T1/E1 beyond the BTS - how about BSC and TRAU?

Hello Osmocom, I know a lot of people here have salvaged T1/E1 BTS equipment from Nokia, Ericsson etc. But what about the next level up - has anyone been able to salvage a classic T1/E1 BSC that goes with those BTSes? And given the hardware, does anyone in our community know how to get one of those beasts working? I am interested in the TRAU component of the classic GSM BSS architecture, and I would really love to lay my hands (remotely, via OCTOI, would be just fine) on one of those beauties. Specifically, I seek to feed custom-crafted bits to the TRAU's Abis input and capture what it puts out on the A interface G.711 side, and vice-versa. What can be learned from such experiments? Several things: * I would love to play with TFO: see the TFO_REQ in-band signaling messages the TRAU should put out on its own during the first 5 s or so, then send our own TFO_REQ and TFO_ACK to the TRAU, do the whole protocol, and get the TRAU to actually enter TFO mode. Reading the spec is one thing, but seeing it in action would be so much more fun! I've also been wanting to write my own FOSS implementation of in-band TFO within G.711 RTP, but it would be an impractical task without having some other existing implementation to test against. * If we can get TFO to work, we'll be able to see exactly how real TRAUs handled the onerous requirements of TS 28.062 section C.3.2.1.1. Implementing those rules for FR1 would be quite easy, but try doing the same for EFR or HR1 - *very* daunting! It would be lovely to see exactly what actual historical implementations did here. * Outside of TFO, we should be able to get the TRAU into a known state by feeding it spec-defined encoder and decoder homing frames, and then craft our own test sequences (beyond the standard ones it was surely tested with by its designers) to exercise those parts of the codec implementation where the specs allow implementors to innovate, particularly everything to do with error concealment. But doing all of the above requires access to some old-style T1/E1 BSC that contains such a TRAU. Does anyone in our community have access to such hw? M~