AP-6000

1
AP-6000
2
Air Protocol Analyzer
3

• Main Characteristics Benefits

4
System Diagram

• The AP-6000 is designed to analyze the air
  interface (Uu) in WCDMA Networks

Iu CS/PS
Iub
DL
Iub
Traced UE
UL
UL
Uu
DL

• Does not require any physical connection to UE,
  Node B or target Network

DL Downlink UL Uplink Uu UE/UTRAN
Interface Iub Node B/RNC Interface
5
Main Characteristics

• Displays the signaling and information of Layers
  1, 2 and 3 of the UTRAN Air Protocol
• Provides Control Plane and User Plane information
• Fully compliant with 3GPP specifications
  Release 99, 5 and 6 (HSUPA)

6
Main Characteristics

• UE BTS vendor Independent
• Auto Manual modes
• Follows UE throughout the whole communication
  process by decoding RRC messages

7
Benefits

• Allows a complete analysis of the Uu protocol as
  well as data for higher level applications
• Auto mode a fast way to find a Cell, UE and
  start analysis
• Manual mode parameter setting provides RD
  engineers with a flexible and powerful tool to
  analyze a wide range of scenarios

8
Benefits

• Provides an independent and reliable source for
  protocol analysis between UE and Node B
• Off-line analysis provides RD and IOT engineers
  critical data
• Form L1 signaling to L2, L3 messages, C-plane and
  U-plane
• Reduce testing time time to market

9

• AP-6000 basics
• HW and SW

10
System Configuration

• The Main Unit requires the Console PC for
  configuration and operation
• Off-line data is analyzed in console PC
• Full stand alone operation of Main Unit is under
  development. Itll use the Touch Screen LCD for
  Main Unit configuration and call capture

LAN Connection
On Board PC Boards
IQ Inputs
RF Inputs
Touch Screen LCD
Main Unit
Console PC
11
RF Configuration

• Integrated RF units monitor WCDMA, GSM and
  InterRAT calls
• Each RF units captures the UL and DL radio
  signals between UE and Node Bs

RF Unit 3 DL UL GSM (Optional)
RF Unit 2 DL UL WCDMA
RF Unit 1 DL UL WCDMA
12
RF Specifications

• WCDMA Dual RF / Quad Band units provide the
  capacity to follow
  inter-frequency HO
• GSM Option

13
Boards

• The AP-6000 has an on-board PC to control all the
  Main Units functions
• 4 Standard WCDMA Boards 1 Optional GSM Board
• Call information is stored in Console PC

On-board PC
WCDMA UL Board
WCDMA DL Board 1 (RF Unit 1)
WCDMA DL Board 2 (RF Unit 2)
WCDMA HSDPA Board
GSM Board (Optional)
14
Boards

• Boards configuration is stored in CF memories
• HSUPA option does not require a separate board

On-board PC
Each board stores its configuration and code in
CF memories
15
Software

• The AP-6000 system software consist of five parts
• Console software running on Windows XP
• Firmware running on Main Unit
• FPGA configuration in Main Units Boards
• DSP code in Main Units Boards
• On-board Main Units PC
• Software uploads are made through the Console PC

16
In/Out Synch Interfaces

• The AP-6000 provides input and output interfaces
  to synchronize with other equipments
• Output 10msec pulse controlled by DL or UL RRC
  messages
• Input 10msec or 100µsec pulse

Sync In
Sync Out
17

• Understanding AP-6000s operation and basic
  features

18
Basic Features

• The AP-6000 has three main steps in its
  operation
• Configuration
• Real Time Capture
• Off-line Analysis

19
Basic Features

• Configuration
• Allows to set up parameters on how the AP is
  going to work
• Band Frequency
• Auto or Manual modes
• Which UE to follow

20
Basic Features

• Real Time Capture
• Trace a particular UE following RRC messages
• Off-line Analysis
• The console software provides several ways to
  display signaling information as well as control
  and user plane data
• Allows to export data such as SIB, TPC at frame
  and time slot level, U-plane data

21
Configuration Auto Mode

• The first step is to create a SCENE and configure
  basic parameters
• The SCENE will contain all the calls we record
• A file is created with each SCENE and the calls
  are automatically saved

Auto or Manual Mode
Band and DL Frequency
of cells to be detected (idle mode)
22
Configuration Auto Mode

• Once the Band and Frequency have been set, the
  SCH can be detected

SCH Profile

• Node Bs detected with
• SCH strength in dBm
• Primary SCR Code

The information displayed here is from a
simulation.
23
Configuration Auto Mode

• Configure if the call is going to be carried out
  in one or two frequencies (Inter-Freq HO)
• In the case of Inter-Freq HO, AP only needs to
  know the first DL Freq. Changes in Freq are
  followed according to InterFreqMeasurmentInfo, or
  RRC messages containing info on the second Freq.

Single or Multiple Freq
24
Configuration Auto Mode

• There are three ways to trace a UE
• First FACH
• First RACH
• Specify a UE ID by its IMSI, TIMSI, P-TIMSI or
  IMEI
• The console SW allows to store the 16 most used
  UEs

Way to trace a UE
25
Configuration Auto Mode

• AP has built in the KASUMI algorithm used for
  encryption in UMTS
• In order to properly decode all messages the AP
  needs to know the CK used by the UE
• Four options
• Enter the CK values
• Use a Test USIM and enter the K value
• Use the RS-232 port in the Console PC to enter
  the CK values from the UE as they change during
  the call. This required a special modified UE
  with access to CK values
• USIM reader

Ciphering Options
26
Configuration Auto Mode

• Fifth option
• Using a UE that does not support ciphering
• Note If CKs are unknown it is possible to decode
  the common channels but not the dedicated channels

Ciphering Options
27
Real Time Capture

• Start recording a call
• Once the configuration is done, it is time to
  record a call
• Recording a call is known as a TAKE
• There can be many TAKES in on SCENE file
• Each individual TAKE can be saved without the
  need of keeping the original SCENE file

Start a Take
28
Real Time Capture

• Real time Window
• Physical and Transport Channel signaling is shown
  during a Take

HSDPA Channels
WCDMA Channels
RRC Messages
HSUPA Channels
29
Real Time Capture

• Real time Window
• The yellow vertical timeline advances with every
  frame, that is every 10msec
• For WCDMA channels, each line represents a
  Transport Channel
• For HSDPA/HSUPA channels, each line represents a
  2msec sub-frame

Timeline
Timeline
Tr Channels
2msec sub-frames
Note Green CRC-OK or ACK Red CRC-Error or
NACK Yellow Data w/o CRC or None Depending
on the type of channel
30
Off-line Analysis

• The Off-line Analysis give the options to see
  detailed information in all 3 layers as well as
  control and user plane
• RRC Messages
• Power control
• PDUs
• PDU protocol data unit
• SDU service data unit

31
Off-line Analysis

• Main Screens
• Layer 1 Graphic View
• Layer 1 Data Dump
• BCH Analysis
• C-Plane RRC/NAS Analysis
• U-Plane Analysis
• Online Messages
• C-Plane RLC Analysis
• U-Plane RLC Analysis

32
Off-line Analysis

• Layer 1 Graphic View
• It provides a similar view to the Real Time
  Window plus Transport and Physical channels data

Physical and Transport Channels signaling
Transport Channels Data
Physical Channels Data (Control information TFCI,
TPC)
33
Off-line Analysis

• Layer 1 Data Dump
• It provides information on the selected Transport
  and Physical channels

Transport Channels
Filter
Physical Channels (Control information TFCI, TPC)
34
Off-line Analysis

• C-Plane RRC/NAS Analysis

• RRC Messages with RLC sequence No. RLC Control
  PDUs
• RRC/NAS ASN.1 display
• RRC PDU data
• RLC MAC Layer data
• Transport Channel data
• Efficient way to Troubleshooting

RRC Messages
RB Inf.
L3 SDU
L2 MAC SDU
L2 RLC SDU
RRC Messages ASN.1
Tr CH Data
35
Off-line Analysis

• U-Plane Analysis

• U-Plane data in units of RLC SDUs sequence No.
• IPv4 Header display with Hex and ASCIIdump of
  data payload
• RLC, MAC, Tr CH layer data

• Detailed TCP/IP Analysis
• Evaluation for UE application

36
Off-line Analysis

• C U-Plane RRC/NAS Analysis

• Statistic information
• Total Data PDU
• Total Data PDU with Polling bit
• Resend Data
• Reset PDU
• Reset ACK PDU
• Status PDU

Statistical Information
37
Off-line Analysis

• C U-Plane RRC/NAS Analysis

• RLC sequence information
• Direction (UL/DL)
• Transaction of RLC PDU
• Resend data, Ack Nack PDU
• Reason of Re-send is estimated
• Evaluate Service Quality

RRC Messages ASN.1
38

• Options

39
Options

• HSUPA Analysis Software
• Software upgrade to support HSUPA. No additional
  hardware required (Based on 3GPP Dec 2005
  version)
• InterRAT Monitoring (GSM/GPRS)
• Factory upgrade of AP-6000 for InterRAT
  monitoring. Additional GSM/GPRS module, RF unit
  and InterRAT monitoring software is required
• Off-line viewer software license
• Off line viewer can process AP log files on a
  local PC. It has the same analyzing features of
  the console software

40
Options

• U-plane data PCAP format file export
• File export function. PCAP format file can be
  created from user plane data in the AP log
  database
• LSC format file export
• File export function. LSC format file can be
  created form RRC message on the AP log database
  (Anritsu LSC software can use the file as input)
• U-plane data PPP on UDI PCAP format file export
• File export function. PCAP format file can be
  created from PPP protocol data on UDI user plane
  in AP log database
• UDI - Unrestricted Digital Information This is
  an ISDN (Integrated Services Digital Network)
  term to describe the ability to transfer any bit
  pattern over a digital channel.

41
Options

• SS (Supplementary Services) message analysis
• Analysis function for upper layer message on
  control plane data
• U-plane data H.245 decode
• User plane data analysis function. TV call
  protocol H.245 header can be decoded and
  displayed on the user plane data analysis window
• MBMS
• HSPA
• Remote Control
• Customization Special requirements can be
  evaluated and implemented

42
Options LSC Format File Export

• LSC format file export
• Conversion of AP log file data to LSC format
• Anritsu LSC software generates test scenario for
  MD8480 signaling tester
• Reduce programming time

Note The LSC Log Scenario Converter software
is sold by Anritsu Engineering
43
Options LSC Format File Export

• LSC format file export

lsc_bch.txt
lsc_flow.txt
Scenario Compiler
Note The LSC Log Scenario Converter software
is sold by Anritsu Engineering
44
Options U-plane Data Conversion

• U-plane data PPP on UDI PCAP format file export
• U-plane data PPP on UDI packets can be exported
  to PCAP format file to be analyzed by third party
  TCP-IP analysis software i.e. Ethereal
• Packet data is a digital circuit packet
  communication on UDI

45
Options GSM

• GSM/InterRAT
• Allows the AP monitoring GSM calls as well as
  InterRAT WCDMA ??GSM handovers
• Factory upgrade option for standard AP-6000
• Additional board, RF Unit and Software

GSM DL
GSM BS
WCDMA Node B
WCDMA DL
46

• FAQs and AP answers

47
FAQs - Handovers

• How do I see Inter-Frequency HO?
• Real Time Window and Off-line The AP displays
  DPCH 1 and 2 corresponding to RF1 and RF2 during
  Inter-Frequency Handover
• Online RRC messages such as PhysicalChannelReconfi
  guration

Inter-Freq HO shown in the DL
Inter-Freq HO shown in the UL
48
FAQs - Handovers

• How do I see Inter-Frequency HO?
• Off-line Detailed RRC message sequence and ASN.1
  details

RRC messages list PhysicalChannelReconfiguration
RRC messages list ASN.1
49
FAQs - Handovers

• How do I see Intra-Frequency HO?
• Real Time Window and Off-line The AP combines
  all DPCH involved in the Intra-Freq HO so it is
  not possible to see the HO in a graphical way
• Off-line It is possible to see the RRC messages
  such as ActiveSetUpdate adding or releasing RLs
• In this case new RL is added at ITC 46076 with
  SCR 18

50
FAQs - Handovers

• Then, we can see in Layer 1 Data Dump Physical
  CHs that at ITC 4607B, 50msec later, there are 3
  DPCCHs (0, 1 and 2) in the DL

• It is possible to see detailed information such
  as RSSI, RSCP and SFN

51
FAQs Power Control

• How do I see Power Control?
• Power Control can be seen in two different ways
• Method 1
• Using the TPC Save option for DPCH or UDPCH
• It generates a .CSV file that can be opened with
  Excel and display the TPC at a Frame level
• The TPC is calculated as an average of TPC bits
  in each time slot
• The result gives an indication in the power in a
  frame was up or down

52
FAQs Power Control
Method 1 Result
53
FAQs Power Control

• How do I see Power Control?
• Method 2
• Layer 1 Data Dump Physical CHs contains the TPC
  information for each Transport Channel at a time
  slot level
• Using the Log ?Save option the data can be
  exported to a .CSV file that can be opened with
  Excel

54
FAQs Power Control

• How do I see Power Control?
• Note
• RSSI and RSCP show in the DL are in dBm
• RSCP in the UL is calculated on the UL-DPCH but
  it is not an absolute value
• UL RSCP in the range of -90dBm -/5 is accurate

DL RSSI RSCP
UL RSCP
55
FAQs Connection Setup

• How do I know if the connection setup sequence is
  correct?
• Checking signalling and messages during
  connection procedure
• AP can show if a message is missing
• Ability to see PRACH preamble signature and AICH
  response

56
FAQs Connection Setup

• How do I know if the connection setup sequence is
  correct?
• AP can indicate if PRACH preamble and/or message
  is transmitted at an illegal time (3GPP specs.
  25.211 / 7.1 7.3)

57
FAQs - Sensitivity

• What is the AP-6000 sensitivity?
• The AP-6000 complies with the 3GPP specifications
  25.101 User Equipment (UE) radio transmission
  and reception (FDD) section 7.3.1 Receiver
  characteristics - Reference sensitivity level -
  Minimum requirement
• BER test are performed to verify AP compliance
  with 25.101
• Tests are carried out in all frequency bands
  supported by the AP, for both RF Units and in the
  DL UL

58
FAQs - Sensitivity

• Sample BER Tests Results - DL

1.9GHz UNIT 1 BER Downlink (DCH 12.2kbps)
59
FAQs - Sensitivity

• Sample BER Tests Results - UL

1.9GHz UNIT 1 BER Uplink (DCH 12.2kbps)
60
FAQs - Sensitivity

• Recommended AP-6000 / UE RF connection - Lab

Attenuator lt 10dB
Circulator
WCDMA Network Emulator
UE
Power Divider
AP6000
61
FAQs - Sensitivity

• Recommended AP-6000 / UE RF connection - Field

Shared RF between UE and AP-6000
UE
AP6000
62
Pacific Rim Mobile Technologies