M5 Mobile UE Tester
Base Station Emulator for 4G eNodeB, 5G gNodeB RAN and mobile core to test UE devices including CPE router, phone, modem & IoT devices
M5 Mobile UE Tester
Base Station Emulator for 4G eNodeB, 5G gNodeB RAN and mobile core to test UE devices including CPE router, phone, modem & IoT devices
Overview
Valid8's Mobile UE Tester is a hardware-based solution that mimics 4G & 5G RAN along with a customizable core network emulator to test user equipment (UE) devices
What we Can Do For You
Lower Cost Per Test: Valid8 has continued to add automation and simplicity to their technology, driving down the cost per test.
Increased Test Environment Flexibility: By allowing the ability to configure the simulated environment to meet specific testing needs, users can safely perform penetration tests and other security tests that could not typically be performed on a public network.
Comprehensive Test Menu: Enables testing of a variety of data-centric cellular devices including: IoT,embedded, modems, routers & hotspots.
Actionable/Collaborative Reports : From a user-friendly interface screen users can quickly see test results, uncover any issues, and drill-down as needed.Historical tracking allows for trend analysis and reports. Reports can be easily shared with the rest of the team, or integrated into a 3rd party reporting tool.
Why we’re Different
- Software based solution runs on high-end Valid8 hardware for RAN emulation
- Components can also be run on customer hardware or in a Virtual Machine or the Cloud environment (e.g. Amazon AWS) allowing maximum versatility and performance
- Web-based Graphical User Interface provides customer with intuitive, easy access via browser
- API’s used (REST, HTTP) enable seamless integration with automation test systems and other equipment
- Stateful modeling provides accurate emulation of network elements
- Turnkey technology, including SIM cards to test UE CPE devices
- All-in-one method to test any band up to 6GHz
Features
- Emulates the RAN with OTA connection available for UEs and IoT devices
- Emulates some or all of the core network, exposing all internal interfaces
- Test the bands that may be unavailable in your geographic region
- Attach/Detach,IPv4/IPv6, Normal/Emergency, network rejection, create bearers, perform fuzzing
- 3rd party OTT tests incl. iPerf, nmap etc.
- Emulators available per subsystem (MME, AMF, HSS, PCRF, MSC, SGSN, SGW, PGW, etc.)
- True stateful simulation
- Handover support on X2 and S1 (requires 2 eNodeB option)
- Signaling request/response messages for call handling, mobility management, authentication, QoS
- Report on media received, call connect time, call duration, jitter, packet loss
- Generate valid and invalid/negative messages and call-scenarios (fully editable scenarios)
- Supports sending invalid messages including malformed, dropped, and misordered packets
- Check parameters in messages from SUT and flag errors
- 3GPP-compliant interfaces
PHY Layer
- LTE release 14 compliant.
- FDD and TDD configurations.
- Supported bandwidths: 1.4, 3, 5, 10, 15 and 20 MHz.
- Handle several cells in intra-band or inter-band configurations.
- Transmission modes: 1 (single antenna) and 2 to 10 (MIMO 2x2).
- Wideband CQI/PMI reports.
- HARQ support.
- Timing measurement thru the PRACH.
- Closed-loop UE power control.
- Frequency based MMSE equalizer.
- Highly optimized software turbo decoder.
- PAPR reduction support.
- Support of other radio heads can be added with an external shared library.
- Positioning Reference Signals (PRS) support.
- CSI-RS support.
- Multi-cluster PUSCH allocation.
- PUCCH 3 and PUCCH channel selection support.
- Carrier Aggregation support with cross carrier scheduling (tested with 3 DL channels, supports up to 4 DL channels).
- Mixed FDD-TDD Carrier Aggregation support.
- CoMP testing features (DMRS scrambling identity and QCL parameters can be selected).
- 256QAM DL support for PDSCH and MBMS.
- 1024QAM DL support for PDSCH.
- 256QAM UL support for PUSCH.
- Support of release 11 TDD special subframe configurations 7 and 9.
LTE Protocol Layer
- LTE release 14 compliant.
- Implements the MAC, RLC, PDCP and RRC layers.
- Proportionally fair MAC scheduler with QoS support.
- Support of full and half duplex UEs.
- DRX support.
- Number of active users only limited by the available bandwidth.
- Fully configurable System Information Blocks.
- Integrity check and encryption using AES, Snow3G and ZUC algorithms.
- Support of RRC measurement with measurement gap.
- Supports intra eNodeB, S1, X2 and EPS to 5GS handovers.
- QoS support with user selectable DRB configuration for each QCI.
- ROHC support (RTP, UDP and IP v1 profiles, unidirectional mode, no RTP CSRC, no IP extensions, no outer/inner IP). Chapter 2: Features 3
- Public Warning System (CMAS/ETWS) support.
- MBMS support.
- Support of all ciphering and integrity protection algorithms including ZUC. Note that ciphering is subject to export rules depending on your country.
- Category 0 UE support.
- eDRX support.
- EN-DC support.
- RRC release with redirection to NR SA cell support.
Related Video
LTE-M:
- Release 14 compliant
- Category M1 UE support.
- TM6 and TM9 support.
- FDD only (FDD and HD-FDD UEs are supported).
- Support of multiple CE levels (only CE-Mode A is supported).
- Support of message repetition for MPDCCH, PDSCH, PUCCH and PUSCH in full and half duplex. No message repetition for PRACH.
- Support of localized and distributed MPDCCH transmission.
- EPDCCH support for Category M1.
- No frequency hopping.
- Bandwidth must be >= 5 MHz for cells that also need to support Category 0 and above UEs.
- DRX support.
- eDRX support.
NB-IOT:
- NB-IoT release 14 compliant.
- Single-tone and multi-tone category NB1 and NB2 UE support.
- 15 kHz and 3.75 kHz subcarrier spacing are supported.
- All operation modes (in-band, guard band and standalone) are supported.
- Multiple NB-IoT and LTE cells can be used at the same time in the same eNodeB.
- Support of multiple coverage levels.
- Support of all NPDCCH, NPDSCH, NPUSCH and NPRACH configurations.
- Support of control plane CIoT optimization.
- Support of multi-DRB mode.
- Support of non-anchor carriers, including Release 14 NPRACH and paging on non-anchor carriers.
- Support of two HARQ processes.
- Support of interference randomisation.
- DRX support.
- eDRX support
NR
- NR release 15 compliant.
- FDD/TDD FR1 (< 6 GHz).
- Bandwidth: 5 to 100 MHz.
- Data subcarrier spacing: 15, 30, 60 or 120 kHz. SSB subcarrier spacing: 15, 30, 120 or 240 kHz. All SSB/data subcarrier spacing combinations are supported.
- Up to 4 layer downlink MIMO.
- Up to 4 layer uplink MIMO.
- 256QAM.
- All PUCCH and PRACH formats.
- PUSCH with and without transform precoding. PUSCH and PDSCH with user configurable DMRS and number of symbols.
- User configurable TDD UL/DL pattern and k0, k1 and k2 values.
- PDCCH with DCI 0 0, 0 1, 1 0 and 1 1.
- CSI-RS and TRS support.
- Scheduling Request support.
- PHY test mode: support for continuous PDSCH and PUSCH transmission.
- EN-DC support with dynamic activation/deactivation based on events.
- Dynamic LTE/NR DRB configuration.
- User selectable DRB configuration for each QCI/5QI.
- DRX support.
- RRC measurement with measurement gap support.
- PScell change support.
- Standalone support.
- Intra gNodeB, NG or 5GS to EPS handovers support.
- Public Warning System (CMAS/ETWS) support.
- Carrier aggregation support, both in NSA and SA operation.
- RRC release with redirection to EUTRA cell support.
- EPS fallback support.
Additional Videos
Subsystems
KPIs
Report Measurements
- Network Registration Attach time after Power-On
- Dedicated Bearer Setup Request Response Time
- Network Deregistration Detach time after Power-Off
- Authentication Request Response Time
- Tracking Area Update Request Response Time
- iPerf OTT QoS measurements
Report Counters
- Attach Requests/Successes/Fails
- Detach Requests/Successes/Fails
- Dedicated Bearer Requests/Successes/Fails
- Current Active Sessions/ Bearers
- Number of Sessions/ Bearers Created
- Attach Request Response Time
- Protocol Errors
- Message Timeouts
Configurable Parameters
Generic
- Frequency Band
- EARFN
- Channel Bandwidth 1.4, 3, 5, 10, 15, 20
- Includes CBRS band
- TDD/FDD
- Carrier Aggregation
- PLMN Mobile Country Code (MCC), Mobile Network Code (MNC)
- eNodeB Type IP Address S1 Interface
- IP Address eNodeB
- Primary DNS Address
- Secondary DNS Adress
- MAC Address Public Gateway
- GTP Tunnel IP Address and Port
- GTP Tunnel eNodeB IP Address
- Integrity Algorithm
- IP Address to assign UEs on LAN
CBRS
- FCC ID
- CBSD Category
- Call Sign
- User Id
- Air Interface
- CBSD Serial Number
- Meas Capability
- Installation Parameters
- Grouping Parameters
Automation API
User commands can be fully automated using REST API. This includes performing all test control functions as well as collecting results and metrics. It can be integrated into virtually any CI system via the HTTP API, including Jenkins, CircleCI, Gitlab and others. Includes Autom8 Python framework.
Scripting
The application’s subsystems can be edited directly in the browser using TDL. The Message Workshop allows for the creation of test scenarios directly from the hex stream of a remote capture, while the Composer graphical editor (being deployed for all products in 2021) will allow for creating customized call scenarios by dragging and dropping the call flow to meet your test needs.
This is some text inside of a div block.
PRODUCT OPTIONS
No items found.
M5 Mobile UE Tester
Use Cases
UE CPE Router Under Test
For testing CPE Router UE devices that have WiFi and cellular data capability, the 5G 4G 3G Base Station Emulators can provide OTA testing capability through its built-in base station and core network emulator. It enables end-to-end testing from WiFi to cellular.
Supported Scenarios:
Supports scenarios:
- Power on
- Attach
- Detach
- TAU
- Data Connection
Some of the key capabilities introduced with the M5 Mobile UE Tester Include:
- Lower Cost Per Test
- Increased Test Environment Flexibility
- Comprehensive Test Menu
- Actionable/Collaborative Reports
- End-to-end Over-the-Air performance test capability
- Includes RF base station
- Emulates all core network nodes and allows for data connection to external networks
UE IoT Device Under Test
For testing IoT devices that have cellular data capability, the 5G 4G Base Station Emulators can provide OTA testing capability through its built-in base station and core network emulator. It enables end-to-end testing.
Supported Scenarios:
Supports scenarios:
General
- Power on
- Attach
- Detach
- TAU
- Data Connection
Cyber Security suite:
- Bruteforce authentication attack (max number of authentication attempts within a certain time interval)
- Reuse Authentication credentials
- Require secure communication established
- Access without authentication
- Power outage resiliency
- Valid data input via APIs
Some of the key capabilities introduced with the M5/M1 Mobile UE Tester Include:
- Lower Cost Per Test
- Increased Test Environment Flexibility
- Comprehensive Test Menu
- Actionable/Collaborative Reports
- End-to-end Over-the-Air performance test capability
- Includes RF base station
- Emulates all core network nodes and allows for data connection to external networks
UE Phone Under Test
For testing phones that have cellular data capability, the 5G 4G 3G Base Station Emulators can provide OTA testing capability through its built-in base station and core network emulator. It enables end-to-end testing.
Supported Scenarios:
Supports scenarios:
- Power on
- Attach
- Detach
- TAU
- Data Connection
- VoLTE (with IMS Core option)
- SMS (with IMS Core option)
Some of the key capabilities introduced with the M5/M1 Mobile UE Tester Include:
- Lower Cost Per Test
- Increased Test Environment Flexibility
- Comprehensive Test Menu
- Actionable/Collaborative Reports
- End-to-end Over-the-Air performance test capability
- Includes RF base station
- Emulates all core network nodes and allows for data connection to external networks
M5 Mobile UE Tester
M5 Mobile UE Tester
Summary of Specifications
Specifications
Protocols
- 3GPP TS 23.401 (EUTRAN)
- 3GPP TS 24.301 (NAS)
- 3GPP TS 29.060 (GTPv1)
- 3GPP TS 29.274 (GTPv2-C)
- 3GPP TS 29.281 (GTPv1-U)
- 3GPP TS 36.413 (S1AP)
- 3GPP TS 36.414 (S1-U)
- IETF RFC5246 (TLS, Protocol (1.0, 1.1, 1.2))
- IETF RFC6101 (SSL, Protocol Version 3.0)
- IETF RFC793 (TCP)
- IETF RFC768 (UDP)
- IETF RFC4960 (SCTP)
- IETF RFC791 (IPv4)
- IETF RFC2460 (IPv6)
- IETF RFC3711 (SRTP)
- IETF RFC1035 (DNS)
- IETF RFC2131 (DHCP)
- IETF RFC3550 (RTP/RTCP)
- IETF RFC3261 (SIP)
UEs Supported
- Up to 1,000 per unit
4G Technical Specifications
- 3GPP Specification : LTE Release 8 support with features up to Release 14
- Frequency bands : All sub-6GHz bands, 400 - 6000 Mhz; including Bands 1 - 44 plus unlicensed 5Ghz band and others
- Bandwidth : 1.4, 3, 5, 10, 15 and 20 MHz, 200 KHz for NB-IoT
- Carrier Aggregation: up to 4 carriers in DL and 2 carriers in UL
- MIMO : DL MIMO support up to 2x2
- Modulation schemes : up to 256 QAM in DL and UL
- AS encryption and Integrity protection :AES, SNOW3G, ZUC
- Handover : Intra-freq, inter-freq and inter-band Handovers
- Group communication : eMBMS as per Rel10
- IoT : LTE category 0 and 1, LTE-M cat M1, NB-IoT cat NB1 and NB2 UE categories. NB-IoT subcarrier spacing 15 kHz & 3.75kHz, PSM and eDRX
- UE Categories : Cat0, Cat1, cat3, cat4, cat5, cat6, cat7, cat9, cat 10, cat11, cat12, cat13
- Number of active users : 1000+ UEs
- Number of active cells : 4 cells MIMO 2x2 or 2 cell MIMO 4x4
- IP traffic : simulation of TCP, UDP, RTP, HTTP and VoIP with configurable packet size as well as support of external applications such as iperf
- FDD and TDD configurations
- Handle several cells in intra-band or inter-band configurations
- Transmission modes: 1 (single antenna) and 2x2 MIMO
- 256QAM DL support for PDSCH and MBMS
- RF power output < 10 dBm
- Max RF input power: -10 dBm
- 4 SMA female (TX1, TX2, RX1, RX2), AC coupled
- 1 SMA female (GPS antenna with 3.3V DC power supply)
- ADC/DAC Sample Rate: 61.44 MS/s
- ADC/DAC Resolution: 12 bits
- Frequency Accuracy: 2 ppm
- LTE 20MHz 64QAM EVM < 2 %rms (f < 2.6 GHz)
- LTE 20MHz 64QAM EVM < 4 %rms (f < 3.5 GHz)
- Support of release 11 TDD special subframe configurations 7 and 9
- WINNF-TS-0016
5G Technical Specifications
- 3GPP Specification : Release 15
- Frequency bands : FDD/TDD FR1 All sub-6GHz bands, 400 - 6000 Mhz; including Bands 1 - 44 plus unlicensed 5Ghz band and others
- Bandwidth : up to 50 MHz
- Carrier Aggregation: up to 4 carriers in DL and 2 carriers in UL
- MIMO : DL MIMO support up to 2x2
- Modulation schemes : up to 256 QAM in DL and UL
- Subcarrier spacing : All SSB/data subcarrier spacing combination
- Supported Modes : NSA and SA
- NSA NR split bearer : 3, 3a, 3x
- Use case : eMBB
- Number of active users : 3 UE
- Number of active cells : up to 4 5G cells or 4 4G cells
Hardware
- Intel-based; scalable to meet performance needs
Operating System
- Protocol Engine (Linux-based)
User Interface
- Browser-based, touch-optimized graphical user interface
Automation
- HTTP API
Max output power
- < 10 dBm (10 mW)
Connector types
- Femtocell: SMA female
LAN Connectivity
- 1x10Gbps
- 4x1Gbps
Hardware dimensions
- M5: 3.5"H x 17.2"W x 25.5”D; appx. 16.7lb
Power supply
- M5: 520W AC to DC, 100 - 240v
Product Details
Disclaimer:
- Hardware products containing RF modules are designed to be used for laboratory testing purposes only. Furthermore, in order to comply with FCC rules, the user must:
- - Use cabling to connect RF modules, or
- - Use the hardware products within RF shielded chambers when radiating with antennas, or
- - Obtain FCC approval for using the hardware products in another manner.
- RF shielded chambers are offered as a product option with these hardware products.
Details:
- Emulates base station and core to test the IoT UE.
- Actual throughput levels over radio may vary based on the 3rd party device manufacturer and software versions.
-
- Valid8 product specifications are subject to change at any time without notice
Related Protocols
Valid8 exports its products strictly in accordance with all US Export Control laws and regulations which shall apply to any purchase or order. Specifications are subject to change without notice.
500 West Cummings Park, Suite 6550 Woburn, MA 01801
p: +1-855-482-5438
f: +1-781-996-3708
welcome@valid8.com
VALID8.COMp: +1-855-482-5438
f: +1-781-996-3708
welcome@valid8.com
Follow Us
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Ready to Learn More?
Contact Us