M5 Mobile UE Tester

Base Station Emulator for 4G eNodeB, 5G gNodeB RAN and mobile core to test UE devices including CPE router, phone, modem & IoT devices
Core
CBRS
3G-UMTS
4G-LTE
5G
MCX
UE
VoLTE
M5 Mobile UE Tester

Base Station Emulator for 4G eNodeB, 5G gNodeB RAN and mobile core to test UE devices including CPE router, phone, modem & IoT devices

Overview

Valid8's Mobile UE Tester is a hardware-based solution that mimics 4G & 5G RAN along with a customizable core network emulator to test user equipment (UE) devices

What It Can Do For You

Lower Cost Per Test: Valid8 has continued to add automation and simplicity to their technology, driving down the cost per test.

Increased Test Environment Flexibility: By allowing the ability to configure the simulated environment to meet specific testing needs, users can safely perform penetration tests and other security tests that could not typically be performed on a public network.

Comprehensive Test Menu: Enables testing of a variety of data-centric cellular devices including: IoT,embedded, modems, routers & hotspots.

Actionable/Collaborative Reports : From a user-friendly interface screen users can quickly see test results, uncover any issues, and drill-down as needed.Historical tracking allows for trend analysis and reports. Reports can be easily shared with the rest of the team, or integrated into a 3rd party reporting tool.

Why It’s Different

  • Software based solution runs on high-end Valid8 hardware for RAN emulation
  • Components can also be run on customer hardware or in a Virtual Machine or the Cloud environment (e.g. Amazon AWS) allowing maximum versatility and performance
  • Web-based Graphical User Interface provides customer with intuitive, easy access via browser 
  • API’s used (REST, HTTP) enable seamless integration with automation test systems and other equipment
  • Stateful modeling provides accurate emulation of network elements
  • Turnkey technology, including SIM cards to test UE CPE devices
  • All-in-one method to test any band up to 6GHz

Features

  • Emulates the RAN with OTA connection available for UEs and IoT devices 
  • Emulates some or all of the core network, exposing all internal interfaces 
  • Test the bands that may be unavailable in your geographic region
  • Attach/Detach,IPv4/IPv6, Normal/Emergency, network rejection, create bearers, perform fuzzing
  • 3rd party OTT tests incl. iPerf, nmap etc.
  • Emulators available per subsystem (MME, AMF, HSS, PCRF, MSC, SGSN, SGW, PGW, etc.) 
  • True stateful simulation 
  • Handover support on X2 and S1 (requires 2 eNodeB option)
  • Signaling request/response messages for call handling, mobility management, authentication, QoS 
  • Report on media received, call connect time, call duration, jitter, packet loss 
  • Generate valid and invalid/negative messages and call-scenarios (fully editable scenarios) 
  • Supports sending invalid messages including malformed, dropped, and misordered packets 
  • Check parameters in messages from SUT and flag errors
  • 3GPP-compliant interfaces 

PHY Layer

  • LTE release 14 compliant.
  • FDD and TDD configurations.
  • Supported bandwidths: 1.4, 3, 5, 10, 15 and 20 MHz.
  • Handle several cells in intra-band or inter-band configurations.
  • Transmission modes: 1 (single antenna) and 2 to 10 (MIMO 2x2).
  • Wideband CQI/PMI reports.
  • HARQ support.
  • Timing measurement thru the PRACH.
  • Closed-loop UE power control.
  • Frequency based MMSE equalizer.
  • Highly optimized software turbo decoder.
  • PAPR reduction support.
  • Support of other radio heads can be added with an external shared library.
  • Positioning Reference Signals (PRS) support.
  • CSI-RS support.
  • Multi-cluster PUSCH allocation.
  • PUCCH 3 and PUCCH channel selection support.
  • Carrier Aggregation support with cross carrier scheduling (tested with 3 DL channels, supports up to 4 DL channels).
  • Mixed FDD-TDD Carrier Aggregation support.
  • CoMP testing features (DMRS scrambling identity and QCL parameters can be selected).
  • 256QAM DL support for PDSCH and MBMS.
  • 1024QAM DL support for PDSCH.
  • 256QAM UL support for PUSCH.
  • Support of release 11 TDD special subframe configurations 7 and 9.

LTE Protocol Layer

  • LTE release 14 compliant.
  • Implements the MAC, RLC, PDCP and RRC layers.
  • Proportionally fair MAC scheduler with QoS support.
  • Support of full and half duplex UEs.
  • DRX support.
  • Number of active users only limited by the available bandwidth.
  • Fully configurable System Information Blocks.
  • Integrity check and encryption using AES, Snow3G and ZUC algorithms.
  • Support of RRC measurement with measurement gap.
  • Supports intra eNodeB, S1, X2 and EPS to 5GS handovers.
  • QoS support with user selectable DRB configuration for each QCI.
  • ROHC support (RTP, UDP and IP v1 profiles, unidirectional mode, no RTP CSRC, no IP extensions, no outer/inner IP). Chapter 2: Features 3
  • Public Warning System (CMAS/ETWS) support.
  • MBMS support.
  • Support of all ciphering and integrity protection algorithms including ZUC. Note that ciphering is subject to export rules depending on your country.
  • Category 0 UE support.
  • eDRX support.
  • EN-DC support.
  • RRC release with redirection to NR SA cell support.

Related Video

LTE-M:

  • Release 14 compliant
  • Category M1 UE support.
  • TM6 and TM9 support.
  • FDD only (FDD and HD-FDD UEs are supported).
  • Support of multiple CE levels (only CE-Mode A is supported).
  • Support of message repetition for MPDCCH, PDSCH, PUCCH and PUSCH in full and half duplex. No message repetition for PRACH.
  • Support of localized and distributed MPDCCH transmission.
  • EPDCCH support for Category M1.
  • No frequency hopping.
  • Bandwidth must be >= 5 MHz for cells that also need to support Category 0 and above UEs.
  • DRX support.
  • eDRX support.

 NB-IOT:

  • NB-IoT release 14 compliant.
  • Single-tone and multi-tone category NB1 and NB2 UE support.
  • 15 kHz and 3.75 kHz subcarrier spacing are supported.
  • All operation modes (in-band, guard band and standalone) are supported.
  • Multiple NB-IoT and LTE cells can be used at the same time in the same eNodeB.
  • Support of multiple coverage levels.
  • Support of all NPDCCH, NPDSCH, NPUSCH and NPRACH configurations.
  • Support of control plane CIoT optimization.
  • Support of multi-DRB mode.
  • Support of non-anchor carriers, including Release 14 NPRACH and paging on non-anchor carriers.
  • Support of two HARQ processes.
  • Support of interference randomisation.
  • DRX support.
  • eDRX support

NR

  • NR release 15 compliant.
  • FDD/TDD FR1 (< 6 GHz).
  • Bandwidth: 5 to 100 MHz.
  • Data subcarrier spacing: 15, 30, 60 or 120 kHz. SSB subcarrier spacing: 15, 30, 120 or 240 kHz. All SSB/data subcarrier spacing combinations are supported.
  • Up to 4 layer downlink MIMO.
  • Up to 4 layer uplink MIMO.
  • 256QAM.
  • All PUCCH and PRACH formats.
  • PUSCH with and without transform precoding. PUSCH and PDSCH with user configurable DMRS and number of symbols.
  • User configurable TDD UL/DL pattern and k0, k1 and k2 values.
  • PDCCH with DCI 0 0, 0 1, 1 0 and 1 1.
  • CSI-RS and TRS support.
  • Scheduling Request support.
  • PHY test mode: support for continuous PDSCH and PUSCH transmission.
  • EN-DC support with dynamic activation/deactivation based on events.
  • Dynamic LTE/NR DRB configuration.
  • User selectable DRB configuration for each QCI/5QI.
  • DRX support.
  • RRC measurement with measurement gap support.
  • PScell change support.
  • Standalone support.
  • Intra gNodeB, NG or 5GS to EPS handovers support.
  • Public Warning System (CMAS/ETWS) support.
  • Carrier aggregation support, both in NSA and SA operation.
  • RRC release with redirection to EUTRA cell support.
  • EPS fallback support.

Additional Videos

Subsystems

KPIs

Report Measurements

  • Network Registration Attach time after Power-On
  • Dedicated Bearer Setup Request Response Time 
  • Network Deregistration Detach time after Power-Off
  • Authentication Request Response Time
  • Tracking Area Update Request Response Time
  • iPerf OTT QoS measurements

Report Counters

  • Attach Requests/Successes/Fails 
  • Detach Requests/Successes/Fails 
  • Dedicated Bearer Requests/Successes/Fails 
  • Current Active Sessions/ Bearers 
  • Number of Sessions/ Bearers Created 
  • Attach Request Response Time 
  • Protocol Errors
  • Message Timeouts
Configurable Parameters

Generic

  • Frequency Band
  • EARFN
  • Channel Bandwidth 1.4, 3, 5, 10, 15, 20
  • Includes CBRS band
  • TDD/FDD
  • Carrier Aggregation
  • PLMN Mobile Country Code (MCC), Mobile Network Code (MNC)
  • eNodeB Type IP Address S1 Interface 
  • IP Address eNodeB 
  • Primary DNS Address 
  • Secondary DNS Adress 
  • MAC Address Public Gateway 
  • GTP Tunnel IP Address and Port 
  • GTP Tunnel eNodeB IP Address 
  • Integrity Algorithm 
  • IP Address to assign UEs on LAN

CBRS

  • FCC ID
  • CBSD Category
  • Call Sign
  • User Id
  • Air Interface
  • CBSD Serial Number
  • Meas Capability
  • Installation Parameters
  • Grouping Parameters

Automation API

User commands can be fully automated using REST API. This includes performing all test control functions as well as collecting results and metrics. It can be integrated into virtually any CI system via the HTTP API, including Jenkins, CircleCI, Gitlab and others. Includes Autom8 Python framework.

Scripting

The application’s subsystems can be edited directly in the browser using TDL. The Message Workshop allows for the creation of test scenarios directly from the hex stream of a remote capture, while the Composer graphical editor (being deployed for all products in 2021) will allow for creating customized call scenarios by dragging and dropping the call flow to meet your test needs.
This is some text inside of a div block.

PRODUCT OPTIONS

No items found.
M5 Mobile UE Tester

Use Cases

UE CPE Router Under Test

For testing CPE Router UE devices that have WiFi and cellular data capability, the 5G 4G 3G Base Station Emulators can provide OTA testing capability through its built-in base station and core network emulator. It enables end-to-end testing from WiFi to cellular.

Supported Scenarios:

Supports scenarios:

  • Power on
  • Attach
  • Detach
  • TAU
  • Data Connection

Some of the key capabilities introduced with the M5 Mobile UE Tester Include:

  • Lower Cost Per Test
  • Increased Test Environment Flexibility
  • Comprehensive Test Menu
  • Actionable/Collaborative Reports

  • End-to-end Over-the-Air performance test capability
  • Includes RF base station
  • Emulates all core network nodes and allows for data connection to external networks

UE IoT Device Under Test

For testing IoT devices that have cellular data capability, the 5G 4G Base Station Emulators can provide OTA testing capability through its built-in base station and core network emulator. It enables end-to-end testing.

Supported Scenarios:

Supports scenarios:

General

  • Power on
  • Attach
  • Detach
  • TAU
  • Data Connection

Cyber Security suite:

  • Bruteforce authentication attack (max number of  authentication  attempts  within  a certain  time interval)
  • Reuse Authentication credentials
  • Require secure communication established
  • Access without authentication
  • Power outage resiliency
  • Valid data input via APIs

Some of the key capabilities introduced with the M5/M1 Mobile UE Tester Include:

  • Lower Cost Per Test
  • Increased Test Environment Flexibility
  • Comprehensive Test Menu
  • Actionable/Collaborative Reports

  • End-to-end Over-the-Air performance test capability
  • Includes RF base station
  • Emulates all core network nodes and allows for data connection to external networks

UE Phone Under Test

For testing phones that have cellular data capability, the 5G 4G 3G Base Station Emulators can provide OTA testing capability through its built-in base station and core network emulator. It enables end-to-end testing.

Supported Scenarios:

Supports scenarios:

  • Power on
  • Attach
  • Detach
  • TAU
  • Data Connection
  • VoLTE (with IMS Core option)
  • SMS (with IMS Core option)

Some of the key capabilities introduced with the M5/M1 Mobile UE Tester Include:

  • Lower Cost Per Test
  • Increased Test Environment Flexibility
  • Comprehensive Test Menu
  • Actionable/Collaborative Reports

  • End-to-end Over-the-Air performance test capability
  • Includes RF base station
  • Emulates all core network nodes and allows for data connection to external networks
M5 Mobile UE Tester
M5 Mobile UE Tester

Summary of Specifications

Specifications

Protocols

  • 3GPP TS 23.401 (EUTRAN)
  • 3GPP TS 24.301 (NAS)
  • 3GPP TS 29.060 (GTPv1)
  • 3GPP TS 29.274 (GTPv2-C)
  • 3GPP TS 29.281 (GTPv1-U)
  • 3GPP TS 36.413 (S1AP)
  • 3GPP TS 36.414 (S1-U)
  • IETF RFC5246 (TLS, Protocol (1.0, 1.1, 1.2))
  • IETF RFC6101 (SSL, Protocol Version 3.0)
  • IETF RFC793 (TCP)
  • IETF RFC768 (UDP)
  • IETF RFC4960 (SCTP)
  • IETF RFC791 (IPv4)
  • IETF RFC2460 (IPv6)
  • IETF RFC3711 (SRTP)
  • IETF RFC1035 (DNS)
  • IETF RFC2131 (DHCP)
  • IETF RFC3550 (RTP/RTCP)
  • IETF RFC3261 (SIP)

UEs Supported

  • Up to 1,000 per unit

4G Technical Specifications

  • 3GPP Specification : LTE Release 8 support with features up to Release 14
  • Frequency bands : All sub-6GHz bands, 400 - 6000 Mhz; including Bands 1 - 44 plus unlicensed 5Ghz band and others
  • Bandwidth : 1.4, 3, 5, 10, 15 and 20 MHz, 200 KHz for NB-IoT
  • Carrier Aggregation: up to 4 carriers in DL and 2 carriers in UL
  • MIMO : DL MIMO support up to 2x2
  • Modulation schemes : up to 256 QAM in DL and UL
  • AS encryption and Integrity protection :AES, SNOW3G, ZUC
  • Handover : Intra-freq, inter-freq and inter-band Handovers
  • Group communication : eMBMS as per Rel10
  • IoT : LTE category 0 and 1, LTE-M cat M1, NB-IoT cat NB1 and NB2 UE categories.  NB-IoT subcarrier spacing 15 kHz & 3.75kHz, PSM and eDRX
  • UE Categories : Cat0, Cat1, cat3, cat4, cat5, cat6, cat7, cat9, cat 10, cat11, cat12, cat13
  • Number of active users : 1000+ UEs
  • Number of active cells : 4 cells MIMO 2x2 or 2 cell MIMO 4x4
  • IP traffic : simulation of TCP, UDP, RTP, HTTP and VoIP with configurable packet size as well as support of external applications such as iperf
  • FDD and TDD configurations
  • Handle several cells in intra-band or inter-band configurations
  • Transmission modes: 1 (single antenna) and 2x2 MIMO
  • 256QAM DL support for PDSCH and MBMS
  • RF power output < 10 dBm
  • Max RF input power: -10 dBm
  • 4 SMA female (TX1, TX2, RX1, RX2), AC coupled
  • 1 SMA female (GPS antenna with 3.3V DC power supply)
  • ADC/DAC Sample Rate: 61.44 MS/s
  • ADC/DAC Resolution: 12 bits
  • Frequency Accuracy: 2 ppm
  • LTE 20MHz 64QAM EVM < 2 %rms (f < 2.6 GHz)
  • LTE 20MHz 64QAM EVM < 4 %rms (f < 3.5 GHz)
  • Support of release 11 TDD special subframe configurations 7 and 9
  • WINNF-TS-0016

5G Technical Specifications

  • 3GPP Specification : Release 15
  • Frequency bands : FDD/TDD FR1 All sub-6GHz bands, 400 - 6000 Mhz; including Bands 1 - 44 plus unlicensed 5Ghz band and others
  • Bandwidth : up to 50 MHz
  • Carrier Aggregation: up to 4 carriers in DL and 2 carriers in UL
  • MIMO : DL MIMO support up to 2x2
  • Modulation schemes : up to 256 QAM in DL and UL
  • Subcarrier spacing : All SSB/data subcarrier spacing combination
  • Supported Modes : NSA and SA
  • NSA NR split bearer : 3, 3a, 3x
  • Use case : eMBB
  • Number of active users : 3 UE
  • Number of active cells : up to 4 5G cells or 4 4G cells

Hardware 

  • ‍Intel-based; scalable to meet performance needs 

Operating System 

  • ‍Protocol Engine (Linux-based) 

User Interface 

  • ‍Browser-based, touch-optimized graphical user interface 

Automation 

  • ‍HTTP API 

Max output power 

  • < 10 dBm (10 mW)

Connector types

  • ‍Femtocell: SMA female 

LAN Connectivity

  • 1x10Gbps
  • 4x1Gbps

Hardware dimensions 

  • M5: 3.5"H x 17.2"W x 25.5”D; appx. 16.7lb 

Power supply 

  • M5: 520W AC to DC, 100 - 240v 

Product Details

Disclaimer:

  • Hardware products containing RF modules are designed to be used for laboratory testing purposes only. Furthermore, in order to comply with FCC rules, the user must:
  • - Use cabling to connect RF modules, or
  • - Use the hardware products within RF shielded chambers when radiating with antennas, or
  • - Obtain FCC approval for using the hardware products in another manner.
  •  
  • RF shielded chambers are offered as a product option with these hardware products.

Details:

  • Emulates base station and core to test the IoT UE.
  • Actual throughput levels over radio may vary based on the 3rd party device manufacturer and software versions.
  • Valid8 product specifications are subject to change at any time without notice

Valid8 exports its products strictly in accordance with all US Export Control laws and regulations which shall apply to any purchase or order. Specifications are subject to change without notice.

500 West Cummings Park, Suite 6550 Woburn, MA 01801
p: +1-855-482-5438
f: +1-781-996-3708
welcome@valid8.com
VALID8.COM

Ordering Information

M5 Hardware

m5-mobile-ue-tester (1 UE)

Emulation options:

hardware-5g-rf-module-int-mimo-2x2
hardware-4g-rf-module-int-mimo-2x2
5g-sw-core-network-emulator-lite (AMF, SMF, UDR, AUSF, NRF)
4g-sw-core-network-emulator-lite (MME, HSS, PGW, SGW)
3g-sw-core-network-emulator-lite (MSC, HLR, SGSN, GGSN)
ims-core-network-base (CSCF, AS)

Protocol interface options:
(on request)

Miscellaneous options:
network-emulator-internal-impairment-module
Security, fuzzing, penetration test

Licensing options:
wireless-UE-upgrade-licenses-10 : 10 UEs
wireless-UE-upgrade-licenses-20 : 20 UEs
(others on request)
3CA
4CA
2x2 MIMO
Multiple eNodeBs on request
Multiple EPC network elements on request

Note

  • Actual throughput levels over radio may vary based on the 3rd party device manufacturer and software versions. Valid8 product specifications are subject to change at any time without notice.

Datasheet Page

Related Video

Related Solutions

M5 Mobile UE Emulator

M5 Hardware

mobile-ue-emulator-64
mobile-ue-emulator-128
mobile-ue-emulator-256

Software Only

mobile-ue-emulator-100-sw
mobile-ue-emulator-1000-sw
mobile-ue-emulator-10000-sw

Note

  • Actual throughput levels over radio may vary based on the 3rd party device manufacturer and software versions. Valid8 product specifications are subject to change at any time without notice.

Datasheet Page
MCX Load Tester

MCX Load Tester 

Product Code: sw-loader-mcx

Load options:
sw-loader-mcx-10 : 10 sessions, basic call
sw-loader-mcx-1000 : 100 sessions, basic call
sw-loader-mcx-10000 : 10,000 sessions, basic call (note: RTP enabled only for a subset of audio calls)

(others on request)

Protocol interface options:

Miscellaneous options:


network-emulator-internal-impairment-module : Security, fuzzing, penetration test

Licensing options:
node locked, floating

Datasheet Page
IMS Core Network Emulator
  • Product Name: IMS Core Network Emulator
  • Product Code: ims-core-network-emulator

Datasheet Page
Mobile Core Network Emulator

Mobile Core Network Emulator

Options:

sw-emulator-mobile-3g-core-lite : 10 sessions
sw-emulator-mobile-3g-core-100 : 100 sessions
sw-emulator-mobile-3g-core-1000 : 1,000 sessions
sw-emulator-mobile-3g-core-10000 : 10,000 sessions

sw-emulator-mobile-4g-core-lite : 10 sessions
sw-emulator-mobile-4g-core-100 : 100 sessions
sw-emulator-mobile-4g-core-1000 : 1,000 sessions
sw-emulator-mobile-4g-core-10000 : 10,000 sessions

sw-emulator-mobile-5g-core-lite : 10 sessions
sw-emulator-mobile-5g-core-100 : 100 sessions
sw-emulator-mobile-5g-core-1000 : 1,000 sessions
sw-emulator-mobile-5g-core-10000 : 10,000 sessions

(others on request)

Miscellaneous options:
network-emulator-internal-impairment-module
Security, fuzzing, penetration test

Licensing options:
(not applicable)

Datasheet Page
Mobile Core Network Tester

Mobile Core Network Tester

Mobile Core Network Tester

Options:

3g
4g
5g

mobile-sw-core-network-tester-1000 : 1,000 sessions, base protocol, basic call
(others on request)

Miscellaneous options:
network-emulator-internal-impairment-module
Security, fuzzing, penetration test

Licensing options:
(not applicable)

Datasheet Page
Simulation Toolkits

Product Code:
sw-simul8 : Simulation application

Test Suites:
sw-simul8-toolkit-cap
sw-simul8-toolkit-coap
sw-simul8-toolkit-diameter
sw-simul8-toolkit-gtp
sw-simul8-toolkit-map
sw-simul8-toolkit-megaco
sw-simul8-toolkit-pfcp
sw-simul8-toolkit-radius
sw-simul8-toolkit-ranap
sw-simul8-toolkit-s1ap
sw-simul8-toolkit-sigtran
sw-simul8-toolkit-sip
sw-mobile-performance-testsuite-5g
sw-mobile-performance-testsuite-4g
sw-mobile-performance-testsuite-3g
(others on request)

Datasheet Page
Loaders

Product Codes:
Base loader:

  • loaders-basic1-tiny (up to 100 instances, 1gbps)
  • loaders-basic1-small (up to 1000 instances, 1gbps)
  • loaders-basic1-medium (up to 10000 instances, 1gbps)
  • loaders-basic1-large (up to 100000 instances, 1gbps)
  • loaders-pro1-small (1000 instances, 10gbps)
  • loaders-pro2-medium (10000 instances, 10gbps)
  • loaders-pro2-large (100000 instances, 100gbps)
Datasheet Page
M1 Mobile UE Tester

M1 Hardware

m1-mobile-ue-device-tester

Software Options:

ue-device-tester-4g

ue-device-tester-5g

ue-test-suite

Note

  • Actual throughput levels over radio may vary based on the 3rd party device manufacturer and software versions. Valid8 product specifications are subject to change at any time without notice.

Datasheet Page
M1 IoT Device Tester

M1 Hardware

m1-iot-device-tester (1 UE)

Software Options:

ue-device-tester-4g

ue-device-tester-5g

iot-device-tester-5g

Note

  • Actual throughput levels over radio may vary based on the 3rd party device manufacturer and software versions. Valid8 product specifications are subject to change at any time without notice.

Datasheet Page