Turning fragmented network evidence into faster, explainable recovery

Why Mobile Core diagnosis remains slow

Mobile Core services depend on both network functions and the cloud infrastructure beneath them. When a service issue occurs, the initiating fault may sit in either domain, while its effects can spread through failover, topology and service dependencies. Engineers must correlate performance indicators, alarms, logs, configuration information and operational knowledge before they can determine what happened and what should happen next. Because an incorrect change in the Mobile Core can disrupt critical connectivity for many subscribers, Phase 1 deliberately keeps corrective action under operator control.

That investigation is often slowed by fragmented tooling and evidence. Engineers may need to assemble data from several systems before they can test a likely cause, increasing investigation effort and delaying recovery.

The Moonshot Catalyst project, Knowledge-driven root cause analysis for faster recovery, is championed by Singtel, Optus, NTT DOCOMO and Telkomsel and delivered by Ericsson, Red Hat and Makman. The filmed demonstration uses anonymised Singtel operational data to replay a PDU session establishment failure on a core node, with a corroborating check of the hosting cloud infrastructure. The approach was separately reviewed by Singtel Mobile Core engineers using operational incidents from November 2025 and March 2026, followed by calibration on live data. Phase 1 covers Awareness and Analysis: identifying the supported cause, showing its evidence trace and presenting the recommended action, which the operator authorizes and performs.

Connecting operational evidence with engineering knowledge

A DataOps platform ingests and normalizes performance measurements, alarms, logs and relevant configuration data from the 5G Core and cloud environment. Inventory information can provide authoritative topology context. Machine-learning models detect abnormal KPI behaviour and publish an enriched anomaly identifying the affected entities and time window. This gives the RCA agents a defined starting point for investigation. They use the ontology-driven Knowledge Plane to retrieve relevant evidence, examine network topology and service dependencies, and test candidate causes against engineering rules. The workflow then produces an evidence-backed root-cause assessment, with a traceable reasoning path, or returns an inconclusive result if the available evidence is insufficient.

An ontology-driven Knowledge Plane links live operational evidence with network topology, service dependencies, product documentation, historical incidents, policies and engineering rules. The ontology defines what network functions, interfaces, services and KPIs mean and how they relate (TBox), while the knowledge graph connects these concepts to actual network entities and dependencies (ABox). This allows RCA agents to follow relevant KPI and dependency paths and apply consistent meaning across network and cloud domains. However, topology and graph relationships provide context rather than proof of causality: that requires supporting, time-stamped evidence from alarms, logs and other operational data. Specialist root cause analysis (RCA) agents retrieve this bounded evidence and use an explicit, versioned decision function to validate candidate causes through a governed workflow:

• Scopes the incident and identifies the relevant time window and entities.
• Traverses the knowledge graph and checks temporal and topology consistency.
• Retrieves supporting evidence and tests candidate causes against governed rules.
• Returns an evidence-backed root-cause assessment with a traceable reasoning path, or an inconclusive result when the evidence is insufficient.

A sovereign MaaS/LLM layer supports natural-language requests and summarizes the findings within the operator environment, but it does not make the final RCA decision. Ericsson contributes the DataOps, Knowledge Plane and agent architecture; Red Hat provides the OpenShift-based sovereign platform and AI infrastructure; and Makman, the consulting partner for autonomy and TM Forum standards, defines the autonomy statement task by task against the Core Network Fault Management scenario (GB1523B, scored per IG1252), positions the solution in the Autonomous Networks reference architecture (IG1251) and shapes the Knowledge Plane as a contribution candidate to the TM Forum Autonomous Networks projec

Standards for explainable and progressive autonomy

The project uses the following TM Forum assets:

• TR326 Operationalizing Ontologies for AI-Native Autonomous Networks, which guides ontology lifecycle, semantic interoperability, governance and knowledge exposure.
• IG1218F Autonomous Networks Framework, which structures the current Awareness and Analysis scope and the planned progression toward Decision and Execution.
• IG1251 Autonomous Networks Reference Architecture, together with related Level 4, agent and multi-agent architecture reports, which position the functional design and the longer-term pathway to Level 4 operations.
• GB1523B Core Network Fault Management Questionnaire with Subscenarios and IG1523B AN L4 Core Network Fault Management Solution Package, which provide scenario and solution references for the demonstrated use case.
• IG1252 Autonomous Network Levels Evaluation Methodology and ANLET, which support the stated autonomy level and its evidence requirements.
• IG1256 Autonomous Network Effectiveness Indicators and IG1256B Autonomous Networks High-Value Scenarios Effectiveness Indicators, which frame measurable outcomes and high-value-scenario indicators.
• IG1373F AI-Augmented Knowledge Graph for 5G Networks, which maps topology, functions, alarms, KPI observations and causal hypotheses.
• The Business Process Framework (eTOM), which positions the workflow within Resource Trouble Management and Service Problem Management.

Measuring faster, more consistent investigation

Singtel Mobile Core professionals reviewed the results using operational incidents from November 2025 and March 2026, followed by calibration on live data. Diagnosis time fell from about 60 minutes to 5 minutes, while recovery time decreased from 2 to 3 hours to 60 minutes, with the operator still deciding and executing the corrective action. The solution has run in controlled production at Singtel since September 2026, with one authorised user and session on limited data. In addition to reported diagnosis and recovery times, the team is evaluating RCA accuracy, engineer effort and evidence coverage as adoption expands.

“This Catalyst solution is valuable because it shows how fragmented network signals can be transformed into connected, reusable knowledge for faster and more explainable fault investigation. By combining telecom ontology, a semantic knowledge graph and deterministic agentic reasoning, it can help operations teams move from manually assembling evidence towards a traceable diagnosis in minutes rather than hours,” said Louis Lai, Senior Director, Group Strategy, Engineering & Innovation at Singtel, and Mohit Mathur, Director, Autonomous Networks at Singtel Optus Pty Limited.

A reusable foundation for trusted operations

For communications service providers, faster and more consistent fault isolation could shorten service disruption and improve the resilience of critical connectivity. For the wider industry, the Catalyst demonstrates a method grounded in TM Forum standards for converting fragmented network data into connected, reusable knowledge. The Knowledge Plane and telecom ontology are designed to extend across network domains and assurance use cases, reducing duplicated point solutions and supporting progressive autonomy.

Phase 1 keeps corrective action under operator control: the recommended action is presented, and the operator authorises and performs it. Phase 2 aims to add impact assessment, intent and delta detection where relevant, remediation proposals, policy and risk evaluation, and automated actuation. Any future actuation would require policy checks, approval where needed, verification of the result and a rollback or escalation path. Reusing the same data and knowledge foundation, this staged approach provides a pathway towards trusted closed-loop operations without presenting future capabilities as current results.

Meet the team at Innovate Asia in Bangkok, 17-19 November 2026, at the Autonomous Networks innovation zone kiosk.