Aventura, Florida · serving clients across the United States (305) 404-9404Toll-free (800) 767-8566Emergency? Get a call within 1 hour
Logistics, maritime container terminal Illustrative engagement

Private 5G on CBRS for a port terminal: remote cranes, yard tractors and scanners on one radio network

A container terminal operator at a US Gulf Coast port, a leader in its segment.

Scale
About 250 acres, 6 berths, 12 outdoor radios, 2 core sites, 3.55 to 3.7 GHz CBRS, 20 MHz carriers
Engagement
Survey, spectrum planning, a pilot on one berth and a phased terminal rollout

The challenge

The terminal's Wi-Fi mesh dropped connections as vehicles and stacked containers moved, handheld scanners lost sessions between berths, and the operator wanted to remotely operate cranes and add automated yard tractors. Steel stacks shadow radio signals, a licensed carrier network was not designed for the yard, and the terminal needed its own network that it controlled and could connect to its operating system.

A container terminal on the Gulf Coast covers about 250 acres with six berths. Its Wi-Fi mesh dropped connections as vehicles and container stacks moved, handheld scanners lost sessions when workers crossed between berths, and the operator wanted to run cranes remotely and add automated yard tractors. Steel stacks shadow radio signals, and a public carrier network is not designed for a yard. The terminal wanted a network it owned, could tune and could join to its terminal operating system.

We began with a radio survey and a propagation model that included stack heights, then placed 12 outdoor radios on towers and crane legs. They are Category B CBRS devices, which the rules in 47 CFR Part 96 permit to operate outdoors at higher power than Category A devices. CBRS uses 3.55 to 3.7 GHz, managed by a Spectrum Access System (SAS): each radio asks the SAS for channels, and the SAS grants them and can take them back. The base plan used General Authorized Access, which needs no license, and we checked whether a Priority Access License in the county would give protected channels for the most critical traffic.

A port is a coastal site, and coastal zones can be protected for federal radar. A SAS may limit or move channels near the coast, so the design assumes it will happen. We planned spare channel capacity, a fallback allocation of 20 MHz carriers and the way each radio would behave when it loses a grant, and we told the operator in plain words which parts of the yard have less margin. This is the kind of constraint that surprises owners who plan on a map instead of on a grant.

The core is a private 5G core with local breakout, so user traffic never leaves the terminal, and a second core at a backup site takes over if the first fails. Devices authenticate with SIMs and eSIMs the terminal controls. The air interface runs TDD in band n48 with an uplink-heavy frame pattern, because crane and tractor cameras send more than they receive. Quality-of-service classes protect crane control and vehicle telemetry ahead of scanner and office traffic. A firewall and 802.1X on the wired side keep the radio network, the terminal operating system and the corporate network apart.

Failure testing took as long as installation. We cut radios, backhaul links and a core, and measured what a tractor experienced while it crossed the yard from one radio to the next. The pilot on one berth ran for weeks before the rest of the terminal moved over, berth by berth, with the Wi-Fi mesh kept as a fallback until each berth was stable. Coverage and latency figures in this illustrative case are modeled for a design of this kind. Our article on private 5G versus Wi-Fi 6E and 7 explains the trade-offs.

What our team delivered

  • A radio survey and propagation model of the yard, including container stack heights, then placement of outdoor Category B radios on towers and crane legs
  • Spectrum planning in the Citizens Broadband Radio Service band (3.55 to 3.7 GHz, 47 CFR Part 96): a Spectrum Access System grants channels to each radio, General Authorized Access use as the base plan and a check for a Priority Access License in the county
  • A coastal constraint handled up front: coastal zones can be protected for federal radar, so the SAS may limit or move channels, and the design includes a fallback plan and spare channel capacity
  • A private 5G core on site with local breakout, local subscriber authentication using SIMs and eSIMs, and a second core at a backup site for failover
  • TDD (band n48) configured with an uplink-heavy frame pattern for camera feeds from cranes and tractors, and quality-of-service classes for crane control, vehicle telemetry and scanner traffic
  • Segmentation between the radio network, the terminal operating system and the corporate network, with firewall rules and 802.1X on the wired side
  • Failure testing: radio, backhaul and core faults, and a measured handover while a tractor crossed the yard

Result

The yard had continuous coverage across stacks and berths, handhelds and tractors stayed connected as they moved, and the operator owned a network it could tune and extend. Coverage and latency figures are modeled for a design of this kind, not measurements from a client.

Failover in under a second

ISP A fails at 300 ms. BFD (RFC 5880) with a 50 ms interval and multiplier 3 declares the session down 150 ms later, BGP withdraws the routes, and the forwarding table repoints to ISP B. Traffic is back at full rate in well under a second; without BFD the router would wait for the 90 s BGP hold timer. Illustrative figures.

Failover in under a secondLine chart over 1.2 seconds. ISP A carries 8 gigabits per second until 300 milliseconds, then drops to zero. ISP B carries nothing until about 650 milliseconds and reaches 8 gigabits per second at 720 milliseconds. Roughly 400 milliseconds of loss in between.Traffic per upstream during a link failureISP A (primary)ISP B (standby)04812Gb/s0200 ms400 ms600 ms800 ms1000 ms1200 msabout 400 ms of loss1 Link to ISP A fails2 BFD: 3 missed hellos (3 × 50 ms), session down3 Routes withdrawn, FIB repointed to ISP BWithout BFD, BGP would wait for the 90 s hold timer (30 s keepalives).

Private 5G across a plant floor

Radios on the shared 3.55 to 3.7 GHz CBRS band connect robots, cameras and sensors. A Spectrum Access System grants the channels, a partner-provided 5G core and a local user plane keep traffic on site, and edge compute runs vision and machine learning in milliseconds. The cloud gets only what it needs.

Private 5G across a plant floorMobile robots, inspection cameras and sensors connect over private 5G to two radio units that act as CBRS devices on the 3.55 to 3.7 GHz band, NR band n48. The radios register with a cloud Spectrum Access System, which grants General Authorized Access or Priority Access channels and can tell them to move when an incumbent such as Navy radar is detected. On site, a user plane function breaks traffic out locally to an edge compute node running vision inspection and machine learning, and a partner-provided 5G core controls the user plane. Only selected data goes on to the cloud. On a loop, a robot hands over from radio 1 to radio 2 without losing its session, and the SAS moves the radios to another channel. DEVICESAMRsmobile robotsCamerasinspectionSensorsvibrationRANRadio 1gNB · CBSDRadio 2gNB · CBSDPLANT EDGEUPFlocal breakoutEdge / MECvision + ML5G corepartner-providedCloudtraining · BISASspectrum grantsgrant + heartbeatincumbent: move channel5G handoverCBRS 3.55–3.7 GHz · NR band n48GAA + PAL tiers47 CFR Part 96Partner-provided 5G core · local breakoutControl and vision stay on site

Round-trip times between seven cities

Round-trip time in milliseconds on direct paths between seven sites, close to what today's fibre routes deliver (light in glass covers about 100 km per millisecond one way, and real routes are longer than the map line). The darker the cell, the longer the round trip. Illustrative figures.

Round-trip times between seven citiesSeven by seven heat map of round-trip times in milliseconds. New York to Miami 27, to São Paulo 115, to London 70, to Frankfurt 80, to Singapore 225, to Tokyo 160. London to Frankfurt 14, the shortest. Singapore to Tokyo 70. Singapore to São Paulo 330, the longest.Round-trip time between sites (ms), direct pathsunder 3030 to 99100 to 149150 to 219220 and upNew YorkMiamiSão PauloLondonFrankfurtSingaporeTokyoNew York271157080225160Miami27110100115240155São Paulo115110190200330255London7010019014170220Frankfurt8011520014160230Singapore22524033017016070Tokyo16015525522023070Symmetric by construction. Singapore to São Paulo is the longest pair, close to the opposite side of the planet.

Separate by region and by business unit

Each business unit lives in its own VRF and VLAN in every region, so a problem in retail cannot reach finance. Traffic between units has to pass a firewall that denies by default and allows only what is written down.

Separate by region and by business unitA grid with three regions, Americas, EMEA and APAC, and three business units, Finance, Retail and R&D. Each cell is a separate VRF with its own VLAN and VNI. Each business unit has one overlay running across its three regional cells, shown as a row. On the right a firewall zone enforces a zero-trust policy that denies by default. A red packet from Retail trying to reach Finance is blocked at the firewall. A teal packet from R&D to the shared DNS and identity services is allowed. AMERICASEMEAAPACFinanceVRF fin · VLAN 110VNI 10110VRF fin · VLAN 110VNI 10110VRF fin · VLAN 110VNI 10110RetailVRF retail · VLAN 120VNI 10120VRF retail · VLAN 120VNI 10120VRF retail · VLAN 120VNI 10120R&DVRF rnd · VLAN 130VNI 10130VRF rnd · VLAN 130VNI 10130VRF rnd · VLAN 130VNI 10130Firewallzoneszero trustdeny bydefaultSharedDNS · IdPdenyallowVRF · L3 isolationVLAN to VNI · L2Default-deny policyEVPN-VXLAN fabricWireGuard + IPsec WANLogs to one SIEM

Frequently asked questions

Direct answers to the questions we hear most. Something else on your mind?

Send us a message
Why did the terminal choose private 5G on CBRS?

The Wi-Fi mesh dropped connections as vehicles and stacked containers moved, and the operator wanted remote cranes and automated yard tractors. A private network gave it coverage and control it could connect to its operating system.

How was radio spectrum planned?

In the CBRS band (3.55 to 3.7 GHz, 47 CFR Part 96): a Spectrum Access System grants channels, General Authorized Access is the base plan, and the design includes a fallback because coastal zones can be protected for federal radar.

How was coverage designed around container stacks?

A radio survey and propagation model including stack heights set the placement of outdoor radios on towers and crane legs.

How was the radio network kept separate from other systems?

Segmentation with firewall rules and 802.1X on the wired side separated the radio network, the terminal operating system and the corporate network. Failure tests covered radio, backhaul and core faults.

Do you know if your company is safe?

Speak with a security engineer today. The first assessment call is free and confidential.

CallFree assessment