Page 1 of 65

CONTENTS

CONTENTS ...... 1

FIGURES ...... 4

TABLES ...... 4

Introduction ...... 8

Background ...... 8

INL Test Range Overview ...... 9

WTB Overview ...... 9

Spectrum Availability and Management ...... 10

Cellular Frequency Availability ...... 10

Real Time Spectrum Monitoring ...... 11

WTB Communications Networks ...... 12

Overviews of INL WTB Communication Test Networks ...... 14

Overviews of INL WTB Facilities ...... 20

Test Equipment ...... 23 LTE Protocol Analyzer ...... 23 UMTS Protocol Analyzer ...... 23 GSM Protocol Analyzer ...... 23 VIAVI Cell Advisor Signal Analyzer ...... 23

Test Planning and Conduct ...... 23 Coordination and Scheduling ...... 24 Test Development and Execution ...... 24

Range Access and Services ...... 24 Access ...... 24 Prohibited Articles ...... 24 Prohibited Activities ...... 24

Page 1 of 65

Vehicle Access ...... 25 Transportation...... 25 Visitor Computer Network ...... 25 Food Services ...... 25 Onsite Fueling ...... 25 Classified Networks and Meeting Rooms ...... 25 Fire Department and Medical Dispensary ...... 25 INL Over Flight Notifications ...... 26 INL Addresses ...... 26 Transportation and Travel from Regional Airports to INL Test Range ...... 26 Hotels & Car Rentals ...... 26

Detailed Technical Specifications ...... 28 LTE Tier I Network ...... 28 Overall System Description ...... 28 Network Elements ...... 28 Management and Configuration Capabilities ...... 30 System Resources ...... 30 System Capacity ...... 30 LTE Tier 1 Network added features and capabilities ...... 31 LTE Band 13 & 14 Deployable Network ...... 32 Overall System Description ...... 32 Base Configuration ...... 32 eNodeBs ...... 33 LTE Cellular on Wheels (COWs) ...... 33 Management and Configuration Capabilities ...... 33 System Resources ...... 34 System Capacity ...... 34 GSM and UMTS...... 34 Network Elements ...... 35 GSM and UMTS Base Configuration ...... 37 GSM and UMTS Management and Configuration Capabilities ...... 37 GSM&UMTS System Resources ...... 38 GSM Authentication & Encryption ...... 40 DCOSS ...... 41 ChatterBox Voice & SMS Traffic Generator ...... 43 CDMA ...... 44 Overall System Description ...... 44 Base Configuration ...... 44 Management and Configuration Capabilities ...... 44 System Resources ...... 45 5G Amarisoft Callbox Ultimate ...... 45 Overall System Description ...... 45

Page 2 of 65

Isolated Satellite Backhaul Network ...... 46 Overall System Description ...... 46 Base Configuration ...... 46 System Resources ...... 47 System Capacity ...... 47 High Frequency Test Bed (HFTB) ...... 47 Overall System Description ...... 47 Base Configuration ...... 47 Management and Configuration Capabilities ...... 47 System Resources ...... 48 Fiber Network ...... 48 WTB Backhaul ...... 49 Overall System Description ...... 49 Use Considerations ...... 49 System Resources ...... 50 WTB Local Area Networks (LANs) ...... 50 Local Area Network #1 (LAN1) – GSM/UMTS ...... 50 System Resources ...... 50 Local Area Network #4 (LAN4) – RTSM ...... 51 System Resources ...... 51 Cellular Network Management ...... 51 Overall System Description ...... 51 Base Configuration ...... 52 Management and Configuration Capabilities ...... 52 System Resources ...... 52 SMSC- Short Messaging Service Center ...... 52 Overall System Description ...... 52 Base Configuration ...... 53 Management and Configuration Capabilities ...... 53 System Resources ...... 53

Appendix A Frequently Asked Questions ...... 55

Appendix B Supporting Test Equipment ...... 58

Appendix C NTIA Red Book Section 7.11 ...... 62

Appendix D Unmanned Aerial Systems (UAS) ...... 63 Parameters for INL Based Operations ...... 63 Pilot Qualifications ...... 63 Weight Requirements ...... 63 Beyond Visual Line of Sight (BVLOS) Operations...... 63 Single or Multiple UAS Operations ...... 63 Customer Questionnaire for INL UAS Flight Operations ...... 64

Appendix E (OUO Separate) INL Electronic Warfare Modelling & Simulation (EWM&S) ...... 65

Page 3 of 65

FIGURES Figure 1 INL Test Range Boundary (green line) ...... 9 Figure 2 INL Real Time Test Monitoring range locations ...... 12 Figure 3 INL WTB Cell and Fixed Test Sites ...... 13 Figure 4 INL Overview Maps ...... 27 Figure 5 INL WTB CFA-609 Cell Site ...... 36 Figure 6 Cellular assets installed at INL and China Lake ...... 42 Figure 7 INL WTB CDMA QDBS NIB ...... 45 Figure 8 WTB Fiber Network Overview ...... 49

TABLES Table 1 INL WTB Baseline RF Channels ...... 11 Table 2 Current GSM System Subscriber Capacity – Fixed Cell Sites ...... 39 Table 3 Current GSM System Subscriber Capacity – Mobile Cell Sites ...... 39 Table 4 Current UMTS System Subscriber Capacity – Fixed Cell Sites ...... 39 Table 5 Current UMTS System Subscriber Capacity – Mobile Cell Sites ...... 39

Page 4 of 65

Acronyms AAA Authentication, Authorization, and Accounting ACE-HF Animated Communications Effectiveness – High Frequency AMR Adaptive Multirate ARFCN Absolute Radio Frequency Channel Number ATM Asynchronous Transfer Mode ATCA Advanced Telecommunications Computing Architecture AuC Authentication Center BCCH Broadcast Control Channel BGAN Broadband Global Area Network BRI Basic Rate Interface BSC Base Station Controller BSR Base Station Radio BTS Base Transceiver Station BVLOS Beyond Visual Line of Site CDMA Code Division Multiple Access CDR Call Detail Record CFA Central Facilities Area CIP Critical Infrastructure Protection CITRC Critical Infrastructure Test Range Complex CONUS Continental United States COW Cell-on-Wheels DCOSS Digital Central Office Switch Simulator DOE-HQ Department of Energy - Headquarters DSX Digital Signal Cross-connect DTMF Dual-Tone Multi-Frequency EDGE Enhanced Data Rates for Global Evolution EFR Enhanced Full Rate EPC Evolved Packet Core FOT Fiber Optic Technology GPRS General Packet Radio Service GSM Global System for Mobile communication

Page 5 of 65

HF High Frequency HFTB High Frequency Test Bed HLR Home Location Register NT-HLR New Technology Home Location Register HSS Home Subscriber Server ISDN Integrated Services Digital Network ISBN Isolated Satellite Backhaul Network LAN Local Area Network LOS Line of Sight LTE Long Term Evolution MAN Metropolitan Area Network MGW Multimedia Gateway oMGW Open Multimedia Gateway MME Mobility Management Entity MSC Mobile Switching Center oMSS Open Mobile Softswitch N&HS National & Homeland Security NIB Network in a Box NMS Network Management System NOC Network Operations Center NSN Siemens Network NSS Network Subsystem NTIA National Telecommunications and Information Administration PAN Personal Area Network PCRF Policy Charging and Rules Function P-GW Packet Data Network Gateway POTS Plain Old Telephone Service PSTN Public Switched Telephone Network QDBS Deployable Base Station RF Radio Frequency RGW Residential Gateway RNC Radio Network Controller

Page 6 of 65

RTSM Real Time Spectrum Monitoring SART Signaling Analyzer Real Time SIM Subscriber Identity Module SGW Serving Gateway SMS Short Message Service SMSC Short Messaging Service Center STA Special Temporary Authority TAN Test Area North TCH Traffic Channel TCP/IP Transmission Control Protocol/Internet Protocol TDD Time Division Duplexing TNES Traffica Network Element Server TRAU Transcoder and Rate Adaption Unit TRX Transceiver TS Traffica Server TSCM Transcoder Submultiplier UAV Unmanned Aerial Vehicle UMTS Universal Mobile Telecommunications System VLR Visitor Location Register VOACAP Voice of America Coverage Analysis Program VoIP Voice over IP WAN Wide Area Network WCC Warning Control Center WCDMA Wideband Code Division Multiple Access WLAN Wireless Local Area Network WMAN Wireless Metropolitan Area Network WPAN Wireless Personal Area Network WRRTF Water Reactor Research Test Facility WTB Wireless Test Bed WWAN Wireless Wide Area Network

Page 7 of 65

Introduction infrastructure attributes and capabilities of the INL Test Range, geographic features, a diverse, world- The Idaho National Laboratory (INL) Wireless class technical and support staff, and the quiet RF Test Bed (WTB) is a Customer focused test and environment of the remote INL Test Range. The evaluation program that is part of the National & INL WTB utilizes the designation as a National Homeland Security (N&HS) Directorate’s Critical Telecommunications and Information Infrastructure Security and Resilience (CIS&R) Administration (NTIA) federal experimental radio Division. The INL WTB aims to be the premier station which is managed by an onsite INL full-scale Wireless Test Bed supporting US Spectrum Manager. Specific testing efforts that National and Homeland Security by expediting require the use of additional offsite test locations telecommunications research, development, on federal/state land in the vicinity of the INL Test demonstration, evaluation, testing and training. Range are granted frequency use authorization The WTB’s mission is to: through the NTIA special temporary authority (STA) process that is managed by INL spectrum Provide wireless and telecommunications management staff on behalf of Customer and land technical expertise, systems and environments use approvals granted by the Bureau of Land to enable: Management (BLM), Idaho Department of Lands • Testing and Demonstration of wireless (IDL), or the US Forest Service (USFS), systems and equipment depending upon which agency has management responsibility over the particular area. • Development and Training of tactics,

techniques and procedures Common INL WTB provided test support In a representative environment with tailored activities include: design, engineering, systems operating at real-world frequencies infrastructure deployment, operations and and power levels to make informed decisions. maintenance, system integration, modeling and simulation, data analysis, troubleshooting, Common feedback from Customers include: logistics, and test management and oversight • “This is the most accommodating, efforts to enable testing across most of the wireless technically knowledgeable staff at any communications spectrum from high frequency test range that I have tested with.” (HF) to millimeter waves which encompasses numerous military communications, broadcast, • “Experience was Priceless.” push-to-talk radio, commercial cellular and • “That is not what we expected from our telecommunications, point-to-point and point-to- system(s).” multipoint microwave, and satellite communications (SATCOM) systems and • “That is not what happened in the lab.” technologies. Test event complexity ranges from • ‘That is not what the RF simulation small scale, developmental testing focused on a results predicted.” single technology, system, or component to large scale test-matrix driven, multi-technology/multi- • “Need to rethink entire approach.” system, and multi-agency testing across multiple, Background simultaneously active, and geographically separated test locations spanning weeks or months Since its inception in 2003, the INL WTB has in duration. enabled and supported Customer-driven, end-to- end network, and component-based testing, Since the establishment of the INL WTB, the program training, and evaluation efforts of numerous management, technical, and support staff have wireless communications technologies in real- successfully enabled over seven hundred (700) wireless world, open air environments at full scale and full communications tests over six thousand (6000) test power, using representative operational days (and nights) for over one hundred (100) industry, frequencies and test scenarios. The INL WTB academic, and US government Customers. facilitates wireless testing by leveraging unique

Page 8 of 65

INL Test Range Overview

The INL Test Range is an eight hundred ninety (890) square mile, access-controlled Department of Energy (DOE) national laboratory facility and is managed and operated by Battelle Energy Alliance. The INL Test Range is in southeastern

Idaho’s Snake River Plain, approximately forty- five (45) miles west of Idaho Falls, Idaho. The Test Range is at approximately five thousand

(5000) feet elevation above sea level with a gently rolling terrain and a high desert climate with steep mountainous areas to the west and north.

WTB Overview Full scale, “Tier 1” cellular, HF, VHF, and other test and monitoring capabilities, are available at the INL Wireless Test Bed (WTB) for Customer use. Test networks are isolated from all other INL and WTB systems and commercial networks, though capable of inter-system operations and off- site connectivity, where possible. All aspects of each test network are configurable to replicate commercial systems found worldwide, providing Miles realistic test environments. This replication 40 encompasses a range of system functions including core switching and signaling protocols, PSTN traffic simulation, simulated Internet, service provider and subscriber identities, and air interface transmissions. The INL WTB provides four major assets to its customers: 1. Spectrum

• Low RF noise 27 Miles • NTIA Experimental Radio Station Figure 1 INL Test Range Boundary (green line) • Local Spectrum Manager • Monitoring

2. Isolated Communication Test Networks

• LTE-Advanced (Rel.10) • GSM & UMTS (3GPP Rel. 11 comp)

• LTE

• HF and VHF

Page 9 of 65

• Satellite backhaul which includes the INL Test Range. The INL WTB Test Team works with Customer and the • Terrestrial fiber optic backhaul INL Spectrum Manager to gain approval for 3. Telecommunications Engineering Expertise customer request of spectrum use. The frequency use approval is conducted on a case by case basis • Design typically within one to four weeks’ time, and • Installation faster when necessary. • System integration When Customer has a request for spectrum, they work with the WTB assigned Test Lead. An INL • Operations & Maintenance Spectrum Request Form is filled out and submitted • Testing to the INL Spectrum Manager. A search is performed from both the FCC and government • Troubleshooting databases for any licensing conflicts. Also taken • Analysis into consideration are the specific Customer test dates, effort times and the potential for spectrum • RF modeling/simulation coordinated between Customers. 4. Remote geographical area Recommendations to shift frequency use or adjust time of day for tests are accommodated as • Isolation required. RF simulations of the test cases are performed, as required to gain INL Spectrum • Unrestricted airspace Manager approval. • Controlled access The INL WTB, in conjunction with the INL • Full range services Spectrum Manager, review each Customer frequency request on a case by case basis, considering the desired RF footprint and RF Spectrum Availability and output power of each test. The frequency Management approvals are valid for only the period they were INL’s designation as a federal experimental radio requested. If during the effort harmful station is defined by Section 7.11 of the NTIA Red interference is caused from WTB or Customer Book as shown in Appendix C. equipment, immediate changes will be made. Cellular Frequency Availability This designation grants permission for the INL WTB and Government Customers to emit signals The INL WTB has several telecommunications at almost any frequency as long as the following assets, including HF and cellular, along with a RF authority guidelines are complied with: spectrum monitoring system – which will be described in detail later in this manual. 1. No harmful interference is induced onto local The INL WTB has the following cellular assets: system/spectrum owners • NR, all FDD / TDD frequencies below 6 GHz 2. No commercial services are provided only within EROB lab environment 3. Government test purposes only • LTE 700 MHz, 1800 MHz, 2600 MHz No urban areas or military bases exist near the • UMTS 2100 MHz INL range. • GSM 850 MHz, 900 MHz, 1800 MHz & 1900 The NTIA federal experimental radio station MHz designation enables frequency use at INL facilities from DC to light as long as authority guidelines • CDMA 800 MHz & 1900 MHz are adhered to. INL’s Spectrum Manager approves all spectrum use on INL properties,

Page 10 of 65

Table 1 provides information on the baseline RF channels / frequencies that have been chosen for the WTB cellular assets.

Table 1 INL WTB Baseline RF Channels

Item Spectrum Band Channel / Frequency 1 GSM 900 P 20, 22, 24, 26, 28, 30, 32, 34, 36, 38, 40, 42 2 GSM 1800 DCS 512, 514, 516, 518, 520, 522, 524, 526, 528, 530, 532, 534 3 GSM 1900 F Block 712, 714, 716, 718, 720, 722, 724, 726, 728, 730, 732, 734 4 UMTS-FDD 2100 Band I 10562 5 LTE Band 3 1710 – 1785 MHz Uplink, 1805 – 1880 MHz Downlink 6 LTE Band 7 2500 – 2570 MHz Uplink, 2620 – 2690 MHz Downlink 5 LTE Band 13 777 – 787 MHz Uplink, 746 – 756 MHz Downlink 6 LTE Band 14 788 – 798 MHz Uplink, 758 – 768 MHz Downlink 7 CDMA 800 B (10MHz) 507 8 CDMA 1900 F (5MHz) 862 9 PTMP Mobile System 4900 – 4920 MHz 10 KU Band Satellite 12 – 18 GHz 11 BGAN 1626.5 – 1660.5 MHz all FDD / TDD frequencies below 6 GHz GHz only within EROB lab 12 5G: New Radio environment

Real Time Spectrum Monitoring The WTB Real Time Spectrum Monitoring Each location has a Spectrum Analyzer with a (RTSM) system allows for unclassified remote variety of antennas and various logging monitoring of RF emissions on the INL Range capabilities. The system also has remote control property. The spectrum analyzers are located at capabilities, including control of the azimuth Howe Peak, EBR 1 & RTMF as shown in Figure pointing angle of antennas (± 180° rotation), as 2. The current system capabilities are: 300 kHz to well as control and access to the RTSM System 14 GHz at RTMF and 300 kHz to 3 GHz at Howe from CFA 609 (INL Spectrum Manager) and Peak and EBR 1. CFA-1609 (WTB Frequency Manager).

Page 11 of 65

Howe Peak

16

7 Miles

Figure 2 INL Real Time Test Monitoring range locations

WTB Communications Networks • HF fixed and mobile radio/antenna network INL WTB consists of several full-scale • Complete control of all parts of the system Communications Test Networks, which include • Ability to link with other INL assets or the following: external assets • LTE Cellular network isolated from the The WTB consist of three fixed cell sites, internet augmented by several fixed test sites as shown in • GSM and UMTS Cellular networks isolated Figure 3. from the PSTN with handovers between

networks supported

• Isolated Satellite Backhaul Network

• CDMA 2000 NIBs

Page 12 of 65

WRRTF INL radio site at 8628’

RTMF

CFA 1609 & 699 NOCs Cell Site #9

Cell Site #6

CFA 609 Cell Site

EBR 1 Cell Site

Gate 1 Cell Site HFTB Site Idaho Falls 45 miles East

Figure 3 INL WTB Cell and Fixed Test Sites

Page 13 of 65

Overviews of INL WTB Communication Test Networks A high-level overview for each of the INL WTB Communications Test Networks is provided in the following sections. A detailed description for each Network is provided later in this manual.

LTE Tier I Network

The INL WTB LTE Tier I Network consists of full-scale Nokia Evolved Packet Core (EPC), Subscriber Data Management (SDM) & LTE eNodeBs. The Evolve Packet Core (EPC) is located at Gate1-Shelter3, and consists of Mobility Management Entity (MME), Serving & PDN-Gateway (S&P-GW), Domaine Name Servers (DNS), Nokia Service Platform (NSP NFM-P), and Internet Simulator. EPC handles the control and user plane traffic.

The Subscriber Data Management (SDM) is located at Gate 1-Shelter 3 and consists of Home Subscriber Server –Front End (HSS-FE) and One-Network Directory Server (One-NDS). SDM handles the subscriber databases.

All three cellular towers located at Gate1-Shelter 1, CFA-609, & EBR-1 have a release 10 compliant LTE eNodeB that is configured for bands 3 & 7 on all three sectors of each tower.

LTE Deployable Band 13 & 14

The INL WTB LTE Cellular Network consists of a Mini Athonet EPC which controls 3 LTE eNodeBs (2 Band 14 & 1 Band 13), which are each installed in one of three COWs. The mini EPC functionalities includes MME (Mobility Management Entity), S-GW and P-GW (Serving/Packet Data Network Gateway or SAE Gateway) HSS/AuC (Home Subscriber Service, Authentication Center), & Policing Control and Charging Rules Functions (PCRF).

The core network (mini EPC) is located at Gate1 while the 3 COWs (eNodeB) can be deployed within INLs fiber backbone. There are 2 Band 14 eNodeB and 1 Band 13 eNodeB. Both can be configured for 5 & 10 MHz bandwidth. 2x2 support SISO & MIMO and can have an adjustable power up to 40 watts. The

panel antenna on each COW has electric down-tilt and azimuth control.

GSM

The INLWTB GSM Cellular Network consists of a full-scale Tier 1 NOKIA oMSS and BSC switching center which currently controls three fixed cell sites. The GSM network switching Hub is located at CFA-609 and is the central equipment core of the network. The NOKIA Tier1 NT-HLR is located at Gate1.

The cellular system is operated from one of four (4) Network Operation Centers (NOC), which are currently located in the CFA-1609, CFA-699 and EROB buildings. WTB Engineers control and monitor the network from the NOCs. Frequencies supported are 900 MHz, 850 MHz, 1800 MHz and 1900 MHz.

Page 14 of 65

UMTS

The INL WTB UMTS (WCDMA) Cellular Network consists of a full-scale Tier 1 NOKIA MSC and RNC switching center which currently controls three fixed cell sites. The network switching Hub is located at CFA-609 and the RNC is located at Gate 1.

The cellular system is operated from one of four (4) Network Operation Centers (NOC), which are currently located in the CFA-1609, CFA-699 and UB-4 buildings. WTB Engineers control and monitor the network from the NOCs. Frequency supported is 2100 MHz.

Cellular Network Management

The INL WTB NOKIA Tier 1 NetAct is the operations support system (OSS) for operating and maintaining the elements of the WTB GSM, UMTS and LTE cellular networks. It allows the WTB to automate many of the tasks associated with configuring and operating the cellular networks and thereby reduce errors and improve efficiency and availability. NetAct also provides monitoring of the various GSM, UMTS, and LTE Nokia network elements.

The cellular operators can make network configuration changes during test events, including the use of scripting when required.

Traffica Monitoring Tool

The INL WTB Nokia Traffica is a real-time traffic monitoring tool designed to facilitate the monitoring and analysis of network traffic. Traffica allows you to see how the network functions from the network elements down to individual subscriber. It visualizes network traffic both via pre-defined and user definable real-time graphs. The tool also stores records for each call attempt, SMS delivery and data session into a database for further use in troubleshooting and historical analysis.

The Traffica system was integrated with and supports operations on the WTB GSM (2G), UMTS (3G) & LTE (4G) cellular networks.

Core & Aggregation Router

The INL WTB LTE Tier 1 network uses a Cisco ASR9006 Core and 3750 Aggregation Router that manage the layer 2&3 routing and handles the signaling and user traffic from all the Nokia Network Element interfaces.

Page 15 of 65

Short Messaging Service Center (SMSC)

The INL WTB Tecore SMSC provides simultaneous SMS operations for GSM (2G), and UMTS (3G) wireless networks. It delivers full SMS services including standard services i.e. (Mobile Originated (MO) and Mobile Terminated (MT) short messages, Message delivery report), measurements i.e. (Successful MOs /MTs, Failed MOs/MTs), and extended features i.e. (Custom Message Delivery to any subscriber). The SMSC runs on a R610 hardware platform with LINUX version: 2.6.32- 358.18.1.el6.i686

Internet Simulator

The INL WTB cellular network contains an internet simulator that provides simulated data through the LTE network. This allows network isolation for customer testing events yet a ‘real feel’ data capability for testing purposes.

PSTN Simulator

The INL WTB GL Communications DCOSS provides a simulated PSTN connection to the GSM and UMTS cellular networks. The DCOSS supports full

SS7 signaling, voice call switching, and POTS traffic generation into the cellular networks.

ChatterBox

The INL WTB TLC Solutions ChatterBox provides cellular loading through the 32 built-in GSM/UMTS modems. This unit is capable of emulating 128 IMSI registrations, 32 simultaneous text messages and 16 simultaneous field calls. Basic call & text scripting is performed through a GUI. This self-contained unit is capable of being remotely administered and has the ability to connect to other directional antennas as required.

CDMA

The INL WTB CDMA 2000 cellular network consists of three (3) Qualcomm Deployable Base Station (QDBS) systems. Each system is a Network in a Box (NIB), two of which support 800 MHz operations and one that supports 1900 MHz operations.

These transportable cellular NIBs can be deployed at any location across the INL desert site, in a portable fashion or fixed configuration using the existing INL cellular towers.

Page 16 of 65

Isolated Satellite Backhaul Network

The INL WTB Isolated Satellite Backhaul Network (ISBN) consists of a fixed 5.6m ground station and seven 1.2m auto deploy field kits. The field kits are a mixture of ground and vehicle mounted units that can support encrypted voice and data communication to isolate test traffic from outside vendor teleports. KU band commercially available satellites provide the interconnect. The ISBN is only deployed when required and can be uniquely configured for each customer event.

Voice and Data Connectivity in the Field

With support from INL’s Information Management Infrastructure (IMI) group, the INL WTB offers on-demand voice and data connectivity at both frequently used/ad-hoc INL Test Range field sites that do not have available communications infrastructure. Connectivity is facilitated via INL managed Redline Communications fixed wireless broadband WLAN equipment that operates in the 5.8 GHz unlicensed band. Currently, the INL WTB’s field deployable kits can support three (3) simultaneously active field test sites; however, the number of sites supported can be expanded to accommodate additional sites.

Current capabilities of each field deployable kit include: 1. Wired and wireless Internet access 2. VoIP phone with PSTN (internal INL) phone number 3. Dedicated VLAN for isolated connectivity among the three (3) sites with configurable host assignments on a per site basis and access to network time protocol (NTP) servers 4. Interconnectivity via the dedicated VLAN and back-end IMI infrastructure to other INL Test Range facilities with existing

communications infrastructure 5. Dual RSA (Real Time Spectrum Analyzer) Spectrum monitoring

Typical downlink throughput values range between 6 and 12 Mbps, which is site dependent.

High Frequency (HF) & Very High Frequency (VHF) Radio

The INL WTB HF & VHF footprint extends between Idaho Falls, Idaho to Salmon, Idaho and the Mountain Home Air Force Base. Fixed radio systems can be placed at a variety of field locations with expedient fixed antenna assets. Common test locations include: • HFTB (on INL reservation) • STF (on INL reservation) • WRRTF (on INL reservation) • IRC (Idaho Falls, east of INL) • Antelope Canyon (off-site, west of INL) • Eight Mile Canyon (off-site, north of INL) • Mountain Home AFB (off-site, southwest of INL)

Page 17 of 65

INL maintains HF spectrum authorization through NTIA TAs for off-site testing locations.

The INL WTB has a stock of Barker & Williamson BWDS-90N HF antennas and R.A. Miller Industries OE254 VHF, as well as other antennas and required RF cabling, grounding and supporting deployment equipment.

High Frequency (HF) Sounder

The Lowell Digisonde International (LDI) DPS-4D HF sounder characterizes the ionospheric conditions for a radius of 300 miles. The DPS-4D HF sounder detects the electron density of ionospheric plasma as a function of height. The DPS-4D HF sounder sweeps from 500 kHz to 30 MHz and characterizes the ionosphere from 80 to 1280 km above the Earth. The DPS-4D HF sounder generates an ionogram and a skymap depicting the ionospheric conditions on a 15 minute interval.

Backhaul

The Wireless Test Bed cellular assists are connected by means of an ATM network. The LAN networks riding on the ATM infrastructure are isolated from not only the outside world (PSTN or internet) but from each other as well. This design supports simultaneous testing of multiple networks without the concern of intrusion or interference.

LAN1 (Fixed Cell Sites LAN Network)

LAN1 is an isolated TCP/IP Ethernet network providing wireline network access at five facilities for the WTB GSM and UMTS networks. The purpose of LAN1 is to provide TCP/IP connectivity for all WTB cellular network elements and support components located in the WTB fixed network sites in addition to one of three (3) Network Operations Centers (NOC).

LAN4 (Real Time Spectrum Monitoring RTSM)

LAN4 is an isolated TCP/IP Ethernet network providing wireline network access at five facilities for the remote monitoring of RF emissions on the INL Range. The purpose of LAN4 is to provide TCP/IP connectivity for all WTB cellular network elements and support components located in the WTB fixed network sites in addition to one of three (3) Network Operations Centers (NOC).

Page 18 of 65

5G Cellular: Amarisoft Callbox Ultimate

AMARI Callbox Ultimate is a 3GPP compliant eNodeB, gNodeB, EPC and 5GC allowing functional and performance testing of NR, LTE, LTE-M and NB- IoT devices. It also includes an integrated IMS server as well as an eMBMS gateway for VoLTE and eMBMs testing. The Callbox Ultimate supports LTE, 5G Non-standalone (NSA) or 5G Standalone (SA) configurations. It is equipped with 4 PCIe Defined Radio (SDR) cards supporting up to 4x4 MIMO and a maximum of 8 cells. RF coverage ranges from 500 MHz to 6.0 GHz, and each channel’s bandwidth can be adjusted between 200 KHz – 100 MHz. The power output is set at 16 mW, because it is intended for lab bench testing and experimentation only. The Callbox Ultimate is located in NOC-4, within EROB.

Page 19 of 65

Overviews of INL WTB Facilities A high-level overview for each of the INL WTB Facilities is provided in the following section.

CFA-609 – Cellular Hub, Fixed Cell Site

CFA-609 is the main cell site and switching center for the WTB cellular network. Outside of the building is the CFA tower consisting of three 120° sector platforms at 50’ and 60’ levels for mounting antennas, amplifiers and other equipment. This location is linked to fixed remote cell sites via microwave or fiber optics.

GATE-1 – Fixed Cell Site

Gate-1 is a fixed remote cell site linked to CFA-609 via fiber. There are three shelters. Shelter 1 is an environmentally controlled, 11’x22’ concrete construction. Between Shelter 1 and Shelter 2 is a 60’ tower with three 120° sector platforms at 50’ and 60’ levels for amplifiers and other equipment. Shelter 2 is of the same caliber as Shelter 1, while Shelter 3 acts as a remote cellular hub where much of the cellular core equipment is located.

EBR-1 – Fixed Cell Site

EBR-1 is a fixed remote cell site that is linked to CFA-609 via fiber. There is one shelter, which is an environmentally controlled 11’x22’ concrete construction. Next to the shelter is a 60’ tower with three 120° sector platforms at 50’ and 60’ levels for mounting antennas, amplifiers and other equipment.

CFA-1609

CFA-1609 is the primary network operations for the WTB. This building facilitates WTB support personnel, two fully capable Network Operations Centers (NOCs), customer operating areas, charging room, staging room, and lunchroom. The outside of the building hosts Rhone towers to support customer antenna and equipment, with RF ports in each of the customer operating areas.

CFA-699

CFA-699 includes a third Network Operations Center (NOC) and customer operating area. This building also includes a high bay, lab area, tool and test equipment storage, storage, and hosts WTB support personnel.

Page 20 of 65

LTE Band 13 & 14 Deployable COWs

LTE COWs are deployable within INLs fiber infrastructure. The three available COWs can be towed anywhere to an approved testing area. The Mast on each COW will extend up to Approx. 60 feet. Each COW has its own diesel generator or can run on commercial power.

Mobile Tower-1

Mobile Tower-1 is constructed out of an ATC-106C mobile tower trailer with a retractable antenna tower. Mast height can be adjusted between 29’ and 106’ and support guy wires connect directly to the outrigger support arms. An external power source is required to operate the antenna tower.

Mobile Tower-2

Mobile Tower-2 is constructed out of an ATC-60C mobile tower trailer with a retractable antenna tower and 6’ x 6’ environmentally controlled equipment shelter. Mast height can be adjusted between 29’ and 60’ and support guy wires connect directly to the outrigger support arms. An external power source is required to operate the antenna tower and HVAC equipment.

Mobile Boom Lifts

Mobile boom lifts are often used as an optional antenna mast in support of quick deploy and rapidly changing test environments. Typical height for the boom lift ranges from 45’ and 60’ and no support guy wires are required. Boom lifts can be obtained within a day through the local INL Big Shop for the duration of the customer effort.

Mobile Lab Trailers

The INL WTB owns and operates a total of four mobile lab trailers. These mobile lab trailers are enclosed trailers with integrated HVAC units for remote field operations. The interiors have approximately 12’ of counter tops with cabinets along both sides, a microwave and small refrigerator. RF cable pass through ports are located on both sides of the trailers to facilitate antenna connections. As required the mobile lab trailers can be outfitted with an INL WiMAX kit to allow for voice and data services from remote locations. External generators are provided by the INL WTB test team to ensure AC power is available for customer use.

Page 21 of 65

Cell Site #9

Cell Site #9 supports remote testing of various equipment through optical transport, AC power and the fixed tower.

CFA-1610

CFA-1610 supports secure storage, meetings, and testing efforts. There is scaffolding erected outside of the building to mount various antennas and equipment configurations.

Howe Peak Access

The WTB has access to the INL Howe Peak Radio Transmission Facility to locate and operate equipment. The elevation of Howe Peak is over 8500 feet. Howe Peak also hosts WTB spectrum monitoring equipment that overlooks the INL desert site in support of the WTB Real Time Spectrum Monitoring System.

HF Test Bed

The HF Test Bed (HFTB) is located at STF and facilities a variety of HF test configurations. Six RF transmission cables run out to two pedestals in the antenna field where various antennas can be deployed and connected to the HFTB facility. Each pedestal contains a 120V AC outlets and a 20A breaker for power connections in the field.

The HFTB also hosts an HF monitoring station which combines spectral feeds from receivers in ID, UT, MD and FL to provide situational awareness.

RTMF

The Real Time Monitoring Facility (RTMF) is a fixed location that supports the Real Time Spectrum Monitoring System. RTMF is located near the Critical Infrastructure Test Range Complex (CITRC).

WRRTF

Located at the northern end of the INL range, WRRTF is home to a trailer with AC power and HVAC. This location is outside of the INL gated site grounds and supports access to the surrounding public lands. The HF Sounder is located at WRRTF.

Page 22 of 65

Test Equipment LTE Protocol Analyzer Real time monitoring and recording of data exchange between LTE network elements is capable through the Viavi Signaling Analyzer Real Time (SART) protocol analyzer. The Viavi LTE Protocol Analyzer is located at the Gate-1 Shelter-3 cell site location. The SART through Packet Insight is configured to passively monitor all uplink and downlink communication transferred between all interfaces on the WTB LTE Network Collected data can be provided in different file Collected data can be provided in text file format or formats such as txt, pcap, rec or played back played back through an M5 viewer utility. The through a viewer utility. playback viewer provides filtering capabilities and a graphical user interface similar to the M5 UMTS Protocol Analyzer Analyzer. Real time monitoring and recording of data VIAVI Cell Advisor Signal Analyzer exchange between UMTS network elements is capable through the Viavi Signaling Analyzer Real The CellAdvisor is a handheld portable unit that Time (SART) protocol analyzer. can be deployed at various locations around the network to perform RF over Fiber (RFoFiber – The Viavi Protocol Analyzer is located at the Gate- RFoOBSAI), LTE/LTE-Advanced (FDD and 1 Shelter-3 cell site location. The SART is TDD), as well as Over the Air (OTA configured to passively monitor all uplink and measurements). It also has a fiber inspection scope downlink communication transferred on the Iu and option. Iub signaling links. Collected data can be provided in text file format or Test Planning and Conduct played back through a viewer utility. The process for initiating a project or field test at GSM Protocol Analyzer INL generally follows these steps: • Contact the WTB Test Manager to discuss the Real time monitoring and recording of data exchange between GSM network elements is feasibility of a prospective project capable through a NetHawk M5 protocol analyzer. • If the project is feasible, negotiate scope, cost and schedule The M5 is in the equipment hub at CFA-609. The M5 interfaces to the Digital Signal Cross-connect • WTB provides a detailed ROM Cost Proposal (DSX) board which acts as a patch panel for • Identify the appropriate funding mechanism network element circuits. These interfaces • Provide project documentation and funding passively monitor all uplink and downlink • Department of Energy sends project acceptance communication transferred on the Abis (BSC to letter BTS) and Ater (MGW to BSC) circuits as well as the IP control plane protocols. • Project begins

Page 23 of 65

Coordination and Scheduling information is sent to INL Personnel Security, and visitor badges will be printed. Visitor badges will The WTB Test Manager is the central point of be available upon check-in at the Test Range or contact for coordinating and scheduling tests at the Idaho Falls INL Security Facilities. All visitors WTB. In order to maintain the test log, the WTB must present a valid photo ID for positive Test Manager shall be informed of all testing being identification. Valid badges from other DOE sites conducted at the WTB. will be honored at INL facilities. Escort Test Development and Execution requirements will be determined by the Test Lead. The WTB Test Manager is responsible for the NOTE: Foreign visitor access requires overall test event scope, schedule and budget. The additional coordination. Test Manager will assign one of several WTB Test Prohibited Articles Leads to serve as the single point-of-contact for technical execution of each test project phase. The The following items are prohibited in all areas at WTB Test Manager and Test Lead will work with INL (a list of these prohibited items is posted at all the Customer to refine technical and program facility entry points): requirements, reporting, and other information • Firearms, ammunition and all other types of necessary to assure that the project is conducted weapons both safely and satisfactorily. In some instances, the WTB Test Team will develop a Test Plan for • Explosives, flammable or hazardous chemicals the Customer driven effort. • Intoxicants or illegal drugs Before test effort execution the sponsor and/or test • All dangerous items or materials likely to team is encouraged to visit INL for a site survey to produce injury or damage to personnel or better understand the site layout. Upon test effort property. execution an onsite pre-testing brief will be conducted at the beginning of each test cycle to • Pets (except service animals) review hazard mitigation requirements and • Non-badged personnel including family, revalidate RF spectrum environment. Upon friends, or children completion of the testing cycle, a post-testing brief will be conducted to review operational activities The following items are prohibited in Security for Noteworthy Practices and Lessons Learned. Areas at INL without proper authorization: • ALL cameras (including in cellular phones) Range Access and Services • Audio or video recorders The INL is one of the Department of Energy’s • Radio transmitters (DOE) seventeen national laboratories across the United States. Access to DOE government • ALL wireless communication equipment facilities and resources has both requirements and (BlackBerrys, cell phones, PDAs, laptops, etc.) restrictions. • Note: A completed Personal Electronic Access Device (PED) form approved by DOE-IN will be required prior to entry in buildings Admittance/access to the INL Test Range and UB2, UB5 and CFA-1610. Idaho Falls facilities must be for Official Business Only. All visitors are subject to search for Prohibited Activities prohibited articles prior to entry. A listing of INL The following activities are prohibited at INL prohibited articles is included in the next section. without proper authorization: The WTB Test Lead will collect personnel visitor • information prior to the customer arrival. This Gambling

Page 24 of 65

• Hunting or target practice diesel fuel tank for refueling diesel generators during weekend and off-hour activities. The fuel • Searching for or removing archeological charges are applied to the overall test costs. artifacts Aircraft fueling services are only available in Idaho • Soliciting Falls. • Grazing of livestock Classified Networks and Meeting Rooms • Recreational activities Several INL facilities, both on the Test Range and in Idaho Falls support classified processing and • Mineral exploration and mining. discussion, up to and including TS/SCI. Both Test Vehicle Access Range and Idaho Falls classified facilities have Unless notified otherwise, the use of private and NSTS/STU-III/STE phones available. In Idaho government vehicles at the Wireless Test Bed is Falls there is access to SIPRNET (S/NSI) and unrestricted. All vehicles are subject to search and JWICS (TS/SCI) network, as well as postal seizure at the main security gates at all INL entry shipping addresses for classified materials. points. Additionally, depending on the type and/or If access to the INL classified facilities is required, classification of the testing being conducted at the the individual’s clearances would have to be INL Test Range, the use of private vehicles may be forwarded to appropriate INL security personnel. restricted or limited in specified areas. Fire Department and Medical Dispensary Transportation The INL has a fully functional Medical Dispensary, Non-INL personnel (visitors) are required to including an operating room at the CFA area. CFA provide their own transportation to/from the INL Medical is open Monday through Thursday, with (approximately 100 miles roundtrip). physicians available 0700 – 1700 hours (24-hour Visitor Computer Network nursing coverage). The Wireless Test Bed has dedicated workstations Ambulance services dispatch from the INL Fire for visitors to conduct business “outside” of the Department, also located at CFA. Typical response INL Firewall via a visitor network for internet time, depending on training location on site, is access. approximately 3-6 minutes. Food Services If a medical emergency is beyond the capability of the INL Medical Dispensary, the patient will be A cafeteria is available at the Central Facilities transported to Eastern Idaho Regional Medical Area (CFA) and at Test Area North (TAN) on the Center (EIRMC). Travel time is approximately INL Site. Visitors have the option of providing their 45 minutes by ambulance, and approximately own meals or including the cost of catered meals in 30 minutes by life flight helicopter. the overall testing cost. Food service contracts may not always be reliable on site, so it is important to In case of medical emergency while on the INL test discuss these details with the Test Lead prior to range, dial 911. The INL Warning arrival. Communications Center (WCC) should be contacted at (208) 526-1515 for non-emergencies. Onsite Fueling Always contact your WTB Lead with any The INL Wireless Test Bed can accommodate on- emergency site fueling services for customer provided The INL also has a full capacity Fire Department generators and vehicles used for test activities, and located in the CFA area. all WTB provided work trailers and generators. There is a fuel station (gasoline and diesel) at CFA and TAN. The WTB also has a truck-mounted

Page 25 of 65

INL Over Flight Notifications Freight/Fed Ex Address: Test range personnel are required to make over Idaho National Laboratory flight notifications to the WCC and PSO for aircraft Attn: Name, Area, Building flying under 1000’ AGL. Flights above 1000’ are 1765 North Yellowstone Hwy. only required to follow FAA regulations. Idaho Falls, ID 83415 – (Mail Stop). The INL desert site does not have a runway or fueling services for aircraft. The Idaho Falls airport is the suggested staging area for such activities. Transportation and Travel from Regional Airports to INL Test Range The WTB Test Lead will submit INL over flight notifications for all Wireless Test Bed customer • Idaho Falls Airport (IDA), 2140 N Skyline flights. The following information will be required Drive, Idaho Falls, ID, 208-612-8221 (46 miles in order to coordinate and deconflict INL over to INL Test Range) flight activities: • Pocatello Airport (PIH), 1950 Airport Way, 1. Date of Flight Pocatello, ID, 208-234-6154, (66 miles to INL 2. Time (to/from) of Flight Test Range) 3. INL Areas to be Flown (entire site, south, • Salt Lake City International Airport (SLC), 776 or north) N. Terminal Drive, Salt Lake City, UT, 4. Aircraft Type (make and model) 801-575-2400, (215 miles to Idaho Falls 5. Aircraft Color facilities, 225 miles to INL Test Range) 6. ID Number

INL Addresses Hotels & Car Rentals The following are the standard INL mailing addresses. Hilton Garden Inn, 208-522-9500 Hilton Tru, 208-522-8500 Mailing Address: Hilton Home2 Suites, 208-529-0400 Name of recipient depending upon test effort Hampton Inn Airport, 208-523-1400 Idaho National Laboratory Residence Inn Marriott, 208-542-0000 PO Box 1625 SpringHill Suites Marriott, 208-522-7000 Idaho Falls, ID 83415 – (Mail Stop). (In certain situations, INL WTB staff may help

obtain block agreements at hotels)

Alamo, 208-522-0340

Avis, 208-522-4225 Budget, 208-522-8800 Dollar, 208-528-2332

Enterprise, 208-523-8111 Hertz, 208-529-3101 National, 208-522-5276 Overland West, 208-529-3101 Thrifty, 208-227-0444.

Page 26 of 65

40 Miles

27 Miles

Figure 4 INL Overview Maps

Page 27 of 65

Detailed Technical Specifications mobility between LTE and other LTE Tier I Network 3GPP technologies - responsible for packet forwarding, Overall System Description routing, and buffering of downlink The LTE Tier I Cellular Network consists of a full EPC data for UEs that are in LTE-IDLE system (MME and a combined S&P-GW), Subscriber Data Management (HSS-FE and One-NDS), & E-Utran state (3 eNodeBs) Nokia solution which is 3GPP Release 10 - provides default EPS bearer compliant. The LTE Tier1 system is operated from one termination and IP address allocation of four (4) Network Operation Centers (NOC), which - provides dedicated non-GBR/GBR are currently located in the CFA-1609, CFA-699 and EROB buildings. WTB Engineers control and monitor EPS bearer termination the network from the NOC. Network Elements • NSP NFM-Packet The LTE EPC network elements are all located at - Network Functions Manager – Packet, Gate1Shelter3. based on the Nokia Network Service Evolve Packet Core: Platform that perform comprehensive network management for mobile • MME (Mobility Management Entity) packet core (CMM, CMG). - CMM-a2 (Cloud Mobility Manager- - It provides base fault, configuration, appliance 2), high performance Airframe RM17 HW based solution performance and security - 3GPP LTE Advance (Class5& 6) management. compliance Subscriber Data Management: - manage the Control plane for the LTE access • HSS-FE (Home Subscriber Server – Front End) - authenticates and authorizes the user - Based on the HP Blade System Gen8 - manages and stores UE context hardware, utilizing dual CPUs at 6 - generates temporary identities and cores each allocates them to UEs - runs on the high availability CMS- - manages mobility (idle and active 8200Telecommunication Service mode) Platform 7000 (TSP7000) - manages Intra-LTE handover - acts as a flexible point of access to the - S-GW relocation data stored in the subscriber repository • S&P-GW (combined Serving & PDN - stores mobile subscriber data for Gateway) circuit-switched and packet-switched - CMG-a2 (Cloud Mobility Gateway- domains appliance 2), high performance - provides support functions in mobility Airframe RM17 HW based solution management, call and session setup, - serves as the mobility anchor for the user authentication and access user plane during inter-eNodeB authorization handovers and as the anchor for - Supports S6a and S6d interface that enables LTE access and User Mobility for LTE / evolved PS core

Page 28 of 65

• One-NDS (One Network Directory - supports baseband pooling of two Server) System Modules, making it possible - Based on HP Blade System Gen8 to build high capacity sites hardware, utilizing dual CPUs at 8 • Domain Name Server (DNS) cores each - Based on Trinzic 1410 Network - Solution that unifies the subscriber Service Appliance data by storing it in a single - Purpose-built network appliances centralized repository and enable the deliver high-performance reliable and applications share data secure DNS, DHCP, and IPAM (DDI) - Uses entirely in-memory data storage - support Lights Out Management and is optimized for high transactional (LOM) for remote site communication throughput and low directory latency and management, feature a Unit - Stores subscriber, service, network, Identification Button / LED, and and application configuration data utilize the latest technology for - Provides an open centralized database achieving energy efficiency. in compliance with the X.500 and • Internet Chat Email (ICE) Box LDAP standards for a data directory - Fully functional internet simulator server system - Features: - Functional components; Network Email Server; POP/IMAP/SMTP, Directory Server (NDS), Provisioning o Web-based Administration, Gateway (PGW), Notification WebMail Client, Anti-Spam Manager (NTF), Operation and Filter, Groupware Server Maintenance Server (OAM), Installation Server (INS) o Internet Server; Fully Customizable, Real Websites • eNodeB (Flexi Multiradio 10 Base Station) o Chat Server; XMPP (Jabber) Compatible, Customizable (via - Based on Flexi Multiradio System plugins), Secure Module and Multiradio-capable RF Module Base Configuration - Support features and features 3GPP LTE Tier 1 Fixed Cell Sites are co-located with Release 10, high capacity, Single- GSM & UMTS at Gate-1, EBR-1, and CFA-609. RAN, and LTE-Advance ready The Gate 1 & EBR 1 Cell sites consist of - Supports LTE FDD, and the most equipment enclosures and a monopole. The common interfaces between the enclosures measure 10 feet by 10 feet by 20 feet modules and functions as defined by and have racks to facilitate most any equipment, Open Base Station Architecture HVAC and a battery backup system. The CFA- Initiative (OBSAI) and Common 609 Cell site monopole is near the CFA-609 Public Radio Interface (CPRI) equipment hub. - fully utilizes Ethernet-based transport • Each of the three fixed cell sites has the with security solutions, following infrastructure components: synchronization and timing methods - 60 ft Monopole based on synchronous Ethernet, timing over packet, and GPS methods - 50 ft & 60 ft platforms - 3rd platform possible

Page 29 of 65

- 3 sectorized antennas Monitored VPN access is provided to US vendor - Remote electrical down tilt capable citizens when outside support is required. - Multiple RF fiber optic transmission lines All WTB engineers and supporting team members to support multiple diverse antennas are US citizens that possess TS/SCI security • CFA-609 Cell Site – Large Configuration clearances. - Flexi Multiradio BTS LTE-FDD, FL18SP Spectrum SW, 3 Sectors each At the INL, the INL Spectrum Manager, under a - FDD charter from DOE’s NE-ID Chief Information - 4x2 MIMO Officer, controls Radio Frequency (RF) spectrum. INL has “experimental station” authority granted - 60W for Band 3 and 40W for Band 7 by DOE-HQ & NTIA, which allows - BW- 20MHz Band 3, 10MHz Band 7 communications testing at INL. - Carrier Aggregation (CA) – 30MHz Total The following are the GSM and UMTS bands • Gate 1 & EBR 1 Cell Sites – Medium approved to be utilized by WTB test customers: Configuration • Band 3 - Flexi Multiradio BTS LTE-FDD, FL18SP − 1710 – 1785 MHz Uplink SW, 3 Sectors each − 1805 – 1880 MHz Downlink - FDD • Band 7 - 2x2 MIMO − 2500 – 2570 MHz Uplink - 40W for Band 3 & 7 − 2620 – 2690 MHz Downlink - BW- 10MHz each Physical Location - Carrier Aggregation (CA) – 20MHz Total All cellular network facilities are on the INL range. The fixed cell sites provide RF coverage over the southern end of the 890 square mile Management and Configuration Capabilities range. The mobile cell sites can be positioned to The LTE Tier 1 network can be administered, provide RF coverage from CFA, TAN, WRRTF manage, and operate via Network Management and the HFTB where optical transport is available. System (NMS) platform, the NetAct 18. It is also This flexibility provides hundreds of square miles accessible locally, and remotely via VPN. of testing environments over paved and unpaved All configuration required of the cellular network roads, building campuses, and open desert. can be setup, tested and verified in advance of The RF Coverage is dependent on frequencies, client arrival on range to insure correct system operation and seamless testing. Post-test practices transmit powers, attenuations and antenna return the system to original base configuration. downtilts, which are all configurable parameters. They can be configured based on the coverage objective and other requirements. System Resources

WTB Personnel System Capacity The LTE Tier 1 cellular network was designed and installed by WTB engineers and commercial EPC (license based): vendor teams. The WTB cellular engineers are • MME and S/P GW trained to fully operate, configure, upgrade, - 10k LTE subscribers troubleshoot and maintain the cellular network. - 10k bearers

Page 30 of 65

- 1Gbps throughput license - 100-150 users internet - LTE Category 5 (required for 4x2 MIMO) browsing/email/background interactive and Category 6 (required for Carrier and best effort applications like Skype. Aggregation) EBR-1 & Gate-1 - 50/20 Mbps DL/UL, 50 simultaneous Subscriber Data Management (license based): users (per site with 3 sectors), 10+10 CA • One-NDS band 3 @60W and Band 7@40W, 2x2 MIMO - Support up to 300K Subscribers - 3-5 users with HD video - Support 1 million Subscriber Identities conferencing/streaming (average of 3- - 1 GB Subscriber profile storage 5Mbps using laptop or similar device with • HSS 720p/15/30 frames/sec), - 10K licensed sessions - 20-30 users internet - LTE EPS Access 50Mb (S6a) browsing/email/background interactive and best effort applications like Skype. • DNS/DHCP Server LTE Tier 1 Network added features and - 30,000 DNS Queries/second capabilities - 210 DHCP leases/second • SGs Interface • Internet Chat Email (ICE) Box - Circuit Switched Fallback (CSFB - Fully functional internet simulator server for email, chat, & internet . The CS voice service - Server Specifications: continuity is implemented through service triggered - 110-240 VAC 50/60 Hz redirection from LTE to - 4 GB RAM UMTS or GSM for - Gigabit Ethernet multimode device. - 1 TB Had Drive - SMS over SGs interface - Mirroring RAID . A solution implemented - 1 RU Rack mount between MME & MSS to - 1.67” H x 17.10” W x 24.00” D carry out the SMS without the (in) need to change radio access technology back to 2G/3G. E-UTRAN Capacity CFA-609 eNodeB: LTE Network Traffic Logging - 200/40 Mbps DL/UL, 200 simultaneous LTE real time monitoring and recording of data users, 20+10 CA band 3 @60W and band between LTE network elements is achieved 7@40W, 4x2 DL MIMO through a Viavi PacketInsight / Signaling - 10-20 users with HD video Analyzer Real Time (SART) protocol analyzer. conferencing/streaming (average of 3- The Viavi PacketInsight provides full filtering and 5Mbps using laptop or similar device with search functions, Key Performance Indicator (KPI) 720p/15/30 frames/sec), analysis and call and session analysis. It can generate PCAP and REC files for analysis.

Page 31 of 65

The Viavi LTE Protocol Analyzer is located at the - is responsible for packet forwarding, Gate-1, Shelter 3 cellular hub. The Viavi routing, and buffering of downlink PacketInsight passively monitors all LTE data for UEs that are in LTE-IDLE Interfaces of the LTE Network. state All data is recorded and can be saved in different - provides default EPS bearer file formats such as text, PCAP, REC or the termination and IP address allocation original Viavi SART Protocol Analyzer recording - provides dedicated non-GBR/GBR file can be saved and played back at a later time with a Viavi Decode viewer program. EPS bearer termination • HSS/AuC (Home Subscriber Service, LTE Band 13 & 14 Deployable Network Authentication Center) Overall System Description - providing the user authentication and authorization information to the MME The LTE Band 13 & 14 deployable network - managing user profiles consists of the core network (mini EPC) from - preserving user location at MME Athonet and three Nokia eNodeBs (2-Band14 & 1- level Band13) installed in three Cell on Wheels (COWs) that can be deployed within INLs fiber backbone. - storing of mobility and service data for every subscriber Base Configuration - permanent and central subscriber database The LTE miniEPC is a single server configuration using Athonet's Mobility Gateway Management • Policing Control and Charging Rules System Release 7.0 which is part of the PRIMO Functions (PCRF) solution. - responsible for brokering QoS Policy and Charging Policy on a per-flow The PRIMO Mobility Gateway implements the basis LTE Evolved Packet Core (EPC) functionality - Priority and preemption which consist of the following: - Data usage • MME (Mobility Management Entity) - Access RAN network type -authenticates and authorizes the user - Access to APN -manages and stores UE context - Uplink and downlink GBR & non- - generates temporary identities and GBR allocates them to UEs - Subscriber ID such as IMEI, IMSI - manages mobility (idle and active and MSSISDN mode) - Class of subscriber - manages Intra-LTE mobility - Time of day - manages EPS bearers • S-GW and P-GW (Serving/Packet Data The Mobility Gateway is structured to include a Network Gateway or SAE Gateway) network management (O&M) module that - serves as an anchor point both for supports: inter-eNB handover and for intra- • Configuration Management; 3GPP mobility • Performance Management, and; • Fault Management

Page 32 of 65

eNodeBs The LTE Deployable eNodeBs are Nokia Flexi • Radio Network Layer 3 Multiradio 10 Base Station installed in the COW (Cell-On-Wheels) trailers. The COWs can be - Radio Resource Control: deployed within INLs fiber backbone. There are 2 - Radio Bearer Control Band 14 eNodeBs and 1 Band 13 eNodeB. - Radio Admission Control - Idle and Connected Mode Mobility The eNodeBs host the following functions: Control

- Inter-cell Interference Coordination • Radio Network Layer 1 (Physical Layer) - Load Balancing - Inter-RAT RRM - error detection on the transport channel and indication to higher layers • Network related functions - FEC encoding/decoding of the transport channel - routing of U-plane to S-GW - hybrid ARQ soft combining - uplink QoS support at transport and bearer - rate matching of the coded transport level channel to physical channels - connection to the internet - mapping of the coded transport channel onto physical channels LTE Cellular on Wheels (COWs) - power weighting of physical channels - There is a total of three COWs. Two of - modulation and demodulation of physical them have Band 14 eNodeBs and the third channels has a Band 13 eNodeB. - frequency and time synchronization - COWs are mobile and can be towed to an - radio characteristics measurements and approved testing location. indication to higher layers - Each COW Mast extends up to Approx. - 2x2 MIMO (Multiple Input Multiple 60 feet high. Output) antenna processing - Each Antenna has a 0-16 degree elevation - transmit diversity (TX diversity) beamwidth and 65 degrees azimuth - RF processing beamwidth. - Each COW has an on-board diesel • Radio Network Layer 2 generator or will run on commercial power. - PDCP: robust header compression - There is one panel antenna mounted on (RoHC); Ciphering each mast of each COW. The antennas - RLC: RLC segmentation; Automatic have electric down-tilt and azimuth Repeat Request (ARQ) control. - MAC: MAC multiplexing - Hybrid Automatic Repeat Request Management and Configuration Capabilities (HARQ) The LTE deployable network can be accessed - uplink timing alignment locally and remotely via the management PC - packet scheduling inside the EPC cabinet. The management PC can

Page 33 of 65

be administered locally using the credentials The LTE deployable Band 13 & 14 network is on created on it and it can be accessed remotely via the 890 square mile INL reservation located VPN. Both the mini EPC and the eNodeBs can be approximately 45 miles west of Idaho Falls, ID. administered thru the management PC. The mini The INL location has the advantage of not being EPC uses a web-based application while the near any major metropolitan areas, airports or eNodeB uses the Nokia BTS Manager software military bases. installed in the management PC. The EPC is located at Gate1 Shelter 3 and the

eUTRAN which are installed in the 3 COWs (Cell System Resources on Wheels) can be deployed within INL’s fiber Personnel backbone. When the COWs are not in use, they The LTE deployable network was designed, are located at STF for storage. installed and implemented by WTB engineers and System Capacity Nokia based vendor teams. The network is The LTE deployable network has the following operated and maintained by WTB engineers and capacity: technicians. Monitored VPN access is granted to US vendor citizens when outside support is • Supports 1,000 sessions (registered required. subscribers) Spectrum • Supports 500 attached subscribers at any At the INL, the INL Spectrum Manager, under a given time charter from DOE’s NE-ID Chief Information • Supports 100 active subscribers Officer, controls Radio Frequency (RF) spectrum. transferring data at any given time WTB LTE deployable network operates at the • Supports “10” S1 interfaces (eNodeB and following channels/frequency bands: MME) License based limitation only.

• LTE Band 13: GSM and UMTS Downlink: 746 - 756 MHz (10 MHz) & The NOKIA GSM & UMTS Cellular Network 746 - 751 MHz (5 MHz) consists of a full MSC/HLR/BSC/RNC switching Uplink: 777 - 787 MHz (10 MHz) & center which controls six cell sites. Three of these 777 - 782 MHz (5 MHz) sites are mobile cells, or Cell-on-Wheels (COWs), and three of these sites are fixed cells. • LTE Band 14: Downlink: 758 - 768 MHz (10 MHz) & The GSM & UMTS network was configured with four PLMNs namely INLOFF/PLMN1, 758 - 763 MHz (5 MHz) INLTST/PLMN2, INLICE/PLMN3 and Uplink: 788 - 798 MHz (10 MHz) & INLLUX/PLMN4. The GSM & UMTS Cell Sites 788 - 793 MHz (5 MHz) located at INL facility were configured as INLTST/PLMN2 and the GSM & UMTS Cell LTE Band 13 (10 MHz Bandwidth) emissions as Sites outside INL facility were configured as approved and coordinated with Verizon and LTE INLOFF/PLMN1. The other 2 PLMNs (INLICE Band 14 (5 MHz Bandwidth) emissions as & INLLUX) can be configured to the GSM & approved by FirstNet and as coordinated with UMTS Cell Sites as needed. Below is the Clark Communication if required) and approved information for each PLMN and the subscribers through FCC and NTIA STA/TAs. configured on each PLMN works in all four PLMNs. Physical Location

Page 34 of 65

- The maximum capacity figures in a Nokia PLMN1 PLMN2 PLMN3 PLMN4 8 million subscriber profile for the oMSS PLMN INLOFF INLTST INLICE INLLUX Name 17 are: LAC INLIDH200 INLTS200 INLIC300 INLLU400 • 8 000 000 subscribers in the Name LAC VLR 10200 20000 30000 40000 Number • 8 000 000 Busy Hour Call Mobile Country Attempts (BHCA) 103 103 274 270 Code (MCC) • 8 000 000 short Mobile messages/busy hour Network 68 10 05 77 Code • up to 300 000 simultaneous (MNC) calls MSISDN 1208 1222 1333 1444 Range • power consumption: 2621 BHCA / W - Full support for GSM, CDMA,UMTS The network switching Hub is located at CFA-609 (WCDMA), and CS over HSPA access and is the central equipment core of the network. networks. It has interfaces to the LTE The cellular system can be operated from one of Evolved Packet Core (EPC) to function as four (4) Network Operation Centers (NOCs), a CS Mobile Softswitch in 3GPP CS which are located in CFA-1609 (2), CFA-699 and Fallback architecture and interworks with UB-4 buildings. WTB engineers control and the 3GPP IMS All-IP communication monitor the network from the NOC. networks as a Media Gateway Control Function (MGCF). Network Elements • Open Multimedia Gateway (oMGW) The following sections include detailed information for the GSM and UMTS cellular - NOKIA software version 16 on Advanced network elements (see Figure 4) Telecommunications Computing Architecture (ATCA) hardware platform. WTB GSM and UMTS Equipment Located at CFA-609 - Handles the User Plane transportation and switching for both GSM and UMTS, • Standalone Open Mobile Softswitch (oMSS) where the oMSS handles the control plane - Based on the M17 Release DX200 SW - IP backend connectivity to the oMSS platform and commercial off-the-shelf instead of costly PCM E1s Advanced Telecommunications - Up to 9M Busy Hour Call Attempts Computing Architecture (ATCA) (BHCA) hardware platform. - Up to 150,000 Erlang - Provides call control and mobility - 64 E1 Ports for (BSC/PSTN) via ADX201 management by performing signaling and call and connection control. The user - Connectivity to the “simulated” Public plane switching and routing, performed by Switched Telephone Network (PSTN) Multimedia Gateways (MGWs), - Provide Full Transcoder capability, implement the user plane interworking decreasing the amount of T1 between the between the packet-switched and the BSC and MGW circuit-switched networks. - Supports Adaptive Multirate (AMR), Enhanced Full Rate (EFR), AMR Half

Page 35 of 65

- Rate (HR), and AMR Full Rate (FR) - Performs radio resource allocation to a speech codecs mobile station, frequency administration, • New Technology - Home Location Register handover handling, and power (NT-HLR) Front End management - Supports up to 150 TRXs = 1200 full rate - NOKIA software version 17.5 on the HP channels. Blade System Gen9 hardware solution, high performance dual CPU (6 Cores) UMTS Equipment Located at Gate 1 - Runs on the high availability CMS- • Radio Network Controller (RNC) 8200Telecommunication Service Platform - Nokia RNC 2600 HW platform running 7000 (TSP7000) software Version WCDMA17 Performs - Acts as a flexible point of access to the radio resource management and data stored in the subscriber repository telecommunications management for the (One-NDS). Radio Access Network (RAN). - Handles authentication, encryption, and - Can support up to 680,000 subscribers and over-the-air ciphering of voice and data 1,440 Node B’s. - Traffic is shared between 2 NT-HLR front - IuCs over IP connection to the end oMSS/oMGW - Supports GSM, GPRS, EDGE, UMTS

Figure 5 INL WTB CFA-609 Cell Site

WTB Fixed Cell Sites located at Gate-1, EBR-1, and CFA-609 • GSM Base Station Controller (BSC) The Gate 1 & EBR 1 Cell sites consist of - Base station subsystem switching and equipment enclosures and a monopole. The control enclosures measure 10 feet by 10 feet by 20 feet - NOKIA software Version RG40 on the and have racks to facilitate most any equipment, DX200 hardware platform HVAC and a battery backup system. The CFA-

Page 36 of 65

609 Cell site monopole is near the CFA-609 base state of the cell site base stations is described equipment hub. below. • Each of the three fixed cell sites has the Fixed Cell Sites: following infrastructure components: • Physical Configuration: - 60 ft Monopole - Three sectors per tower with individual - 50 ft & 60 ft platforms transmission lines feeding each - 3rd platform possible technology on each sector - GSM 1900/1800/900 BTS • Logical Configuration: - UMTS 2100 MHz Node B - GSM – Single Broadcast Control Channel - Point to point microwave links to & from (BCCH) carrier per frequency/sector Hub (9 total BCCH carriers per Fixed cell site). - 3 sectorized antennas - UMTS – Single Common Pilot Channel − Remote electrical down tilt capable Signal (CPICH) per frequency/sector (3 total CPICH’s per Fixed cell site). - Multiple RF coaxial transmission lines to support multiple diverse antennas Mobile Cell Sites (COWs): • GSM Base Transceiver Stations (BTS) • Physical Configuration: - NOKIA Ultrasite Edge, software version - Stowed position at PER-623 dock stations CX8. where commercial shore power is - The BTS contains the equipment for available and routine maintenance transmitting and receiving of radio signals performed (transceivers), antennas, and equipment - 1 360° sector cell with RF power divider for encrypting and decrypting feeding 3 antennas to form an OMNI communication with the BSC directional RF footprint - (3) 1900 MHz GSM/EGSM/GPRS TRXs • Logical Configuration: - (4) 1800 MHz GSM/EGSM/GPRS TRXs - GSM – Single Broadcast Control Channel - (4) 900 MHz GSM/EGSM/GPRS TRXs (BCCH) carrier per frequency/sector • UMTS Node B (3 total BCCH carriers per COW). - NOKIA Flexi Node B, software version - UMTS - Single Common Pilot Channel WN9.1 Signal (CPICH) per frequency/sector (1 total CPICH per COW). - The Node B performs the radio interface Layer 1 processing as well as some basic GSM and UMTS Management and Configuration Capabilities Radio Resource Management. - (3) 2100 MHz RF transceiver modules The cellular network can be configured and operated remotely from any point attached to the - (1) System module Local Area Network (LAN1). The NOC is the GSM and UMTS Base Configuration primary location for network operations and test The NOKIA GSM and UMTS cellular network is control, providing both personnel space and placed in a default or base configuration between supporting resources. Centralized network control test events. This configuration is represented in a of the cellular system is achieved through the logical state of the network elements as well as a NOKIA Network Management System (NMS) physical state of the cell site base stations. The NetAct.

Page 37 of 65

The base configuration for network operation can • GSM 1900 MHz be utilized for testing with minimal preparation − 1850 – 1910 MHz Uplink effort. Upon request, the network configuration can be customized to meet specific test − 1930 – 1990 MHz Uplink requirements. The physical and logical setup can • GSM 1800 MHz be altered to replicate most any commercial network or to replicate a specific RF environment − 1710 – 1785 MHz Uplink to meet test objectives. − 1805 – 1880 MHz Downlink All configuration required of the cellular network can be setup, tested and verified in advance of • GSM/EGSM 900 MHz client arrival on range to insure correct system − 880 – 915 MHz Uplink operation and seamless testing. Post-test practices return the system to original base configuration. − 925 – 960 MHz Downlink. The current software version of the NOKIA NMS • UMTS 2100 MHz system is NetAct 18. − 1922.4 MHz Uplink GSM&UMTS System Resources − 2112.4 MHz Downlink WTB GSM & UMTS Personnel − 1927.4 MHz Uplink The NOKIA GSM & UMTS cellular network was − designed, installed and implemented by WTB 2117.4 MHz Downlink engineers and Nokia vendor teams. The WTB Physical Location cellular engineers are trained to fully operate, All cellular network facilities are on the INL configure, upgrade, troubleshoot and maintain the range. The fixed cell sites provide RF coverage cellular network. over the southern end of the 890 square mile All WTB engineers and supporting team members range. The mobile cell sites can be positioned to possess TS/SCI security clearances. provide RF coverage from the Central Facilities Area to the Northern border of the reservation. Spectrum This coverage terrain provides hundreds of square At the INL, the INL Spectrum Manager, under a miles of testing environments over paved and charter from DOE’s NE-ID Chief Information unpaved roads, building campuses, and open Officer, controls Radio Frequency (RF) spectrum. desert. INL has “experimental station” authority granted by DOE-HQ & NTIA, which allows The RF Coverage is dependent on frequencies, communications testing at INL. transmit powers, attenuations and antenna downtilts, which are all configurable parameters. The NOKIA GSM & UMTS cellular network They can be configured based on the coverage operates in four frequency bands. Hundreds of objective and other requirements. GSM Absolute Radio Frequency Channel Numbers (ARFCNs) and two UMTS UTRA GSM System Capacity Absolute Radio Frequency Channel Numbers The cellular subscriber load capacity is defined per (UARFCN) have been approved for WTB use on network element. Each element described in the INL site. Specific ARFCN and UARFCN section “Network Elements” lists the volume of usage is coordinated through the INL Spectrum channels (voice calls) currently supported. The Manager. overall system capacity is best defined by the physical radio resources provided by each BTS. The following are the GSM and UMTS bands When configured for Full Rate channel coding and approved to be utilized by WTB test customers:

Page 38 of 65 a single TRX per cell sector, there are 7 bearer See Tables 2 and 3 for the subscriber capacities of channels available to subscribers for voice the WTB Fixed and Mobile Cell Sites. channels. Table 2 Current GSM System Subscriber Capacity – Fixed Cell Sites

# of Bearer Fixed Cell Total # of GSM Frequency TRXs Channels Sites Subscriber Calls 1900 MHz 3 7 3 63 1800 MHz 4 7 3 84 900 MHz 4 7 3 84

Table 3 Current GSM System Subscriber Capacity – Mobile Cell Sites

# of Bearer Mobile Cell Total # of GSM Frequency TRXs Channels Sites Subscriber Calls 1900 MHz 1 7 3 21 1800 MHz 1 7 3 21 900 MHz 1 7 3 21

UMTS System Capacity The UMTS system subscriber load capacity is defined per Node B. The capacity is defined by the number of channel elements per Node B. A conversational call requires one channel element for the uplink and one channel element for the downlink. Channel elements are a NOKIA capacity license key and are upgradeable to 224 Channel Elements per Node B. See Table 4 and 5 for the subscriber capacities of the WTB Fixed and Mobile Cell Sites.

Table 4 Current UMTS System Subscriber Capacity – Fixed Cell Sites

Fixed # of RF Channel Cell Total # of UMTS Frequency Transceivers Elements Sites Subscriber Calls 2100 MHz 3 192 3 288

Table 5 Current UMTS System Subscriber Capacity – Mobile Cell Sites

Mobile # of RF Channel Cell Total # of UMTS Frequency Transceivers Elements Sites Subscriber Calls 2100 MHz 1 192 3 288

Page 39 of 65

GSM and UMTS Terminals, Radios and Handsets Customer provided terminals or radios can be GSM Network Traffic Logging programmed for use on the system if they are Real time monitoring and recording of data GSM/UMTS compliant and will accommodate a exchange between GSM network elements is WTB provided SIM card. In some cases, customer capable through a NetHawk M5 protocol analyzer. provided SIM cards can be added to the network. The WTB has access to additional SIM cards as The M5 is located in the equipment hub at CFA- well as the programming equipment to program 609. The M5 interfaces to the Digital Signal the SIM cards. Cross-connect (DSX) board which acts as a patch panel for network element circuits. These GSM Authentication & Encryption interfaces passively monitor all uplink and The WTB NOKIA cellular equipment supports downlink communication transferred on the A, and utilizes the A3 & A8 GSM algorithms. These Abis and Ater circuits as well as the IP control algorithms are used to generate the keys used in plane protocols. the encryption process. The WTB NOKIA cellular Collected data can be provided in text file format equipment also supports and utilizes the A5/1 & or played back through an M5 viewer utility. The A5/2 GSM algorithms used to encrypt over-the-air playback viewer provides filtering capabilities and communication channels between the BTS and the a graphical user interface similar to the M5 handset. Analyzer. UMTS Authentication & Encryption UMTS Network Traffic Logging The WTB NOKIA UMTS cellular network UMTS real time monitoring and recording of data supports the 3GPP standard for UMTS Security. between UMTS network elements is achieved UMTS authentication is based on mutual through a Viavi Distributed Network Analyzer authentication which utilizes an Authentication (DNA) protocol analyzer. The Viavi DNA and Key Agreement (AKA). The AKA utilizes a provides full filtering functions, Key Performance 128 bit Ciphering key (CK) and an Integrity Key Indicator (KPI) analysis and call and session during the authentication process. The WTB analysis. UMTS network supports the following CK algorithms: UEA0 (no encryption) and UEA1 The Viavi SART Analyzer is located at the Gate- (Kasumi). 1, Shelter 3 remote cellular hub. The Viavi SART Protocol Analyzer passively monitors all uplink GSM and UMTS Billing and Record Keeping and downlink protocol messages on the IuB and The current WTB MSC generates Call Detail Iu-CS interfaces of the UMTS Network. Records (CDR) and other call tracing utilities that All data is recorded and can be saved in a comma can be accessed through the Network Management delimited text (CSV) format or the original Viavi System (NMS) NetAct. SART Protocol Analyzer recording file can be Signaling and traffic communication between saved and played back at a later time with a Viavi network elements is monitored and recorded Decode viewer program. through the NetHawk protocol. PSTN Simulation & Traffic Generation The WTB cellular Core network can facilitate a The WTB NOKIA cellular network is an isolated converged billing system but does currently network with no physical interfaces to systems employ a billing management server to facilitate outside of the WTB. A GL Communications charging practices typical to a commercial Digital Central Office Switch Simulator (DCOSS) provider. has been integrated into the MSC (Mobile Switching Center) to simulate the Public Switched

Page 40 of 65

Telephone Network (PSTN). The DCOSS appears timeslots. Includes Modem Quality to the MSC as the PSTN and will route signaling Assessment and traffic calls to and from the simulator. The • Transmit and Detect DTMF/MF digits DCOSS also provides traffic generation/loading simultaneously over all timeslots capability. • Transmit and Detect Single- or Dual- DCOSS Frequency Tones simultaneously over all • Windows 2000/XP Operating System timeslots • Portable system with digital E1/T1 trunks, • Switches Calls among Timeslots/Trunks with BRI ISDN and POTS (Plain Old Telephone Protocol Conversion capability Set) Interfaces • Pass/Fail Calls using User-Defined Pass • Available Protocols Include: Criteria - T1 CAS: R1, Loopstart, Ground Start, • Real Time Status of Each Call Feature Group D, Immediate Start • Real Time Statistics with Hourly Information - E1 CAS: R1, MFC-R2, Digital E&M, Europea Digital CAS • Save and Load Protocol, Trunk and Dialing Parameters as User Defined Configurations - PRI ISDN - includes USA ISDN, Euro ISDN, Asian ISDN, T1 NFAS • Multiple 2-Wire (RJ11) -> (up to 64 - SS7 - includes support for ISUP, TUP, interfaces) Standard Telephone Interfaces (8, TCAP, SCCP, SCP 16, 24) - SS5 • BRI ISDN European ST-Interface (16 port) • Support for up to 16 T1's and/or E1's • Manual or Automatic ANI (Caller ID) • Generates and Receives Manual or Automatic Generation Calls Simultaneously on any or all Timeslots • Remote Access Capability (Client/Server) • Record and Playback of PCM Voice Files using GUI or Command Prompt. Access to simultaneously over all timeslots. Includes OCX/DLL to develop user-defined client Voice Quality Testing using PAMS, PSQM, • Automatic Bulk Call Generation/Reception for PSQM Plus, and PESQ load testing digital/analog trunks • Real-Time FAX Call Generation/Reception • Bulk Call Scripting with simple point-and- (V.29, V.27, V.17, V.33) simultaneously over click script setup. Allows for conditional all timeslots. Includes Fax Quality Assessment commands as well as script looping • Send/Receive Modem Traffic (V.21, V.23, V.34, V.90, V.92) simultaneously over all

Page 41 of 65

Figure 6 Cellular assets installed at INL and China Lake

Page 42 of 65

ChatterBox Voice & SMS Traffic • Bi-directional voice calls Generator • SMS messaging with user-definable text The WTB utilizes the 32 channel ChatterBox from messages TLC Solutions to create voice and SMS traffic on • Remotely controlled via IP interface its isolated cellular network. This self-contained unit is able to provide 16 simultaneous voice calls • Individual channels can be permanently within itself, or 32 voice calls to other cellular camped on any 2G basestation devices registered on the same network. • Programmed jobs can start at any date or time System highlights for the Chatterbox are as • Visual status of current running jobs follows: • Time stamped log files for each job • 32 Channels for voice & SMS • Integrated log file viewer • Mobile-to-Mobile voice generation • 20 scenarios per job with up to 20 pending • Multi-SIM functionality with up to 4 SIM jobs cards per channel • Dimensions & Weight: • Integrated antenna combiner so all channels feed through one antenna • 30” L x 22.47” W x 11.09” H • User definable voice wave files • 57 lbs.

Page 43 of 65

CDMA • Position Determination System (GPS data) Overall System Description (800 MHz QDBS only) The WTB CDMA cellular assets consist of three • Picture Upload server (800 MHz QDBS only) Qualcomm Deployable Base Station (QDBS) • Three Sector Expansion Kit (1900 MHz systems: two which support 800 MHz operations QDBS only) and one which supports 1900 MHz operations. QDBS Capacity/Expandability Each QDBS is: • Base Transceiver Station (BTS) • A compact, easily deployable, self-contained - Up to 45 users per sector CDMA2000 1xRTT Rev 0 compliant system. - Up to 3 RF sectors per BTS • A complete cellular base station and switch - Packet data rates up to 153 kbps/user in packaged in transit cases for ease of shipping, clear mode storage, setup and operations; i.e., network-in- a-box (NIB). • Base Station Controller (BSC) • Able to operate stand-alone or interconnected - Up to 12 RF sectors per BSC (for 1900 MHz NIB) to public or private - Supports hand-over between BTS sectors communications networks. - Power control for mobile units QDBS Standard Features • Mobile Switching Center (MSC) • Coverage area of 3-10 miles (depending on - Supports multiple BSCs antennas, mast height, terrain, etc.) - Supports inter-BSC handoffs • Voice mobile calls - Home Location Register (HLR) supports 2500 devices • Packet data (up to 153 kbps) - Media Gateway (MGW) has four T1 • PSTN/PBX interconnectivity (1900 MHz interfaces and is expandable QDBS only) − Each T1 supports 45 mobile-to-land or • Standard voice services (Caller ID, Call land-to-mobile calls. Waiting, Call Forwarding, Three-way Base Configuration Calling). All components of the CDMA system, when not in • Supports many commercial-off-the-shelf use, are shutdown, packed in their transit cases and (COTS) phones, air cards and PDAs. stored in the WTB warehouse (CFA-661). • Operates in pico-cell (100 mW) or macro-cell Management and Configuration Capabilities (17W) modes. Each QDBS includes a laptop computer which QDBS Optional Features provides the interface to operate, administer and • Secure voice maintain the system: • QSec-2700 Type-1 Certified FNBDT secure • System startup and shutdown handset • Transmit power adjustment (0 – 17 W per • Asynchronous data (clear and secure). sector in 1% increments) • Clear->Secure & Secure->Clear transitions. • Subscriber database management • Short Message Service (SMS) • Dial plan management • Call Detail Record review

Page 44 of 65

• System log review • 800 MHz: This spectrum is owned by Verizon, the local commercial CDMA carrier; • System configuration management. however, Verizon has agreed to allow The 800 MHz QDBS systems include a second INL/WTB to operate on the following laptop computer to provision the included ten channels/frequencies: mobile devices. - 507 (840.21 MHz uplink, 885.21 MHz downlink) - 548 (841.44 MHz uplink, 886.44 MHz downlink) - 630.(843.90 MHz uplink, 888.90 MHz downlink) • 1900 MHz: The WTB has spectrum manager approval to operate in CDMA 1900 Block F - Channels 825 – 875 - 1891.25 – 1893.75 MHz uplink - 1971.25 – 1973.75 MHz downlink. CDMA Location As the CDMA QDBS NIBs are very portable, they can be set up and used anywhere on the 890 square miles INL range, with approval.

5G Amarisoft Callbox Ultimate Overall System Description Callbox Ultimate is a 3GPP compliant eNodeB, gNodeB, EPC and 5GC allowing functional and Figure 7 INL WTB CDMA QDBS NIB performance testing of NR, LTE, LTE-M and NB- IoT devices. It also includes an integrated IMS System Resources server as well as an eMBMS gateway for VoLTE CDMA Personnel and eMBMs testing. The Callbox Ultimate supports LTE, 5G Non-standalone (NSA) or 5G The CDMA system is operated and maintained by Standalone (SA) configurations. WTB engineers and technicians. Standard Features CDMA Spectrum • INL has “experimental station” authority granted 4 PCIe Software Defined Radio (SDR) cards by DOE-HQ & NTIA. At the INL, the INL • Up to 4x4 MIMO in downlink Spectrum Manager, under a charter from DOE’s • NE-ID Chief Information Officer, controls Radio Modulation: Up to 1024 QAM in DL & 64 Frequency (RF) spectrum. QAM in UL CDMA WTB operations are allowed in the • Supports all FDD and TDD bands < 6 GHz following channels/frequency bands: • RF Coverage: 500 MHz – 6.0 GHz • RF bandwidth: 200 KHz – 100 MHz

Page 45 of 65

• Max total # of cells: 8

o Max # of LTE cells: 8 o Max # of 5G cells: 2 • Power output set at 16 mW Location of 5G Amarisoft Callbox Ultimate NOC-4, within EROB: intended for lab bench testing and experimentation only.

Isolated Satellite Backhaul Network Overall System Description The ISBN consists of a fixed 5.6m Andrew ground station, iNetVu 1.2m field terminals and associated routing, switching, encryption and PBX units. This system can operate as a stand-alone isolated network, or it can be connected to external teleports for outside connectivity. The ISBN is iNetVu 1.2m Field Kits: only deployed when required and can be uniquely configured for each test event. The iNetVu auto deploy drive and fly away field kits consist of a 1.2m dish, antenna controller, Base Configuration modem, switch, encryption unit and VOIP phone. Andrew 5.6m Teleport: The current configuration supports five drive away units that mount in the back of a truck, and two fly The Andrew ground station dish and associated away units that are ground mounted. These kits transport equipment is located at the Fillmore Test can be deployed anywhere in the world with the Facility (FTF). The dish is outfitted with heating proper KU satellite coverage and/or transport back elements to support year-round KU band to the United States. With a mere push of the connections to commercial satellites. Encrypted button the field kits will track and lock onto the voice and data are accomplished through isolated pre-programed satellite; immediately establishing routers, switches, encryption units and redundant an encrypted connection to the ground station. PBX systems. The ground station can interface Powering the field kits is typically done through with other INL terrestrial networks including the use of a WTB provided Honda 3K generator. voice, internet and external VPN connected Customers are able to connect their system under networks for various test scenarios. test to the field kit switch and pull power from the 3K generator.

Page 46 of 65

outside vendor teleports where external voice and data connections can be configured for unlimited calling within the US and Canada.

High Frequency Test Bed (HFTB) Overall System Description The High Frequency Test Bed (HFTB) facilitates HF communications testing and consists of several ground mounted and portable antennas, mobile System Resources radio systems, HF Monitoring system, HF Sounder, and HF modeling capabilities. The Personnel HFTB facility is dedicated to HF testing, with The Isolated Satellite Backhaul Network is many temporary locations available over southeast operated and maintained by Wireless Test Bed Idaho as required. staff. Base Configuration Spectrum All radio and antenna kits for testing are deployed The ISBN operates in the commercially available when needed in the configuration required for KU band: each test. Mobile radios are packed into their - Transmit: 13 - 14.5 GHz respective kits and stored at the HFTB facility. - Receive: 11 - 12.5 GHz All portable antenna kits, cables, watt meters and equipment are stored at the HFTB to be deployed Radio Frequency spectrum coordination is as needed. conducted with the INL Spectrum Manager before satellite deployment to ensure spectral harmony The HF spectrum is continuously monitored at with other test events. receiver locations in FL, MD, UT and ID during HF test events. Each location hosts a FLEX-6700 Physical Location receiver capable of monitoring spectrum from 30 The ground station is located in the CITRIC area kHz to 72 MHz and 135 MHz to 165 MHz of the INL site, which is approximately 45 miles depending on the connected antenna. Spectral east of Idaho Falls, ID. The iNetVu auto deploy displays are transported to an INL terminal via field kits can be operated with in INL’s 890 square secure VPN. mile test range or anywhere within satellite The HF Sounder takes measurements of the HF coverage. Voice and data connectivity of the spectrum every 15 minutes. Ionograms and ISBN can be extended through WTB terrestrial skymaps are posted to a public website which networks to reach various campus facilities on the holds a history of ionospheric conditions at INL. INL desert site. Management and Configuration Capabilities System Capacity Each HF radio asset is configured on a per-device The ISBN is typically operated under equal path basis; however, ICOM provides a software balance allowing for 100 KBps up & down to each program that allows the creation of multiple field location, expandable to T1 speeds to each configurations that can be transferred to the radio location. Utilizing the integrated ground station via a serial port. Devices can be reconfigured to PBX system calls and bridge conferencing are suit customer requirements within the capabilities unlimited. As required, the field terminals can be of the equipment. configured with iDirect modems for access to

Page 47 of 65

The HF Monitoring system is controlled and several NTIA Temporary Authorizations (TA’s) maintained by WTB engineers from the HFTB. for HF and VHF testing. Spectrum feeds from all FLEX-6700 receivers are Physical Location displayed in the HFTB or transported to other facilities as required for the test event. WTB Most WTB HF radio facilities are on the engineers analyze signal captures and inform the 890 square mile INL reservation located test team of real-time signal propagation. approximately 45 miles West of Idaho Falls, ID. In addition, there are test locations in Idaho Falls, as The HF Sounder is controlled and maintained by well as several off-site areas around the INL in WTB engineers from the HFTB or other test remote locations for NVIS testing. facilities as required for the test event. Ionospheric conditions are analyzed by WTB The INL location has the advantage of not being engineers to inform the test team and guide near any major metropolitan areas, airports or channel selection. military bases, in a relatively low RF noise environment. HF ionospheric radio signal propagation modeling and forecasting is conducted with the ACE-HF Common Test Locations software platform to design test experiments and 1. HFTB (on INL reservation) determine proper channel selection during events. 2. STF (on INL reservation) ACE-HF uses the latest VOACAP as the 3. WRRTF (on INL reservation) computational engine. 4. IRC (Idaho Falls, east of INL) System Resources 5. Antelope Canyon (off-site, west of INL) 6. Eight Mile Canyon (off-site, north of INL) Personnel 7. Mountain Home AFB (off-site, southwest of The HFTB radio system was built, operated and INL) maintained by INL WTB engineers. In addition, the staff is experienced with: Portable Antennas and Radios • Current commercial and military tactical HF 1. Diamond BB7V Whip w/SGC Smartuner 230 radios 2. Barker & Williamson BWD-90 Folded Dipole 3. Barker & Williamson BWD End fed “Vee” • Multiple platform tests 4. CODAN Vehicle Mounted NVIS Whip • Supporting regional (South East Idaho) Near 5. Chameleon EMCOMM II HF Long Wire Vertical Incident Skywave testing (NVIS) 6. ICOM IC-F7000

• Fast test setup and reconfiguration Fiber Network Spectrum Overall System Description At the INL, the INL Spectrum Manager, under a The WTB fiber network facilitates isolated charter from DOE’s NE-ID Chief Information short/long term interconnectivity to: Officer, controls Radio Frequency (RF) spectrum. • CFA-609, Gate-1, and EBR-1 cell sites INL has “experimental station” authority granted • Over thirty (30) power pole mounted fiber by DOE-HQ & NTIA, which allows patch panel breakouts at field locations in communications testing for government between the three (3) cell sites customers. In some cases, excluded frequencies and offsite frequency use may be implemented, • Other INL/WTB/Customer systems, but this requires a special filing with the NTIA and facilities, and internal/external transport a more rigorous approval process outside the and networking infrastructure INL’s Spectrum Manager’s office. WTB maintains

Page 48 of 65

Infrastructure Summary • End-to-end infrastructure management by • Two (2) primary backbone links WTB staff o CFA-609 – EBR-1 cell site * Maximum capacity, actual available dark o CFA-609 – Gate-1 cell site One-hundred forty-four (144) single fiber capacity is less due to existing o connections mode fibers per link* . Ninety-six (96) patched fibers . Forty-eight (48) straight- through fibers

Wireless Test Bed Fiber Network Overview PBF-608 018-L (power pole) 012-L (power pole) 53-16 (power pole) 53-22 (power pole) 53-28 53-37 (power pole) Scoville (power pole) Substation

CFA-668

CFA-609

HFTB

STF EBR-1 Cell Site 53-60 (power pole)

B27-606

Gate-1 B27-603 Cell Site

CFA-609 – EBR-1 cell site link CFA-609 – Gate-1 cell site link Outdoor Pedestal Termination Indoor Termination Power Pole Breakout Figure 8 WTB Fiber Network Overview

WTB Backhaul The WTB backhaul network is comprised of the Overall System Description following components: The WTB backhaul network is used to facilitate • Ericsson ATM switches, connectivity for GSM, UMTS, and LTE (China • ADTRAN and RAD DS3 multiplexors, Lake ONLY) cellular base stations, ancillary local area networks (LANs), and ad-hoc/test specific • RAD and MRV media converters, and requirements. • Microsemi GPS-referenced The WTB backhaul network supports transport of synchronization and network time servers E1/T1, E1 IMA, DS3, STM-1/OC-3c, and 10/100 Use Considerations Mbps Ethernet interfaces to WTB operated test facilities by leveraging WTB fiber, other INL- • Existing WTB backhaul infrastructure managed backbone transport infrastructure, and configuration is tailorable with expandable two (2) leased DS3 circuits, which are specifically capacity used to support connectivity to China Lake.

Page 49 of 65

• WTB backhaul network connectivity can be 4. Gate-1, Shelter-1 to Shelter-3: TCP/IP over extended to other facilities/campus areas multi-mode fiber. across the INL Test Range by using other Base Configuration existing INL-managed transport infrastructure The base configuration of LAN1 is with all • WTB backhaul network connectivity can be devices and systems operational. extended to offsite locations through a leased line service obtained from a commercial Management and Configuration Capabilities telecommunications provider, such as Century All devices and services on LAN1 can be Link configured and operated remotely from any point System Resources attached to the LAN. Devices and services can be reconfigured to suit customer requirements within The WTB backhaul network was designed, the capabilities of the equipment. deployed, and is operated and maintained by WTB staff. System Resources WTB Local Area Networks (LANs) Personnel Local Area Network #1 (LAN1) – LAN1 was built and is operated and maintained by GSM/UMTS network engineers on the WTB staff. Overall System Description Physical Location LAN1 is an isolated TCP/IP Ethernet network All LAN1 facilities are on the 890 square mile providing wireline network access at five facilities INL reservation located approximately 45 miles all of which are located on the INL reservation. east of Idaho Falls, ID. The INL location has the The purpose of LAN1 is to provide TCP/IP advantage of not being near any major connectivity for all WTB cellular network metropolitan areas, airports or military bases. elements and support components located in fixed Network facilities at each location: network sites in addition to the Network Operations Center (NOC). The facilities served by 1. CFA-609 LAN1 are: - Cisco 3845 Router 1. CFA-609, Room 200 - Cisco 3560 48 port Layer 3 PoE switch 2. Gate1, shelter-1 - Cisco 3560 24 port Layer 3 PoE switch 3. Gate1, shelter-3 2. Gate1, Shelter-1 4. EBR1 shelter 5. RTMF - Cisco 3560 24 port Layer 3 PoE switch - Fiber patch panel The links between the facilities are: 3. Gate1, Shelter-3 1. CFA-609 to RTMF: Ethernet bridge over - Cisco 3845 Router ATM; single-mode fiber. - Cisco 2960G 24 port Layer 2 switch 2. CFA-609 to Gate1: Ethernet bridge over - Cisco 2950 24 port Layer 2 switch ATM; 23 GHz Microwave link (2.85 miles). - Fiber patch panel 3. CFA-609 to EBR1: Ethernet bridge over 4. EBR1 23 GHz Microwave link (2.57 miles). - Cisco 2960 24 port Layer 2 switch 5. RTMF

Page 50 of 65

- Cisco 3560 24 port Layer 3 PoE switch. Networking gear at each location 1. CFA-1609 Local Area Network #4 (LAN4) – RTSM - Cisco 3560 Layer 3 PoE switch Overall System Description - Tektronix Spectrum Analyzer LAN4 is an isolated TCP/IP Ethernet network - Remote Controlled RF Switch providing wireless network access at three - Horn antenna facilities and wireline network access at five facilities all of which are located on the INL - Omni antenna reservation. The purpose of LAN4 is to support 2. EBR-1 Real Time Spectrum Monitoring (RTSM) through - Cisco 2950 Layer 2 switch the use of spectrum analyzers. The facilities served - Tektronix Spectrum Analyzer by LAN4 are: - Remote Controlled RF Switch • CFA-1609 - Horn antenna • RTMF Trailer - Omni antenna • EBR1 shelter 3. RTMF • Howe Peak - Cisco 2950 Layer 2 switch Base Configuration - Tektronix Spectrum Analyzer - Remote Controlled RF Switch The base configuration of LAN4 is with all devices and systems operational. All spectrum - Horn antenna analyzers support remote operations allowing the - Omni antenna user to be located out of a Wireless Test Bed 4. Howe Peak facility. - Cisco 2950 Layer 2 switch Management and Configuration Capabilities - Tektronix Spectrum Analyzer All devices and services on LAN4 can be - Remote Controlled RF Switch configured and operated remotely from any point - Horn antenna attached to the LAN. There is no centralized configuration facility; each asset must be - Omni antenna configured on a per-device basis. Devices and services can be reconfigured to suit customer Cellular Network Management requirements within the capabilities of the equipment. Overall System Description System Resources NOKIA NetAct is an operation support system that consists of many tools for operating and Personnel maintaining the elements of the WTB cellular LAN4 was built and is operated and maintained by network. It allows the WTB to automate many of network engineers on the WTB staff. the tasks associated with configuring, operating and monitoring the cellular networks and thereby Physical Location reduce errors, improve efficiency and availability. All LAN4 facilities reside in and around the 890 square mile INL reservation located approximately The NetAct system is integrated with and supports 45 miles east of Idaho Falls, ID. the following operations on the WTB GSM (2G), UMTS (3G) & LTE (4G) cellular networks:

Page 51 of 65

• Radio network configuration • 1900 MHz • Alarm and status monitoring • 2100 MHz • Performance reporting In addition, NetAct related network traffic is carried over microwave backhaul links operating • System administration at the following frequencies: Base Configuration • 10.5 GHz (microwave links) The base configuration of NetAct is with all systems and applications operational. • 23 GHz (microwave links). Management and Configuration Capabilities Physical Location All NetAct applications can be accessed and All NetAct facilities are on the 890 square mile operated locally at the NetAct cabinet and INL reservation located approximately 45 miles remotely from any point attached to the LAN1 east of Idaho Falls, ID. The INL location has the with a PC that has the NetAct client software advantage of not being near any major installed. In addition, all NetAct servers and metropolitan areas, airports or military bases. devices can be administered locally or remotely NetAct equipment at location: from any point attached to LAN1. All components of the NetAct system are System Resources collocated in a single cabinet that is installed at Personnel Gate-1 Shelter-3. NetAct was installed and integrated by INL and The components of the NetAct system are: NOKIA engineers. NetAct is operated and 1. Hewlett Packard BL460c Gen8 and Gen9 maintained by INL engineers and technicians. CTO Blade Server Spectrum 2. Hewlett Packard BL460c Gen8 2658 Core At the INL, the INL Spectrum Manager, under a CPU1 & HP BL460c Gen9 E5-2680v3 CPU charter from DOE’s NE-ID Chief Information 3. Hewlett Packard HI 5500-24G-4SFP switch Officer, controls Radio Frequency (RF) spectrum. 4. Hewlett Packard B-Series 8/24 Blade System INL has “experimental station” authority granted SAN switch by DOE-HQ & NTIA, which allows communications testing for government customers 5. EMC VNX 5200 2.5 4x600GB + 8x1TB at all, but the specifically excluded bands, of the storage frequencies listed below. In some cases, these 6. EMC VNX 5100 6x2TB 3.5 RTF backup excluded frequencies may also be used, but this storage requires a special filing with the NTIA and a more rigorous approval process outside the INL’s 7. Hewlett Packard TFT7600 KVM console Spectrum Manager’s office. 8. EMC Fast Suite for VNX5200 performance NetAct does not directly operate in the wireless and storage efficiency spectrum; however, the cellular equipment 9. Cisco 2951 K9 Router managed by NetAct operates in the following frequency bands: SMSC- Short Messaging Service Center • 900 MHz Overall System Description • 1800 MHz

Page 52 of 65

The Tecore Short Messaging Service Center between different roaming networks with message (SMSC) is fully integrated with other Core delivery problems. products. It provides simultaneous SMS operations • Custom Message Delivery to any subscriber for GSM and UMTS wireless networks. It delivers full SMS services including: • SMSC Multiplexer/SMPP Server for message routing to networks without direct connection Standard Services: Base Configuration • Mobile Originated (MO) and Mobile Terminated (MT) short messages The base configuration of SMSC is to provide SMS feature for WTB subscribers in GSM (2G) • All supported GSM text formats: 7 bit alphabet and, UMTS (3G) Cellular networks. (default), 8 bit and 16 bit encoding Management and Configuration Capabilities • Message storage if recipient is unavailable SMSC applications can be accessed and operated • Message delivery report locally at CFA609 Rm200 and remotely from any • Message forwarding and redelivery if recipient point attached to the LAN1 with a PC that has the becomes available VNC software installed. • Standard SS7 MAP 1, 2, 3 for GSM MAP and System Resources ANSI-41 Rev A, B, C, D for CDMA Personnel • SIGTRAN Support SMSC was installed and integrated by INL and • Message Waiting Notification support Tecore engineers. SMSC is operated and maintained by INL engineers and technicians. • Log reports and Operational Spectrum Measurements: SMSC does not directly operate in the wireless • Successful MOs spectrum; however, the cellular equipment • Successful MTs associated to SMSC operates in the following frequency bands: • Failed MOs • 900 MHz • Failed MTs • 1800 MHz • Delivery Reports Generated • 1900 MHz • Re-attempts completed • 2100 MHz • SMPP Connection status

• SS7 Connection status Physical Location • Fully configurable via a GUI client SMSC is located in CFA609 area of the 890 Extended features: square mile INL reservation located approximately 45 miles east of Idaho Falls, ID. The INL location • SMPP interface for a single or multi ESME has the advantage of not being near any major destinations metropolitan areas, airports or military bases. • Gateway functionality (SMPP & SS7) to manage SMSC facilities at location: connections to one or more SMSCs for roaming networks. This will make it easy to switch

Page 53 of 65

All components of the SMSC system are collocated in a single rack that is installed at CFA609 Rm 200 The components of the SMSC are: 1. Dell Power Edge R610 2. Dell MD3200i 3. Cisco 2960s Switch 4. Cisco 3750x Switch

Page 54 of 65

Appendix A Frequently Asked Questions 1) What is the process for conducting work with the WTB? The process of conducting work at the WTB typically starts with a detailed requirements discussion with the customer test team and the WTB Test Manager. The Test Manager will pull on the appropriate subject matter experts within INL to ensure we understand all the requirements and can facilitate your request. An advance test range visit is strongly encouraged for a site survey of the facilities and testing infrastructure. INL will then generate a ROM Cost Proposal based on these discussions/requirements. Once the work scope and ROM are accepted by your team, we can initiate the funding mechanism via DOE through the DOE’s Strategic Partnership Program (SPP) program which allows us to conduct work for Federal agencies, Universities, private industry and others.

2) How do you handle scheduling? Scheduling range time is handled directly through the WTB Test Manager. Events are typically booked on a first come, first serve bases; outside of range conflicts and other mission critical war time events. The WTB Test Manager schedules efforts to minimize simultaneous testing; although, if necessary, will work with all customer groups to see if simultaneous testing is a possibility.

3) What kind of scheduling lead time (pre-timeline) required for conducting a test? The lead time required will vary depending upon your scope and funding mechanism. If your organization can process MIPRs, it is likely pre-test activities for your effort can occur within 3 to 6 weeks of funding initiation. Tentative "holds" are placed on the WTB Test Range calendar for your effort until you are ready to commit, preferably 3 months in advance of the test.

4) Do you have any restrictions on testing (time of day or calendar)? There are no restrictions on test days/times unless driven by your spectrum requirements. We typically work 7 AM to 5 PM, Mon - Fri but can accommodate off shifts if needed and when resources are available.

5) Do test events overlap in physical location, time and/or frequency? The INL Test Manager works with each current and potential customer to determine mission criticality and sensitivities to overlapping events in location, time and frequency. In certain situations, it is possible to conduct multiple site-based efforts for varying customers test teams when spectrum and locations are deconflicted.

6) What fees/payments are required for testing/services? The INL is a not-for-profit Federally Funded Research and Development Center (FFRDC). We are a total cost recovery organization and require funds in house at INL prior to performing work. The WTB will charge against your funds for the time and materials required to meet the project scope. Typical total test costs can vary from $75K to $700K per 5-day week depending on the individual requirements.

7) What types of range services are available? INL provides a full suite of range services available for use to include small/large portable generators, gas/diesel fueling services, Land Mobile Radio (LMR) communications, high bay and warehouse storage, shipping services, fire and medical emergency response teams, technical and administrative support.

Page 55 of 65

8) How do you handle RF spectrum allocation? The WTB is authorized to support RF testing for government customers through an NTIA Experimental Radio status. This authority was granted on the basis of experimental RF testing which does (1) not cause harmful interference to a local spectrum owner and (2) does not provide an operational or commercial service. The INL WTB Test Lead will submit a spectrum request form to our DOE appointed Spectrum Manager for all customer efforts. The Spectrum Manager will process this request through FCC and Government databases and provide approval/disapproval conditions based on the characteristics of the request. The request must be complete with all transmitter and antenna characteristics in order to process. Typical approval time for common (cellular, ISM, unlicensed) or prior approved spectrum is a couple of weeks. Larger more complex efforts may require FCC Special Temporary Authority (STA) which may take upwards of three months to process.

For commercial and Universities tests efforts with the INL WTB, they are required to submit a STA request to the FCC. The INL Spectrum Manager will work with the commercial/university teams and the FCC to expedite the FCC review and acceptance process.

9) Does INL have restricted airspace? Airspace is unrestricted above 1000' AGL, though there are some limitations placed on flight paths within 1 NM of certain range campus areas. The INL coordinates overflights that are conducted in support of laboratory efforts but does not alleviate any FAA regulations.

10) Do you have portable power available on range? Portable power is available on range. Gas or diesel generators from 2 to 100 KW are typically used in field locations. Fueling/maintenance of the generators are also available. We have a stock of 12V batteries, and additional can be purchased/used as needed.

11) Would any of the potential sites have power available? There are several sites on range that have commercial power. These sites are typically situated near the campus areas and may or may not be conducive to the specified test environment.

12) How do you handle communications for test participants? INL operates a trunked radio (LMR) network with repeaters on nearby mountain tops. Coverage is available anywhere on the INL Test Range and into Idaho Falls. The WTB Isolated Satellite Backhaul Network (ISBN) capability is also available for communications between customers on and off the INL Test Range.

13) What cellular technologies do each of the cellular fixed sites have? Each fixed cellular tower contains three sectors, and each sector has GSM, UMTS, and LTE capabilities. Further frequency information can be found in the range manual.

14) What actions are performed on the cellular systems or other test networks after a customer event? The INL WTB staff have created a general use baseline for all cellular assets and test networks. Once the customer has completed their range exercise, WTB staff return the cellular assets or test networks to a baseline configuration in order to help maintain security requirements. The customer is encouraged to partake in further discussions with WTB SMEs of each system to better define the level of baseline and ‘cleaning’ they can perform.

15) What outside vendors have access to WTB networks?

Page 56 of 65

The INL WTB staff limit outside vendor exposure to all networks and test equipment. The customer is encouraged to partake in further discussions with WTB SMEs of each system to better determine who, if anyone, has outside access for maintenance and troubleshooting.

16) How are personnel transported to the site? The INL WTB staff utilize the INL bus services, along with GSA vehicles. We can supply transportation of customer personnel if required through our GSA vehicle fleet or INL bus service, though it will be more cost effective for your team to drive rental cars to (and while on) the range.

17) How is equipment transported to and from the site? The INL utilizes WestOne Logistics, a third-party shipping company, for the transportation of equipment to and from the INL site location. Both Fed-Ex and UPS incoming shipments will be automatically routed through WestOne Logistics. Outgoing shipment costs are applied to the total test effort costs, or against the customers’ direct shipping account.

18) What kind of space and topography are available for test environments? The INL desert Test Range generally consists of relatively flat rolling hills with grass and sage brush vegetation. Near the edges of the range there are mountains, hills and ridgelines. The INL WTB will also work with state and local landowners to obtain further areas of testing

19) What city like configurations are you able to provide at the INL desert site? Wherever possible existing infrastructure including buildings, trailers, storage and local landscape is utilized to re-create unique environmental configurations that reflect specific target areas. In certain circumstances connex boxes are used to aid in the configuration.

20) How does INL handle the environment and associated testing areas around the INL desert site location? It is INL’s Environmental Policy to conduct research, development and demonstration for energy and national security in a manner that protects and preserves human health and the environment while in full compliance with applicable environmental laws, regulations, and other requirements. For each event taking place at INL the WTB Test Manager and Test Lead will work directly with the customer to determine all environmental impacts. The INL Test Lead will fill out all the required INL/DOE documentation to receive environmental and health-based approvals to proceed with the effort.

21) Should we be concerned about nuclear radiation from current active, or previous, reactor locations? INL continually monitors and tracks radiological levels across the INL desert reservation to ensure no employee, contractor or visitor is unnecessarily exposed to unsafe levels. The INL WTB does not allow customer test teams to be co-located with critical radiological material. INL’s Environmental Policy to conduct research, development and demonstration for energy and national security is conducted in a manner that protects and preserves human health and the environment.

Page 57 of 65

Appendix B Supporting Test Equipment

GSM Only Phones Item # Qty Phone Model Phone Type Frequency Band (MHz) 1 8 LG KG130 Commercial GSM 900 / 1800 2 9 LG MG160a Commercial GSM 850 / 1900 3 10 C139 Commercial GSM 850 / 1900 4 13 Motorola L6 Commercial GSM 850 / 900 / 1800 / 1900 5 9 V3 Commercial GSM 850 / 900 / 1800 / 1900 6 2 Motorola T720 Commercial GSM 850 / 1900 7 1 Motorola T725 Commercial GSM 850 / 1900 8 8 Motorola V620 Commercial GSM 850 / 900 / 1800 / 1900 9 10 NEC e132 Commercial GSM 900 / 1800 10 7 Nokia 1200 Commercial GSM 900 / 1800 11 9 Nokia 1208 Commercial GSM 900 / 1800 12 10 Nokia 1600bNOK SV Commercial GSM 850 / 1900 13 2 Nokia 3230 Commercial GSM 900 / 1800 / 1900 14 1 Nokia 3310 Commercial GSM 900 / 1800 15 10 Nokia 3500c Commercial GSM 900 / 1800 / 1900 16 3 Nokia 6170 Commercial GSM 900 / 1800 / 1900 17 2 Nokia 6190 Commercial GSM 1900 18 2 Nokia 6230 Engineering GSM 900 / 1800 / 1900 19 2 Nokia 6230b Engineering GSM 1900 20 12 Nokia 6651 Engineering GSM 1900 21 4 Nokia 6820a Engineering GSM 900 / 1800 / 1900 22 2 Nokia 7260 Engineering GSM 900 / 1800 / 1900 23 2 Sagem OT430 Engineering GSM 900 / 1800 / 1900 24 2 Sagem OT438 Engineering GSM 850 / 900 / 1800 / 1900 25 7 SAM-T519 Commercial GSM 850 / 900 / 1800 / 1900 26 2 Samsung SGH-X450 Commercial GSM 900 / 1800 / 1900 27 1 Siemens CX70 Commercial GSM 900 / 1800 / 1900 28 10 Sony Ericsson T610 Commercial GSM 900 / 1800 / 1900 29 1 Sony Ericsson T610 TEMS Engineering GSM 900 / 1800 / 1900

UMTS and GSM Phones Item # Qty Phone Model Phone Type Frequency Band (MHz) 1 5 LG KU250 Commercial GSM 900 / 1800 / 1900 / UMTS 2100 2 5 Motorola RAZR V3XX Commercial GSM 900 / 1800 / 1900 / UMTS 2100 3 7 Motorola V1100 Commercial GSM 900 / 1800 / 1900 / UMTS 2100 4 3 Motorola V975 Commercial GSM 900 / 1800 / 1900 / UMTS 2100 5 5 Nokia 6120c1 Commercial GSM 900 / 1800 / 1900 / UMTS 2100 6 2 Nokia 6650 Engineering GSM 900 / 1800 / 1900 / UMTS 2100 7 5 Sony Ericsson K530i Commercial GSM 900 / 1800 / 1900 / UMTS 2100 8 1 5800D-1 Commercial GSM 900 / 1800 / 1900 / UMTS 2100 9 2 LG GC900 Commercial GSM 900 / 1800 / 1900 / UMTS 2100 10 1 MOTOROLA A3100 Commercial GSM 900 / 1800 / 1900 / UMTS 2100 11 4 NOKIA 3120C Commercial GSM 900 / 1800 / 1900 / UMTS 2100 12 1 SONY ERICSSON G900 Commercial GSM 900 / 1800 / 1900 / UMTS 2100 13 3 NOKIA 5230 Commercial GSM 900 / 1800 / 1900 / UMTS 2100 14 1 NOKIA 5630D Commercial GSM 900 / 1800 / 1900 / UMTS 2100 15 2 SAMSUNG SGH-U900 Commercial GSM 900 / 1800 / 1900 / UMTS 2100 16 1 SAMSUNG SGH-U900v Commercial GSM 900 / 1800 / 1900 / UMTS 2100

Page 58 of 65

GSM, UMTS, CDMA and LTE Phones

Frequency Band (MHz) Phone Model Phone Type Qty

Item # GSM CDMA UMTS LTE

1 2 Alcatel OneTouch POP S3 Commercial 850/ 900/ 1800/ 1900 MHz 850/ 900/ 2100 MHz 1/3/7/8/20

2 1 Apple iPhone 5c Commercial 850/ 900/ 1800/ 1900 MHz 850/ 900/ 1900/ 2100 MHz 1/2/3/5/7/8/20/38/39/40

3 1 Apple iPhone 5s Commercial 850/ 900/ 1800/ 1900 MHz 850/ 900/ 1900/ 2100 MHz 1/2/3/5/7/8/20/38/39/40

4 2 Commercial 850/ 900/ 1800/ 1900 MHz 800/1900 MHz 850/ 900/ 1700/2100/ 1900/ 2100 MHz 1/3/5/7/8/20

5 2 HTC Desire 816 Commercial 850/ 900/ 1800/ 1900 MHz 850/ 900/ 2100 MHz 3/7/8/20

6 2 HTC One mini Commercial 850/ 900/ 1800/ 1900 MHz 850/ 900/1900/ 2100 MHz 3/7/8/20

7 7 HTC One E8 Commercial 850/ 900/ 1800/ 1900 MHz 850/900/2100 MHZ 1/3/7/8/41

8 2 Ascend Commercial 850/ 900/ 1800/ 1900 MHz 850/ 900/ 1900/ 2100 MHz 1/3/7/8/20

9 2 LG G2 Commercial 850/ 900/ 1800/ 1900 MHz 800/ 1900 MHz 850/ 1900/ 2100 MHz 1/3/5/7/8/20

10 1 Nokia Lumia 1520 Commercial 850/ 900/ 1800/ 1900 MHz 850/ 900/ 1900/ 2100 MHz 1/3/7/8/20

11 1 Nokia Lumia 930 Commercial 850/ 900/ 1800/ 1900 MHz 850/ 900/ 1900/ 2100 MHz 1/3/7/8/20

12 1 OnePlus One Commercial 850/ 900/ 1800/ 1900 MHz 850/ 900/ 1700/2100/ 1900/ 2100 MHz 1/3/4/7/17/38/40

13 1 7a Commercial 850/ 900/ 1800/ 1900 MHz 850/ 900/ 1800/ 1900 MHz 1/3/7/20/40

14 1 Commercial 850/ 900/ 1800/ 1900 MHz 850/900/1900/2100MHz 17/5/4/3/2/1/7

15 2 SP-M35t Commercial 850/ 900/ 1800/ 1900 MHz 850/ 900/ 2100 MHz 1/3/5/7/18

16 2 C6906 Commercial 850/ 900/ 1800/ 1900 MHz 850/ 900/ 1700/2100/ 1900/ 2100 MHz 1/2/4/5/7/8/20

17 2 ZTE Nubia Z7 Commercial 850/ 900/ 1800/ 1900 MHz 850/ 900/ 1900/ 2100 MHz 1/3/7/38/39/40/41

18 6 ZTE Nubia Z7 Max Commercial 850/ 900/ 1800/ 1900 MHz 850/ 900/ 1900/ 2100 MHz 1/3/7/38/39/40/41

CDMA Phones Item # Qty Phone Model Phone Type Frequency Band (MHz) 1 20 Motorola V710 Engineering CDMA 800 2 8 Kyocera KX444 Engineering CDMA 1900 3 2 Motorola RAZR V3M Engineering CDMA 1900

Page 59 of 65

Analyzers Item # Qty Make Model Type 1 1 VIAVI PacketInsight / SART LTE Protocol Analyzer 2 1 VIAVI SART UMTS Protocol Analyzer 3 3 Tektronix RSA 6114A Real Time Spectrum Analyzer 4 3 Tektronix RSA 306B (2 per Kit) Dual Real Time Spectrum Analyzer Kit 5 1 VIAVI JD748B Cell Advisor Signal Analyzer (LTE/Fiber)

LTE Tier III Band 13 & 14 Phones Item # Qty Make Model Band 1 2 Sonim XP7 14 2 4 Bittium (was Elektrobit) EB Tough Mobile 13 & 14 3 2 Motorola LEX L10 13 & 14 4 2 Motorola UM1000 Dongle 14

LTE Tier I Band 3 & 7 Devices Item # Qty Make Model Band 1 1 APPLE APL-iPhone6S 3&7 2 1 LG LG-H815 (G4) 3&7 3 LG 1 LG-H860 (G5) 3&7 4 LG 1 LG-H961 (V10) 3&7 5 Netgear Aircard 2 Netgear-AC790S 3&7 6 Samsung Galaxy 3&7 1 CSA-A5 7 Samsung Galaxy 3&7 1 CSA-A7 8 Samsung Galaxy 3&7 1 CSA-S6 9 Samsung Galaxy 3&7 1 CSA-S6-Edge 10 Samsung Galaxy 3&7 1 CSA-N915G 11 Samsung Galaxy 3&7 1 CSA-A8 12 Samsung Galaxy (w/ HANDY PRO NEMO) 3&7 4 SM-N910F

Page 60 of 65

Field Deployable Kits

Item # Qty Make Model Band 1 5 iNetVu (ISBN) Drive Away (Truck Mount) KU 2 2 iNetVu (ISBN) Fly Away (Ground Mount) KU 3 6 Redline WiMax 5.8 GHz 4 Tektronix RSA 306B Dual Analyzer 3 RF Spectrum Monitoring 9 KHz - 6.2 GHz

Page 61 of 65

Appendix C NTIA Red Book Section 7.11

USE OF FREQUENCIES BY CERTAIN This authority is limited to radio EXPERIMENTAL STATIONS frequency usage which is an integral part of an experimental operation and shall not Except as provided in the following be construed as authorizing frequency paragraph, Federal experimental radio usage for administrative or operational use stations at the locations listed below are related thereto. No priority rights shall authorized to use any radio frequency for derive from the use of a specific frequency short or intermittent periods without prior for an operation conducted pursuant to this authorization of specific frequencies authority nor shall any specific frequency provided that a) such operations are usage constitute a bar to the authorization confined to the immediate vicinity of the of other uses. The following frequency station; b) the nature or duration of the bands are specifically excluded from this requirement is such that the assignment of authority: specific frequencies is impracticable; and c) all reasonable measures are taken before such frequencies are used to ensure that harmful interference will not be caused to authorized services, and, in this regard, consideration should be given to the propagation characteristics of the frequency to be utilized and to the operational nature of the services normally operating on frequencies of the order of that selected.

The following frequency bands are specifically excluded from WTB use under the INL's Experimental Station authority: kHz MHz GHz 495.0-510.0 73.0-74.8 10.68-10.70 2173.5-2190.5 121.4-121.6 15.35-15.40 8354.0-8374.0 156.7-156.9 23.60-24.00 21850.0-21870.0 242.8-243.2 31.20-31.50 1400.0-1427.0 58.20-59.00

Page 62 of 65

Appendix D Unmanned Aerial Systems (UAS)

Parameters for INL Based Operations An unmanned aerial system is an aircraft operating autonomously or piloted remotely without a pilot on board the aircraft. INL has 3,100 square miles of approved airspace to use for UAS operations. Current Certificate of Authorizations (COAs) authorize INL based UAS flights up to 4,500 feet above ground level (AGL). Per Federal Aviation Administration (FAA) regulations, the ceiling for UAS flights is 18,000 feet mean sea level (MSL) with the proper coordination and a chase plane. The INL UAV Airstrip can accommodate UAVs up to 600 lbs. The INL UAV runway is 100 feet wide and 1000 feet long.

Pilot Qualifications All Pilots operating at the INL must have passed 14 CFR Part 107 training and possess a Remote Pilot License from the FAA. In certain circumstances a certification from a military training program may be accepted as an equivalent level of qualification. These credentials must be presented to the INL Chief UAS Pilot for documentation purposes.

Weight Requirements INL has a Certificate of Authorization in place for all Unmanned Aerial Systems under 55 lbs., either fixed wing or multi-rotor, with approval to fly upwards of 4,500 feet Above Ground Level. Visual line of sight (LOS) to the UAS is required; however, a “daisy chain” of visual observers is an acceptable tactic for flights that expand across the INL approve flight zone.

INL is required to generate a new COA for each Unmanned Aerial Systems over 55 lbs. Lead time for a new COA is based on the complexity of the platform and operational duration; 60 – 90 days for most moderately complex operations. New COAs are not guaranteed and require approval from the FAA before INL based operations may occur.

Beyond Visual Line of Sight (BVLOS) Operations Operational requirements for beyond visual line-of-sight depend upon the intended flight objectives and test goals. Visual observation along the flight path (daisy chain of observers) is a consideration that will be explored with BVLOS operations.

Single or Multiple UAS Operations INL has the ability to support multiple UAS operations; however, all desired flight operations must be evaluated prior to conducting operations to ensure safety requirements and mission success of all parties is upheld. INL requires a unique Pilot for every UAS. At all times an INL Pilot in Charge (PIC) must be present and co-located with the UAS pilots during all UAS operations.

Page 63 of 65

Customer Questionnaire for INL UAS Flight Operations

1. Pilot Qualification (must show your credentials)  FAA Part 107  Military  Other ______

2. Platform Type/Description  Make ______ Model ______ Color ______

3. Platform Weight (including payload) ______

4. Flight Altitude (AGL) ______

5. Number of UASs ______

6. Visual Line of Sight  Yes  No

7. Additional UAS Information (optional) ______

______

______

______

______

______

RETURN COMPLETED FORM TO YOUR INL TEST LEAD FOR COORDINATION WITH INL PILOT IN CHARGE.

Page 64 of 65

Appendix E (OUO Separate) INL Electronic Warfare Modelling & Simulation (EWM&S)

Page 65 of 65