Cell Broadcast Operations Guide

OmniLCS implements a Cell Broadcast Centre (CBC) supporting 2G networks via CBSP, 3G UTRAN networks via SABP, and 4G LTE networks via SBC-AP. The CBC can send, update, and stop broadcast messages across all connected radio access network elements simultaneously.

Architecture

2G CBSP Operations

Connection Model

CBSP uses TCP transport per 3GPP TS 48.049. The CBC listens on TCP port 48049 (IANA registered) and BSCs establish inbound connections.

• Each accepted connection spawns a connection handler under a DynamicSupervisor
• Connections are tracked in the :cbsp_connections ETS table
• Connection state is broadcast via PubSub to the LiveView UI

Keep-Alive

The CBC implements proactive keep-alive:

Parameter	Default	Description
Keep-alive interval	30 seconds	How often the CBC sends KEEP-ALIVE to each peer
Keep-alive timeout	10 seconds	Time to wait for KEEP-ALIVE COMPLETE before marking unhealthy

The CBC both sends proactive KEEP-ALIVE messages and responds to KEEP-ALIVE messages initiated by BSCs with KEEP-ALIVE COMPLETE.

CBSP Message Types

Message	Direction	Code	Description
WRITE-REPLACE	CBC -> BSC	0x01	Send or update a broadcast message
WRITE-REPLACE COMPLETE	BSC -> CBC	0x02	Broadcast accepted by BSC
WRITE-REPLACE FAILURE	BSC -> CBC	0x03	Broadcast rejected by BSC
KILL	CBC -> BSC	0x04	Stop a broadcast
KILL COMPLETE	BSC -> CBC	0x05	Broadcast stopped
KILL FAILURE	BSC -> CBC	0x06	Failed to stop broadcast
LOAD-QUERY	CBC -> BSC	0x07	Query radio resource loading
LOAD-QUERY COMPLETE	BSC -> CBC	0x08	Load information returned
LOAD-QUERY FAILURE	BSC -> CBC	0x09	Load query failed
STATUS-QUERY	CBC -> BSC	0x0A	Query broadcast delivery status
STATUS-QUERY COMPLETE	BSC -> CBC	0x0B	Status information returned
STATUS-QUERY FAILURE	BSC -> CBC	0x0C	Status query failed
RESET	CBC -> BSC	0x10	Reset broadcast state on BSC
RESET COMPLETE	BSC -> CBC	0x11	Reset acknowledged
RESET FAILURE	BSC -> CBC	0x12	Reset failed
RESTART	BSC -> CBC	0x13	BSC restarted (informational)
FAILURE	BSC -> CBC	0x14	BSC failure indication
ERROR INDICATION	Either	0x15	Protocol error
KEEP-ALIVE	Either	0x16	Connection supervision
KEEP-ALIVE COMPLETE	Either	0x17	Keep-alive response

CBSP Message Framing

Every CBSP message on the wire is:

+----------+----------+------+
| Length   | Type     | IEs  |
| (3 bytes)| (1 byte) | ...  |
+----------+----------+------+

The 3-byte length field covers the type byte plus all IEs (excludes the 3 length bytes themselves).

Cell List Formats

The Cell List IE identifies which cells a broadcast targets. Supported formats:

Discriminator	Value	Format	Description
CGI	0x00	MCC+MNC+LAC+CI	Full Cell Global Identity
LAC+CI	0x01	PLMN+LAC+CI	Location Area Code + Cell Identity
CI	0x02	CI only	Cell Identity only
LAI	0x04	MCC+MNC+LAC	Location Area Identity
LAC	0x05	LAC only	Location Area Code
All in BSC	0x06	(no cells)	All cells managed by the BSC

Channel Indicator

Value	Name	Description
0	Basic CBCH	Primary Cell Broadcast Channel
1	Extended CBCH	Extended Cell Broadcast Channel (higher capacity)

3G SABP Operations

The Service Area Broadcast Protocol (SABP) provides the Iu-BC interface between the CBC and RNCs in a 3G UTRAN network, per 3GPP TS 25.419. SABP uses ASN.1 PER aligned encoding over TCP.

Connection Model

SABP uses TCP transport per TS 25.414 §7.1.3.3. The IANA-registered port for SABP is 3452. Per TS 25.419 §5, the CBC initiates connections for normal operations (Write-Replace, Kill, etc.) and the RNC initiates connections only for Failure/Restart Indications. Both sides use destination port 3452 when establishing new connections.

• Each accepted TCP connection spawns a connection handler under the SABP connection DynamicSupervisor
• Connections are tracked in the :sabp_connections ETS table
• Connection state changes are broadcast via PubSub to the LiveView UI
• TCP keepalive socket option is enabled since SABP has no protocol-level keep-alive mechanism

SABP Message Framing

SABP messages are framed over TCP with a 4-byte big-endian length prefix:

+-------------------+---------------------------+
| Length (4 bytes)   | ASN.1 PER Encoded PDU     |
| big-endian uint32  | ...                       |
+-------------------+---------------------------+

The length field specifies the number of bytes in the ASN.1 PER encoded payload that follows. Multiple messages may arrive in a single TCP segment; the connection handler buffers and reassembles as needed.

SABP Procedures

Procedure	Code	Class	Direction	Description
Write-Replace	0	Class 1	CBC -> RNC	Send or update a broadcast message
Kill	1	Class 1	CBC -> RNC	Stop an active broadcast
Load-Status-Enquiry	2	Class 1	CBC -> RNC	Query radio resource loading
Message-Status-Query	3	Class 1	CBC -> RNC	Query broadcast delivery status
Reset	4	Class 1	CBC -> RNC	Reset broadcast state on RNC
Restart-Indication	5	Class 2	RNC -> CBC	RNC restarted, re-send active broadcasts
Failure-Indication	6	Class 2	RNC -> CBC	RNC failure indication
Error-Indication	7	Class 2	Either	Report a protocol error

SABP Information Elements

The SABP protocol uses ASN.1-defined Information Elements (IEs). Key IEs used in Write-Replace:

IE	ID	Criticality	Type	Description
Broadcast-Message-Content	0	Reject	Binary	Encoded CBS message content
Category	1	Ignore	Enum	Message priority (high, normal, background, default)
Cause	2	Ignore	Integer	Cause value for failure/error indications
Data-Coding-Scheme	4	Ignore	8-bit	How message content is encoded (e.g., 0x0F for GSM 7-bit)
Message-Identifier	6	Reject	16-bit	CB message identifier
New-Serial-Number	7	Reject	16-bit	Serial number for the new/updated broadcast
Number-of-Broadcasts-Requested	9	Reject	Integer	Total broadcast count (0..65535)
Old-Serial-Number	10	Ignore	16-bit	Serial number of message being replaced (optional)
Repetition-Period	13	Reject	Integer	Seconds between repetitions (1..4096)
Service-Areas-List	15	Reject	List	Target service areas (list of SAIs)

Service Area Identifier (SAI)

SABP targets broadcasts to specific Service Areas identified by SAIs. Each SAI consists of:

Field	Size	Description
PLMN Identity	3 bytes	BCD-encoded MCC+MNC per 3GPP TS 24.008
LAC	2 bytes	Location Area Code
SAC	2 bytes	Service Area Code

Broadcast Category

The optional Category IE sets the priority of a broadcast message:

Category	Description
high-priority	Highest priority, pre-empts other broadcasts
normal-priority	Standard priority
background-priority	Low priority, does not pre-empt
default-priority	Default when no category is specified

Restart-Indication and Failure-Indication Handling

When the CBC receives a Restart-Indication from an RNC, the RNC has restarted and lost its broadcast state. The CBC should re-send all active broadcasts to that RNC.

When the CBC receives a Failure-Indication, the RNC is reporting that certain service areas have lost broadcast capability. This is logged and emitted as a telemetry event.

4G SBC-AP Operations

Connection Model

Per 3GPP TS 29.168 Section 4.3, the CBC initiates SCTP associations to each MME. The MME listens on port 29168 (IANA registered). The SCTP Payload Protocol Identifier (PPID) for SBC-AP is 24.

The transport implements automatic reconnection with exponential backoff:

Parameter	Value	Description
Initial reconnect delay	5 seconds	First retry delay after connection failure
Maximum reconnect delay	60 seconds	Maximum backoff ceiling
SCTP heartbeat interval	10 seconds	Peer address heartbeat
SCTP path max retransmissions	7	Before declaring path failure
SCTP RTO max	30 seconds	Maximum retransmission timeout
SCTP RTO min	1 second	Minimum retransmission timeout

SBC-AP Procedures

Procedure	Code	Class	Direction	Description
Write-Replace-Warning	0	Class 1	CBC -> MME	Send or update a warning message
Stop-Warning	1	Class 1	CBC -> MME	Stop an active warning
Error-Indication	2	Class 2	Either	Report a protocol error
PWS-Restart-Indication	3	Class 2	MME -> CBC	MME restarted, re-send active warnings
PWS-Failure-Indication	4	Class 2	MME -> CBC	eNB failure, cells lost broadcast capability

Write-Replace-Warning-Request IEs

IE	ID	Criticality	Type	Description
Message-Identifier	5	Reject	16-bit	CB message identifier (e.g., 0x1112 for CMAS)
Serial-Number	11	Reject	16-bit	Serial number with geo scope, msg code, update number
List-of-TAIs	14	Reject	List	Tracking area identities for the broadcast
Warning-Area-List	15	Ignore	Choice	Target area (TAI list, cell list, or emergency area)
Repetition-Period	10	Reject	Integer	Seconds between repetitions (0..4096)
Number-of-Broadcasts-Requested	7	Reject	Integer	Total broadcast count (0..65535)
Warning-Type	18	Ignore	2 bytes	ETWS warning type + activation flags
Data-Coding-Scheme	3	Ignore	8-bit	How message content is encoded
Warning-Message-Content	16	Ignore	Binary	Encoded CBS pages
Omc-Id	19	Ignore	Binary	Operations centre identifier
Concurrent-Warning-Message-Indicator	20	Reject	Boolean	Allow concurrent warnings

Stop-Warning-Request IEs

IE	ID	Criticality	Description
Message-Identifier	5	Reject	CB message identifier to stop
Serial-Number	11	Reject	Serial number of the broadcast to stop
List-of-TAIs	14	Reject	(Optional) Limit stop to specific TAIs
Warning-Area-List	15	Ignore	(Optional) Limit stop to specific areas

PWS-Restart-Indication Handling

When the CBC receives a PWS-Restart-Indication from an MME, it re-sends all active broadcasts (those in :sent or :acknowledged status) to that MME. This ensures broadcast continuity after MME restarts.

PWS-Failure-Indication Handling

When the CBC receives a PWS-Failure-Indication, it marks affected broadcasts with a :pws_failure response for the reporting MME association. This is logged as a warning.

Message Formatting

GSM 7-bit Encoding

The default encoding for CBS messages. Each CBS page holds up to 93 septets packed into 82 bytes.

The GSM 7-bit default alphabet maps standard Latin characters plus Greek letters and special symbols. Characters not in the basic alphabet use the extension table (escape sequence 0x1B + extension code), consuming two septets.

The Warning-Message-Content binary structure:

+----------+-------------------------------------------+
| Num Pages| Page 1 (82 bytes packed + 1 byte length) |
| (1 byte) | Page 2 ...                                |
+----------+-------------------------------------------+

UCS-2 Encoding

For non-Latin scripts (CJK, Arabic, Thai, etc.). Each CBS page holds up to 40 UCS-2 characters (80 bytes of UTF-16BE data), padded to 82 bytes.

Data Coding Scheme (DCS)

Encoding	DCS Value	Description
GSM 7-bit	0x0F	GSM 7-bit default alphabet, language unspecified
UCS-2	0x48	UCS-2 (UTF-16BE), language unspecified

The DCS can be set explicitly per broadcast or is auto-derived from the encoding parameter.

Serial Number Structure

Per 3GPP TS 23.041 Section 9.4.1.2.1, the 16-bit serial number has internal structure:

+----+------------+--------+
| GS | Msg Code   | Update |
| 2b | 10 bits    | 4 bits |
+----+------------+--------+

Field	Bits	Description
Geographical Scope (GS)	15-14	0 = Cell-wide immediate, 1 = PLMN-wide, 2 = LA/TA-wide, 3 = Cell-wide
Message Code	13-4	Identifies the broadcast within its scope (0..1023)
Update Number	3-0	Incremented for message updates (0..15)

The MessageFormatter.build_serial_number/3 helper constructs a serial number from these components.

Warning Types (ETWS)

The Warning-Type IE is 2 bytes per 3GPP TS 23.041 Section 9.3.24:

Warning Type	Octet 1 Value	Description
Earthquake	0x00	Earthquake warning
Tsunami	0x01	Tsunami warning
Earthquake + Tsunami	0x02	Combined earthquake and tsunami
Test	0x03	Test warning
Other	0x04	Other emergency

Octet 2 activation flags (default 0xC0):

Bit	Value	Description
Bit 8	0x80	Emergency User Alert (activate alert tone/vibration)
Bit 7	0x40	Popup (automatically display message on screen)

Both bits are set by default (0xC0) to ensure maximum visibility.

Broadcast State Management

State Lifecycle

Persistence

Active broadcasts for 2G, 3G, and 4G are persisted to priv/active_broadcasts.json as JSON. On startup, the Engine reloads this file to restore broadcast state. This allows the CBC to re-send active warnings after application restart. The persistence file stores three separate broadcast maps: active_broadcasts_4g, active_broadcasts_3g, and active_broadcasts_2g3g.

Response Tracking

For 4G broadcasts, each send_broadcast_4g starts a 30-second response timeout timer. Responses from MMEs are correlated by Message-Identifier and Serial-Number. The timer is cancelled when all expected MME peers have responded. Timed-out peers are logged with a :timeout cause.

Active Broadcasts View

The Active Broadcasts page provides a unified view of all in-flight broadcasts across 2G, 3G, and 4G networks.

Broadcast History

The Engine maintains a rolling history of the last 100 4G broadcasts for the LiveView UI and API queries.

Troubleshooting

No MMEs Connected (SBC-AP)

1. Verify mme_peers configuration contains correct IP addresses and ports
2. Check that the local_ip is reachable from the MME network
3. Look for SCTP connection errors in the log: SBC-AP: Failed to connect to MME
4. Verify SCTP is not blocked by firewalls (protocol 132)
5. Confirm MME is listening on port 29168

No BSCs Connected (CBSP)

1. Verify listen_ip and listen_port configuration under :cbsp
2. Check that TCP port 48049 is not blocked by firewalls
3. Look for accept errors: CBSP accept failed
4. Confirm BSC is configured with the CBC IP address and port

No RNCs Connected (SABP)

1. Verify listen_ip and listen_port configuration under :sabp
2. Check that TCP port 3452 is not blocked by firewalls
3. Look for accept errors: SABP accept failed
4. Confirm RNC is configured with the CBC IP address and port
5. Check logs for SABP connection closed by peer or SABP TCP error messages

Broadcast Not Delivered

1. Check the active broadcasts table for response status
2. Look for WRITE-REPLACE FAILURE or KILL FAILURE messages in the CBSP/SABP message log
3. Verify cell list format matches what the BSC/RNC/MME expects
4. For 4G, check that TAC values are valid for the target MME
5. For 3G, check that Service Area Identifiers (SAIs) are valid for the target RNC
6. Check the broadcast history for timeout entries

Encoding Issues

1. For non-Latin text, ensure :ucs2 encoding is selected
2. Verify the DCS matches the encoding (0x0F for GSM 7-bit, 0x48 for UCS-2)
3. GSM 7-bit can only represent the GSM default alphabet; unsupported characters are replaced with ?

3GPP References

Specification	Title
TS 25.419	UTRAN Iu-BC interface: Service Area Broadcast Protocol (SABP)
TS 29.168	Cell Broadcast Centre interfaces with the Evolved Packet Core (SBC-AP)
TS 48.049	Cell Broadcast Centre Protocol (CBSP)
TS 23.041	Technical realization of Cell Broadcast Service (CBS)
TS 23.038	Alphabets and language-specific information (DCS, GSM 7-bit)
TS 24.008	Mobile radio interface layer 3 specification (PLMN identity encoding)