path: root/2019/osmodevcon2019-cell_broadcast/osmodevcon2019-cell_broadcast.adoc

Cell Broadcast for Osmocom
==========================
:author:	Harald Welte <laforge@gnumonks.org>
:copyright:	2019 by Harald Welte (License: CC-BY-SA)
:backend:	slidy
:max-width:	45em


== Cell Broadcast

* classic GSM (and other 3GPP) are point-to-point
** limited radio resources means limited concurrent communication
* exotic options for point-to-multipoint
** VGCS/VBS (voice group/broadcast calls) exist only in GSM-R
** MBMS (never deployed in 2G/3G) adds multicast packet service
* this leaves cell broadcast as the *only* fast way to send informations to many subscribers at once
** main use case: emergency / disaster warning

== Message Structure

* Message has maximum 15 pages
* Each page is 82 bytes of data, resulting in 93 characters in GSM 7-bit default alphabet
* Messges are broadcast on logical channels (more like an address)
* Subscribers can activate/deactivate selective addresses
* 3GPP TS 03.41 / 23.041

== Cell Broadcast in GSM

[graphviz]
----
digraph G {
  BTS0 [label="BTS"];
  BTS1 [label="BTS"];
  BTS10 [label="BTS"];
  BTS11 [label="BTS"];
  BSC1 [label="BSC"];

  User -> CBC [label="proprietaty"];
  CBC -> BSC [label="CBSP"];
  CBC -> BSC1 [label="CBSP"];
  BSC -> BTS0 [label="RSL"];
  BSC -> BTS1 [label="RSL"];
  BSC1 -> BTS10 [label="RSL"];
  BSC1 -> BTS11 [label="RSL"];
  BTS0 -> MS [label="CBCH"];
}
----

== Cell Broadcast in GSM

[mscgen]
----
include::smscb-2g.msc[]
----

== Cell Broadcast in Osmocom today

image::osmocom-cbs.png[]

== Cell Broadcast in Osmocom soon (TM)

* publicly funded project to complete Cell Broadcast support
** Prototype Fund
* to be completed within Q3/2019
* covers at least the full support for 2G + 3G
** if time permits, 4G support will be added

== Functionality in the BTS

* replace one SDCCH in SDCCH/4 or SDCCH/8 with CBCH
* advertise CBCH presence in BCCH (SYSTEM INFORMATION)
* receive `RSL SMS BROADCAST CMD` from BSC
** segment that message into four blocks
** transmit blocks in `04.12 SMS BROADCAST REQ` on CBCH
* generate `CBCH LOAD INDICATION` and send them via RSL to BSC

== Functionality in the BSC

* receive SMSCB via CBSP from CBC
* distribute them to the respective BTSs in the target area
* schedule the bandwidth between different concurrently active SMSCB
* process RSL `CBCH LOAD INDICATION` and compute load averages
* perform flow control based on `RSL CBCH LOAD IND` from each BTS
* respond to load status enquiries from CBC

== Functionality in the CBC

* receive SMSCB from external users (emergency services)
** each SMSCB has geographic scope and validity period
** no standard interface specified in 3GPP
* manage distribution of SMSCB for each connected BSC
** send SMSCB only to those BSC within geographic scope
** remove messages from BSCs after time expires
** handle BSC restart situations where state is lost

== RSL SMS BROADCAST CMD

* transmits entire SMSCB message (88 octets)
* can also be used to set a _default SMSCB message_ 
** this message is transmitted whenever no other non-default message is pending
** works similar to _SACCH filling_ or _BCCH information_

== CBSP (3GPP TS 48.049)

* spoken on the unnamed interface between CBC and BSC
* no formal syntax, good old "human readable tables in specs" style
* transported over TCP port 48049
* key procedures
** Write-Replace Procedure
** Kill Procedure
** Load Status Enquiry Procedure
** Message Status Query Procedure
** Set DRX Procedure (optional)
** Reset Procedure

== Cell Broadcast in UMTS

Is actually called *Service Area Broadcast*

[graphviz]
----
digraph G {
  BTS0 [label="NodeB"];
  BTS1 [label="NodeB"];
  BTS10 [label="NodeB"];
  BTS11 [label="NodeB"];
  BSC [label="RNC"];
  BSC1 [label="RNC"];

  User -> CBC [label="proprietaty"];
  CBC -> BSC [label="SABP"];
  CBC -> BSC1 [label="SABP"];
  BSC -> BTS0 [label="Iub"];
  BSC -> BTS1 [label="Iub"];
  BSC1 -> BTS10 [label="Iub"];
  BSC1 -> BTS11 [label="Iub"];
  BTS0 -> UE [label="BMC/CTCH"];
}
----

== Cell Broadcast in UMTS

[mscgen]
----
include::smscb-3g.msc[]
----

== Functionality in the NodeB

* completely transparent
* relay the BMC protocol between UE (via Uu) and RNC (via Iub)

== Functionality in the RNC

* pretty much analogous to that of BSC
* schedule transmission of CBS messages on CTCH (Common Traffic Channel)

== Functionality in the CBC

* identical functionality like for 2G
* additional protocol required: SABP

== SABP Protocol (3GPP TS 25.419)

* spoken on Iu-BC interface between CBC and RNC
* specified in ASN.1 using BASIC-PER
* transported over ALCAP/SAAL/AAL5/ATM (yikes!)
** later specified over TCP port 3452
** some hints that use over UDP and SCTP also exists
** typiclaly established in CBC -> RNC direction 
* key procedures
** Write-Replace Procedure
** Kill Procedure
** Load Status Query Procedure
** Reset Procedure


== Functionality in the HNBGW

* hNodeBs include the RNC functionality, but they don't connect directly to CBC
* HNBGW handle the IuBC connection to the CBC
* relay / multiplex IuBC between hNodeBs and CBC


== Cell Broadcast in LTE

* Generic Cell Broadcast was removed; only Emergency Warnings in 4G
[graphviz]
----
digraph G {
  BTS0 [label="eNodeB"];
  BTS1 [label="eNodeB"];
  BTS10 [label="eNodeB"];
  BTS11 [label="eNodeB"];
  BSC [label="MME"];
  BSC1 [label="MME"];

  User -> CBC [label="proprietaty"];
  CBC -> BSC [label="SBc-AP"];
  CBC -> BSC1 [label="SBc-AP"];
  BSC -> BTS0 [label="S1-AP"];
  BSC -> BTS1 [label="S1-AP"];
  BSC1 -> BTS10 [label="S1-AP"];
  BSC1 -> BTS11 [label="S1-AP"];
  BTS0 -> UE [label="FIXME"];
}
----

== Cell Broadcast in LTE

[mscgen]
----
include::smscb-4g.msc[]
----

== Functionality in the eNodeB

* handling of S1-AP "Write-Replace Warning" procedure
* scheduling of SMSCB
* transmission of SMSCB in SIB

== Functionality in the MME

* pretty much analogous to that of BSC/RNC
* less work to do, as all scheduling is done inside eNodeB
* basically purely a distribution/routing function

== Functionality in the CBC

* identical functionality like for 2G/3G
* additional protocol required: SBc-AP

== SBc-AP Protocol (3GPP TS 29.168)

* spoken on SBc interface between CBC and MME
* ASN.1 specified
* operated over SCTP port 29168
* key procedures
** Write-Replace Warning Procedure
** Stop Warning Procedure
** Error Indication Procedure

== Wireshark support for Cell Broadcast

* `gsm_cbs` dissector for TS 04.12 format of SMSCB messages
* SABP dissector in mainline for more than a decade
* SBc-AP dissector present in mainline since 2011
* CBSP dissector missing
** written by Harald Welte in 2018, but untested and not yet mainline
** see `laforge/cbsp` branch of `git://git.osmocom.org/wireshark.git`

== Further Reading

* https://osmocom.org/projects/cellular-infrastructure/wiki/Cell_Broadcast[Cell Broadcast in Osmocom.org wiki]

* https://www.etsi.org/deliver/etsi_ts/123000_123099/123041/15.02.00_60/ts_123041v150200p.pdf[3GPP TS 23.041 GSM: Technical realization of Cell Broadcast Service (CBS)]
* https://www.etsi.org/deliver/etsi_ts/148000_148099/148049/15.00.00_60/ts_148049v150000p.pdf[3GPP TS 48.049 GSM: Baste Station Controller - Cell Broadcast Centre (BSC-CBC) interface specification; Cell Broadcast Service Protocol]
* http://www.etsi.org/deliver/etsi_ts/122200_122299/122268/14.00.00_60/ts_122268v140000p.pdf[3GPP TS 22.268 PWS: Public Warning System (PWS) requirements]
* https://www.etsi.org/deliver/etsi_ts/144000_144099/144012/15.00.00_60/ts_144012v150000p.pdf[3GPP TS 44.012 GSM: Short Message Service Cell Broadcast (SMSCB) support on the mobile radio interface]
* https://www.one2many.eu/assets/files/19_displaying-cb-messages.pdf[Whitepaper on Displaying Cell Broadcast]


== EOF

End of File