I see several requests here asking "what is the format of PDU" for SMS.
I had some notes from my source code which might help others figure out
how PDUs are encoded and decoded. It is for the simplest 7-bit SMS on
Nokia that is available.
Definitely anyone wanting to understand PDU format needs to download
from etsi.org:
GSM 04.11 (v5.1.0 or later)
(for the format of SC, orig, & dest addresses),
GSM 07.05 (v5.3.0 or later)
(for the format of the AT Commands)
and GSM 03.40 (v5.3.0 or later)
(for the format of the PDUs,
SMS-DELIVER is outgoing and
SMS-SUBMIT is incoming.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
This is my guess as to how the PDU format for SMS-SUBMIT on 6190 looks:
(i.e., SMS-SUBMIT means "Outgoing" SMS)
For Nokia 6190 (perhaps all 61xx) the PDU is prefixed
with octets for the SC number.
Nokia handsets require the SC Address to precede
the PDU. This is different than SM-RL specs in
GSM 04.11 PDU, and is not really documented very
well in GSM 03.41. Here, the standard address
consists of:
Octet 1: [Length] Service Center (SC) Addr Length.
(appears to be the number of complete octets
which follow this octet. This differs
from GSM 04.11 specs which say Address
Length is the number of semi-octets
where one semi-octet represents one
decimal digit).
This difference is goofy ..., but they do it
the same way for the SUBMIT (Send Msg) PDU as
they do for the DELIVER (Rcv. Msg) PDU.
Octet 2: [unused, set HIGH (bit 7)]
[TYPE of Number (3 bits, 6,5,4)]
[Numbering Plan ID (4 bits, 3, 2, 1, 0)]
Type of number: 001 = International Type.
(Even though within US, always use 001).
Numbering Plan ID: 0001 ISDN/Telephone
(Per E.163/E.164 from GSM 04.11 specs.)
Binary [1][001][0001] -> [1001][0001] -> 0x91h.
Octet 3: [Number Digit 2][Number Digit 1]
Octet 4: [Number Digit 4][Number Digit 3]
etc., until complete.
[Here the octet count starts over at 1, to match
the PDU specs.]
Ok, now start the normal PDU for SMS-SUBMIT per
GSM 03.41 specs.
Octet 1: [RP][UDHI][SRR][VPF(2)][RD][MTI(2)]
[TP-MTI] Message Type
(01 - Submit (Send) Mobile -> SC).
[TP-RD] Reject Duplicates?
(0 - SC should accept, even if duplicate.)
[TP-VPF] Validity Period Format.
(00 - Don't want optional TP-VP field.)
[TP-SRR] Status Report Request?
(0 = No Status Requested.)
[TP-UDHI] UD contains Header?
(0 = No Header in UD, just the Msg text.)
[TP-RP] Request Reply Path?
(0 = Not Requesting A Reply Path)
i.e., 0000 0001 = 0x01h.
Next Octet: [TP-MR]. (Message Reference).
(The message reference is #0 through 255,
but how you know this BEFORE the message
is sent is a mystery to me (unless sending
it after saving it to SIM memory.). Doesn't
seem to matter what you put in here.
Next set of Octets: [TP-DA] (Destination Address.)
Same format as SC Address from above, except that
length here represents number of digits (one
per semi-octet).
Octet 1: [Length].
Octet 2: [unused, set HIGH (bit 7)]
[TYPE of Number (3 bits, 6,5,4)]
[Numbering Plan ID (4 bits, 3, 2, 1, 0)]
Same as above. [1][001][0001] -> 0x91h.
Octets 3 ... (nCount - 1): TP-DA Digits.
(an odd number of digits will use an entire octet
and the leftover digit written as "F" (all high).)
Next Octet: [TP-PID] (Protocol Layer Identifier).
Nothing selected: 00000000 (No special handling.)
Next Octet: [TP-DCS] (Data Coding Scheme)
[00][Compress?][[Reserved][Alphbt(2)][Reserved(2)]
All set to 0. [00000000].
(**** Next Octet: [TP-VPF] The specs show this as
the next octet, but if specified in Octet 1
to NOT use TP-VPF, then don't even write this
to the PDU. ***)
Next Octet: [TP-UDL] (Length of text.)
Next Octets: [TP-UD} (Message text).
This is encoded as it is 7 bit ascii. This way
there are eight characters that fit in 7 octets.
Octet 001H 001L 002H 002L 003H 003L 004H 004L
------ ---- ---- ---- ---- ---- ---- ---- ----
Char 2111 1111 3322 2222 4443 3333 5555 4444
Bit 7123 4567 6712 3456 5671 2345 4567 1234
Octet 005H 005L 006H 006L 007H 007L
------ ---- ---- ---- ---- ---- ----
Char 6666 6555 7777 7766 8888 8887
Bit 3456 7123 2345 6712 1234 5671
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
This is my guess as to how the PDU format for SMS-DELIVER on 6190 looks.
(i.e., SMS-DELIVER means "Incoming" SMS)
Octet 1: SC Length
(# of octets to follow that are part of the
SC Address.)
SC Address format.
Octet 2: [1][Typ][Plan] e.g., [10010001]
Type: Bits 6-4, 001= International.
Plan: Bits 3-0, 0001= ISDN/Numbering.
Octets 3 - n:
Semi-octets representing SC digit. Each
semi-octet represents one Decimal [0]-[9].
If odd number of SC digits, then all bits
set high [F] for that semi-octet.
E.g., if Length was 7, then would have six
SC Address Octets, meaning twelve digits
possible. They are in reverse order.
So if SC number is the eleven digit number
18132630025 (Aerial's SC #, BTW), then this
would be represented as:
Octet 3: [8][1] [decimal 8][decimal 1]
Octet 4: [3][1] [decimal 3][decimal 1]
Octet 5: [6][2] [decimal 6][decimal 2]
Octet 6: [0][3] [decimal 0][decimal 3]
Octet 7: [2][0] [decimal 2][decimal 0]
Octet 8: [F][5] [All Bits Set Hi][5].
[Here the octet count starts over at 1, to match
the PDU specs.]
Now we have the raw PDU for SMS-DELIVER.
The spec for this is from GSM 03.41.
Octet 1: [RP][UDHI][SRI][00][MMS][MTI(2)]
[TP-MTI] Message Type
Only process when 00 types.
(00 - Deliver (Receive) SC -> Mobile ).
[TP-MMS] More Messages To Send (From SC)?
Expect either but can ignore.
(1 - SC has no more to send.
0 - SC has more to send.)
[TP-SRI] Status Report Indicator
Expect either but can ignore as that is
handled by the mobile handset.
(0 = No Status requested.)
(1 - Status is requested.)
[TP-UDHI] UD contains Header?
Assuming will only get 0. Only process 0.
(0 = No Header in UD, just the Msg text.)
[TP-RP] Reply Path exists?
Expect either but can ignore.
(0 = Not Requesting A Reply Path)
Bit representation in octet:
e.g., if Bits 0 and 6 set -- 0100 0001 = 0x41h.
Next set of Octets: [TP-DA] (Destination Address.)
Same format as SC Address from above, except that
length here represents number of digits (one
per semi-octet).
Also, for notation, am calling next octet Octet 1,
even though, obviously we are already into the PDU.
Octet 1: [Length].
Octet 2: [unused, set HIGH (bit 7)]
[TYPE of Number (3 bits, 6,5,4)]
[Numbering Plan ID (4 bits, 3, 2, 1, 0)]
Next Octet: [TP-PID] (Protocol Layer Identifier).
Again -- we don't need so just drop these two
chars from the buffer.
Next Octet: [TP-DCS] (Data Coding Scheme)
Next 7 Octets: [TP-SCTS] (Service Center Time Stamp).
Next Octet: [TP-UDL] (Length of text.)
Next Octets: [TP-UD} (Message text).
This is encoded as it is 7 bit ascii. This way
there are eight characters that fit in 7 octets.
Octet 001H 001L 002H 002L 003H 003L 004H 004L
------ ---- ---- ---- ---- ---- ---- ---- ----
Char 2111 1111 3322 2222 4443 3333 5555 4444
Bit 7123 4567 6712 3456 5671 2345 4567 1234
Octet 005H 005L 006H 006L 007H 007L
------ ---- ---- ---- ---- ---- ----
Char 6666 6555 7777 7766 8888 8887
Bit 3456 7123 2345 6712 1234 5671
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
So, to Send A PDU using AT commands
AT+CMGF=0[CR] (Takes out of text mode)
AT+CMGS=16[CR} (To send a PDU with 16 hex pairs.)
> 07918131620320F5013C0B912181990600F0000003F4391D[CTRL-Z]
And then that
PDU broken down as:
07 (Length of SC address)
91 (Number type, format)
8131620320F5 (Actual SC Address:
18132630025 (F means leftover spot))
01 (Message Type)
3C (Message Reference, which was
60 for this example.)
0B (Length of Dest Address)
91 (Number type, format)
2181990600F0 (Actual Dest Address
12189960000
(F means leftover))
00 (Protocol Layer ID)
00 (Data Coding
Scheme)
03 (Length of
User Data)
F4391D (User Data:
"tst")
[CTRL-Z] to tell Nokia Datasuite that all done with the
PDU.