PaperlayerView exact revision on arXiv

Source-linked AI summary

Controlled Radio Fault Injection and Telemetry Evaluation for Open 5G RANs

Babak Azkaei, Maxim Bîtiu, Georgios Exarchakos, Kishor Chandra Joshi

arXiv:2610.31598v1cs.NIcs.SYeess.SY

TL;DR

Evaluating RAN telemetry requires controlled radio changes and observations of their application consequences. This paper adds C and Python channel brokers and a joint capture workflow to software 5G testbeds; its use cases show that different measurements describe different fault responses, while the tested RLC codelets did not improve interruption classification.

  • Problem

    Assessing RAN telemetry requires a known change in radio conditions and an independent observation of its application consequences.

    Source: §1 · p. 1

  • Method

    C and Python brokers apply scheduled directional I/Q transformations in a software 5G testbed while the workflow records applied faults, native and codelet telemetry, and application outcomes.

    Source: §1 · p. 1, §2.3 · p. 3

  • Results

    Native feedback identifies the tested interruptions, noise changes decoding outcomes without that feedback pattern, application measurements show a longer slow-reply tail despite near-stable median RTTs, and the selected RLC codelets leave interruption classification unchanged.

    Source: §7 · p. 6

  • Takeaways & Limitations

    The framework provides a reusable basis for evaluating measurement choices against known radio interventions and their service consequences.

    Source: §7 · p. 6

    The tested digital stressors are not complete physical-fault replicas, and the selected RLC codelet result does not establish general codelet redundancy.

    Source: §2.1 · p. 2, §4.4 · p. 5

Abstract

from arXiv · show

Radio access network (RAN) telemetry reveals radio conditions, protocol behavior, and their consequences for applications. Evaluating its usefulness requires controlled impairments and observations of the same execution. We present C and Python channel brokers and a fault injection workflow for software 5G testbeds connecting an OCUDU base station and a software UE through ZeroMQ. The brokers apply scheduled, directional transformations to I/Q samples and restore the link, while the workflow jointly records applied faults, native and programmable (codelet) telemetry, and application delay. We demonstrate this capability through 45 comparative trials of brief uplink interruptions and stepped additive noise. These use cases distinguish recognizing a radio change from measuring its service consequence: native missing-feedback events retrospectively identify interruptions, whereas noise changes decoding-error measurements without producing those events. Median on-time round-trip times remain near 30 ms, but the prespecified comparisons show mean increases in on-time 95th-percentile delay of 354 and 604 ms for one and five interruptions, and 113 ms for noise. Adding receive-side radio link control (RLC) codelet summaries did not improve interruption classification on held-out trials. The framework provides a reusable way to evaluate measurement choices under known radio faults, before using them in monitoring or learning systems.

1 Introduction

Evaluating RAN telemetry requires both a known change in radio conditions and an independent observation of its application consequences. This work adds channel brokers and a shared capture workflow to a software 5G testbed, then uses interruptions and noise to show that different questions require different measurements.

1 Introduction

  • RAN monitoring must distinguish what changed in the link from what that change meant for applications, using known radio changes and independent consequence measurements.The motivation is especially relevant to AI-RAN, where learning and control functions depend on telemetry.Source: §1 · p. 1
  • The framework inserts a channel broker into an OCUDU gNB–software UE ZeroMQ link to transform I/Q samples before reception and restore the link.It enables controlled experiments without radiating interference and complements over-the-air tests, where surrounding activity and movement may be harder to repeat.Source: §1 · p. 1
  • The reusable capability combines C and Python brokers for directional, scheduled impairments with a workflow linking applied and restored faults to native, codelet, and application observations.Figure 1 shows the selected broker applying a scheduled transformation and the records and measurements describing the same run; the brokers are alternatives, not serial stages.Source: §1 · p. 1, Figure 1 · p. 2
  • Interruption and additive-noise use cases show that fault identification, service delay, and internal protocol timing require different measurements.The telemetry study demonstrates the experimental capability rather than defining its main contribution.Source: §1 · p. 1

2 Radio-Fault Injection Framework

The framework interposes a selected broker at the virtual-radio boundary, schedules and restores signal transformations, and records complementary views of the same execution. This supports comparisons between known interventions, internal RAN behavior, and end-to-end application outcomes.

2.1 Brokers at the Virtual-Radio Boundary

  • The C and Python brokers interpose on the ZMQ I/Q path, transform selected samples, and forward blocks at their original length for the receiver and protocol stack to process.They share controls for impairment, direction, strength, start, and restoration; the repeated studies use C, while Python broadens available transformations rather than serving as a performance baseline.Source: §2.1 · p. 2
  • These controlled digital stressors do not fully replicate physical faults: tone is not an interfering cell, blanking is not complete blockage, and noise is not calibrated to receiver SINR.Static TDL examples also omit mobility and spatial effects.Source: §2.1 · p. 2

2.2 Scheduling a Change and Observing Restoration

  • The schedule and workflow record when transformations are processed, forwarded, and restored, then continue observing because protocol and application effects may outlast signal restoration.Replaying a schedule controls the intervention, not an identical subsequent protocol trajectory.Source: §2.2 · pp. 2–3

2.3 Three Complementary Measurement Paths

  • Native reports and events, Janus/jBPF codelet summaries, and a UE–core–UE echo probe provide complementary views of the same run; the probe measures RTT and deadline misses.Researchers can hold the fault schedule fixed while changing the observation point or summary being evaluated.Source: §2.3 · p. 3

3 Evaluation Design

The evaluation compares two controlled uplink faults and measures their radio, protocol, and application observations in the same trials. It specifies matched comparisons, telemetry definitions, and separate time bases for injected faults and service outcomes.

3.1 Two Radio-Fault Use Cases

  • The study contrasts brief desired-signal interruptions with stepped additive noise that leaves the signal present; interruptions suppress equal total sample counts while the downlink stays unchanged.Three 0.5-samplesecond stages, beginning four sample-seconds after activation, add noise at 0.01P_ref, 0.1P_ref, and P_ref before noise-free forwarding is restored; desired-signal gain remains one.Source: §3.1 · p. 3

3.2 Observations and Comparisons

  • Forty-five trials include prespecified matched comparisons; service effects average fault-minus-control on-time p95 RTT, while unanswered requests remain separate.Fault schedules use sample time, whereas RTT and deadlines use host elapsed time.Source: §3.2 · p. 3

3.3 Native and Programmable Telemetry

  • Native telemetry includes grouped DTX events plus CRC, MCS, and BSR-derived observations; RLC codelets summarize accepted SDU counts and receive-side latency.The frozen native-versus-native-plus-RLC comparison uses identical eligible rows, with 14 shared training cases and 13 shared test cases.Source: §3.3 · pp. 3–4

4 Results: Two Uses of the Framework

Interruption feedback patterns identify the programmed blanking patterns, while application delay varies mainly in the slow-reply tail. Noise produces decoding-error changes without DTX events, and the measurements describe different parts of radio and application behavior.

4.1 Interruptions: From Radio Events to Service Delay

  • Native DTX grouping identifies all 33 interruption trials, but event count is not a severity measure: one blank produces more events than five.Thresholds from 20 to 500 ms give the same grouping on the 30 prespecified interruption trials.Source: §4.1 · p. 4
  • One-blank and five-blank trials show 4.28- and 7.02-second spans of consecutive slow requests, respectively, not measured recovery times.The five-blank span includes 80 missed deadlines; reduced MCS and elevated pending-data estimates accompany delayed replies in both fault trials.Source: §4.1 · p. 4

4.2 Repeated Service Outcomes

  • 354 and 604 ms are the mean increases in on-time p95 RTT for one- and five-blank trials over matched controls.These prespecified comparisons use ten interruption blocks; Table 2 reports mean increase in on-time p95 RTT over the matched control.Source: Table 2 · p. 4, §4.2 · p. 4

4.3 Noise: A Different Radio Response

  • 113 ms is the mean increase in application p95 RTT across five prespecified noise pairs; CRC-failure fractions rise in every pair without DTX events.Median RTT remains around 30 ms, and neither arm misses a reply deadline.Source: §4.3 · p. 5

4.4 Choosing Measurements for the Question

  • Larger pending-data estimates generally accompany higher p95 RTTs, but the scheduler’s quantized BSR-derived estimate is neither a physical queue measurement nor a validated alarm threshold.Native-only and native-plus-RLC trees classify all 13 eligible shared test cases correctly, yielding no accuracy increase for this task.Source: §4.4 · p. 5

5 Practical Value and Scope

The framework makes telemetry selection a controlled experiment: researchers can relate a chosen signal change to radio response and application consequence. Custom measurements should answer a specific question and be compared with corresponding native records; the evaluation is limited to one UE on a shared VM, a fixed workload, and a low-SINR uplink.

5 Practical Value and Scope

  • The framework lets researchers test whether measurements reveal a radio response, an application consequence, or a particular internal stage.The applied-fault record and application probe serve as common reference points.Source: §5 · p. 5
  • Custom measurements should target a specific missing observation and be compared with corresponding native records.Uplink waiting calls for UE enqueue/transmit timestamps and grant or demand summaries; reassembly calls for segment-arrival and completion events.Source: §5 · p. 5
  • Holding impairment and traffic settings fixed while adding a question-motivated summary helps distinguish measurement benefit from changed experimental conditions.The applied-fault record and application probe remain common reference points.Source: §5 · p. 5
  • The evaluation uses one UE on a shared VM, a fixed workload, and a low-SINR uplink, with host scheduling, protocol adaptation, and ZMQ pacing also potentially contributing to delay.Source: §5 · p. 5

6 Related Work

Prior work offers programmable instrumentation, data-driven monitoring, and channel-emulation platforms. This study complements those efforts with a controlled workflow that jointly varies faults and observations without rebuilding experiment control.

6 Related Work

  • Janus codelets provide inline user-defined RAN telemetry and control, while E3/dApps use an external sidecar for OCUDU measurement and control.The workflow adds controlled radio conditions for comparing the resulting observations.Source: §6 · pp. 5–6
  • SpotLight, the OpenRAN anomaly testbed, and OpenRAN Gym address anomaly detection, mitigation, or intelligent RAN-control workflows; this study instead tests measurements against known interventions and service consequences.Its classifier is not presented as a competing detector or cross-dataset accuracy comparison.Source: §6 · p. 6
  • Unlike broader channel-emulation platforms, the integrated workflow combines finite directional fault schedules, applied/restored records, and simultaneous native, codelet, and service observations without rebuilding experiment control.It complements, rather than replaces, broader propagation models or scale.Source: §6 · p. 6

7 Conclusion

The paper presents brokers and a fault-injection workflow for testing telemetry against known radio interventions. In the demonstrated use cases, different measurements capture different aspects of the fault and service response, while further evaluation across settings remains future work.

7 Conclusion

  • C and Python channel brokers and a radio-fault injection workflow jointly record scheduled sample changes, native telemetry, programmable codelets, and application outcomes in direct-ZMQ 5G testbeds.This lets researchers test measurement choices against known interventions without rebuilding fault control and joint capture for each question.Source: §7 · p. 6
  • Native feedback identifies tested interruptions, while noise changes decoding outcomes without that feedback pattern; application measurements show a longer slow-reply tail despite near-stable median RTTs.The selected RLC codelets describe a narrower receiving stage and leave interruption classification unchanged.Source: §7 · p. 6
  • Future evaluation can extend to additional radio impairments, traffic loads, and multi-UE scenarios, as well as selected over-the-air comparisons.Varying reporting intervals and collection configurations could assess trade-offs among measurement detail, reliability, and instrumentation cost.Source: §7 · p. 6
Loading 2610.31598v1…