Platform

Normalization is the product.

Diagnosis is what customers pay for. Normalization is what nobody else can copy quickly. Everything below sits on one vendor-neutral schema, built once and maintained as an asset.

Ericsson Nokia Samsung O-RAN / SMO
01 / INPUTS

Data inputs

We take the files you already generate.

We pull from the operator's existing PM collector, mediation layer or OSS export target — never from network elements. Three acquisition paths, all read-only.

CategoryWhat it isCadenceIn v1
PM countersPerformance measurement files, per cell / per relation / per beam15-min ROPYes — primary
CM configurationFull or delta configuration dumps of the managed objectsDaily full, or on-changeYes — primary
FM alarmsFault management event stream and alarm historyEvent-drivenYes
Topology & inventorySite, sector, cell, node identifiers, coordinates, bandsWeekly or on-changeYes
Sync / timingPTP and SyncE state, holdover events, fronthaul statistics15-min or eventWhere available
Call tracesPer-call or per-UE trace recordsContinuous, sampledNo — contains subscriber IDs

SFTP pull

From the operator's own file server. The most common path in Tier-2 and Tier-3 estates.

Read-only credential

Object storage

A customer-owned S3 or Azure Blob bucket with a read-only policy scoped to the export directory.

Scoped bucket policy

Manual drop

A web upload for a scoped investigation. Deliberately supported — it is how most engagements start.

No integration required

Schema compliance is not semantic compatibility

A “3GPP-compliant” XML file from two vendors will validate against the same schema and mean different things — different counter semantics, different aggregation over the ROP, different treatment of counter reset on node restart. That gap is the business.

02 / NORMALIZE

The normalization problem

Three sub-problems. Each one kills a naive implementation.

2.1

Identity resolution

Every measurement must resolve to a canonical cell identity — ECGI for LTE, NCGI for NR — and to a stable internal cell_uid that survives renames. Vendor DNs encode identity positionally and differently. Operators rename cells during site swaps and refarming. PCI is not an identity — it is reused across the estate by design, and a PCI-keyed join produces silent, plausible, wrong answers.

2.2

Time alignment

Some vendors timestamp a ROP by its start, some by its end. A one-period offset between two vendors makes every cross-vendor correlation wrong by fifteen minutes — enough to invert a causal story. Add timezone and DST inconsistency, counter resets on node restart, and suspect-flagged partial periods. We store UTC internally, always, and propagate every quality flag to the derived KPI.

2.3

KPI semantics

“Handover success rate” is not one thing. Each vendor computes it from a different counter set, with different inclusion rules for intra-frequency, inter-frequency and inter-RAT cases, and different treatment of preparation versus execution failures. Two vendors reporting 98.2% may be measuring materially different events. KPI definitions are versioned configuration, not code — and they ship with the release so customers can read them.

Two rules that are never negotiated away

Comparability is stated, not assumed.

Every canonical KPI carries a comparability grade across vendors. Displaying a cross-vendor comparison without the grade is how you get an engineer to stop trusting the product permanently.

The definition library lives in version control and ships with the release. Customers can read it. Some will argue with it. That argument is a sales asset, not a support burden.

kpi/handover_execution_success_rate.yaml
kpi: handover_execution_success_rate
canonical_unit: ratio
aggregation: weighted_by_attempts
definitions:
  - vendor: ericsson
    release_range: ">=21.Q2,<24.Q1"
    formula: pmHoExeSuccLteIntraF / pmHoExeAttLteIntraF
    excludes: [inter_rat]
  - vendor: nokia
    release_range: ">=SBTS21A"
    formula: <counter_set_per_release_dictionary>
comparability: directional
caveats:
  - "vendors differ on whether preparation failures
     are counted; comparison is directional, not exact."
03 / MODEL

Canonical data model

Five entities. Deliberately small.

We resist the urge to model the whole 3GPP information model. Every row carries source_file and ingest_run_id — because the evidence pack has to trace any number on screen back to the file it came from, or an operator's vendor will dismiss it.

EntityGrainKey fields
cellone row per cell per validity intervalcell_uid, ECGI/NCGI, vendor, rat, band, pci, site_uid, valid_from, valid_to
relationone row per neighbour relation per intervalsrc_cell_uid, dst_cell_uid, type, dst_resolved, valid_from, valid_to
measurementone row per cell or relation per ROP per KPIcell_uid, ts_utc, kpi_id, value, denominator, quality_flag
config_itemone row per object per parameter per intervalobject_uid, param, value, valid_from, valid_to, source_file
eventalarms, node restarts, upgrades, planned worksobject_uid, ts_utc, type, severity, raw
04 / EVIDENCE

The evidence pack

The primary product surface.

When an engineer accepts a diagnosis, they need to forward it — to a colleague, a manager, or a vendor's support desk. The evidence pack is a self-contained export that circulates inside the customer's organisation without us in the room, and into the vendor relationship where it does work no dashboard can.

With every affected object named in the operator's own naming convention — not ours.

With the detection window and the statistical baseline band both marked.

The specific raw counters used, under their vendor-native names, so the vendor's own engineer can reproduce the result in their own tool.

The relevant configuration values, and the diff if a change is implicated.

Everything in the window that might bear on the finding, including planned works.

Source filenames, ROP timestamps, ingest run, the KPI definition version used, and the comparability grade on any cross-vendor number.

Formats — PDF to forward · HTML to link · JSON for the customer’s own tooling

05 / DETECTION

Detection approach

The honest position on machine learning.

The first release uses deterministic rules plus per-object statistical baselines — seasonal decomposition per cell, per KPI, with day-of-week and hour-of-day profiles. Not because machine learning would not help, but because of three things that are true at this stage.

01

No labelled corpus yet

There is no labelled fault corpus until the product has been deployed and outcomes recorded. Training on nothing produces confidence without accuracy.

02

Engineers reject black boxes

An engineer will accept “this relation's failure rate is 4.1σ above its own eight-week profile, here are the counters.” They will not accept an unexplained anomaly score.

03

Reproducibility is leverage

Every diagnosis must be reproducible and explainable to a vendor support desk. A model that cannot show its work generates no leverage in that conversation.

Machine learning enters in the second release, for ranking and cross-signal correlation, trained on the labelled outcomes the first release collects. That sequencing is the point.

06 / DEPLOYMENT

Deployment & security

Three modes. One security story.

Managed SaaS

For vendor QA organisations, smaller operators and initial pilots. Runs against anonymised exports.

Time to first diagnosis · 5–15 days

Single-tenant VPC

Inside the operator's own cloud account. The common choice for Tier-2 operators with cloud approval.

Time to first diagnosis · 3–6 weeks

On-premise appliance

Same container images with an offline registry bundle, for regulated markets and air-gapped estates.

Time to first diagnosis · 6–12 weeks

The read-only architecture removes most of the attack surface

No inbound connection to the network — all acquisition is outbound-initiated pull, or the customer pushes to us. No write path exists in the codebase. There is no credential in the system capable of changing a network parameter.

And the rest is conventional discipline

Least-privilege read credentials scoped to the export directory. Encryption in transit and at rest. Per-tenant key separation. A full audit log of access and export. SOC 2 on the roadmap ahead of the first Tier-2 operator deal.

Next step

Bring one export. We’ll bring the schema.

A scoped investigation needs no integration and no network access — only a sample of the performance data you already produce.