Skip to main content
3GPP RAN and Core Platforms

Implementation Detail

See also: Developer Exchange.

In short
  • Platform description: 5G-MAG maintains forks of Open5GS, the srsRAN Project and srsRAN_4G, each with a variant for MBS, so that the other reference tools have a network to run against. This part is not yet audited.
  • 5G Core service consumers: reusable libraries to invoke service operations on 5GC network functions. The BSF, PCF and MB-SMF libraries and the NRF discovery they use are audited on the main branch of rt-5gc-service-consumers. The PCF library covers the core of policy authorization only, with no optional feature negotiated.

Platform description (not yet audited)​

Not yet audited. The description in this part is taken from the project's repositories and published 5G-MAG material; only the service consumer libraries further down have been audited.

What this project implements​

This project provides the 5G network infrastructure that other 5G-MAG reference tools run against. 5G-MAG maintains forks of established open-source Radio Access Network (RAN) and Core software, adds the components needed for its media and broadcast work, and documents how to stand up a working network in a lab or testbed.

In 5G terminology the RAN can be split into a Central Unit (CU) and a Distributed Unit (DU); the network core is the 5G Core (5GC); and Software Defined Radio (SDR) hardware is used to transmit and receive the radio signal. The forks below add support for the different delivery technologies 5G-MAG works on.

A note on the delivery technologies referenced here:

  • MBS (Multicast-Broadcast Services), is the 3GPP feature for delivering the same content to many devices over the 5G Core and NR radio.
  • 5G Broadcast (LTE-based) delivers free-to-air TV and radio over LTE/eMBMS radio, without a 5G core or return channel. It reuses Further evolved Multimedia Broadcast Multicast Service (FeMBMS).

These are distinct technologies; the forks below follow this split.

Upstream software we build on​

Some Reference Tools Projects make use of software developed by other Open-Source Software initiatives.

In particular:

  • srsRAN Project, in its two variants:

    • srsran/srsRAN_Project: Open source O-RAN 5G CU/DU solution from Software Radio Systems (SRS), used primarily as the NG-RAN to build Reference Tools demonstrators and PoCs and as the basis for the development of NG-RAN related components for MBS
    • srsran/srsRAN_4G: Open source SDR 4G software suite from Software Radio Systems (SRS), used primarily as the basis for the LTE-based 5G Broadcast components, emergency alerts over 5G Broadcast and the development of UE functionalities for MBS

  • Open5GS Project, used primarily as the 5GC to build Reference Tools demonstrators and PoCs and as the basis for the development of 5GC related components for MBS

What this project provides​

This project does not deliver media itself; it provides a working radio access network and core so that MBS and 5G Broadcast components have something to attach to in a lab or testbed. The pieces map to 5G terminology as follows:

  • NG-RAN (gNB), split into CU and DU: built from rt-srsRAN_Project, 5G-MAG's fork of the srsRAN Project (an O-RAN-native 5G CU/DU with a full L1/L2/L3 implementation from Software Radio Systems). This is the NR side used for MBS demonstrators and for developing NG-RAN components for MBS.
  • 5G Core (5GC): built from 5G-MAG's fork of Open5GS. The multicast and broadcast core functions are described in the 5G Multicast and Broadcast Services project.
  • LTE-based radio and UE, for 5G Broadcast: built from srsRAN_4G (the SDR 4G suite from SRS). This is the basis for the LTE-based 5G Terrestrial Broadcast transmitter and for developing UE-side functionality.
  • SDR hardware: Software Defined Radio front-ends transmit and receive the radio signal that the software above generates and processes.

The two delivery technologies, and why the forks split​

The project maintains forks of Open5GS, the srsRAN Project and srsRAN_4G, each with a variant for MBS. The forks are organised around two distinct delivery technologies.

  • MBS: 5G NR radio and the 5G Core with multicast and broadcast functions, for delivering the same content to many devices. The RAN software basis is rt-srsRAN_Project (NR CU/DU).
  • 5G Broadcast (LTE-based): LTE/eMBMS radio (reusing FeMBMS), with no core and no return channel, for free-to-air TV and radio, receive-only. The RAN software basis is srsRAN_4G (eNodeB with MBMS).

Further evolved Multimedia Broadcast Multicast Service (FeMBMS) is the LTE broadcast feature reused by 5G Broadcast. Published 5G-MAG material notes that the LTE-based 5G Broadcast transmitter builds on the MBMS implementation in the srsRAN_4G eNodeB, extended towards the 3GPP LTE-based 5G Terrestrial Broadcast feature set (for example channel estimation and reference signals for the 1.25 kHz subcarrier spacing introduced in Release 14, TR 36.976 V19.0.0 clause 4.3). The dedicated 5G Broadcast transmitter and modem live in separate repositories (for example rt-mbms-tx and rt-mbms-modem), which depend on this project for the underlying radio software.

How this relates to the media reference tools​

The MBS and 5G Broadcast media stacks depend on a working network to run against. This project supplies that network so the media components do not each have to stand up a RAN and core. Because the RAN and core are forks of upstream open-source projects (srsRAN, Open5GS), 5G-MAG tracks the upstream projects and maintains the additions needed for its broadcast and multicast work.

Getting started​

  1. Decide which technology you are building for: MBS (5G NR plus 5GC) or LTE-based 5G Broadcast. This determines which fork you need.
  2. For MBS, build the NG-RAN from 5G-MAG/rt-srsRAN_Project and the core from 5G-MAG/open5gs, using the MBS variant of each fork.
  3. For 5G Broadcast, use the LTE-based transmitter path built on 5G-MAG/srsRAN_4G; see the dedicated transmitter and modem repositories.
  4. Follow the Tutorials for the network and SDR setup guides, including SDR front-end configuration.

5G Core Service Consumers​

The platforms also include a collection of reusable service consumer libraries for the 5G Core. The next sections describe them.

What the service consumers implement​

The 5G Core (5GC) presents several Network Functions, each of which has its own set of service interfaces. This project hosts a collection of reusable service consumer libraries designed to talk to some of these functions. A "service consumer library" is a small library that implements the client (consumer) side of a 5G Core service API, so an application can call that function without re-implementing the protocol.

Key terms
  • PDU Session: the Packet Data Unit session that carries a device's IP traffic across the 5G network.
  • QoS: Quality of Service, the network treatment (bandwidth, latency, priority) applied to that traffic.
  • NRF: Network Repository Function, used to discover other network functions.
  • PCF: Policy Control Function, which applies QoS and charging policy.
  • BSF: Binding Support Function, which maps a PDU Session to the PCF serving it.
  • MB-SMF: Multicast/Broadcast Session Management Function, which manages MBS sessions.
  • TMGI: Temporary Mobile Group Identity, the identifier for an MBS session.

This page is split into two domains, separated by a horizontal rule: first the Media Streaming QoS libraries (BSF and PCF), then the Multicast/Broadcast Services (MBS) library (MB-SMF).

Technology pages that give context to this project are linked below.

Technology: Media Streaming and Advanced Media Delivery

Technology: Media delivery over 5G Multicast Broadcast Services

Deployment Configurations​

How the service-consumer libraries sit between a media Application Function and the 5G Core in each deployment.

5G Multicast Broadcast Services (MBS) with 5GC Service Consumers​

The diagram below shows how the MBS reference tools use the MB-SMF service consumer library to reach the 5G Core.

Architecture of the 5G MBS reference tools using the MB-SMF service consumer library to reach the 5G Core

Media Streaming QoS (BSF and PCF)​

Within the context of 5G Media Streaming (5GMS), the 5GMS Application Function (AF) needs to communicate with the 5G Core in order to manipulate network Quality of Service (QoS) for ongoing media streaming sessions.

Architecture showing the libscbsf and libscpcf service consumer libraries connecting a media Application Function to the BSF and PCF in the 5G Core

The diagram below shows how the 5GMSd reference tools use the 5GC Service Consumer libraries (BSF and PCF) to request network QoS from the 5G Core.

Architecture of the 5G Downlink Media Streaming reference tools using the 5GC Service Consumer libraries to reach the BSF and PCF

The following libraries are available:

  • libscbsf - Binding Support Function (BSF) service consumer library
  • libscpcf - Policy Control Function (PCF) service consumer library

libscbsf - Binding Support Function (BSF) service consumer library​

  • Responsible for maintaining a mapping between UE PDU Session and the PCF which is managing that PDU Session.
  • The libscbsf library aids in discovery of the BSF in the 5G Core (by interrogating the NRF) and subsequently looking up which PCF is managing the PDU Session for a UE, identified by its IP address.
  • This library implements the service consumer end of the following service-based APIs:
    • Nbsf_Management

libscpcf - Policy Control Function (PCF) service consumer library​

  • Responsible for applying charging and network policy to the PDU sessions of UEs. The Npcf_PolicyAuthorization service API is used at reference point N5 by an Application Function (AF) to request policy changes to the PDU session on behalf of the UE, manipulating particular network QoS parameters for selected IP traffic flows within it.
  • The libscpcf library allows an application to connect to a PCF and request an AppSessionContext which it can then use to manipulate the network routing policies for traffic passing across specific application flows within a UE's PDU Session.
  • This library implements the service consumer end of the following service-based APIs:
    • Npcf_PolicyAuthorization
Command line tool: pcf-policyauthorization​

The pcf-policyauthorization tool manipulates the network Quality of Service parameters of Application Session Contexts in the PCF by using the PCF service consumer library to invoke operations on the Npcf_PolicyAuthorization service API.

The PCF address can be explicitly specified at the command line if this is already known. Alternatively, the tool can also use the BSF service consumer library to look up which PCF instance is managing the PDU Session of interest ( based on the IP address of a UE registered with the AMF).

Tutorial: Test libscpcf

Multicast/Broadcast Services (MB-SMF)​

Within the context of 5G Multicast/Broadcast Services (MBS), the Multicast/Broadcast Session Management Function (MB-SMF) is responsible for allocating and deallocating Temporary Mobile Group Identities (TMGIs) and for the management of Multicast/Broadcast Services on the Multicast/Broadcast User Plane Function (MB-UPF).

Architecture showing the libscmbsmf service consumer library connecting an application to the MB-SMF in the 5G Core

The following libraries are available:

  • libscmbsmf - Multicast/Broadcast Session Management Function (MB-SMF) service consumer library

libscmbsmf - Multicast/Broadcast Session Management Function (MB-SMF) service consumer library​

  • Responsible for allocating and deallocating Temporary Mobile Group Identities (TMGIs) and for the management of Multicast/Broadcast Services (MBS) on the Multicast/Broadcast User Plane Function (MB-UPF).
  • The Nmbsmf_TMGI service API is used at reference point Nmb1 for the allocation and deallocation of TMGIs, and the Nmbsmf_MBSSession service API is used at reference point Nmb1 for the creation, modification and destruction of MBS Sessions and for the management of notification subscriptions to events arising on those MBS Sessions.
  • The libscmbsmf library provides a simple create/destroy interface for TMGI management and an MBS Session and notifications subscriptions model for management of MBS Sessions.
  • This library implements the service consumer end of the following service-based APIs:
    • Nmbsmf_TMGI
    • Nmbsmf_MBSSession
Command line tool: tmgi-tool​

The tmgi-tool provides a simple command line interface to either request the creation or destruction of a TMGI using the interfaces provided by the MB-SMF service consumer library to invoke operations on the Nmbsmf_TMGI service API.

Command line tool: mbs-service-tool​

The mbs-service-tool can register an MBS Session and will then wait for notifications for that MBS Session. It does this by using the interfaces provided by the MB-SMF service consumer library to invoke operations on the Nmbsmf_MBSSession service API.

Tutorial: Test libscmbsmf

How to choose a library​

The three libraries split by what you are trying to do:

  • If you need to request network QoS for a unicast media session (the 5G Media Streaming case), use libscpcf to talk to the PCF via Npcf_PolicyAuthorization. If you do not already know which PCF serves the UE, use libscbsf first to look it up from the UE's IP address; the pcf-policyauthorization tool can do both in one step.
  • If you need to create and manage multicast/broadcast sessions (the MBS case), use libscmbsmf to talk to the MB-SMF via Nmbsmf_TMGI (allocate/deallocate a TMGI) and Nmbsmf_MBSSession (create, modify, release a session and subscribe to its events).

Each library implements only the consumer (client) side of its APIs, so it assumes a running 5G Core that produces those services. The libraries handle NRF-based discovery where relevant (for example, libscbsf discovers the BSF), which means an application usually only needs an entry point address and the session or UE identity, not the full topology of the core.

Implementation status of the service consumer libraries​

This status comes from an audit of the main branch of rt-5gc-service-consumers on 2026-10-22. Each requirement of the 5G Core service specifications is split into the cases its clause defines, and each case was read against the code by one reader and then independently by a second, with a third reading where they disagreed. It covers libscbsf (BSF), libscpcf (PCF, Npcf_PolicyAuthorization), libscmbsmf (MB-SMF) and the NRF discovery they use. Cases that depend on Open5GS, which is not part of this repository, are not shown; some shown cases could be read only up to that boundary.

  • libscbsf: looks up the PCF binding of a UE with a GET on pcfBindings by IPv4 address or IPv6 prefix. It has no query by SUPI, GPSI, DNN or S-NSSAI, and no register, update, deregister or subscribe operation. Any reply other than 200 is reported to the application as "no binding".
  • libscpcf, application sessions: creates (POST), updates (PATCH) and deletes (POST to delete) an application session, and serves the event notification callback. A session is created with the notification URI, the IPv4 address of the UE, the supported-features value 0, an event subscription list, sponsored connectivity set to disabled, a fixed resource priority and the media components the application builds. The session is removed locally after any answer to a delete.
  • libscpcf, event subscriptions: subscribes with a PUT and unsubscribes with a DELETE on the events subscription. A change to the subscription goes through the same PUT, which merges the events list only; the event subscription is never changed by a PATCH. Unsubscribing removes the whole subscription.
  • libscpcf, not implemented: the library never negotiates an optional feature, so every procedure and attribute that exists only under an optional feature is not implemented. It does not send the SUPI, GPSI, DNN, slice information or an IPv6 address. The notification server accepts only the notify operation and rejects the terminate operation, so a termination request from the PCF is not served. Redirects are not followed, Retry-After is not read, and the error body of the PCF is not interpreted.
  • libscmbsmf, sessions: create, update and delete an MBS session; create, update and delete a status subscription; receive the StatusNotify notification. ContextUpdate and the context status operations, and multipart content, are not implemented.
  • libscmbsmf, TMGIs: allocate and deallocate TMGIs. Refreshing a TMGI is in the code but no public call reaches it.
  • Needs fix:
    • Updating a status subscription sends the session's changes, not the subscription's.
    • A subscription created on its own, after the session, carries no notification URI.
    • The notification receiver answers 200 where TS 29.532 gives 204.
    • A failed update is reported to the application without the error details; a delete is treated as successful whatever the answer; a failed subscription creation and a failed allocation of a new TMGI are not reported.
  • NRF discovery: the MB-SMF library sets the service name and the Service-Map requester feature, and adds the target PLMN when a session is created with a TMGI. The BSF library sets no discovery options. Every other discovery parameter, stored search and SCP domain routing is not used.
  • 3GPP RAN and Core Platforms.
  • Service consumers (5G Core Service Consumers libraries): rt-5gc-service-consumers.
  • Source: code read against every statement of the specifications on the project page; statements a component cannot meet by construction marked absent by group, 2026-10-22.
  • Not shown: 69 further cases (a specification or code outside the audit that could not be read; the readers disagreed, so the case is not shown).
3GPP release
260 of 1727 implemented · 41 differ · 1426 absentcases, over 260 requirements

✓ Implemented≠ Differs from the specification– Absent? Specification inconsistent: its text and its OpenAPI or tables disagreei Noted: observed, not a verdict against a clause

Policy authorization (Npcf_PolicyAuthorization)154 of 1270 implemented · 23 differ · 1093 absent
Binding support (Nbsf_Management)12 of 43 implemented · 31 absent
MBS session management (Nmbsmf_MBSSession)57 of 168 implemented · 15 differ · 96 absent
TMGI management (Nmbsmf_TMGI)27 of 43 implemented · 2 differ · 14 absent
Network Function discovery (Nnrf_NFDiscovery)10 of 203 implemented · 1 differs · 192 absent

Getting started with the libraries​

See Tutorials to run the tools against a 5G Core, and Repositories for the source code and releases.

Used with other projects​

note

Refer to the rt-srsRAN_Project and open5gs repositories to contribute to this project. See How to Contribute for the process.