PRMT Confidential Proprietary 27 The Off-line Analysis give the options to see detailed information in all 3 layers as well as control and user plane RRC Messages Power control PDUs PDU protocol data unit SDU service data unit

29. PRMT Confidential Proprietary 28 Main Screens: –Layer 1 Graphic View –Layer 1 Data Dump –BCH Analysis –C-Plane RRC/NAS Analysis –U-Plane Analysis –Online Messages –C-Plane RLC Analysis –U-Plane RLC Analysis

30. PRMT Confidential Proprietary 29 Layer 1 Graphic View –It provides a similar view to the Real Time Window plus Transport and Physical channels data Physical and Transport Channels signaling Transport Channels Data Physical Channels Data (Control information TFCI, TPC)

31. PRMT Confidential Proprietary 30 Layer 1 Data Dump –It provides information on the selected Transport and Physical channels Transport Channels Physical Channels (Control information TFCI, TPC) Filter

32. PRMT Confidential Proprietary 31 C-Plane RRC/NAS Analysis RRC Messages L3 SDU L2 MAC SDU L2 RLC SDU Tr CH Data RRC Messages ASN.1 RB Inf. RRC Messages with RLC sequence No. & RLC Control PDUs RRC/NAS ASN.1 display RRC PDU data RLC & MAC Layer data Transport Channel data Efficient way to Troubleshooting

33. PRMT Confidential Proprietary 32 U-Plane Analysis U-Plane data in units of RLC SDUs & sequence No. IPv4 Header display with Hex and ASCII dump of data payload RLC, MAC, Tr CH layer data TCP/IP analysis (by Ethereal) Detailed TCP/IP Analysis Evaluation for UE application

34. PRMT Confidential Proprietary 33 C & U-Plane RLC Analysis Statistic information Total Data PDU Total Data PDU with Polling bit Resend Data Reset PDU Reset ACK PDU Status PDU Statistical Information

35. PRMT Confidential Proprietary 34 C & U-Plane RLC Analysis RRC Messages ASN.1 RLC sequence information Direction (UL/DL) Transaction of RLC PDU Resend data, Ack & Nack PDU Reason of Re-send is estimated Evaluate Service Quality

36. PRMT Confidential Proprietary 35 Options

37. PRMT Confidential Proprietary 36 HSUPA Analysis Software Software upgrade to support HSUPA. No additional hardware required (Based on 3GPP Dec 2005 version) InterRAT Monitoring (GSM/GPRS/EDGE) Factory upgrade of AP-6000 for InterRAT monitoring. Additional GSM/GPRS module, RF unit and InterRAT monitoring software is required. EDGE option is just a SW upgrade to the GSM/GPRS one. Off-line viewer software license Off line viewer can process AP log files on a local PC. It has the same analyzing features of the console software

38. PRMT Confidential Proprietary 37 U-plane data PCAP format file export File export function. PCAP format file can be created from user plane data in the AP log database LSC format file export File export function. LSC format file can be created form RRC message on the AP log database (Anritsu LSC software can use the file as input) U-plane data PPP on UDI PCAP format file export File export function. PCAP format file can be created from PPP protocol data on UDI user plane in AP log database UDI - Unrestricted Digital Information This is an ISDN (Integrated Services Digital Network) term to describe the ability to transfer any bit pattern over a digital channel.

39. PRMT Confidential Proprietary 38 SS (Supplementary Services) message analysis Analysis function for upper layer message on control plane data U-plane data H.245 decode User plane data analysis function. TV call protocol H.245 header can be decoded and displayed on the user plane data analysis window MBMS HSPA+ Remote Control Customization: Special requirements can be evaluated and implemented

40. PRMT Confidential Proprietary 39 LSC format file export Conversion of AP log file data to LSC format Anritsu LSC software generates test scenario for MD8480 signaling tester Reduce programming time Note: The “LSC Log Scenario Converter” software is sold by Anritsu Engineering LSC Format Files lsc_bch.txt lsc_flow.txt Data conversion software AP log file to LSC format Log Scenario Covert Software loads LSC files and creates test scenario for MD8480 Anritsu MD8480 Test Mobile Lab Scenario Duplication

41. PRMT Confidential Proprietary 40 LSC format file export Note: The “LSC Log Scenario Converter” software is sold by Anritsu Engineering lsc_bch.txt lsc_flow.txt Scenario Compiler

42. PRMT Confidential Proprietary 41 U-plane data PPP on UDI PCAP format file export U-plane data PPP on UDI packets can be exported to PCAP format file to be analyzed by third party TCP-IP analysis software – i.e. Ethereal Packet data is a digital circuit packet communication on UDI PCAP Format.log Data conversion software AP log file to PCAP format TCP-IP Analysis software (3rd party software) TCP header TCP-IP protocol sequence TCP-IP user data Web access data e-mail data

43. PRMT Confidential Proprietary 42 GSM/GPRS/InterRAT Allows the AP monitoring GSM calls as well as InterRAT WCDMA  GSM handovers Factory upgrade option for standard AP-6000 Additional board, RF Unit and Software GSM BS GSM DL GSM/WCDMA Capable UE AP-6000 With GSM Option WCDMA Node B WCDMA DL

44. PRMT Confidential Proprietary 43 FAQ –Handovers –Power Control –Connection Setup –Sensitivity

45. PRMT Confidential Proprietary 44 How do I see Inter-Frequency HO? –Real Time Window and Off-line: The AP displays DPCH 1 and 2 corresponding to RF1 and RF2 during Inter-Frequency Handover –Online RRC messages such as PhysicalChannelReconfiguration Inter-Freq HO shown in the DL Inter-Freq HO shown in the UL

46. PRMT Confidential Proprietary 45 How do I see Inter-Frequency HO? –Off-line: Detailed RRC message sequence and ASN.1 details RRC messages list: PhysicalChannelReconfiguration RRC messages list ASN.1

47. PRMT Confidential Proprietary 46 How do I see Intra-Frequency HO? –Real Time Window and Off-line: The AP combines all DPCH involved in the Intra-Freq HO so it is not possible to see the HO in a graphical way –Off-line: It is possible to see the RRC messages such as ActiveSetUpdate adding or releasing RLs –In this case new RL is added at ITC 46076 with SCR 18

48. PRMT Confidential Proprietary 47 How do I see Intra-Frequency HO? –Then, we can see in Layer 1 Data Dump Physical CHs that at ITC 4607B, 50msec later, there are 3 DPCCHs (0, 1 and 2) in the DL –It is possible to see detailed information such as RSSI, RSCP and SFN

49. PRMT Confidential Proprietary 48 How do I see Inter-System HO (WCDMA  GSM) ? –Real Time Window: The AP will show the DPCH information for WCDMA calls and no information when the call goes to GSM –Off-line: See the RRC message “INTER SYSTEM TO UTRAN HANDOVER COMMAND” in the “GSM C-Plane Analysis” tab, and “HandoverFromUTRANCommand-GSM” in the “C-Plane RRC/NAS Analysis” tab and/or Select the "WCDMA/GSM Message List" tab and select from the pull down menus “DisplayMode  GSM U-Plane Analysis  MIX View” and “DisplayMode  WCDMA/GSM Message List  MIX View”

50. PRMT Confidential Proprietary 49 How do I see Inter-System HO (WCDMA  GSM) –"WCDMA/GSM Message List" tab, RRC message “HandoverFromUTRANCommand-GSM”

51. PRMT Confidential Proprietary 50 How do I see Inter-System HO (WCDMA  GSM) –"WCDMA/GSM Message List" tab, RRC message “INTER SYSTEM TO UTRAN HANDOVER COMMAND”

52. PRMT Confidential Proprietary 51 How do I see Power Control? Power Control can be seen in two different ways: Method 1 –Using the TPC Save option for DPCH or UDPCH –It generates a.CSV file that can be opened with Excel and display the TPC at a Frame level –The TPC is calculated as an average of TPC bits in each time slot –The result gives an indication in the power in a frame was up or down

53. PRMT Confidential Proprietary 52 Method 1 Result

54. PRMT Confidential Proprietary 53 How do I see Power Control? Method 2 –Layer 1 Data Dump Physical CHs contains the TPC information for each Transport Channel at a time slot level –Using the Log  Save option the data can be exported to a.CSV file that can be opened with Excel

55. PRMT Confidential Proprietary 54 How do I see Power Control? Note: –RSSI and RSCP show in the DL are in dBm –RSCP in the UL is calculated on the UL-DPCH but it is not an absolute value –UL RSCP in the range of -90dBm -/+5 is accurate DL RSSI & RSCP UL RSCP

56. PRMT Confidential Proprietary 55 How do I know if the connection setup sequence is correct? –Checking signalling and messages during connection procedure –AP can show if a message is missing –Ability to see PRACH preamble signature and AICH response

57. PRMT Confidential Proprietary 56 How do I know if the connection setup sequence is correct? –AP can indicate if PRACH preamble and/or message is transmitted at an illegal time (3GPP specs. 25.211 / 7.1 & 7.3) 1 UL PRACH Preamble 2 DL AICH 3 UL RRC Connection Request (PRACH message) 4 DL RRC Connection Setup (S-CCPCH)

58. PRMT Confidential Proprietary 57 What is the AP-6000 sensitivity? –The AP-6000 complies with the 3GPP specifications 25.101 “User Equipment (UE) radio transmission and reception (FDD)” section 7.3.1 “Receiver characteristics - Reference sensitivity level - Minimum requirement” –BER test are performed to verify AP compliance with 25.101 –Tests are carried out in all frequency bands supported by the AP, for both RF Units and in the DL & UL

59. PRMT Confidential Proprietary 58 –Sample BER Tests Results - DL 1.9GHz – UNIT 1 BER Downlink (DCH 12.2kbps)

60. PRMT Confidential Proprietary 59 –Sample BER Tests Results - UL 1.9GHz – UNIT 1 BER Uplink (DCH 12.2kbps)

61. PRMT Confidential Proprietary 60 –Recommended AP-6000 / UE RF connection - Lab UE WCDMA Network Emulator AP6000 Attenuator < 10dB Circulator Power Divider

62. PRMT Confidential Proprietary 61 –Recommended AP-6000 / UE RF connection - Field AP6000 Shared RF between UE and AP-6000 UE Node B

63. Pacific Rim Mobile Technologies