SMS
This document describes the Short Message Service implementation in OmniMSC, covering mobile-originating and mobile-terminating SMS flows, DTAP transaction identifier allocation, A-interface SAPI handling, MAP response routing, and the SMS codec layers.
For call flow diagrams that include SMS alongside voice, see Call Flow Diagrams. For MAP interface details covering MO-ForwardSM and MT-ForwardSM operations, see MAP Operations. For SMSc address and point code configuration, see Configuration Reference. For common SMS delivery issues, see Troubleshooting — SMS Issues.
MO-SMS (Mobile Originating SMS)
A subscriber sends a short message via the MSC to the SMS Centre (SMSc). The MSC acts as a relay, receiving the SM from the air interface and forwarding it to the SMSc using MAP MO-ForwardSM.
The MO Handler extracts the SM-RP-DA (destination address, typically the SMSc address) and SM-RP-OA (originating address, the subscriber MSISDN) from the RP-DATA, then constructs the MAP MO-ForwardSM request. The MAP response determines whether the MSC sends RP-ACK or RP-ERROR back to the UE.
MT-SMS (Mobile Terminating SMS)
The SMSc delivers a short message to a subscriber via the MSC. The SMSc sends a MAP MT-ForwardSM (opcode 44) to the MSC, which pages the subscriber if necessary and delivers the SM over the air interface.
Synchronous TI Allocation
The MT Handler calls register_mt_sms on the MSC-A process as a synchronous operation. This allocates a DTAP Transaction Identifier for the MT-SMS delivery and prevents a race condition where two concurrent MT-SMS deliveries to the same subscriber could be assigned the same TI. The synchronous call ensures that TI values are unique across all active SMS transactions for a given subscriber.
DTAP Transaction Identifier
For MT-SMS, the network allocates the Transaction Identifier (TI). Per 3GPP TS 24.007, the TI flag distinguishes the originator:
| Direction | TI Flag | Meaning |
|---|---|---|
| Network → UE (CP-DATA) | 0 | Network originated this transaction |
| UE → Network (CP-ACK, RP-ACK) | 1 | UE responding to network-originated transaction |
The MSC sets TI flag=0 in the CP-DATA sent to the UE. The UE mirrors the TI value but sets flag=1 in all responses (CP-ACK, CP-DATA containing RP-ACK). This convention allows both sides to distinguish between multiple concurrent SMS transactions.
SAPI 3
SMS NAS PDUs (CP-DATA, CP-ACK, CP-ERROR) are carried on SAPI 3 of the A-interface per 3GPP TS 48.006. The DLCI (Data Link Connection Identifier) byte in the BSSAP DTAP header is set to 0x03, indicating SAPI=3.
SAPI 3 provides a separate logical channel from the main signaling channel (SAPI 0), which carries CC and MM messages. This separation allows SMS delivery to occur concurrently with an active voice call without interfering with call control signaling.
MAP Response Routing
When an MT-ForwardSM arrives from the SMSc, the MSC must route the TCAP End response back to the correct originating point code. The ingress module captures the OPC (Originating Point Code) from the incoming M3UA transfer message and stores it as routing_info[:opc].
When constructing the TCAP End response, the MSC uses this stored OPC as the DPC (Destination Point Code) for the outgoing M3UA message. This ensures the response reaches the correct SMSc, which is important in networks where multiple SMSc instances use different point codes, or where an STP routes based on point code rather than SCCP global title.
The OPC/DPC swap follows the standard M3UA convention: the response OPC is the MSC's own point code (the incoming DPC), and the response DPC is the SMSc's point code (the incoming OPC).
SMS Codec
The SMS codec handles two protocol layers per 3GPP TS 24.011:
CP Layer (Connection Management Sublayer)
| Message | Direction | Description |
|---|---|---|
| CP-DATA | Both | Carries an RP message as payload |
| CP-ACK | Both | Acknowledges receipt of CP-DATA |
| CP-ERROR | Both | Reports a CP-layer error (cause value included) |
CP-DATA contains a single RP-layer PDU. Each CP-DATA must be acknowledged with a CP-ACK before the next CP-DATA can be sent on the same transaction.
RP Layer (Relay Protocol)
| Message | Direction | Description |
|---|---|---|
| RP-DATA | Both | Carries the SM-TP-DU (the actual short message) along with RP-DA and RP-OA addresses |
| RP-ACK | Both | Confirms successful RP-DATA delivery |
| RP-ERROR | Both | Reports an RP-layer error (cause value from TS 24.011 table 8.4) |
For MO-SMS, the RP-DATA from the UE contains the SM-RP-DA (SMSc address) and SM-RP-OA (subscriber address). For MT-SMS, the MSC constructs RP-DATA with SM-RP-DA (subscriber IMSI) and SM-RP-OA (SMSc address).
References
| Specification | Title | Relevance |
|---|---|---|
| TS 24.011 | Point-to-Point Short Message Service support on mobile radio interface | CP and RP protocol layers, message formats, cause codes |
| TS 29.002 Section 12 | MAP Specification - Short Message Service procedures | MAP MO-ForwardSM (opcode 46), MT-ForwardSM (opcode 44), routing info for SM |
| TS 23.040 | Technical realization of SMS | SM-TP layer encoding, validity period, status reports |
| TS 48.006 | Signalling transport mechanism specification for the BSC-MSC interface | DLCI/SAPI assignment for A-interface DTAP |
| TS 24.007 | Mobile radio interface signalling layer 3 - General aspects | Transaction Identifier allocation and TI flag conventions |