TETRA Special Solutions:

RF Coverage-Test and Coverage-Simulation

Digital Voice Interface
Telemetry and SCADA Solutions
Cape Town
February 2016

Funk-Electronic Piciorgros GmbH

Stephanie D. Piciorgros
 Funk-Electronic Piciorgros GmbH
(TETRA Business)

Wireless Solutions from 1982 until 2016++

Member of the TETRA Association

(MoU/TandCCA)
Core Manufacturer (Own TETRA Terminal)
IOP certified from ISCOM (Italy)
Member of the SME Group

Piciorgros GmbH * Germany

Funk-Electronic Piciorgros GmbH
(TMC-200 / T-One Terminal)

350, 380, 410, 450, 800 MHz

Status, SDS, Packet Data, MSPD
Authentication, Encryption,
TEA1, 2, 3

Piciorgros GmbH * Germany

Funk-Electronic Piciorgros GmbH
(National Approvals)

EU (BABT Certificate)
Hong Kong, Thailand, Russia
FCC (USA), IC (Canada)
Philippines, Australia, Malaysia

Piciorgros GmbH * Germany

Funk-Electronic Piciorgros GmbH
(IOP Certificates)

Rohill
SELEX
EADS / Cassidian
3T-Frequentis / Sepura
Damm, Teltronics
Hytera (ETELM)
Motorola

Piciorgros GmbH * Germany

Piciorgros GmbH * Germany
 TTS-2000
TETRA Coverage Analyzer
and
Coverage Simulation

Piciorgros GmbH * Germany

TTS-2000 - TETRA Radio Coverage Test Set

Piciorgros GmbH * Germany

iPad Mini MMI using WiFi Link

Piciorgros GmbH * Germany

TTS-2000 Car Drive Display

Piciorgros GmbH * Germany

TTS-2000 Net Info Display

Piciorgros GmbH * Germany

 TTS-2000 Features

Can measure without being registered on the TETRA network

Same in most Public Safety networks (restrictions may apply)
Measure-Cycle: Starting from 1 Second or distance starting from 10 m
Capture the RSSI of the Serving Cell
Capture BER
Capture RSSI of the NBCs
Capture Time, Date, Location, Speed, for each point measured
Display the Sys-Info Message
Display the Cell Change Parameter supplied from the Infrastructure

Piciorgros GmbH * Germany

Manual Measuring APP

Piciorgros GmbH * Germany

BKK TETRA Coverage

Piciorgros GmbH * Germany

BKK TETRA Carrier Level Change

Piciorgros GmbH * Germany

Data base (excel.csv) after test drive

Piciorgros GmbH * Germany

 Features of the Analyzer-Software CoverMap

HTML-Application can be used on Mac and on PC Computers

Based on Google Maps
Displays each single point in colors referring to dBm color bar
OnMouseOver shows all TETRA parameter for that specific point, as well as the
RSSI of all related NBCs
All Serving Cells sorted and displayed with a color Max-RSSI indicator
OnMouseOver on the Serving Cell displays all NBCs of that specific BS
CrossCheck function to detect wrong NBC settings
Create your own BS-List using CoverMap
OnMouseOver on the BS Map Locations shows the Coverage and RSSI for all
test points
Show coverage in % depending on a dBm threshold
Show where Cell Reselection happened, Show Cell reselection Cause
Show Distance to Base Station
Single, Multiple switch on/off Base Stations to simulate BS fail

Piciorgros GmbH * Germany

Coverage view on PC

Piciorgros GmbH * Germany

Analyzer (PC/Mac): Display the RSSI

RSSI of
Strongest Cell Three best
(Bold) Neighbor Cells
Best Cell on
Selected Map/Sat View
RSSI of Location Selector
Serving Cell Serving Cell
Info about Parameter
(Blue)
Selected
Serving Cells Location
dB Ref.-Bar
during Test Double Click
Drive Serving Cell
Serving Cell Indicator to change Colors
for Selected
BS reported Location
during Test
Drive
CoverMap
Colored Dot Version Number
(BS Location) Selected US / Metric
indicates highest
Location Select
RSSI seen for this BS
(MouseOver)

Piciorgros GmbH * Germany

Analyzer (PC/Mac): Coverage of one Base Station

Select RSSI
Display
Base Station
Select RSSI Parameter
Level

Mouse Over

Piciorgros GmbH * Germany

Analyzer (PC/Mac): Show the Serving Cell Change

Piciorgros GmbH * Germany

Analyzer (PC/Mac): Simulation of a Base Station Fail

BS 6 BS 6
enabled disabled

RSSI-Result RSSI-Result
with all Base Station active without Base Station 6

Piciorgros GmbH * Germany

Analyzer (PC/Mac): Display the Bit Error Rate

Colored Dot BER Ref.-Bar

Indicate worst Double Click
BER mesured to change Colors

Piciorgros GmbH * Germany

 DVI-100
Digital Voice Interface

The Voice-Bridge
(Smart-ISI)

Piciorgros GmbH * Germany

The DVI-100 (Digital Voice Interface) is a special
TETRA terminal, that feeds all received TETRA
voice signals to its Ethernet (IP) port and vice
verse, without any conversion to analog. So there
is no reduction of the original TETRA voice quality.
Additional also Status and SDS messages are
forwarded to the DVI Ethernet port and sent to a
(any) destination IP (and vice verse).
The DVI uses the Open PTX Protocol
(www.openptx.org) developed in co operation by
the University of Dortmund and Piciorgros GmbH

Piciorgros GmbH * Germany

Piciorgros GmbH * Germany
Piciorgros GmbH * Germany
Piciorgros GmbH * Germany
The DVI-100 can be operated in DMO Mode and can
be used as a TETRA Micro-Spot:

Connected to a DVI-Server

Connected to a PC / iPhone / iPad

Connected to a TETRA Infrastructure switch

Piciorgros GmbH * Germany

Piciorgros GmbH * Germany
The DVI-100 Features
Connect TETRA networks of different
manufacturer
Connect TETRA networks with different
frequencies (450 MHz / 800 MHz)
In house coverage
Access to the own TETRA network from out of
the coverage area (Paris Cologne)
Temporary Micro-Spot (on site)
Dispatcher
Design your own application

Piciorgros GmbH * Germany

SCADA, Telemetry and Telecontrol
using TETRA
Infrastructure

Piciorgros GmbH * Germany

Typical SCADA Server Layout

Ref:
Scada: Wikipedia
Monitor: Samsung

Piciorgros GmbH * Germany

 TETRA Modem - TMO-100
with two serial Ports, one Ethernet
Port and an Audio Port

Piciorgros GmbH * Germany

 TETRA Modem - TMO-100
as before with additional
embedded I/O

Piciorgros GmbH * Germany

 TMO-100 - TETRA related Features

SDS can be up to 255 bytes (2047 Bit) long. Type TL and TL 4

Packet Switched Data (IP) supported
Single and Multi Slot Packet Data supported
Secondary Control Channel supported
Automatic PPP Link set up to the TETRA Switch
Router Function with Port Forwarding and NAT
Up to 3 Watt RF Output Power
Encryption
Over The Air (OTA) updating of Stack, MMI and DSP
Voice feature even with active Packet Data Link
Build in TETRA Monitor (local and remote) via embedded Web Server
Field Strength Indicator on the Front Panel
Short Data or SDS can be sent as alarms (low field strength ...)
370 MHz - 470 MHz in one device and 800 MHz available

Piciorgros GmbH * Germany

 SCADA using an SDS Gateway
Control Room Public Lighting

SDS TMO-100

Two Serial
Interfaces TGW-100 SDS
SDS Gateway
TMO-100
I/O

Command
IP
and Control
Communication Line Device
SDS

AMR

Tetra Switch TMO-100

Piciorgros GmbH * Germany

 SCADA using an Packet Data Gateway
Control Room Serial
Public Lighting
Interface

PD TMO-100

Two Serial TGW-100P

Interfaces PD
Packet Data
Gateway
TMO-100
I/O

Command
and Control
IP
Communication Line Device
PD

Serial
Interface
AMR

Tetra Switch TMO-100

Piciorgros GmbH * Germany

User Inteface - Embedded Web-Browser

Piciorgros GmbH * Germany

 Performance Test with SDS-Gateway on ONE SCCH/MCCH:

Infrastructure: TETRA with one carrier

TETRA Data Link: One SCCH
Data Compression: OFF
Data nodes: One or more polling nodes, each polling 10 TMO-100
Protocol: Modbus RTU
Polling Target: Polling different numbers of bytes from inside the TMO-
100

One Node Two Nodes Three Nodes Four Nodes Eight Nodes

SDS: 20 Bytes 65 130 240 250 295

SDS: 100 Bytes 285

SDS: 200 Bytes 265

Table showing polls per minute

Piciorgros GmbH * Germany

 Performance Test with SDS-Gateway on FOUR SCCH/MCCH:

Infrastructure: TETRA with one carrier

TETRA Data Link: MCCH plus three SCCH
Data Compression: OFF
Data nodes: One or more polling nodes, each polling 10 TMO-100
Protocol: Modbus RTU
Polling Target: Polling different numbers of bytes from inside the TMO-
100

One Node Two Nodes Three Nodes Four Nodes 16 Nodes

(on each TS) (on each TS) (on each TS) (on each TS) (on each TS)

SDS: 20 Bytes 210 410 600 760 880

SDS: 100 Bytes

SDS: 200 Bytes

Table showing total polls (on all time slots) per minute (numbers rounded)

Piciorgros GmbH * Germany

 Availibility (Timeouts) on SDS communication with TGW-100 (Lab):

Remark:
This table shows the timeouts using SDS communication (the results are similar to PD)

Piciorgros GmbH * Germany

Typical SCADA Applications:

Piciorgros GmbH * Germany

Open Pit Mining (Water Level Control)

Piciorgros GmbH * Germany

Turkey, Mining Application DMO Mode

Piciorgros GmbH * Germany

 ME, Gas and Oil

Piciorgros GmbH * Germany

Asia, Utility (Energy Companies) Pole Mounted Switches

Piciorgros GmbH * Germany

TETRA Data Applications

IP Risks and IP Security

Piciorgros GmbH * Germany

The search term Cyber Attack Industry

Gives more than 2.400.000 Results

Piciorgros GmbH * Germany

Piciorgros GmbH * Germany
Piciorgros GmbH * Germany
 Potential IP Risks (Back Doors)

Control Room

Air Interface

Remote Modem

Piciorgros GmbH * Germany

 Risks using IP Communication via wireless
Infrastructures to Remote Outstations
SCADA Control
Room

IP
TMO-100
PD

Remote Modem

Control Room

PD

TMO-100
I/O
Router / Gateway
Command and
Control Line
PD Device

AMR, PLC or
RTU

Tetra Switch Air Interface TMO-100

Piciorgros GmbH * Germany

 Potential IP Risks (Hacks)

Access from the SwMi side to the remote modems (RTUs)

Hacker send Control and Command data to the remote RTUs
Access from the remote devices to the SCADA Server (Intranet)
Hacker try to access and stress the Intranet, SCADA Server or any
other Intranet Server
Access via the Air Interface (using a spare TMO-100)
Hacker try to access the Intranet or try to send commands to the
Outstation RTUs
IP Data flooding via a remote device
Hacker try to flood and stress the TETRA Infrastructure with data
packets

Piciorgros GmbH * Germany

 TMO-100 Protection and Firewall(s)

Access from the SwMi side to the remote modems (RTUs)

The IP Server Source Address received by the TMO-100 can be
restricted to a specific IP Address or a specific IP Address range
Access from the remote devices to the SCADA Server (Intranet)
The RTU Source Address received by the TMO-100 can be restricted to
a specific IP Address or a specific IP Address range
Access via the Air Interface (using a spare TMO-100)
Enable AIE to avoid unwanted Access via the Air Interface
IP Data flooding via a remote device
A configurable IP Flooding Filter stops the data flow for a specific time
(5 minutes), after the TMO-100 has received a specific number of IP
Packets (5 packets) in a specific time frame (10 seconds)

Piciorgros GmbH * Germany

Conlusion:

The TETRA Performance is sufficient for the most SCADA Applications

TETRA can do Serial and IP Communication
With TETRA as a PMR Network, the user has full control of his
Infrastructure (Power Supply, Antennas, Back Bone, )
TETRA is the savest (ref.: Public Safety) existing wireless network
Existing Technologies to protect against Cyber Criminals
TETRA will be available at least for the next 10-15 Years

Piciorgros GmbH * Germany

 Funk - Electronic Piciorgros GmbH
Claudiastr. 5
51145 Kln-Porz
Germany

Thank you very much for your interest in our Products

www.TetraModem.com

Piciorgros GmbH * Germany