Cell Broadcast » History » Version 9

Version 8 (laforge, 09/06/2018 12:42 PM) → Version 9/20 (laforge, 09/06/2018 03:01 PM)

h1. Cell Broadcast


Normally, all user plane data in GSM/GPRS networks are sent in point-to-point channels from the network to the user. Those are called "dedicated" radio channels whcih exist between the network and one given phone/subscriber at a time.

Cell Broadcast is an exception to that rule. It permits user data (so-called SMS-CB data) to be broadcast by the network in a way that can be received by all phones in the coverage area of the given [[BTS]] simultaneously.

More high-level information can be found at and the related specification is found at "3GPP TS 23.041 Technical realization of Cell Broadcast Service (CBS)":

h2. Use Cases

Cell Broadcast was used for various different use cases primarily in the 1990ies and early 2000s, including
* advertisement of the GPS position of the cell tower you're currently camping on
* advertisement of the calling codes of your current "home zone", i.e. a "lower cost short distance" call zone travelling with you as you roam around.

More recently, SMS-CB is seeing some uptake by various desaster warning systems, such as
* CMAS (Commercial Mobile Alert System), later renamed to WEA ("Wireless Emergency Alerts": in the US.
* EU-Alert in the European union
* Messer Ishi (Rocket Alert) in Israel
* ETWS (Earthquake and Tsunami Warning System) in Japan
* KPAS (Korean Public Alert System)

> h2. Osmocom Cell Broadcast support

* [[OsmoBTS:]] implements the "SMS BROADCAST COMMAND" Message in RSL according to Section 8.5.8 of 3GPP TS 08.58 *but not all hardware targets support this yet, see #1617. osmo-bts-sysmo and osmo-bts-octphy are fine.*
* [[OsmoNITB:]] and [[OsmoBSC:]] implement a VTY command @bts <0-255> smscb-command <1-4> HEXSTRING@ to send a given hex-formatted cell broadcast message to a specified BTS
** you (obviously) first need to enable a timeslot/channel combination on the BTS that actually includes a CBCH, i.e. ccch+sdcch4+cbch or sdcch8+cbch


This is sufficient for manual transmission of cell-broadcast messages in a lab environment or in small networks. The functionality has been developed and "used at the 31st annual CCC congress (31C3) to deliver spoofed _Presidential Level Alert_ messages":

h3. What's missing (for production operation in larger networks)

* mechanism to broadcast one (set of) cell broadcast messages from the BSC to multiple/all BTSs, rather than one BTS individually
* BTS reporting of current CBCH load
* BSC scheduler scheduling multiple alternating sets of CBCH messages based on the current CBCH load reported by BTS
* external interface from BSC to a Cell Broadcast Center (CBC), e.g. according to 3GPP TS 48.049
* an Osmocom implementation of the Cell Broadcast Center (OsmoCBC) which can manage and dsitribute messages to multiple BSCs and which has an external interface by which cell-broadcast can be entered into the network

h2. Message Structure

* Message has maximum 15 pages
* Each page is 82 bytes of data, resulting in 93 characters in GSM 7-bit default alphabet
* Messges are broadcast on logical channels (more like an address)
* Subscribers can activate/deactivate selective addresses

h2. Further Reading

* ITU-T SG2 (Standardization of CB Channels)
* 3GPP TS 23.041 Cell Broadcast
* ETSI 102 444
* "3GPP TS 23.041 GSM: Technical realization of Cell Broadcast Service (CBS)":
* "3GPP TS 48.049 GSM: Baste Station Controller - Cell Broadcast Centre (BSC-CBC) interface specification; Cell Broadcast Service Protocol (CBSP)":
* "3GPP TS
22.268 PWS: Public Warning System (PWS) requirements":
* "3GPP TS 44.012 GSM: Short Message Service Cell Broadcast (SMSCB) support on the mobile radio interface":

h3. EU-Alert

* ETSI/EMTEL TS 102 900

h3. CMAS

* ATIS/TIA Standards J-STD-100, 101, 102

h3. ETWS
Add picture from clipboard (Maximum size: 48.8 MB)