LTE CMAS

This tutorial shows how to test LTE CMAS on Amari Callbox with a commercial phone. CMAS stands for Commercial Mobile Alert System. It is a type of PWS (Public Warning System). Basic RAN Process of LTE CMAS is as follows :

• Transmit SIB12 with CMAS Message
• Transmit Paging to inform UE to decode the CMAS message

In real deployment, this process is controlled by CMAS server in core network side.  It is the CMAS server and Core Network which are triggering the whole CMAS process and RAN to transmit the message.

NOTE :  In 2G/3G, there was similar feature like PWS. It is called CBS (Cell Broadcasting System). The logic on core network side logic in CBS would be similar to PWS in LTE, but RAN side implementation of CBS is different from PWS in LTE. In LTE, we don't use any specifically dedicated channel for this and just use one of the existing channel (BCCH - PDSCH) whereas we use specially dedicated channel (CTCH - FACH-SCCPCH) for CBS.

NOTE :  Amarisoft does not support any of 2G/3G (i.e, GSM,CDMA,WCDMA,HSPA) and 2G/3G related function.

Table of Contents

• LTE CMAS
• Introduction
• Summary of the Tutorial
• Test Setup
• Key Configuration Parameters
• Configuration
• Perform the test
• Log Analysis
• RRC / NAS Signaling
• SIB 12
• Paging

Introduction

The Commercial Mobile Alert System (CMAS) is a critical component of modern Public Warning Systems (PWS), enabling authorities to disseminate urgent alerts such as severe weather warnings, AMBER alerts, or national emergencies to mobile users over wireless networks. In LTE (Long-Term Evolution) networks, CMAS leverages the radio access network (RAN) to deliver these broadcast messages efficiently and reliably. The primary mechanism involves transmitting System Information Block Type 12 (SIB12) containing the CMAS message, followed by a paging procedure to notify User Equipment (UE), such as commercial smartphones, to decode and display the alert. In a real-world deployment, the orchestration of these procedures is managed by the CMAS server within the core network, which triggers the RAN to execute the broadcast. Unlike legacy 2G/3G technologies that relied on the Cell Broadcasting System (CBS) and dedicated channels (e.g., CTCH over FACH-SCCPCH), LTE implements PWS using existing broadcast channels, specifically the Broadcast Control Channel (BCCH) mapped to the Physical Downlink Shared Channel (PDSCH), optimizing both efficiency and spectrum usage. The Amari Callbox, an advanced LTE network emulator, enables controlled, repeatable testing of CMAS functionality with commercial handsets, providing valuable insights into end-to-end system behavior and compliance. Notably, Amarisoft's solution focuses exclusively on LTE and does not support legacy 2G/3G technologies, making it ideal for modern wireless alerting system validation. Mastery of LTE CMAS testing with the Amari Callbox is essential for network engineers, test designers, and service providers aiming to ensure robust public warning capabilities in next-generation mobile networks.

• Context and Background
  • CMAS (Commercial Mobile Alert System) is a standardized framework for distributing governmental and emergency alerts over commercial cellular networks.
  • PWS (Public Warning System) in LTE is the evolution of legacy Cell Broadcasting System (CBS) from 2G/3G networks, utilizing more efficient and flexible broadcast mechanisms.
  • LTE RAN Process for CMAS involves SIB12 transmission and paging, coordinated by the core network's CMAS server.
  • Amari Callbox simulates a complete LTE network environment, allowing comprehensive testing with real devices.
• Relevance and Importance
  •   Ensures compliance with regulatory requirements for public safety communications.
  •   Validates end-to-end alerting workflows, helping operators and vendors guarantee reliable message delivery.
  •   Demonstrates differences and improvements over legacy CBS in LTE networks.
  •   Provides a controlled environment to troubleshoot and optimize CMAS-related functionalities.
• Tutorial Outcomes
  •   Understand the architecture and signaling flow of LTE CMAS.
  •   Learn to configure and use Amari Callbox for CMAS message broadcasting.
  •   Gain hands-on experience testing and verifying CMAS delivery on commercial phones.
  •   Identify and interpret related LTE messages such as SIB12 and Paging.
  •   Recognize the roles of RAN and core network components in public warning scenarios.
• Prerequisites
  •   Basic understanding of LTE network architecture, including RAN and core network elements.
  •   Familiarity with radio interface signaling, especially SIBs and Paging procedures.
  •   Experience with test tools or network emulators such as Amari Callbox is helpful but not mandatory.
  •   General knowledge of public warning and emergency alert systems is beneficial.

Summary of the Tutorial

This tutorial details the step-by-step procedures for conducting a CMAS (Commercial Mobile Alert System) test over LTE, including system setup, configuration, test execution, and log analysis. The summary below encapsulates the main test procedures and methodologies as presented in the tutorial.

• Test Setup:
  • Use the SIM card provided with the system. For any configuration changes, refer to the Configuration Guide.
• Key Configuration Parameters:
  • The CMAS configuration is managed via the pws_msgs parameter in the configuration files. Essential sub-parameters include:
    • local_identifier
    • message_identifier
    • serial_number
    • data_coding_scheme
    • repetition_period
    • warning_type
    • warning_message
    • warning_message_hex
    • send_warning_indication
    • warning_area_list
• Configuration Steps:
  • Use enb.default.cfg as the LTE eNB configuration without modification; no specific eNB configuration is needed for CMAS.
  • Copy and modify mme-ims.cfg to create mme-ims-cmas.cfg, adding the pws_msgs section to define CMAS details.
• Test Execution Procedure:
  • Start LTE service and ensure basic cell configuration (any LTE cell is acceptable).
  • Power on the UE and allow it to attach to the LTE cell.
  • Verify that the UE is attached to the MME.
  • Send the CMAS message using the pws_write command. The command parameter (e.g., '2') must match the local_identifier in the pws_msgs configuration.
  • Observe on the UE:
    • Reception of the CMAS text message
    • Activation of the alarm sound (both are required for a successful test)
  • To stop the CMAS message, use the corresponding pws_write command, again with the appropriate local_identifier.
• Log Analysis Procedure:
  • Capture logs with BCCH and RRC enabled to monitor SIB and Paging messages related to CMAS broadcast.
  • Set the log viewing layer for more effective analysis.
  • During CMAS message transmission (via pws_write), confirm the following sequence in logs:
    • Core Network transmits the CMAS message.
    • eNB sends Paging message with cmas-indication.
    • CMAS message content is broadcast over SIB12, containing the parameters from pws_msgs.
  • For test modifications, adjust the pws_msgs configuration to alter SIB12 contents as needed.

This process ensures that the LTE system is correctly configured to broadcast CMAS messages and that UEs can properly receive and alert on those messages, with complete verification via log analysis and signaling inspection.

Test Setup

Test setup for this tutorial is as shown below.  

• SIM Card used in this tutorial is the one delivered with the system as it is.
• If you want to change the configuration, The tutorial Configuration Guide would help

Key Configuration Parameters

Followings are important configuration parameters for this tutorial. You may click on the items for the descriptions from Amarisoft documents.

• pws_msgs : In this link, you would get the descriptions for all the items listed below. In the document, there are much more parameters (optional parameters) than the list below
• local_identifier
• message_identifier
• serial_number
• data_coding_scheme
• repetition_period
• warning_type
• warning_message
• warning_message_hex
• send_warning_indication
• warning_area_list

Configuration

I used the enb.default.cfg (LTE default configuration) as it is without changing any contents in it. Basically you can use any kind of enb configuration. eNB does not require any specific configuration for CMAS.

I also used mme-ims-cmas.cfg which was copied and modified from mme-ims.cfg.

In mme-ims-cmas.cfg I have added the following configuration. pws_msgs is the parameter where you can configure the details of CMAS.

Perform the test

Start LTE service and check basic cell configuration. Any cell configuration is OK as long as it is LTE cell.

Power on UE and let UE attach to the cell

Confirm that UE is attached to mme.

Send CMAS using pws_write command as shown below. (NOTE : The number '2' corresponds to the configuration parameter local_identifier of pws_msgs:[ ] in mme.cfg)

Check if you get CMAS message as shown below. You should hear alarm sound from the UE as well. Both text message and Alarm sound is requirement for the test.

You can stop cmas message using the following command. (NOTE : The number '2' corresponds to the configuration parameter local_identifier of pws_msgs:[ ] in mme.cfg)

Log Analysis

Sample Log

Since CMAS message is broadcast by SIB message, the first step for CMAS log analysis is to capture the log with BCCH and RRC enabled as shown below.

Set the layer as shown below for the convinience of the log analysis.

When you send the CMAS message message with pws_write command, Core Network send CMAS message as shown below.|

When Core Network send CMAS, eNB send Paging with cmas-indication

CMAS message is broadcast via sib12. This message is carrying all the contents configured by pws_msgs parameter in the configuration file. If you want to modify any part of sib12 for testing purpose, you should change the configuration of pws_msgs parameter in the configuration file.

RRC / NAS Signaling

SIB 12

: This is the SIB 12 message sent by eNB  to configure CMAS. (NOTE : You would see some IEs that has a specific assigned vale here, but consider it as just an example value. Those values should vary depending on test requirement)

{

  message c1: systemInformation: {

    criticalExtensions systemInformation-r8: {

      sib-TypeAndInfo {

        sib12-v920: {

          messageIdentifier-r9 '1112'H,

          serialNumber-r9 '3001'H,

          warningMessageSegmentType-r9 notLastSegment,

          warningMessageSegmentNumber-r9 0,

          warningMessageSegment-r9 '0174747A0E4ACF4161D0B0199C82E8E5391DD42ECFE7E1731900000000000000'H,

          dataCodingScheme-r9 '0F'H

        }

      }

Paging

: This is the Paging message sent by eNB  to Notify that CMAS is transmitted. (NOTE : You would see some IEs that has a specific assigned vale here, but consider it as just an example value. Those values should vary depending on test requirement)

 

{

  message c1: paging: {

    nonCriticalExtension {

      nonCriticalExtension {

        cmas-Indication-r9 true

      }

    }

  }

}