SasGwy OneCAS 18.21 - Pub-1

Nagravision SMS Gateway
Interface Definition: OneCAS (EIS 2.7)

Version 18.21
Status: Approved
Filename SasGwy OneCAS 18.21.docx

Date July 14, 2020
Author(s) Fabien Mathieu;Cédric Farine
Information Domain
Client/Project OneCAS
Owner Fabien Mathieu
CONFIDENTIAL
Nagravision is a member of the Kudelski Group of Companies.
This document is the intellectual property of Nagravision and contains confidential and privileged information.
The reproduction, modification, or communication to third parties (or to other than the addressee) of any part of this
document is strictly prohibited without the prior written consent from Nagravision.
You are not allowed to disclose this document outside NagraVision.

This document can only be distributed through Records (records@nagra.com)
CONFIDENTIAL

Version 18.21 Approved
Copyright © 2018 Nagravision. All rights reserved.

CH-1033 Cheseaux, Switzerland.
Tel: +41 21 7320311 Fax: +41 21 7320100
www.nagra.com
All trademarks and registered trademarks are the property of their respective owners.
This document is supplied with an understanding that the notice(s) herein or any other contractual
agreement(s) made that instigated the delivery of a hard copy, electronic copy, facsimile or file transfer
of this document are strictly observed and maintained.
The information contained in this document is subject to change without notice.
Security Policy of Nagravision Kudelski Group
Any recipient of this document, without exception, is subject to a Non-Disclosure Agreement (NDA) and
access authorization.
Copyright © 2017 Nagravision. All rights reserved. Confidential and privileged information. 2
CONFIDENTIAL
Owner: Fabien Mathieu
CONFIDENTIAL

Contents
Contents ........................................................................................................ 3
List of tables .................................................................................................. 6
List of figures ................................................................................................. 7
Preface .......................................................................................................... 8
1. Introduction ......................................................................................... 10
2. System overview .................................................................................. 12

2.1 Purpose of the SMSgw ...................................................................................... 12
2.2 Communication protocols.................................................................................. 12
2.2.1 Layers ....................................................................................................... 12
2.2.2 TCP/IP protocol .......................................................................................... 12
2.2.3 Device_IO protocol ..................................................................................... 13
2.2.4 SMSgw protocol .......................................................................................... 13
2.3 Device_IO communication ................................................................................ 13
2.3.1 Overview ................................................................................................... 13
2.3.2 Establishing a connection with a Device_IO server .......................................... 14
2.3.3 Data exchange between client and server ...................................................... 15
2.3.4 Closing a connection with a Device_IO server ................................................. 15
2.3.5 Rules of use ............................................................................................... 15
2.3.6 Messages format ........................................................................................ 15
2.3.7 Message_1 (connect to the CAS) ................................................................... 15
2.3.8 Message_2 (answer 1 from the CAS) ............................................................. 15
2.3.9 Message_3 (answer from the CAS) ................................................................ 16
2.3.10 Message_5 (Cmd message from the SMS or the CAS) ...................................... 16
3. SMS-SMSgw connections ...................................................................... 17

3.1 Overview ........................................................................................................ 17
3.2 EMM/Control command flow .............................................................................. 18
3.3 Feedback command flow .................................................................................. 18
3.4 Feedback command routing .............................................................................. 18
3.5 Usage ............................................................................................................ 18
3.5.1 Source identifier ......................................................................................... 18
3.5.2 Transaction number .................................................................................... 18
3.5.3 Keeping the SMS connection alive ................................................................. 19
3.5.4 Establishing the SMS connection ................................................................... 19
4. SMS commands ..................................................................................... 20

4.1 Specification ................................................................................................... 20
4.1.1 Commands and responses ........................................................................... 20
4.1.2 Asynchronous by nature .............................................................................. 20
4.1.3 Feedback ................................................................................................... 20
4.2 Metrics ........................................................................................................... 20
CONFIDENTIAL
CONFIDENTIAL

4.3 Time and date ................................................................................................. 21

4.4 Currency ........................................................................................................ 21
4.5 Identifiers ....................................................................................................... 21
4.6 Special notes .................................................................................................. 22
4.6.1 event_name and product_name filler rule ....................................................... 22
4.6.2 event_name and product_name overwriting rule ............................................. 22
4.6.3 Price overwriting rule .................................................................................. 23
4.7 Command support ........................................................................................... 23
4.7.1 Commands per device and addressing modes ................................................. 23
4.8 Command handling .......................................................................................... 26
4.8.1 Products per device and SMS command ......................................................... 26
4.8.2 Credit and price .......................................................................................... 28
4.9 Headers.......................................................................................................... 29
4.9.1 Root header ............................................................................................... 30
4.9.2 Address header – EMM cmd ......................................................................... 31
4.9.3 Address header – Control cmd ...................................................................... 35
4.9.4 Address header – Feedback cmd ................................................................... 36
4.9.5 Address header – Operation cmd .................................................................. 36
4.9.6 Errors due to abnormal operational conditions ................................................ 36
4.10 EMM commands (0nn) ...................................................................................... 37
4.10.1 Command 2: Add Product ............................................................................ 37
4.10.2 Command 4: Product Suspension ................................................................. 39
4.10.3 Command 5: Product Reactivation ................................................................ 40
4.10.4 Command 6: Product Cancellation ................................................................ 41
4.10.5 Command 7: All Products Cancellation ........................................................... 42
4.10.6 Command 8: Credit management ................................................................. 43
4.10.7 Command 9: Update Credit Threshold ........................................................... 44
4.10.8 Command 10: Add Event Product ................................................................. 45
4.10.9 Command 13: Create Credit for Impulse Purchase .......................................... 47
4.10.10 Command 14: Suspend Impulse Purchase ..................................................... 48
4.10.11 Command 15: Reactivate Impulse Purchase ................................................... 49
4.10.12 Command 19: Patch Smart Card .................................................................. 50
4.10.13 Command 20: Suspend Subscriber ICC ......................................................... 51
4.10.14 Command 21: Reactivate Subscriber ICC ....................................................... 52
4.10.15 Command 23: Suspend All ICC Features ........................................................ 53
4.10.16 Command 24: Reactivate All ICC Features ..................................................... 54
4.10.17 Command 25: Suspend All ICC Features With Delay ........................................ 55
4.10.18 Command 35: Create Operator ..................................................................... 56
4.10.19 Command 36: Cancel Operator ..................................................................... 57
4.10.20 Command 37: Un-kill card ........................................................................... 58
4.10.21 Command 46: Set Segments ........................................................................ 59
4.10.22 Command 47: Set Alphanum Zip Code .......................................................... 60
4.10.23 Command 48: Set Zip Code ......................................................................... 61
4.10.24 Command 49: Set Callback Phone Number .................................................... 62
4.10.25 Command 50: Cancel ICC ............................................................................ 63
4.10.26 Command 51: Initialize Smart Card .............................................................. 64
4.10.27 Command 52: Pair the ICC With the STB ....................................................... 66
4.10.28 Command 53: Clear PIN Code ...................................................................... 67
4.10.29 Command 54: Set Callback IP Address .......................................................... 68
4.10.30 Command 55: Set Callback IPV6 address ....................................................... 68
4.10.31 Command 56: Set PIN Code ......................................................................... 70
CONFIDENTIAL
CONFIDENTIAL

4.10.32 Command 58: Pair the ICC with Multiple STB ................................................. 71
4.10.33 Command 60: Immediate Callback ............................................................... 76
4.10.34 Command 61: Enable Automatic Callback ...................................................... 77
4.10.35 Command 62: Disable Automatic Callback ..................................................... 78
4.10.36 Command 65: Force Smartcard Synchronization ............................................. 78
4.10.38 Command 69: Send Generic IRD Command ................................................... 80
4.10.39 Command 71: Get Products ......................................................................... 83
4.10.28 Command 77: Configure auto scanning ......................................................... 84
4.10.29 ommand 78: Refresh Smart Card ................................................................. 85
4.10.40 Command 79: Force Tune ............................................................................ 88
4.10.41 Command 84: Send PRM Credentials ............................................................. 90
4.10.42 Command 88: Send BAEKey At Activation ...................................................... 91
4.10.30 Command 91: Anti-splitter Configuration ....................................................... 92
4.10.43 Command 96: Purge PPV and IPPV Records ................................................... 93
4.10.44 Command 97: Set IPPV Records as Reported ................................................. 95
4.10.45 Command 99: Send Generic IRD Command II ................................................ 96
4.10.45.1 Example: an STB with a Nagravision CAK ................................................. 97
4.10.45.2 Example: an STB with a native MG CAK ................................................... 97
4.11 CONTROL commands (1nn) .............................................................................. 99
4.11.1 Command 100: Redefine Credit Limit ............................................................ 99
4.11.2 Command 101: Set Authorized Phone Number .............................................. 100
4.11.3 Command 104: Create ICC in Call Collector .................................................. 101
4.11.4 Command 105: Cancel ICC in Call Collector .................................................. 102
4.11.5 Command 106: Set Purchase Profile............................................................. 103
4.11.6 Command 107: Set Purchase Profile With Free Programming .......................... 104
4.11.7 Command 110: EMM Cleanup ...................................................................... 106
4.11.8 Command 111: Get History From CC ............................................................ 106
4.11.9 Command 120: Enable Callback Rules .......................................................... 107
4.11.10 Command 121: Disable Callback Rules ......................................................... 108
4.11.11 Command 122: Set Network ....................................................................... 109
4.11.12 Command 123: Trigger Broadcast of Conditional EMM .................................... 111
4.11.13 Command 124: Get Smart Card Synchronization Status ................................. 112
4.11.14 Command 125: Set Subscriber Private Data .................................................. 113
4.11.15 Command 126: Assign Virtual UA to NUID .................................................... 114
4.11.16 Command 127: Get all products .................................................................. 116
4.11.17 Command 150: SNP Override ...................................................................... 117
4.12 Feedback Commands (2nn) ............................................................................. 118
4.12.1 Command 200: Low-Credit Alarm ................................................................ 119
4.12.2 Command 201: Current Debit and Credit ...................................................... 120
4.12.3 Command 202: PPV Purchase List ................................................................ 121
4.12.4 Command 203: PPV Purchase List Report...................................................... 122
4.12.5 Command 204: PPV Purchase List With Payment Status ................................. 123
4.12.6 Command 205: Phone Discrepancies ............................................................ 125
4.12.7 Command 206: STU Responding Status ........................................................ 126
4.12.8 Command 207: ICC Memory Full Alarm ........................................................ 127
4.12.9 Command 211: Start of Report .................................................................... 128
4.12.10 Command 212: End of Report ..................................................................... 129
4.12.11 Command 215: Products List ....................................................................... 130
4.12.12 Command 216: PPV Purchase List Extended .................................................. 131
4.12.13 Command 217: Impulse Purchase List .......................................................... 132
4.12.14 Command 218: Smart Card Synchronization Status ....................................... 134
4.13 Internal CAS commands (7nn) ......................................................................... 135
CONFIDENTIAL
CONFIDENTIAL

4.14 MACRO EMM commands (9nn) ......................................................................... 135

4.14.1 Command 901: Activate Smart card ............................................................. 136
4.14.2 Command 902: Activate Smart card Without Return Path ............................... 139
4.14.3 Command 903: Add List of Products ............................................................. 141
4.14.4 Command 904: Cancel List of Products ......................................................... 143
4.14.5 Command 905: Add Enhanced List of Products .............................................. 144
4.14.6 Command 908: Set Families of Products ....................................................... 148
4.14.7 Command 909: A-la-carte management ....................................................... 150
4.14.8 Commands 910 to 919: Reserved for Internal CAS Actions ............................. 153
4.14.9 Command 923: Activate Smart Card II ......................................................... 153
4.14.10 Command 925: Set a-la-carte services ......................................................... 161
4.15 OPERATION commands (10nn and 20nn)........................................................... 163
4.15.1 Command 1000: Acknowledge Command ..................................................... 163
4.15.2 Command 1001: Non-acknowledged Command ............................................. 164
4.15.3 Command 1002: No Command .................................................................... 165
4.15.4 Command 1003: Acknowledge Command with Virtual UA ............................... 166
4.15.5 Command 1004: Acknowledge command with data ........................................ 167
4.15.6 Command 1005: Send business command .................................................... 169
4.15.7 Command 1006: Acknowledge business command ......................................... 170
4.15.8 Command 1007: Non-acknowledged business command ................................ 171
4.15.9 Command 2000: EMM via Portal Acknowledge command ................................ 172
4.15.10 Command 2001: EMM via Portal Negative-Acknowledge command ................... 173
5. Error codes ......................................................................................... 174

5.1 Table of Error codes ........................................................................................ 174
5.2 Table of Error code extensions ......................................................................... 178
6. UA and CA-S/N checksum ................................................................... 182

6.1 Definitions ..................................................................................................... 182
6.2 Pairing operation ............................................................................................ 182
6.3 Data files ....................................................................................................... 183
6.4 CA-S/N – Pairing keys ..................................................................................... 183
6.5 Checksum algorithm ....................................................................................... 183
7. ASCII Table ........................................................................................ 184
8. SMS Command Process ....................................................................... 187
9. Examples ............................................................................................ 189

9.1 Device_IO connection establishment ................................................................. 189
9.10 Example of command 52 ................................................................................. 195
Glossary ..................................................................................................... 197
Data formats .............................................................................................. 198
List of tables
CONFIDENTIAL
CONFIDENTIAL

Table 4-1: Identifiers ................................................................................................... 22

Table 5-1: Error codes ................................................................................................ 177
Table 5-2: Error code extensions .................................................................................. 181
Table 7-1: ASCII Table ................................................................................................ 186
Listing 9-1: Device_IO connection ................................................................................ 189
Listing 9-2: Example of command 52 ............................................................................ 195
List of figures
Figure 2-1: CAS overview ............................................................................................. 12
Figure 2-2: SMSgw protocol – communication layers ....................................................... 12
Figure 2-3: Device_IO connection establishment and data exchange phases ....................... 15
Figure 3-1: Connections between the SMS and the SMSgw ............................................... 17
Figure 3-2: Multi SMS connections ................................................................................. 17
Figure 4-1: Buffer of command 69 sent by the SMS ......................................................... 82
Figure 8-1: SMS commands ......................................................................................... 187
Figure 9-1: Entire network packet ................................................................................ 196
CONFIDENTIAL
CONFIDENTIAL

Preface
Audience
This guide is directed at the following persons:
The customer’s personnel involved in the management of the SMS – CAS interface
SMS vendors’ personnel involved in the development of the interface between the SMS and the
CAS
Nagravision’s personnel involved in the CAS (marketing, customer support, developer, test
team)
Related Documents
[1] “Information technology – Syntactic meta-language – Extended BNF” (ISO/IEC
14977:1996)
[2] “Conditional Access Kernel – IRD Command Specification” (Nagravision)
Document History
Change logs
Version 18.21 / May 2018
Support of SMS 111(JYO)
Version 17.23 /May 2017
Support of SMS 35 for Aladin SC
Version 17.08 / Feb 2017
Rental PPV not supported for Aladin (PWI)
Added SMS command 150 for SNP
Verion 16.30 / July 2016
Updated checkbox for SMS 904 in section 4.7.1(JYO)
Version 16.24 / May 2016
Support for 902, 903, 96 command for Aladin Added.(KUM)
Version 16.06 / February 2016
. Updated checkbox for SMS command 48,50 and 56 in section 4.7.1 (JYO)
Version 15.47 / November 2015
• Add references to ackRightIfSuspended
• Added SMS 4/5 Aladin checkbox in section 4.7.1
Version 15.44 / October 2015
• Update supported commands/products table for sprint 15.44
Version 15.35.0 July 2015
• Remove support of freeDVR and Rental DVR product type for Aladin
• Mention that freeDVR and Rental DVR products are obsolete
Version 15.29.0 July 2015
Ungrayed Aladin command 7, 8, 10, 13 in section 4.7.1 (BGN)
Version 15.26.0 – June 2015
Grayed out Aladin SMS commands in Command support table that are not yet implemented
in OneCAS
Version 15.23.0 – May 2015
Initial version for OneCAS supporting Aladin, Merlin and DLK platforms
CONFIDENTIAL
CONFIDENTIAL

Change logs
Document Reviewers
Reviewer’s Name Function Review Date Reviewed Version
Fabien Mathieu SAS architect 02/04/2012 1.1.0
Document Approvers
Name Function Approval Approved Version
Date
Jordi Porta Head of SAS 02/04/2012 1.1.0
CONFIDENTIAL
CONFIDENTIAL

1. Introduction
This document presents the interface that interconnects an SMS and the Nagravision conditional
access system (CAS). It provides the connection specifications, the communication protocol and
the commands used in the interface. This issue illustrates only the set of commands fully
supported and tested by the OneCAS standard delivery.
How to use this document

You do not need to read all of this specification as some information is reference material only.
Therefore, depending on your needs chose from the following:
Chapter 2: System overview and communication protocols

Chapter 2 gives an overview of the SMS Gateway and introduces you to the communication
protocols it uses.
Chapter 3: SMS-SMSgw connection

Chapter 3 covers communication between the SMS and the SMS Gateway.
Chapter 4: SMS commands

Chapter 4 covers the individual SMS commands.
Chapter 5: Error codes

Chapter 5 provides reference information on error codes.
Chapter 6: UA and CA-S/N checksum

Chapter 6 describes the procedure to manage unique addresses (UAs) and conditional access
serial numbers (CA-S/Ns) at the customer site.
Chapter 7: ASCII Table

Chapter 7 provides a reference table covering the ASCII characters table.
Chapter 8: SMS Command Process

Chapter 8 explains the process by which a subscriber’s request is carried out.
Chapter 9: Examples
Chapter 9 provides listings demonstrating a Device_IO connection process and a command
transmitted in a network packet.
A note on licenses
This document lists and describes all the commands supported by the Nagravision CAS
interface. However, the use of individual commands depends on the business licenses acquired
by the customer (i.e. the site operator). Make sure you have the appropriate license before
CONFIDENTIAL
CONFIDENTIAL

using a command.
CONFIDENTIAL
CONFIDENTIAL

2. System overview
This chapter presents different aspects of the system related to the SMS Gateway interface.
2.1 Purpose of the SMSgw

The figure below illustrates the location of the SMS Gateway (SMSgw). The SMSgw is an
internal component of the Nagravision CAS system. From the outside world, it can be seen as a
gate to the CAS. Through this gate, one or several SMS entities send instructions or commands
to the CAS. On the way back, the CAS sends the SMS information related to impulse pay per
views (IPPVs).
SMS Set-Top-Box
SMS
SMS Gateway Set-Top-Box
SMS CAS Set-Top-Box
Figure 2-1: CAS overview
2.2 Communication protocols
2.2.1 Layers
There are three communication layers. The lowest is the TCP/IP level and the most abstract is
the level of the SMSgw protocol. Between those two is the Device IO layer whose role is to
gather commands from the TCP/IP stream.
SMS gateway command
DeviceIO
TCP/IP
Figure 2-2: SMSgw protocol – communication layers
2.2.2 TCP/IP protocol
TCP/IP is a stream-based protocol. The application-oriented messages are joined together and
there is no separator between these messages. When reading an application-oriented message
using OS primitives from a stream like TCP/IP, we may face one of the following three
CONFIDENTIAL
CONFIDENTIAL

possibilities:
The message is incomplete (only n bytes of the data have been read).
The message is complete (only the expected message has been read).
More than the expected message has been read.
The diagrams below show these three possibilities. We assume that the TCP/IP stream contains
two application-oriented messages M1 and M2:
M1 M2 TCP/IP stream
Reading an incomplete message:
M1’ M1’’ M2
Reading one complete message:
M1 M2
Reading more than one message:
M1 M2’ M2’’
2.2.3 Device_IO protocol
Device_IO is a protocol used above TCP/IP to exchange data as a buffer of known size. It
consists of a fixed-size header followed by the application data. The header has a size of two
bytes and the application data is a stream of n bytes.
Header section Payload section
Length (2 bytes) Application data (n bytes)
The header is a two-byte hexadecimal value that corresponds to the number of bytes in the
payload section.
The content of the payload section is described in the following chapters.
Warning
▪ The header indicates only the length of the payload section. The first transmitted byte
is the most significant byte of the “Length” value”.
2.2.4 SMSgw protocol
The SMSgw protocol defines the application-oriented message. It is a high-level protocol in

which user data consists of human-readable ASCII characters (from ASCII code 32 to ASCII
code 127) used to describe the value of the command attributes.
2.3 Device_IO communication
2.3.1 Overview
Communication is established through entry points called services. An application establishes

communication with another application by specifying the service name of the target.
CONFIDENTIAL
CONFIDENTIAL

For Device_IO communication between applications running on different machines,

communication must first be established at the TCP/IP transport level.
To manage communication between two systems, the following points must be addressed:
How to establish communication with a Device_IO server and how to indicate the internal client
for which the communication is intended.
How to transmit and receive data to and from the Device_IO server.
In the following description, the commands involved (open, send, receive, listen, and close)
are those of the underlying transport protocol used (TCP/IP). Device_IO does not redefine these
commands. The names used below (open, send, receive, listen, and close) are generic
names representing the corresponding available system calls. Consequently, the calls described
below only show their Device_IO parameters. The transport protocol parameters (such as
socket pointers) are not shown in the generic description of the calls.
2.3.2 Establishing a connection with a Device_IO server
To open a communication with a Device_IO server, an application must call the Device_IO
server. Two parameters must be provided:
The name of the machine on which the server is running;
The (TCP/IP) port number corresponding to the Device_IO server.
Once TCP communication with the server has been established, the name of the target service
must be communicated (message_1) to the Device_IO server in order to establish a link
between the calling client and the requested service.
As a reply, the server must send one or two messages. The first message (message_2) contains
the connection status and, when the communication attempt has been successful, a second
message (message_3) specifies whether the call has been accepted or rejected.
SMS computer CAS computer
SMS DeviceIO SMSgw

process server process
TCP connection
Connection
establish.
Message_1
phase
Message_2
Message_3
Time
exchange
phase
Data
Message_5 (ex: cmd 51)

Message_5 (cmd 1000-ACK)
CONFIDENTIAL
CONFIDENTIAL

Figure 2-3: Device_IO connection establishment and data exchange phases
An example of a Device_IO connection can be found in section 9 Examples (page 189).
2.3.3 Data exchange between client and server
After the communication link is established, messages can be exchanged (message_5) between
the client (here: the SMS) and the Device_IO server.
2.3.4 Closing a connection with a Device_IO server
The connection is closed when communication is closed at TCP level.
2.3.5 Rules of use
If, for any reason, the SMS does not receive either message_2 or message_3 within a specified
time-out period (e.g.: 30 seconds) when the communication is established, the SMS should
close the communication and retry later. The same rule applies if the connection status returned
by message_2 is different than “SUCCESS” or if the answer code returned by message_3 indicates
that the call is rejected.
2.3.6 Messages format
There are four different message types in the Device_IO protocol. The next sections present the
different messages and the way they should be used.
2.3.7 Message_1 (connect to the CAS)
This is the first message sent by the client (the SMS) to the Device_IO server.
Message_1
Syntax Size (byte) Format Description
Len 2 hex Message length in bytes (see section 2.2.3).
op_mode 1 r_hex Data transfer operation mode
0 = Normal data transfer
ob_name_len 1 hex Length of the object name attribute (in bytes).
ob_name ob_name_len text Name of the applicative service with which the
connection should be established.
Ob_name is a string of bytes at least one byte long
and at most 32 bytes long:
1 <= ob_name_len <= 32. This name is compulsory
but its content is up to the client (ex: “SMS_GWY”).
2.3.8 Message_2 (answer 1 from the CAS)
This message is a response from the Device_IO server to the client (in this case: the SMS); the
message validates the connection.
CONFIDENTIAL
CONFIDENTIAL

Message_2
Len 2 hex Message length in bytes. In this case, the
length is always 1 byte.
connect_status 1 r_hex Connection status. Refer to the table below for
applicable values.
Connect_status
Value Identifier Description
0 CONNECT_FAILURE The connection has failed for any unexpected reason
6 SUCCESS The operation has been successfully completed.
2.3.9 Message_3 (answer from the CAS)
This message is a response from the Device_IO server, which validates the connection with the
other process (in our case: the SMSgw).
Message_3
len 2 hex Message length in bytes. In this case, the
length is always 1 byte.
answer_code 1 r_hex 0: call accepted
1: call rejected
2.3.10 Message_5 (Cmd message from the SMS or the CAS)
This message must contain only one SMSgw command.

Message_5
len 2 hex Message length in bytes (see section 2.2.3).
data len See note SMSgw command data.
The data section of message_5 follows the structure shown below:

root header Common to all commands – see section 4.114.9.1.
address header Depends on command type (EMM, CTRL, Feedback, Operation) – see
sections 4.9.2 to4.9.54.9.5.
command body Depends on command type – see sections 4.10 to 4.144.14.6.
CONFIDENTIAL
CONFIDENTIAL

3. SMS-SMSgw connections
3.1 Overview
The figure below illustrates the connections used by the SMS and the Nagravision SMSgw. As
depicted in the figure, a connection can be seen as a data channel. On the same channel,
commands follow one direction, while the opposite direction is followed by the corresponding
responses (ack or nack). An ack response means that the incoming command is correctly
formatted and it has been successfully processed. A nack response means that either the format
or the data structure of the command is not appropriate or that the command has encountered
problems during processing in the system. The SMS is responsible for opening both channels.
The commands flow from the SMS to the CAS in the EMM/Control channel, whereas the
responses flow from the CAS to the SMS in the Feedback command channel.
SMS Nagra SMSgw

EMM/Control channel
Command port
EMM/Control or 1002 commands
Ack or Nack
ack
Feedback
Feedback commands port
Ack or Nack
ack
1002 commands
Ack 1002
ack
FEEDBACK channel
Figure 3-1: Connections between the SMS and the SMSgw
Several SMS may be connected to the same port, as shown in the following figure:
EMM & Control channel Nagra SMSgw

Feedback command channel
SMS 1 Command port
SMS 2
Feedback
port
SMS 3
Figure 3-2: Multi SMS connections
CONFIDENTIAL
CONFIDENTIAL

3.2 EMM/Control command flow

EMM/Control commands are the commands sent by the SMS to the CAS. Some examples of
such commands are “Add product to a smart card”, “Create credit”, and “Set authorized phone
number”, “Initialization”, and “Pairing”.
3.3 Feedback command flow

Feedback commands are the commands sent by the CAS to the SMS. The feedback information
issued by the CAS can be of the following types:
List of IPPVs that have been made by the end users – this data is sent each time an STB makes
a callback
Error condition in the smart card (memory full, low credit)
List of subscription products (reply to command 71: Get Product)
Online purchase command
3.4 Feedback command routing

The routing of a feedback command specifies to which SMS the CAS should send a message.
Message types are described in the previous section.
The routing of a feedback command depends on the SMS source_id associated with a given
smart card, i.e. the source_id linked to an individual end user. The source_id available in the
header of any command is extracted by the CAS during the initialization phase of an end user.
Refer to the Important note (below) for more details.
Each time an SMS opens a connection on a Feedback channel, after the initial Device_IO
handshake successfully completes, the SMS must also issue command 1002 in order to
associate an SMS_id to the connection. The CAS uses that SMS_id to enable the routing of
feedback commands only if an appropriate SMS is up and running.
Important
▪ The source_id identifies an SMS; its value must not change over time during the
entire lifetime of the system. The source_id and dest_id values must be assigned
by Nagravision.
▪ ITM-DNASP2 systems: command 52 is used to catch the SMS source_id.
▪ ITM-Aladin systems: command 13 is used to catch the SMS source_id.
3.5 Usage
3.5.1 Source identifier
Each connection established between the SMS and the Nagravision CAS has a source identifier.
Each connection must have its own source identifier and it is not possible for two connections to
share the same source identifier at any given time. The source identifier of a connection is given
by field source_id in the header of each message sent from the SMS to the CAS.
3.5.2 Transaction number
Each transaction number used must be unique during the life of the corresponding connection.
The transaction number is given by a field in the header of each message sent from the SMS to
CONFIDENTIAL
CONFIDENTIAL

the CAS. Transaction numbers are necessary to determine which commands have been
processed successfully (ack, command 1000) and which commands have not (nack, command
1001).
3.5.3 Keeping the SMS connection alive
During periods of inactivity on the SMS-CAS interface, the SMS must periodically send command
1002 on both ports (EMM/Control and Feedback) to the CAS. The main reason for that
recommendation is that intelligent network devices (such as switches or firewalls) may not keep
idle TCP connections open indefinitely. Nagravision recommends that command 1002 be sent
every 5 minutes on both ports.
3.5.4 Establishing the SMS connection
Each time the SMS opens a connection on either the EMM/Control port or the Feedback port, it
must first generate command 1002.
CONFIDENTIAL
CONFIDENTIAL

4. SMS commands
4.1 Specification
4.1.1 Commands and responses
The SMS sends commands to the CAS. In response, the CAS sends acknowledgment messages
back to the SMS. The same applies to feedback commands: the CAS sends feedback commands
to the SMS; in response, the SMS sends acknowledgements back to the CAS. Of course, the
acknowledgment messages are reported on the same communication channel as the
corresponding commands.
Note
▪ The system will not behave as expected if the following values are not handled
correctly:
– transaction_id
– source_id
– dest_id
4.1.2 Asynchronous by nature
The protocol used between the SMS and the CAS is asynchronous. Several SMS commands may
be sent before acknowledgement messages are received. In other words, there is no need to
wait for the acknowledgement of a command before sending the next commands to the CAS.
Important
▪ The SMS may receive the acknowledgement messages in a different order than the
order in which the corresponding commands have been sent. However, for an
individual smart card, the sequence of EMMs follows the sequence of SMS commands.
▪ Please also note that at the end of the transmission chain, i.e. at the device (smart
card or Set Top Box / CAK),, the sequence of commands is not guaranteed.
4.1.3 Feedback
If there is no return path, the SMS will not need to open a connection on the Feedback port
unless command 71 (Get Products) is sent on the control port to trigger the generation of
commands 215 (Product List) on the Feedback port.
4.2 Metrics
Metric Value range (typical)
Connection The EMM/Control port and Feedback ports may accept up to
10 connections each.
SMS commands The CAS can process from 4 up to 10 SMS EMM and control commands
per second over the EMM/Control channel, with actual figures depending
on the capacity of the CAS hardware.
Feedback commands The CAS can generate and send up to 500 feedback commands per
second. The flow of data is not necessarily regular.
CONFIDENTIAL
CONFIDENTIAL

Note
▪ Those metrics depend on factors such as system architecture and processing power;
they are provided here merely as an order of magnitude.
4.3 Time and date

All dates are expressed in UTC, except product validity dates.
Although product validity dates are generally expressed in UTC, if the IMS product definition
specifies that validity dates are in local time and if the validity dates are specified by the SMS,
then the validity dates provided by the SMS will be interpreted in the subscriber’s local time.
Therefore, for fields begin_date and end_date in SMS commands 2, 901, 902, 903, 921
and 922, the comment must be changed so as to specify generally in UTC rather than UTC.
All dates shall be between 1992.01.01 (i.e. 19920101) and 2038.01.01 (i.e. 20380101).
4.4 Currency
In the CAS database and in the smart cards, the credit and price figures are expressed in CAS
currency – not in local currency. The SMS must convert the credit and price data from local
currency to CAS currency. Note that the conversion coefficient is generally equal to one, and
that CAS currency and local currency are therefore the same.
CAS currency = local currency / coefficient
This applies to all type of commands (EMM, Control, Macro EMM, Feedback, Online Purchase).
The price and credit figures could be expressed in tokens. In such a case, both the
SMS currency and the CAS currency would be tokens and, therefore, the SMS would
not need to apply any conversion factor.
4.5 Identifiers
This section contains descriptions of all identifiers used throughout this document.
ID Definition
circuit_id A number uniquely identifying a video/audio/data stream.
command_id The identifier of an SMS command. The content of this field forms part of the
command. The value of command_id is covered by the SMS documentation
for all commands except the feedback commands, which is covered by the
IMS or CC documentation.
Conditional_add_id Identifier of the conditional add product to be broadcast.
dest_id The identifier of the addressed SMS command. It is entered at system
configuration.
Host_id STB id for a point of development (POD).
IMS_event_id An IMS-generated identifier for individual events. It is entered using the IMS
editor or generated when the EPG data feed is processed.
IMS_product_id The identifier of a product in the IMS. It is the only product identifier known
to the IMS.
MOP_PPID The identifier of the management operator (MOP). This identifier is provided
by Nagravision at system configuration.
Network_id DVB network identifier.
POD_id Point of development identifier (i.e. PCMCIA module).
CONFIDENTIAL
CONFIDENTIAL

ID Definition
Service_id DVB service identifier.
SMS_product_id A product identifier for use by the SMS. It is provided and managed by the
SMS. It is entered into the system by the SMS Gateway through commands
300, 303, 305 or 307.
source_id An identifier specifying the source of SMS commands. This identifier is
entered into the system at system configuration.
STB serial number The hardware serial number of the STB.
STU_number This Nagravision STB number is used to identify the STB in the CA system,
for pairing purposes.
Transport_id DVB transport identifier.
Table 4-1: Identifiers
4.6 Special notes
4.6.1 event_name and product_name filler rule
The event_name or product_name field is characterized by its fixed size length. The useful
section of the field is a string of (ASCII printable) characters. The remaining part of the field
must be padded with space characters (value: 0x20).
Because the previous version of the SMS Gateway document indicated that the field must be
padded with series of 0x00 bytes, the CAS will continue to accept incoming SMS commands that
follow the 0x00-padded format. However, any new development in the SMS must follow the rule
regarding the space characters.
When the SMS uses filler character 0x00, the drawback for the CAS system is that the traces of
the incoming SMS command become corrupted in the log file are corrupted. This is because the
value 0x00 is considered as an end-of-string indicator.
On the other hand, the 0x00 byte does not affect the individual CAS applications processing the
SMS commands.
4.6.2 event_name and product_name overwriting rule
The purpose of the event_name or product_name data provided in the SMS command is for the
STB menu to show a description of the available product.The CAS shall be configured to work in
one of the two following modes:
Mode 1, in which the SMS controls the product name:
The event or product name provided by the SMS (commands 10, 901, 902, 903, 905
and 923) is used to prepare the EMM data. If the length of the product name is
equal to 0, the product name will be taken from the CAS database.
Note that for SMS command 2 and for subscription products in commands 901 and 902,
the event name cannot be specified and it is therefore always taken from the IMS.
Mode 2, in which the IMS controls the product name:
The product name provided by the SMS is ignored. It is overwritten by the
corresponding value that is available in the CAS database.
CONFIDENTIAL
CONFIDENTIAL

4.6.3 Price overwriting rule

The price of a product is usually provided by the SMS (as in command 10 for instance).
Remember: this price is a value that will be displayed by the STB to inform the end user about
the cost of a given product, i.e. it is for information purposes only. However, when the SMS
cannot provide the price value, the CAS can replace it with a value set in the IMS database. The
operational mode is configurable in the CAS.
Note
▪ This is not applicable to subscription products.
4.7 Command support
4.7.1 Commands per device and addressing modes
Unique addressing is supported for most SMS commands, whereas shared and global addressing
are reserved for special operations with a restricted list of SMS commands. See below for
details.
Additionally some commands can only be issued on some device types (Aladin, Merlin or DLK).
The following table shows the allowed addressing modes and devices for each command.
Important
▪ For SMS commands in global addressing mode, the smart card records are not
updated in the CAS database, except if a special feature is enabled to update the CAS
database under global addressing. If this feature is enabled, only a subset of the SMS
commands accepted with global addressing will trigger a CAS database update.
The table below provides the addressing modes supported for each SMS command.
Description Device type Addressing mode
CID Aladin Merlin DLK Unique Shared Global
2 Add Product √ √ √ √ √ √
4 Product Suspension √ √ √ √
5 Product Reactivation √ √ √ √
6 Product Cancellation √ √ √ √ √ √
7 All Products Cancellation √ √ √ √ √
8 Credit Management √ √ √
9 Update Credit Threshold √ √ √
10 Add Event Product √ √ √ √ √ √
13 Create Credit for Impuls. √ √ √
Purchase
14 Suspend impulsive √ √ √ √
purchase
15 Reactivate impulsive √ √ √ √
purchase
19 Patch smartcard √ √
20 Suspend Subscriber ICC √ √ √ √ √
21 Reactivate Subscriber ICC √ √ √ √ √
23 Suspend all ICC features √ √ √ √ √
CONFIDENTIAL
CONFIDENTIAL

24 Reactivate all ICC features √ √ √ √ √

25 Suspend all ICC features √ √ √ √
with Delay
35 Create Operator √ √ √ √
36 Cancel Operator √ √ √ √
37 Un-kill card √ √
46 Set Segments √ √ √ √
47 Set Aphanum Zip Code √ √ √
48 Set Zip Code √ √ √ √
49 Set Callback Phone √ √ √ √
Number
50 Cancel ICC √ √ √ √
51 Initialize Card √ √ √ √
52 Pair the ICC with the STB √ √ √ √
53 Clear PIN Code √ √ √
54 Set Callback IP address √ √ √ √
55 Set Callback IPV6 address √ √ √
56 Set PIN code √ √ √
57 Bind the Cablecard with √
the host
58 Pair the ICC with Multiple √ √
STB
60 Immediate Callback √ √ √
61 Enable Automatic Callback √ √ √
62 Disable Automatic Callback √ √
65 Force Smartcard √ √
Synchronization
69 Send Generic IRD √ √ √ √ √
Command
71 Get Products √ √ √
77 Configure auto-scanning √ √ √ √
78 Refresh Smartcard √ √
79 Force Tune √ √ √ √
84 Send PRM Credentials √ √ √ √
88 Send BAEKey At Activation √ √
91 Anti-splitter Configuration √ √
96 Purge PPV and IPPV √ √ √ √
Records
97 Set IPPV Records as √ √ √
reported
99 Send Generic IRD √ √ √ √
Command II
100 Redefine Credit Limit √ √ √
101 Set Authorized Phone √ √
Number
104 Create ICC On Call √ √ √
Collector
CONFIDENTIAL
CONFIDENTIAL

105 Cancel ICC On Call √ √ √

Collector
106 Set Purch. Profile √ √
107 Set Purch. Profile w free √ √
programming
110 EMM cleanup √ √ √
111 Get History from Call √ √
Collector
120 Enable Callback Rules √ √
121 Disable Callback Rules √ √
122 Set Network √ √ √
123 Trigger Broadcast of Cond. √ √ √ √
EMM
124 Get Smartcard √ √
Synchronization status
125 Set Subscriber Private √ √ √
Data
126 Assign Virtual UA to NUID √ √
127 Get all products √ √ √
150 SNP Override √ √
901 Activate SC √ √ √
902 Activate SC Without Return √ √ √ √

Path
903 Add List of Products √ √ √ √ √ √
904 Cancel List of Products √ √ √ √ √ √
905 Add Enhanced List of √ √ √ √ √
Products
908 Set Families of Products √ √ √
909 A-la-carte management √ √ √
923 Activate Smartcard II √ √ √ √
925 Set a-la-carte services √ √ √
Note
▪ If the SMS Gateway receives an SMS command it does not supported either generally
or for the given addressing mode (shared or global), the SMS command will be
rejected with a ‘BAD_COMMAND_SYNTAX’ error code and an
‘EXTERNAL_SYSTEM_ERROR’ error code extension.
Additionally, the following restrictions apply:

Shared addressing is refused (the SMS command is rejected) in the following cases:
With SMS commands 2, 6, 903, 904 and 905 for products under PA per Operator and for
coins, as well as for SVOD and TVODSub products;
With SMS commands 10, 904 and 905 for coins, for Rental products and for Rental PPV
products;
With SMS command 905 if the purchase mode is set to ‘Re-hit’.
With SMS 7, 20 and 21 if the system is configured to support the PA by operator.
SMS commands 2, 6, 903, 904, 905 adding coins, SVOD, TVODSub products
CONFIDENTIAL
CONFIDENTIAL

SMS commands 10, 903, 904, 905 adding coins, Rental DVR, Rental PPV products
▪ You can configure the SAS to disable support for global addressing, to enable it for all
SMS source IDs, or to enable it only for one source ID.
Global addressing is refused (the SMS command is rejected) in the following cases:
With SMS commands 2, 6, 903, 904 and 905 for subscription products under PA per
Operator and for coins, as well as for SVOD and TVODSub products;
With SMS commands 10, 903, 904 and 905 for coins, as well as for Rental and for
Rental PPV products;
With SMS commands 905 if purchase mode is set to ‘Re-hit’.
Note
▪ The SMS command will be rejected with a ‘BAD_PRODUCT_TYPE’ error code and the
product_type (REGULAR_PRODUCT, PPV_PRODUCT – or
NO_EXTENDED_ERROR_CODE for A la carte product) as the error code extension in
the following cases:
• The product type is not supported for the SMS command (e.g.: PPV products
cannot be added using SMS command 2).
• The product type is incompatible with the addressing mode (e.g.: rental PPV
products cannot be added in shared or global addressing mode).
▪ In the case above, when the smartcard type is not consistent with the product an
error code ‘PRODUCT_INCONSISTENT’ is shown instead.
Note
▪ The SMS command will be rejected with a ‘NOT_AUTHORIZED’ error code and a
‘NO_EXTENDED_ERROR_CODE’ error code extension in the following cases:
• The product PA type is not consistent with the MOP PA type (e.g.: subscription
products under PA per Operator cannot be added to a MOP to which PA per Operator
does not apply).
• The product PA type is incompatible with the addressing mode (e.g.: subscription
products under PA per Operator cannot be added in shared or global addressing
mode).
4.8 Command handling
4.8.1 Products per device and SMS command
The table below shows commands that can be used to handle each type of product.
Note that the products “Free DVR” and “Rental DVR” are obsolete and no longer supported in
OneCAS.
Products supported per device

Short term sub
PPT by Points
PPT by Coins
Flexible Sub
Rental PPV
A-la-carte
TVOD Sub
N of M
SVOD
FPP*
Coin
SUB
PPV
Aladin √ √ √ √ √
CONFIDENTIAL
CONFIDENTIAL

Short term sub

PPT by Points
PPT by Coins
Flexible Sub
Rental PPV
A-la-carte
TVOD Sub
N of M
SVOD
FPP*
Coin
SUB
PPV
Merlin √ √ √ √ √ √ √ √ √ √ √ √ √
DLK √ √ √ √ √
P: applicable to loop product (subscription) V: applicable to loop PPVs
Products supported per SMS command
Short term sub

PPT by Points
PPT by Coins
Flexible Sub
Rental PPV
A-la-carte
TVOD Sub
N of M
SVOD
FPP*
Coin
SUB
PPV
2 Add Product X X X X X X X
4 Product Suspension X X
5 Product Reactivation X X
6 Product Cancellation X X X X X X X X X X
7 All Products X X X X X X X X X X X
Cancellation
10 Add Event Product X X X X X
78 Refresh Smart Card X1 X X
901 Activate Smart Card P P V V V P P
902 Activate Smart Card P P V V V P P
Without Return Path
903 Add List of Products P P P V V
904 Cancel List of Products X X X X X X X X X X
905 Add Enhanced List of P P P P V V V V V P P
Products
908 Set Families of X2
products
909 A-la-carte X
management
923 Activate Smart Card II P P P P V V V V V P P
925 Set a-la-carte services X
1
Only PAP SUB products are refreshed by SMS command 78 (PAO products are not taken into account).
2
Only available for subscription products associated to a family before the migration to the ‘a-la-carte’
product. After the migration, only the SMS commands 909 and 925 should be used to manage ‘a-la-carte’
product.
CONFIDENTIAL
CONFIDENTIAL

* These products are processed automatically without SMS commands.
4.8.2 Credit and price
In the head end and smart cards, credit and prices are handled in CAS currency, not in local
currency. The SMS must convert the credit/price data from local currency into CAS currency.
Note that the coefficient is generally equal to one: CAS currency and local currency are the
same.
CAS currency = local currency/coefficient
This applies to all types of commands (EMM, CONTROL, MACRO EMM and FEEDBACK).
CONFIDENTIAL
CONFIDENTIAL

4.9 Headers
Any message (except business commands) has the following structure, the address headers
depending on the field command_type from the root header:
Root common to all commands
header (see section 4.9.1 Root header below)
Address EMM CTRL Feedback Operation Business
header 4.9.2 4.9.3 4.9.4 4.9.5 (out of scope)
Comman cmd 0nn cmd 1nn cmd 2nn cmd 10nn and 20nn
d body 4.10 4.11 4.11.17 4.15
The next section details the internal structure of the three modules (root header, address
header and command body).
Business commands are reserved for Nagra applications such as JSim and the specification
beyond the root header is beyond the scope of this document.
CONFIDENTIAL
CONFIDENTIAL

4.9.1 Root header
Field Size Format Description

transaction_number 9 num Number used to uniquely identify a
transaction across the interface, for each
source.
Range: 000000000 to 999,999,999.
command_type 2 r_num 01: EMM (cmd series 0nn and 9nn)
02: CONTROL (cmd series 1nn)
04: FEEDBACK (cmd series 2nn)
05: OPERATION (cmd series 1000 and 2000)
source_id 4 num A number that identifies a source, such as the
SMS or the IMS (this number is provided by
Nagravision).
Range: 0000 to 9999
dest_id 4 num Identifier of the addressed SMS. This number
is defined at system configuration.
Range: 0000 to 9999
MOP_PPID 5 num Identifier of the technical MOP. This number is
provided by Nagravision at system
configuration.
Range: 00000 to 65,535
creation_date 8 YYYYMMDD Creation date of the command (in UTC).
Note: the CAS does not use this date to apply
any rule or constraint.
The error codes (nack messages) applicable to this part of the command are listed below.
Field Error codes Error code extensions

any BAD_ROOT_HEADER_SYNTAX NO_EXTENTED_ERROR
transaction_number BAD_HEADER_SYNTAX BAD_TRANSACTION_NUMBER_FORMAT
transaction_number BAD_USAGE TRANS_NR_ALREADY_IN_USE
command_type BAD_HEADER_SYNTAX BAD_COMMAND_TYPE
source_id BAD_HEADER_SYNTAX BAD_SOURCE_ID
source_id BAD_USAGE SOURCE_NOT_AUTHORIZED
source_id BAD_USAGE SOURCE_ALREADY_IN_USE
dest_id BAD_HEADER_SYNTAX BAD_DEST_ID
dest_id BAD_USAGE DEST_NOT_AUTHORIZED
MOP_PPID BAD_HEADER_SYNTAX BAD_MOP_PPID
MOP_PPID INVALID_PPID MOP_NOT_AUTHORIZED
creation_date BAD_HEADER_SYNTAX BAD_DATE_FORMAT
creation_date BAD_USAGE DATE_IN_THE_FUTURE
CONFIDENTIAL
CONFIDENTIAL

4.9.2 Address header – EMM cmd

broadcast_mode 1 r_text Values N or B means that the EMMs are
delivered in-band (i.e. in the transport
stream) with the default broadcast profile
associated with the SMS command.
Values 1 to 9 specify alternative broadcast
profiles to be used instead of the default
profile. If the alternative profile specified by
the SMS does not exist in the CAS
database, then the default broadcast profile
is used.
Value W means that the CAS database is
updated – but without EMM generation.
Value P means that the EMMs are
delivered with an out-of-band scheme. The
EMM are delivered when the STB calls back.
After a certain timeout delay (which users
can set using a parameter in the CAS), the
EMMs are also delivered in-band – provided
the STB does not perform any callback.
Value O means that the EMMs are only
delivered out-of-band.
Value E means that the EMMs are returned
via the Portal (i.e. through acknowledgment
SMS command 2000) and therefore
delivered neither in-band nor out-of-band
when the STB calls back. No contradiction
is handled for these EMMs.
A value of W means that the CAS
database is updated – but without EMM
generation.
Warning for P and O broadcast modes
These modes should not be used for DLK,
as there is no return path. The SMS sends
batches of SMS commands and is
responsible to signal the end of batch using
SMS command 60 – Immediate Callback –
to trigger an STB callback. When the batch
contains only commands which do not
generate any EMM (i.e. SMS control
commands 1xx), the SMS shall not issue
SMS command 60 – Immediate Callback.
There is only one exception: SMS command
122 – Set Network.
Those broadcast modes are not applicable
to the following SMS commands:
• 60 – Immediate Callback
• 65 – Force Smart Card
Synchronization
broadcast_start_date 8 YYYYMMDD Broadcast start date (in UTC). The
command must be sent to the smart card
starting from this date.
See the Note below.
CONFIDENTIAL
CONFIDENTIAL


broadcast_end_date 8 YYYYMMDD Broadcast end date (in UTC). The command
must be sent to the smart card up until this
date.
See the Note below.
address_type 1 r_text EMM addressing mode for EMM commands:
U = unique.
G = addresses all smart cards of an
individual MOP.
S = Shared
U UA 10 r_num The unique address (UA) of the device
(smart card or Set Top Box / CAK) for
which the command is intended.
Range: 0000000001 to 4,294,967,295
G - - – –
S SA 8 r_num The shared address (SA), which is the first

UA of the group divided by the group size.
Range: 00000000 to 16777215.
ADF mode 1 r_text Address Field mode (for future use).

B = Bitmap.
For the time being, ADF mode must be set
Address type
to B.
Bitmap 3 r_num The length (in bytes) of the bitmap.

length Bitmap length is 032 for Aladin and Berlin
smart cards.
It is 032 for Aladin smartcards.
It is 064 for DLK.
It is 032 or 064 for Merlin smartcards,
depending on the system configuration (for
group size or 256 or 512 respectively)..
Bitmap 2x r_text The bitmap of the UA for which the
bitmap_ (see note below) command is intended.
length The first bit of the bitmap from the left (i.e.
the most significant bit) represents the first
UA of the SA (it is equal to SA x group
size), whereas the last bit on the right (i.e.
the least significant bit) represents the last
UA of the SA (equal to SA x [group size] +
[group size] – 1).
The bitmap field contains a string of
characters representing hexadecimal data
coded in the ASCII format (two characters
for one byte).
Important
▪ Regarding shared addresses:
• For Aladin and Berlin smart cards, the group size is equal to 256. Consequently,
CONFIDENTIAL
CONFIDENTIAL

the value of bitmap_length is 32.

• For Merlin smart cards, the group size is 256 or 512 depending on the system
configuration. Consequently, the value of bitmap_length is 32 or 64 respectively.
Important
▪ As indicated in the table above, the format of the bitmap field is r_text. However, it
does not contain a regular string: it is not a text field, such as “this is a sentence with
characters and 1 2 3 4 numerical values”. The data in the bitmap field is a sequence
of hexadecimal numbers encoded in a text format. Consequently, the field will only
accept alpha characters A, B, C, D, E, F representing the numbers 10 to 15 in a
hexadecimal form.
▪ As an example – the CAS will accept the following bitmap value:
A0BCD12A29327B9F. In this example, bitmap_length is equal to 8.
Note
▪ The broadcast_start_date is always used by the SAS, except when handling family
products (in which case it is replaced by the current start date). If it is in the past
then it is set to the current date and time, otherwise it is used as is. The
broadcast_end_date is always ignored (unless the SAS has been explicitely configured
to use it) and rather computed using the broadcast_start_date and adding the
duration specified in the broadcasting profile associated to the SMS command
(association between SMS command and broadcasting profile is configurable at SAS
level). It is recommended to set the broadcast_start_date in the past or to the
current date and time. This allows a better control of the EMM bandwidth. Please do
not confuse the broadcast period that specifies the period when the EMM are
broadcasted, with the right validity period that specifies when a right is valid.

any BAD_HEADER_SYNTAX BAD_DATA_FORMAT
broadcast_mode BAD_HEADER_SYNTAX BAD_BROADCAST_MODE
broadcast_start_date BAD_HEADER_SYNTAX BAD_DATE_FORMAT
broadcast_end_date BAD_HEADER_SYNTAX BAD_DATE_FORMAT
broadcast_end_date BAD_HEADER_SYNTAX BAD_DATE_SEQUENCE
broadcast_end_date BAD_HEADER_SYNTAX DATE_IN_THE_PAST
address_type BAD_HEADER_SYNTAX BAD_ADDRESS_TYPE
address_type BAD_USAGE ADDRESS_TYPE_NOT_AUTHORIZED
UA BAD_HEADER_SYNTAX BAD_UA_FORMAT
SA BAD_HEADER_SYNTAX BAD_UA_FORMAT
ADF_mode BAD_HEADER_SYNTAX BAD_FLAG_VALUE
bitmap_length BAD_HEADER_SYNTAX BAD_NUMBER_FORMAT
bitmap BAD_HEADER_SYNTAX BAD_DATA_FORMAT
Example of shared addressing: consider the following list of UAs:
0200769712, 0200769715, 0200769787, 0200769789.
The address header will look as follows:

N2007050220070502S00784256B06400000000000000000000000000000000000000000000900000000000
000000140000000000000000000000000000000000000000000000000000000000000000
CONFIDENTIAL
CONFIDENTIAL

Breaking down this example into fields:

Field value Field name / Interpretation
N broadcast_mode
Normal
20070502 broadcast_start_date
May 2nd, 2007
20070502 broadcast_end_date
May 2nd, 2007
S address_type
Shared
00784256 SA
Shared address for this group of card is
392128
B ADF_mode
Bitmap
064 Bitmap_length
64 bytes
Bitmap
0000000000000000000000000000000000000000000090 Card 200769712 is the 177th card with
0000000000000000140000000000000000000000000000 shared address 392128
000000000000000000000000000000000000
Card 200769715 is the 180th card with
shared address 392128
Card 200769787 is the 252nd card with
Card 200769789 is the 254nd card with
CONFIDENTIAL
CONFIDENTIAL

4.9.3 Address header – Control cmd

broadcast_mode 1 r_text A value of ‘N’ or ‘B’ means that the mode used is
the default broadcast profile associated with the
SMS command.
Warning: The description of Address header –
EMM cmd (section 4.9.2) also applies to
command 122 – Set Network.
broadcast_start_date 8 YYYYMMDD Current date (today, in UTC)
broadcast_end_date 8 YYYYMMDD Current date (today, in UTC)
address_type 1 r_text EMM addressing mode for EMM commands.
U = unique
G = addresses all smart cards of the MOP (only
applicable to SMS command 123 – Trigger
Broadcast of Conditional EMM)
Type U UA 10 num UA is the unique address of the device (smart

card or Set Top Box / CAK) for which the
command is intended.
Range: 1 to 4,294,967,295
G UA 0 – –

broadcast_mode BAD_HEADER_SYNTAX BAD_BROADCAST_MODE
broadcast_start_date BAD_HEADER_SYNTAX BAD_DATE_FORMAT
broadcast_end_date BAD_HEADER_SYNTAX BAD_DATE_FORMAT
broadcast_end_date BAD_HEADER_SYNTAX BAD_DATE_SEQUENCE
broadcast_end_date BAD_HEADER_SYNTAX DATE_IN_THE_PAST
address_type BAD_HEADER_SYNTAX BAD_ADDRESS_TYPE
CONFIDENTIAL
CONFIDENTIAL

4.9.4 Address header – Feedback cmd

UA 10 Num UA is the Unique Address of the smart card for
which the command is intended.
Range: 0 to 4,294,967,295

4.9.5 Address header – Operation cmd

none There is no header for this command type.

4.9.6 Errors due to abnormal operational conditions

not applicable BAD_ROOT_HEADER_SYNTAX NO_EXTENTED_ERROR
not applicable FATAL_ERROR EXTERNAL_SYSTEM_ERROR
not applicable NO_ITM_PRESENT NO_EXTENDED_ERROR_CODE
not applicable NO_RTM_PRESENT NO_EXTENDED_ERROR_CODE
not applicable NO_SERVER_AVAILABLE NO_EXTENDED_ERROR_CODE
not applicable SMS_NOT_IDENTIFIED NO_EXTENDED_ERROR_CODE
not applicable TM_SERVER_ERROR CORBA_EXCEPTION
MOP_PPID NOT_AUTHORIZED NO_EXTENDED_ERROR_CODE
source_id NOT_DEFAULT_FEEDBACK_S NO_EXTENDED_ERROR_CODE
MS
source_id SOURCE_ID_ALREADY_USED NO_EXTENDED_ERROR_CODE
source_id SMS_NOT_AUTHORIZED NO_EXTENDED_ERROR_CODE
source_id NOT_AUTHORIZED NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

4.10 EMM commands (0nn)

In this section, we present the structure of all commands related to the alteration of the device
(smart card or Set Top Box / CAK). These commands are generated by the SMS. For each
command, there are two tables. The first table illustrates the data structure of the command.
The second table provides the different types of error messages that the CAS could return.
4.10.1 Command 2: Add Product

SAS replaces MOP by SOP No
The SMS uses this command to add a service entitlement in a smart card for a certain product.
Usage Note
▪ For new development, it is advised to use SMS command 905 (Add Enhanced List of
Products) instead of SMS command 2.
Important
▪ Command 2 cannot be used to authorize a PPV. Command 10 should be used instead.
▪ If the RTM [Business]ackRightIsSuspended is set to false (its default value), SMS
command 2 will be rejected if the MOP is suspended (by means of SMS command 20)
or if the SOP is suspended (by means of SMS command 23).
If the RTM [Business]ackRightIsSuspended is set to true, SMS command 2 will be
accepted, the CASDB will be updated accordingly, and with the help of diffusion
profiles, the target secure device(s) will eventually be updated, should the secure
device be reactivated.
▪ If multi-instance products (PPT by points) are added with this command, they will be
handled as new purchases (i.e. the CAS will create a new instance of this product).
▪ The dates (begin_date and end_date) are only used if the SAS is configured to allow
SMS-controlled dates.
Command 2: Add Product

command_id 4 r_num command_id = 0002
IMS_product_id 12 num IMS product ID
Range: 000000000000 to 004294967295
begin_date 8 YYYYMMDD Subscription begin date (in UTC). The subscription
is not valid before this date.
end_date 8 YYYYMMDD Subscription end date (in UTC). The subscription is
not valid after this date.
CONFIDENTIAL
CONFIDENTIAL

List of error codes:

command_id BAD_COMMAND_SYNTAX EXTERNAL_SYSTEM_ERROR
command_id BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IMS_product_id BAD_COMMAND_SYNTAX BAD_IMS_PRODUCT_ID_FORMAT
IMS_product_id PRODUCT_NOT_FOUND NO_EXTENDED_ERROR_CODE
IMS_product_id BAD_PRODUCT_TYPE PPV_PRODUCT
IMS_product_id BAD_PRODUCT_STATUS CANCELLED_PRODUCT
IMS_product_id BAD_PRODUCT_STATUS SUSPENDED_PRODUCT
IMS_product_id BAD_PRODUCT_STATUS INVALID_PURCHASE_DATE
IMS_product_id BAD_PRODUCT_TYPE DRAFT_PRODUCT
IMS_product_id PRODUCT_INCONSISTENT NO_EXTENDED_ERROR_CODE
begin_date BAD_COMMAND_SYNTAX BAD_DATE_FORMAT
begin_date BAD_COMMAND_SYNTAX BAD_DATE_SEQUENCE
end_date BAD_COMMAND_SYNTAX BAD_DATE_FORMAT
end_date BAD_COMMAND_SYNTAX BAD_DATE_SEQUENCE
UA UA_NOT_FOUND NO_EXTENDED_ERROR_CODE
UA CANCELLED_CARD NO_EXTENDED_ERROR_CODE
UA SUSPENDED_CARD NO_EXTENDED_ERROR_CODE
None DATABASE_ERROR BAD_PARAM_IN_CASDB
MOP_PPID INVALID_PPID ISD_MOP_NOT_FOUND
MOP_PPID SUSPENDED_MOP NO_EXTENDED_ERROR_CODE
MOP_PPID DATABASE_ERROR DATA_ERROR
CONFIDENTIAL
CONFIDENTIAL

4.10.2 Command 4: Product Suspension

Usage Note
▪ It is not advised to use this command for new developments. Use command 20
(Suspend Subscriber ICC) instead.
The SMS uses this command to suspend a service or PPV entitlement in a smart card for a
certain product.
The end user will not be able to watch the corresponding services or PPVs until the SMS sends a
product reactivation command. Command 4 may be used when there is a payment problem
with the end user. Command 4 does not impact callbacks.
Important
▪ This command shall not be used for A-la-carte subscription products.
Command 4: Product Suspension

Range: 000000000000 to 004294967295

CONFIDENTIAL
CONFIDENTIAL

4.10.3 Command 5: Product Reactivation

Usage Note
▪ It is not advised to use this command for new developments. Use command 21
(Reactivate Subscriber ICC) instead.
The SMS uses this command to reactivate a service or PPV entitlement in a smart card in cases
where the entitlement has previously been suspended with command 4 (Product Suspension).
The end user will then be able to watch the corresponding services or PPVs again.
Important
▪ This command shall not be used for A-la-carte subscription products.
Command 5: Product Reactivation

IMS_product_id 12 num IMS Product ID
Range: 000000000000 to 004294967295

IMS_product_id RIGHT_NOT_FOUND NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

4.10.4 Command 6: Product Cancellation

Usage Note
▪ It is not advised to use this command to cancel more than one product at once. Use
command 904 (Cancel List of Products) instead.
The SMS uses this command to remove an entitlement from a smart card for a certain product.
This command is applicable to entitlements that have been purchased through the SMS. In
other words, any impulsively purchased entitlement can be cancelled with this command
(whether the assets have been watched or not and whether they have been call-collected or
not).
Cancelling entitlements purchased impulsively has no impact on the end user’s credit in the
smart card (no credit refund occurs).
Important
▪ When several instances of the same product are created on the smart cards,
command 6 cancels all instances of this product.
▪
Command 6: Product Cancellation

Range: 000000000000 to 004294967295

IMS_product_id BAD_PRODUCT_TYPE NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

4.10.5 Command 7: All Products Cancellation

The SMS uses this command to remove all types of entitlements from a smart card. However, it
does not affect impulsive entitlements that have not been call–collected: those will be call-
collected at the next callback.
Important
▪ This command could also suspend the IPPV purchases. It is the equivalent of
command 14 (Suspend Impulse Purchase). This behavior depends on the
configuration of the CAS.
Command 7: All Products Cancellation


CONFIDENTIAL
CONFIDENTIAL

4.10.6 Command 8: Credit management

The SMS uses this command to modify the data of an existing credit record in a smart card. It is
mandatory for smart card to have a credit record in order to allow end users to purchase IPPVs.
Important
▪ The credit information in a smart card can be updated at 4–second intervals.
▪ Use command 13 (Create Credit for Impulse Purchase) to set the initial credit value in
the smart card.
▪ SMS can resend the current credit value of a smart card (stored in CAS) by sending
this command with a “credit_mode” set to “ADD Credit” and a “credit” set to 0.
The credit data field in the command must not exceed the maximum value: 65,535.99.
Compliance with this requirement is ensured by the Call Collector.
Command 8: Credit Management

credit_mode 2 r_num 01 = ADD CREDIT. The value of ICC_credit
in the smart card is incremented by the
credit value provided in command 8.
03 = SET CREDIT. Set the new credit value.
The value of ICC_credit in the smart card
is set as indicated by the value of credit in
this command.
credit 7 r_num The credit amount.
Range: 00,000.00 to 65,535.99

credit_mode BAD_COMMAND_SYNTAX BAD_CREDIT_MODE
credit BAD_COMMAND_SYNTAX BAD_CREDIT_FORMAT
MOP_PPID ACCOUNT_NOT_FOUND NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

4.10.7 Command 9: Update Credit Threshold

The SMS uses this command to update the end user’s impulse credit threshold value in a smart
card. The credit threshold value is what allows the smart card to trigger callbacks on the basis
of the credit status.
This command should not be used to initialize the Credit Threshold value, which is initialized
implicitly using command 13: Create Credit for Impulse Purchase.
If the credit threshold value is set to 0 (zero), then no callback will be issued by the smart card.
Command 9: Update Credit Threshold

threshold_credit 7 r_num The lower limit under which the smart card must
carry out a low credit callback.
Range: 00,000.00 to 00255.99
Note: According to the currency coefficient defined

in CAS system, this value can be truncate because
only the integer part after the application of
currency coefficient is taken into account.

threshold_credit BAD_COMMAND_SYNTAX BAD_THRESHOLD_CREDIT_FORMAT
threshold_credit BAD_COMMAND_SYNTAX CREDIT_THRESHOLD_TOO_HIGH
CONFIDENTIAL
CONFIDENTIAL

4.10.8 Command 10: Add Event Product

Usage Note
▪ For new development, it is advised to use SMS command 905 – Add Enhanced List of
Products – instead of SMS command 10.
The SMS uses this command to add an entitlement to an event product in a smart card. Event
products are typically movies showing on a certain channel at a certain date and time.
Command 10 is typically used to add PPV entitlements to end users who cannot purchase PPV
products impulsively.
When the end user purchases an event product through the SMS (by calling Customer Service),
the smart card credit and debit values do not change.
Important
▪ Event products are pre-flagged as “call collected” in the smart card. Consequently,
the purge mechanism will delete event products when the event product date meets
the purge date condition.
▪ For systems without a return path, PPV entitlements recorded in the end user’s
smart card should be deleted using either a background EMM cleanup command or
SMS command 96 (Purge PPV and IPPV Records). For systems with a return path,
PPV entitlements should be deleted using either a background EMM cleanup command
or a CAS CCM command generated during callbacks.
▪ The CAS does not alter the data in the event_name field of the command. The data is
transmitted as it is in the smart card. The STB then displays the data as it displays
the EIT (Event Information Table) data. Consequently, the SMS must format this
string in accordance with the specification of the character set used by the STB.
▪ The event_name string must also include control characters. Consequently, the
number of displayable characters is reduced accordingly.
▪ When multi-instance (N of M) products are added with this command, they are
handled as a new purchase (i.e. the CAS creates a new instance of the products).
▪ Multi-instance Rental or Rental PPV products added with this command are handled
as “re-hit purchases” (i.e. if an active instance exists, the CAS will create the same
instance of the product; otherwise, the CAS will create a new instance).
▪ If the RTM [Business]ackRightIsSuspended is set to false (its default value), this SMS
command will be rejected if the MOP is suspended (by means of SMS command 20)
If the RTM [Business]ackRightIsSuspended is set to true, this SMS command will be
CONFIDENTIAL
CONFIDENTIAL

Command 10: Add Event Product

Range: 000000000000 to 004294967295
length_event_name 2 r_num Length of the valid data in the event_name field.
It must not exceed 30 bytes. This is due to
storage limitations in the smart card.
event_name 32 text The event name as displayed in the PPV
purchase history of the STB user interface. The
number of characters must match the length set
in length_event_name. The remaining bytes
should be filled up with space characters. See
the special note in section 4.6.1.
price 5 num The price of the product, from 000.00 to 999.99.

IMS_product_id PPV_IN_THE_PAST NO_EXTENDED_ERROR_CODE
IMS_product_id BAD_PRODUCT_TYPE REGULAR_PRODUCT
IMS_product_id PPV_PURCHASE_NOT_ALLOWED NO_EXTENDED_ERROR_CODE
length_event_name BAD_COMMAND_SYNTAX LENGTH_TOO_LONG
length_event_name BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
price BAD_COMMAND_SYNTAX BAD_PRICE_FORMAT
CONFIDENTIAL
CONFIDENTIAL

4.10.9 Command 13: Create Credit for Impulse Purchase

The SMS uses this command to add a credit data structure in a smart card. This will allow the
end user to make impulse PPV purchases.
The SMS should send this command only once, when initializing the impulsive purchase
capability on the smart card. Any other credit management task should be done with command
8: Credit Management.
Important
▪ There is no command to remove the credit data structure in an individual smart card.
▪ If threshold_credit is equal to 0 (zero), then no callback will be issued by the smart
card.
▪ This command is used to catch the SMS source ID (see section 3.4).
▪ The SMS source ID is updated each time command 13 is used, even when the credit
has already been created.
▪ This SMS command will be rejected if the MOP is suspended (by means of SMS
command 20) or if the SOP is suspended (by means of SMS command 23).
Command 13: Create Credit for Impulse Purchase

credit 7 r_num The credit amount set in the smart card.
Warning: credit ranges from 00,000.00
to 65,535.99
threshold_credit 7 r_num The lower limit under which the smart card must
initiate a low credit callback.
Range: 00,000.00 to 00655.35

threshold_credit BAD_COMMAND_SYNTAX BAD_THRESHOLD_CREDIT_FORMAT
threshold_credit BAD_COMMAND_SYNTAX CREDIT_THRESHOLD_TOO_HIGH
CONFIDENTIAL
CONFIDENTIAL

4.10.10 Command 14: Suspend Impulse Purchase

The SMS uses this command to suspend the end user’s impulse purchase capability in a smart
card.
The SMS can reactivate impulse purchases using command 15: Reactivate Impulse Purchase.
Command 14 has no impact on callback operations.
Command 14: Suspend Impulse Purchase


CONFIDENTIAL
CONFIDENTIAL

4.10.11 Command 15: Reactivate Impulse Purchase

The SMS uses this command to reactivate the end user’s capacity to make impulse purchases
with the smart card. This command is used to activate the capacity to make impulse purchases
on an end user’s smart card that has previously received command 14 (Suspend Impulse
Purchase) or command 20 (Suspend End-User Smart card).
Command 15: Reactivate Impulse Purchase


CONFIDENTIAL
CONFIDENTIAL

4.10.12 Command 19: Patch Smart Card

SAS replaces MOP by SOP Yes
The SMS uses this command to generate and broadcast the patch EMM currently applicable to a
smart card.
Important
▪ The currently applicable patch EMM is configured at head-end level.
Command 19: Patch Smart Card

Field size Format Description

CONFIDENTIAL
CONFIDENTIAL

4.10.13 Command 20: Suspend Subscriber ICC

The SMS uses this command to suspend all entitlements in a smart card for an individual MOP.
However, depending on the configuration of the head end, viewing the “free access” services
may or may not be possible once the relevant MOP is suspended.
The entitlements for impulsive PPV products, that were already purchased are also suspended.
Important
▪ In order to reactivate a MOP, the SMS must use command 21.
The SMS can still continue to send EMM command to a deactivated smart card (no error will be
returned). It suspends all entitlements of the subscriber,
including those that have been purchased impulsively, as well as the capacity to
make impulsive purchases. This command does not impact callback operations.
Command 20: Suspend Subscriber ICC


CONFIDENTIAL
CONFIDENTIAL

4.10.14 Command 21: Reactivate Subscriber ICC

The SMS uses this command to reactivate all entitlements for an individual MOP. The capacity to
make impulsive purchases is also reactivated.
Command 21: Reactivate Subscriber ICC


CONFIDENTIAL
CONFIDENTIAL

4.10.15 Command 23: Suspend All ICC Features

The SMS uses this command to suspend all features in a smart card, i.e. all entitlements to
services and PPVs, the capacity to make impulse purchases, as well as entitlements to free
access services.
Command 23 also suspends the entitlements to impulsive PPVs that have already been
purchased.
Important
▪ In order to reactivate smart card features, the SMS should use command 24.
The SMS can still continue to send EMM commands to a deactivated smart card (this will not
cause any errors). Command 23 does not affect callback operations.
Command 23: Suspend All ICC Features

UA EXPIRED_CARD NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

4.10.16 Command 24: Reactivate All ICC Features

The SMS uses this command to reactivate all entitlements to services and PPVs in a smart card,
as well as the entitlements to the free access services.
Note: this SMS command is not allowed on a foreign card.
Command 24: Reactivate All ICC Features


CONFIDENTIAL
CONFIDENTIAL

4.10.17 Command 25: Suspend All ICC Features With Delay

The SMS uses this command to schedule a smart card suspension. At the date and time
specified, command 25 suspends all features in a smart card, i.e. all entitlements to services
and PPVs, the capacity to make impulse purchases, as well as the entitlements to free access
services.
Command 25 also suspends the entitlements to impulsive PPVs that have already been
purchased.
Important
▪ To reactivate smart card features, the SMS should use command 24.
The SMS can still continue to send EMM commands to a deactivated smart card (this will not
cause any errors). Command 25 does not affect callback operations.
Command 25: Suspend All ICC Features With Delay

suspension_date 8 YYYYMMDD Suspension date (generally in UTC).
suspension_time 6 HHMMSS Suspension time (generally in UTC).
For Aladin smart cards, the time is set to 23:59:56
and the time provided by the SMS is ignored.

suspension_date BAD_COMMAND_SYNTAX BAD_DATE_FORMAT
suspension_date BAD_COMMAND_SYNTAX BAD_DATE_SEQUENCE
suspension_time BAD_COMMAND_SYNTAX BAD_TIME_FORMAT
CONFIDENTIAL
CONFIDENTIAL

4.10.18 Command 35: Create Operator

The SMS uses this command to add a new MOP zone in a smart card.
This command is used only when there are several operators sharing device (smart card or Set
Top Box / CAK) for independent Pay-TV operations.
For the relevant operator, this command must precede any other command such as command 2
(Add Product) or command 13 (Create Credit).
The SMS can send this command several times without damaging the entitlements already
stored in the smart card.
Important
▪ In a single-MOP environment, this command should not be used because each new
smart card already contains a pre-defined MOP zone for the unique operator.
▪ The purpose of this command is not to render a smart card pristine: this command
does not perform any cleanup in the smart card.
▪ With a foreign smart card, SMS command 35 will be rejected.
Command 35: Create Operator

MOP_PPID 5 num Identifier of the MOP to be created.
Range: 00000 to 99999

UA FOREIGN_SC NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

4.10.19 Command 36: Cancel Operator

The SMS uses this command to remove a MOP zone and all its associated data from a smart
card.
Important
▪ This command will indirectly remove all entitlements and the entire credit record
currently stored in the smart card for a given operator.
▪ With a foreign smart card, SMS command 36 will be rejected.
Command 36: Cancel Operator

MOP_PPID 5 num Identifier of the MOP to be deleted.
Range: 00000 to 99999

CONFIDENTIAL
CONFIDENTIAL

4.10.20 Command 37: Un-kill card

The SMS uses this command to reactivate (i.e. un-kill) a smart card which was killed by
inadvertence during a fingerprinting campaign.
Command 37: Un-kill card


CONFIDENTIAL
CONFIDENTIAL

4.10.21 Command 46: Set Segments

The SMS use this command to set or update the segments in the device (smart card or Set Top
Box / CAK)..
Note
▪ The segments can be used to address a subset of all the subscribers.
▪ This command contains only the segment changes, and therefore the segments not
specified in the command remain unchanged.
▪ The method to reset a segment is to set to 0 the segment subcategory of the given
segment category.
Command 46: Set Segments

nb_of_segments 2 r_num The number of segments provided in this
command.
Range: 00 to 56
for(i=0;i< A counter.
nb_of_segments;i++) {
segment_category 2 r_num Segment category.
Range: 00 to 55
segment_subcategory 3 r_num Segment subcategory.
Range: 000 to 255
}

command_id BAD_COMMAND_SYNTAX NO_EXTENDED_ERROR_CODE
UA BAD_COMMAND_SYNTAX BAD_UA_FORMAT
nb_of_segments BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
segment_category BAD_COMMAND_SYNTAX BAD_CATEGORY_FORMAT
segment_category SEGMENT_NOT_FOUND NO_EXTENDED_ERROR_CODE
segment_subcategory BAD_COMMAND_SYNTAX BAD_SUBCATEGORY_FORMAT
segment_subcategory SEGMENT_NOT_FOUND NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

4.10.22 Command 47: Set Alphanum Zip Code

The SMS uses this command to set or update the zip code on the device (smart card or Set Top
Box / CAK). Command 47 is also used when the subscriber moves to a different location.
Note
▪ The zip code is used for blackouts and delta time.
Command 47: Set Alphanum Zip Code

zip_code 9 r_text The subscriber’s zip code.
The range is restricted to alphanumeric values.
The value is right-padded with trailing space
characters.
num The subscriber’s zip code.
The range is restricted to numeric values.
The value is left-padded with zeros.
List of error codes sent by the CAS (nack messages):

zip_code BAD_COMMAND_SYNTAX BAD_ZIP_CODE_FORMAT
zip_code ZIP_NOT_FOUND NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

4.10.23 Command 48: Set Zip Code

The SMS uses this command to set or update the zip code of the smart card. The zip code
information is primarily used for blackout and time-zone management.
Important
▪ For countries that use a different zip code scheme (such as zip codes with more than
five digits or alphanumeric zip codes), the operator should create a lookup table that
translates the local zip code format into zip code format of the SMS.
Command 48: Set Zip Code

zip_code 5 num The end-user’s zip code. Range: 00000 to 99999

CONFIDENTIAL
CONFIDENTIAL

4.10.24 Command 49: Set Callback Phone Number

The SMS uses this command to set or update the phone number parameter in the smart card.
This parameter allows the smart card and the STB to open a connection with the Call Collector.
The value of the parameter can be a phone number or a MAC address. The STB will determine
how to interpret this number. Here are two examples:
For a phone number such as 1-800-555-1212, the value of cc_number_1 is 18005551212 (with 5
trailing space characters).
For a MAC address such as 00-06-5B-BC-8F-92, the value of cc_number_1 in a decimal form is
27308887954 (with 5 trailing space characters).
To reset the phone number in the smart card, the two following methods are accepted:
Setting cc_number_1 to a string of 16 space characters (ASCII value 0x20)
Setting cc_number_1 to a string of 16 F characters (ASCII value 0x46)
Important
▪ Field cc_number_1 must contain no other characters (such as “-” or “/”).
▪ To set an IP address in the smart card, the SMS must send command 54 (Set
Callback IP Address).
Command 49: Set Callback Phone Number

cc_number_1 16 p_num The telephone number of the Call Collector. This
field must be right-padded with trailing ASCII
space characters.

cc_number_1 BAD_COMMAND_SYNTAX BAD_PHONE_NUMBER_FORMAT
MOP_PPID CB_PROFILE_NOT_FOUND NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

4.10.25 Command 50: Cancel ICC

The SMS uses this command to permanently disable a device (smart card or Set Top Box /
CAK). Command 50 is sent when a device is taken out of operation (for instance, when a device
is reported to be stolen, lost, or damaged).
The SMS is not allowed to use a cancelled device again because the device is not recoverable
after the cancellation operation.
The UA is flagged as cancelled and deactivated in the CAS database. For that reason, any
incoming commands addressed to this device will remain unacknowledged by the CAS system.
Important
▪ The effect of this command in the smart card is not reversible. In other words, the
device will be permanently decommissioned.
Command 50: Cancel ICC


CONFIDENTIAL
CONFIDENTIAL

4.10.26 Command 51: Initialize Smart Card

The SMS uses this command to initialize the MOP zone of a new device.
The SMS must issue this command prior to any other command except in the 2 following cases:
• SMS targets a virtual UA (DLK): SMS ‘126-Assign Virtual UA to NUID’ shall first issue to
link virtual UA to NUID.
• System manages multiple networks: SMS ‘122-Set Network’ shall be issued before this
command to allow routing generated EMM on the network of the targeted device (UA or
virtual UA).
. The CAS will reject all other commands it receives before processing of command 51
successfully completes.
The initialization of a device can occur several times and has no effect on the entitlements
stored in the device.
Important
▪ This command must be the first command the SMS issues for a new smart card,
unless there are multiple networks – in which case the SMS must first issue
command 122 – Set Network.
▪ The purpose of this command is not to reset the device content, i.e. this command
does not perform any cleanup in the device.
▪ This command does not refurbish a smart card in any way.
▪ This command creates the MOP specified in its header. Therefore, even when the
command has SOP privileges, the PPID of the MOP must be specified in the header of
the command (rather than the PPID of the SOP).
Command 51: Initialize Smart Card


UA UA_OUT_OF_RANGE NO_EXTENDED_ERROR_CODE
UA SC_SET_ID_NOT_FOUND NO_EXTENDED_ERROR_CODE
UA CARD_REFURBISHMENT_FAILED NO_EXTENDED_ERROR_CODE
UA VUA_NOT_LINKED_TO_NUID NO_EXTENDED_ERROR_CODE
INVALID_LICENSE LICENSE_CORRUPTED
INVALID_LICENSE LICENSE_COUNT_EXPIRED
INVALID_LICENSE LICENSE_NOT_FOUND
INVALID_LICENSE LICENSE_BAECNT_SYNC
CONFIDENTIAL
CONFIDENTIAL


INVALID_LICENSE PROTECT_LICENSE_ERROR
CONFIDENTIAL
CONFIDENTIAL

4.10.27 Command 52: Pair the ICC With the STB

The SMS uses this command to pair a smart card with the STB.
This command is mandatory and must be sent before any services can be authorized.
Before pairing can take place, the smart card must have been previously initialized with
command 51.
Usage Note
▪ For new development (Merlin only), when pairing more than one STB with the ICC, it
is advised to use SMS command 58 – Pair the ICC with Multiple STBs – instead.
This command is also used to pair a smart card with different STBs (e.g.: for STB swaps).
Important
▪ For virtual UA, this command was no effect on the device. IRDSN will be stored in
CAS database only.
▪ STU_number is a 14-digit string representing a decimal value.
▪ STU_number can be in one of the following formats:
– A 10-digit string followed by 4 space characters, ranging from “0000000000 ” to
“4294967295 ”
– A 14-digit string ranging from 00000000000000 to 00004294967295
▪ The un-pairing action is performed with the same command, with STU_number set to
“0000000000 ” or 00000000000000.
▪ The value of STB_number as provided in the command coming from the SMS must not
include any checksum.
▪ In multi-pairing (Merlin only),, this command allows to manage the slot 0 only. If the
card was paired on other slots, this command used with STU_number=0 doesn’t
unpair these other slots. See more details on the multi-pairing in the SMS command
58.
Command 52: Pair the ICC With the STB

STU_number 14 r_num The serial number of the conditional access (CA) STB,
in a decimal form.
Range: see the Important note above

STU_number BAD_COMMAND_SYNTAX BAD_STU_NUMBER_FORMAT
CONFIDENTIAL
CONFIDENTIAL

4.10.28 Command 53: Clear PIN Code

The SMS uses this command to reset the PIN code of the STB to its default factory value. In
other words, the new PIN code value to which this command forces the STB is not always 0000.
Also, note that it is the design of individual STBs that determine which features or menus will be
protected by the PIN code.
Important
▪ For STBs with a Nagravision CAK and when strong pairing is used:
– Unlike the other commands described in this document, command 53 is sensitive to
the pairing status of the smart card and the STB: when the SMS sends command 53 to
an individual STB, it will only work if the STB is paired with its smart card.
– The pairing function is achieved with command 52.
Command 53: Clear PIN Code


CONFIDENTIAL
CONFIDENTIAL

4.10.29 Command 54: Set Callback IP Address

The SMS uses this command to set or update the smart card field containing the IP address of
the Call Collector.
Command 54: Set Callback IP Address

CC_IP_address 15 ip_num The IP address of the Call Collector.
Field format and range: 000.000.000.000 to
255.255.255.255
CC_IP_port 5 num The TCP/IP port of the Call Collector. Range: 0 to
65535

CC_IP_address BAD_COMMAND_SYNTAX BAD_IP_ADDRESS_FORMAT
CC_IP_port BAD_COMMAND_SYNTAX BAD_CC_PORT_FORMAT
4.10.30 Command 55: Set Callback IPV6 address

The SMS uses this command to set or update the smart card field containing the IPV6 address of
the CAS system.
CONFIDENTIAL
CONFIDENTIAL

COMMAND 55: SET CALLBACK IPV6 ADDRESS

CC_IP_address 39 r_text CAS System IPV6 address.
Field format is
0000:0000:0000:0000:0000:0000:0000:0000 to
FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF.
CC_IP_port 5 num CAS System TCP/IP port.

Field Error codes Error codes extension

CC_IP_address BAD_COMMAND_SYNTAX BAD_IP_ADDRESS_FORMAT
CC_IP_port BAD_COMMAND_SYNTAX BAD_CC_PORT_FORMAT
CONFIDENTIAL
CONFIDENTIAL

4.10.31 Command 56: Set PIN Code

The SMS uses this command to set or update any of the various PIN codes that can be stored in
the smart card. The smart card does not use the PIN codes directly: only the STB applications
use the PIN code values to verify if the end user can access a functionality or menu.
A PIN code is a 4-digit numeric value. The CAS only verifies if the format of the PIN code value
is correct. The CAS does not store the PIN code in its database. The same PIN code can be
updated many times.
Important
▪ Use of this command is operator-specific. Therefore, the solution architect should
provide a document illustrating the use of the PIN code.
▪ This command is available for some types of smart card only.
▪ The effective range of the index parameter depends on the type of smart card. Refer
to the solution architecture.
Command 56: Set PIN Code

Index 2 r_num PIN code number.
Range for Merlin: 00-15
Range for Aladin: 01-16
PIN 4 num PIN code value.

Index BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
Index VALUE_OUT_OF_RANGE NO_EXTENDED_ERROR_CODE
PIN BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
CONFIDENTIAL
CONFIDENTIAL

4.10.32 Command 58: Pair the ICC with Multiple STB

The SMS uses this command to pair or un-pair a smart card with one or several STB (multi-pairing capability).
When strong pairing (standard Nagravision pairing) is mandatory, this command must be issued before any
service can be authorized. The smart card must have previously been initialized with one of the following
commands before pairing can take place: 51or 923.
There is two ways to use this command (and the pairing slots available on the smart card):
• In Absolute mode: SMS indicates the pairing slots to use
• In Relative mode: SMS pairs the SC with the different STB without indicate the slot to use. In this case,
the slot is provided by the HE. In this case, the slots are allocated sequentially by the HE.
Important: in this mode, if SMS wants to remove or update an STB, it shall unpair all STB and re-
added all STB except the removed STB.
When pairing multiple STBs, one and only one of these STBs could be a CAK V6 or CAK V7 AL STB. In that
case, this STB shall be specified in slot0 (in absolute mode, aka SMS controlled mode) or at the first place (in
relative mode aka SAS controlled mode, to be sure the HE will use slot0).
Please find after the important notes, the use cases for each mode.
Important • Please read the Important note of command 52.

• When strong pairing is enabled, soft hardware pairing or chipset
hardware pairing can be used. When chipset hardware pairing is
enabled (chipset_id different from 0000000000) the CAS keeps
the relationship between the STU_number and the
corresponding chipset_id. In general, the CAS uses this
relationship to get the chipset_id, but it can be overwritten (in
case of error in the CAS or unavailability) in the SMS command
58 by specifying a chipset_id different from 0000000001. The
overwriting value will replace the relationship stored in the CAS
database.
• Please note that the similar functionality in the macro-
command 923 does not contain the fields pairing_slot and
chipset_id.
• The chipset_id and all other related fields (i.e.
update_CSP_data, NUID, CTS, chipset_cut_length and
chipset_cut) are not used in Merlin 3.0 and are therefore
ignored. The field disable_CSP_keys_provisioning must be set
to ‘Y’. The command is rejected otherwise
Use cases for the “Absolute mode”:

CONFIDENTIAL
CONFIDENTIAL

1) Normal pairing: pair on unique STB

This command can be used to pair the ICC with one unique STB. In that case, the command has the
same behavior as SMS command 52 except that the command 58 enables to overwrite the chipset_id.
The SMS command syntax is:
Cmd-58 (nb_of_STB = 01, pairing_slot = 00, STU_number = SN)
2) Normal pairing: un-pair the STB

This command can be used to un-pair the ICC with one unique STB. In that case, the command has the
same behavior as SMS command 52. The SMS command syntax is:
Cmd-58 (nb_of_STB = 01, pairing_slot = 00, STU_number = 00000000000000)
3) Multi-pairing: replace a STB by another one

This command can be used to replace a STB by another STB. The SMS command syntax is:
Cmd-58 (nb_of_STB = 01, pairing_slot = slot_nb, STU_number = SN)
4) Multi-pairing: absolute STB setting

This command can be used in absolute mode by giving an exhaustive list of values for the entire pairing
slot. The SMS command syntax is the following:
Cmd-58 (nb_of_STB = 04, pairing_slot = 00, STU_number = SN1, pairing_slot = 01, STU_number =
SN2, pairing_slot = 02, STU_number = SN3, pairing_slot = 03, STU_number =
00000000000000)
In this example the ICC is paired with three STB.
5) Multi-pairing: un-pair all the STB

This command can be used to un-pair the ICC with all the STB. The SMS command syntax is:
Cmd-58 (nb_of_STB = 00)
6) Multi-pairing: un-pair one STB

This command can be used to un-pair the ICC with the STB that is at a given pairing slot. The SMS
command syntax is the following:
Cmd-58 (nb_of_STB = 01, pairing_slot = slot_nb, STU_number = 00000000000000).
Use cases for the “Relative mode”:
7) Multi-pairing: add a STB

This command can be used to pair the ICC with an additional STB. The Head End will determine the
next available pairing slot (if any left). The SMS command syntax is the following:
Cmd-58 (nb_of_STB = 01, pairing_slot = 99, STU_number = SN)
8) Multi-pairing: add several STB

This command can be used to pair the ICC with several additional STB. The Head End will determine
the next available pairing slot (if any left). The SMS command syntax is the following:
Cmd-58 (nb_of_STB = 03, pairing_slot = 99, STU_number = SN1, pairing_slot = 99, STU_number =
SN2, pairing_slot = 99, STU_number = SN3)
CONFIDENTIAL
CONFIDENTIAL

9) Multi-pairing: un-pair all STB

This command can be used to un-pair the ICC with all the STB. The SMS command syntax is the
following:
a) Cmd-58 (nb_of_STB = 00) OR
b) Cmd-58 (nb_of_STB = 01, pairing_slot = 99, STU_number = 0)
10) Replace an STB with another one

To replace an STB with another one, all the pairings must be undone first, then the pairings are added
including the new STB instead of the old one:
Cmd-58 (nb_of_STB = 00) – unpair all STBs
Cmd-58 (nb_of_STB = 03, pairing_slot = 99, STU_number = SN1, pairing_slot = 99, STU_number
=SN3, pairing_slot = 99, STU_number = SN4) – pair with STB SN1, SN3 and SN_4
CONFIDENTIAL
CONFIDENTIAL

COMMAND 58: PAIR THE ICC WITH MULTIPLE STB

disable_CSP_ke 1 Alpha Flag specifying whether the chipset strong pairing (CSP)
ys_provisioning keys shall be sent to the smart card or not. In all cases, the
pairing is performed.
Value is either ‘Y’ (CSP key are not provisioned to SC) or

‘N’ (CSP keys are sent according to the SAS
configuration).
Only the value ‘Y’ is currently supported.

nb_of_STB 2 r_num Number of STB to which the smart card must be paired
with.
The range is 00 to 04.
When nb_of_STB is set to 00 then it un-pairs all the STB.
for(i=0;i< Counter
nb_of_STB; i++)
{
pairing_slot 2 r_num Pairing slot.
The range is 00 to 03.
When the pairing_slot is set to 99 it uses the next
available pairing slot (if any left) and pair the STB.
STU_number 14 r_num CA STB serial number.
Range 00000000000000 to 00004294967295
When the STU_number is set to 00000000000000 then it
un-pairs the STB of the given pairing slot.
chipset_id 10 r_num Chipset identifier of the STB.
Range 0000000000 to 4294967295
When the chipset_id is set to 0000000000 then the chipset
hardware pairing is disabled for this smart card (i.e. soft
hardware pairing data is sent to the smartcard).
When the chipset_id is set to 0000000001 then this field
is ignored and the chipset id is retrieved from the CAS
database.
When the STU_number is set to 00000000000000 then
the chipset_id does not apply and this field is therefore
ignored.
update_CSP_dat 1 Alpha Flag specifying whether the CSP data (i.e. NUID, CTS
a and chipset cut) associated to the targeted IRDSN shall be
updated or not.
Value is either ‘Y’ (CSP data are updated into CAS

system before to get the CSP keys) or ‘N’ (the CSP data
available in the CAS system will be used to select the
CSP keys to send to smart card).
NUID 10 num Nagra unique ID identifying the chipset.
The range is 0000000000 to 4294967295.
CTS 12 r_text Chipset type string.
chipset_cut_leng 2 Num Number of characters for the chipset cut.
th The range is 00 to 19.
Important: If the 'update_csp_data' field is set to true and

the chipset cut length is 0, the NUID and CTS will be
CONFIDENTIAL
CONFIDENTIAL

updated but not the chipset cut (optional field).

chipset_cut var r_text Chipset cut.
}

nb_of_STB TOO_MANY_ITEMS NO_EXTENDED_ERROR_CODE
nb_of_STB BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
pairing_slot BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
pairing_slot VALUE_OUT_OF_RANGE NO_EXTENDED_ERROR_CODE
pairing_slot NO_FREE_PAIRING_SLOT NO_EXTENDED_ERROR_CODE
STU_number BAD_USAGE ALREADY_PAIRED_WITH_STB
STU_number BAD_USAGE BAD_STU_NUMBER_FORMAT
chipset_id BAD_COMMAND_SYNTAX BAD_CHIPSET_ID_FORMAT
disable_CSP_keys BAD_USAGE NO_EXTENDED_ERROR_CODE
_provisioning
CONFIDENTIAL
CONFIDENTIAL

4.10.33 Command 60: Immediate Callback

The SMS uses this command to force a smart card to call back the CAS “immediately”. Due to
the architecture of the system, an immediate call implies that the CAS expects to receive a
callback from a given smart card within a time frame ranging from a few seconds to several
hours. The best-case scenario depends on the settings of the CAS and on the behavior of the
STB with respect to such callbacks. In the worst case, the callback takes several hours to arrive
due to the behavior of the STB: when an STB performs a callback, if the call fails for any reason
(e.g. the line is busy), the STB will try calling again within a period that can range from a few
minutes to several hours.
Important
▪ The CbDate and CbTime fields are optional.
Command 60: Immediate Callback

CbDate 8 YYYYMMDD The CAS recomputes the value of field CbDate. This
parameter can therefore be set to any valid date. It
is recommended to set CbDate to the current date.
optional
CbTime 6 HHMMSS The CAS recomputes the value of field CbTime. This
parameter can therefore be set to any valid time.
It is recommended to set CbTime to 000000.


CONFIDENTIAL
CONFIDENTIAL

4.10.34 Command 61: Enable Automatic Callback

The SMS uses this command to activate the automatic feedback feature in a smart card. For
more information about the data received by the SMS when a smart card and its STB perform a
callback, refer to section 4.11.12 – Command 123: Trigger Broadcast of Conditional EMM.
Important
▪ If for any reason the SMS issues this command a second time to an individual smart
card, the date_first_call parameter cannot be set to a date that is earlier than the
date sent the first time.
▪ CbTime is an optional field.
Command 61: Enable Automatic Callback

call_freq 2 r_num_x 01 = annual
02 = semi-annual
03 = quarterly
04 = monthly
05 = semimonthly
1m = every m days (1 should be considered as a flag)
m ranges from 1 to F (where F means 15 days)
date_first_call 8 YYYYMMDD The first date (in UTC) on which the smart card should
call back.
CbTime 6 HHMMSS Field CbTime is recalculated by the CAS. Consequently,
this parameter can be any valid time. It is
optional
recommended to set it to 000000.

call_freq BAD_COMMAND_SYNTAX BAD_FREQUENCY_FORMAT
date first call BAD_COMMAND_SYNTAX BAD_DATE_FORMAT
date_first_call BAD_USAGE BAD_DATE_SEQUENCE
CONFIDENTIAL
CONFIDENTIAL

4.10.35 Command 62: Disable Automatic Callback

The SMS uses this command to deactivate the automatic callback feature in a smart card.
When automatic callbacks are disabled, callbacks will still be triggered when the memory is full,
when the credit threshold limit is reached, due to special events, or as a consequence of an
immediate callback command.
Command 62: Disable Automatic Callback


4.10.36 Command 65: Force Smartcard Synchronization
The SMS uses this command to force a smart card to “immediately” call back the CAS and to request a smart
card synchronization. The smart card synchronization means to compare subscription entitlements between the
CAS database and the smart card. Any discrepancy in the smart card will be corrected.
Due to the architecture of the system, an immediate call means that the CAS expects to receive a call back from
a given smart card in a time frame from a couple of seconds to several hours. The best case depends on the
setting of the CAS and on the STB behavior regarding such call back. The worst case is several hours; due to the
behavior of the STB. Indeed, when a STB performs a call back, and if the call fails for any reason (e.g. the line is
busy), the STB will try again within a period of a couple of minutes to several hours.
COMMAND 65: FORCE SMARTCARD SYNCHRONIZATION

synchro_type 1 r_text Smartcard synchronization type:
‘D’: DB synchronization
List of error codes (in NACK messages) applicable to this section of the message.
CONFIDENTIAL
CONFIDENTIAL

command_id BAD_COMMAND_SYNTAX BAD_COMMAND_ID

synchro_type BAD_COMMAND_SYNTAX 4.10.37 BAD_SYNCHRO_TYPE
CONFIDENTIAL
CONFIDENTIAL

4.10.38 Command 69: Send Generic IRD Command

The SMS uses this command to send an IRD command to a decoder. The decoder will execute
an operation based on the instruction in the IRD command (e.g.: set the network ID, force
tune, etc.). In other words, this command is not intended to modify the data in the device
(smart card or Set Top Box / CAK),, but rather to have the decoder execute an action. To
complement command 69, the CAS provides a secure transport mechanism between the head
end and the STB.
Important
▪ This command is applicable to native Nagravision STBs with a CAK. For other STBs,
refer to command 99 (section 4.10.45).
▪ For STBs with a Nagravision CAK when strong pairing used: unlike the other
commands described in this document, command 69 takes into consideration the
pairing status of the smart card and the STB: command 69, when sent to an
individual STB, will work only if the STB is paired with its smart card. The pairing
takes place using command 52.
The data structure that the CAS sends to the STB is described below. The SMS Gateway
computes fields “sequence_number” and “checksum” for the convenience of the SMS: the SMS
does not provide these two parameters.
command_body{
sequence_number 32 uimsbf
command_id 8 uimsbf
operation 8 uimsbf
for (i=0;i<N;i++){
data 8 uimsbf
}
checksum 8 uimsbf
}
As explained above, the purpose of an IRD command is to provide the decoder with a message
that will instruct the decoder to execute an action (e.g.: reset the PIN code). The command_id
and operation parameters provided to the decoder contain two indexes that indicate which
subroutine the decoder should execute.
Nagravision provides STB manufacturers with a list of command_id and operation values for a
list of specific actions. This document is entitled “Conditional Access Kernel – IRD Command
Specification” (see reference [2]).
CONFIDENTIAL
CONFIDENTIAL

Command 69: Send Generic IRD Command

IRD_command_id 3 r_num The command_id field of IRD command_body.
Range: 000 to 255
IRD_operation 3 r_num The operation field of IRD command_body.
Range: 000 to 255
IRD_data_length 2 r_num Length of the useful portion of the IRD_data
field, in bytes. Range: 00 to 48
IRD_data 96 r_text Hexadecimal data coded in the ASCII format.
The string must be transferred in full
(96 characters representing 48 bytes). However,
only the first IRD_data_length bytes on the left
will be included in the data field of the IRD
command_body.

IRD_command_id BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IRD_operation BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IRD_data_length BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IRD_data BAD_COMMAND_SYNTAX BAD_DATA_FORMAT
CONFIDENTIAL
CONFIDENTIAL

Below is an example on how IRD_data should be formatted. In this example, IRD command
Force Tune is sent to the STB. In the IRD command specification document (reference [2]),
the data structure is as follows:
Parameter Value in a decimal Value in a hexadecimal Size in bytes
form form
command_id 193 – 3
operation 001 – 3
network_id – 05 11 2
transport_id – 00 09 2
service_id – 00 0C 2
In this example, IRD_data_length is 6. The following figure shows the detailed string of bytes
in the buffer that should be sent by the SMS. Note that the remaining byte of field IRD_data
must be filled with zero characters (0x30 in a hexadecimal form).
Figure 4-1: Buffer of command 69 sent by the SMS
CONFIDENTIAL
CONFIDENTIAL

4.10.39 Command 71: Get Products

The SMS uses this command to retrieve a list of all the non-impulsive products (subscriptions or
PPVs) known to the CAS for an individual smart card (i.e. an individual end user).
The information comes from the CAS database, which returns the products asynchronously on
the feedback port using command 215: Products List.
Limitations: This command does not support a-la-carte products and requires the deployment of
an ITM module. The SMS command 127 however does not have these limitations and is
synchronous. It is recommended to use SMS command 127.
Command 71: Get Products


CONFIDENTIAL
CONFIDENTIAL

4.10.28 Command 77: Configure auto scanning

This command allows to configure the autoscanning feature of the TV set.
It is used to determine if the TV set is using BAT (Bouquet Association Table), NIT (Network
Information Table) or proprietary mechanism to perform the scanning of the channels
Cable operators are often using bouquet-id or network-id to perform the scanning. Some other
operators may also use channel-lineup-id to get the appropriate channel list
For all devices except TVKey, this command is translated to an IRD Dnasp (5E), that must be
supported by the middleware. Communicate with the STB manufacturer the need to support this
IRD command.
COMMAND 77: CONFIGURE-AUTO SCANNING

scanning_type 1 num The type of information on which the scanning is
based.
0: Channel information is get from the BAT
1: Channel information is get from the NIT
2: Channel information is get form the channel lineup.
scanning_id 8 num Id of the BAT, NIT or channel line-up
For BAT and NIT range is from 0 to 65535
For channel-lineup range is from 0 to 16777215

scanning_type VALUE_OUT_OF_RANGE BAD_SCANNING_TYPE
scanning_id VALUE_OUT_OF_RANGE BAD_SCANNING_ID
4.10.29
CONFIDENTIAL
CONFIDENTIAL

4.10.29 Command 78: Refresh Smart Card

This command ensures that a smart card has all elements needed to work as expected. This command is
especially useful when a smart card has missed EMM by not being tuned to live EMM stream for an unknown
amount of time.
This command may refresh the following smart card elements:

• Global SC elements, provided that the SMS command’s refresh_mode requests it:
o Validity
o Segments (Merlin) or blackout (Aladin)
o DeltaTime
o ZIPCode
o Pairing
o Callback parameters
o Encryption keys (according to SC generation and CAS configuration).
• MOP, for the SMS command’s MOP, provided that the SMS command’s refresh_mode requests it:
o Validity
o Various other attributes
o Credit
o Non expired products of type indicated in product_type_bitmap.
o MOP encryption keys (according to SC generation and CAS configuration).
The smart card elements that are effectively refreshed vary in function of:
• The SMS command attributes:
o The refresh_mode.
o For entitlements, the product_type_bitmap.
• The CAS configuration parameters:
o A CAS configuration parameter dedicated to this command. This
parameter is a bitmap where each bit enables / disables the refresh of a
given element or set of elements.
o CAS configuration parameters which are not specific to this SMS
command but which also apply for this command.
Important
▪ If the smart card has several active MOP then this command should be sent for each
desired MOP.
▪ Depending on the product_type_bitmap value and the CAS configuration this
command may generate many EMM. Therefore the diffusion profile associated to this
command and the broadcast duration shall be configured carefully
The EMM generated by this command will contradict all the other EMM currently on the air for
the given smart card and which have the same purpose / action.
Contradicted EMM will no longer be on air.
• If the smart card has several active MOP then this command should be sent for each
desired MOP.
• Depending on the product_type_bitmap value and the CAS configuration this command
may generate many EMM. Therefore the diffusion profile associated to this command and
the broadcast duration shall be configured carefully.
• The EMM generated by this command will contradict all the other EMM currently on the
CONFIDENTIAL
CONFIDENTIAL

air for the given smart card and which have the same purpose / action.
Contradicted EMM will no longer be on air.
COMMAND 78: REFRESH SMART CARD

refresh_mode 1 r_num Specifies the SC refresh mode. The supported values
are:
• 1: SC global elements
• 2: MOP elements
• 3: SC global elements and MOP elements
range: 1 to 3
product_type_bitmap 8 r_num Specifies the product types that must be refreshed. It is
a 24-bits bitmap where each bit represents a product
type and bit 0 is the lsb:
• Bit 0: Subscription (PAP only)
• Bit 1: Reserved for future usage (RFU)
• Bit 4: PPV
• Bit 8: Rental
• Bit 9 to bit 23 (msb): Reserved for future usage (RFU)
range: 00000000 to 00000273
CONFIDENTIAL
CONFIDENTIAL


MOP_PPID DATABASE_ERROR DATA_ERROR (invalid parent MOP)
refresh_mode VALUE_OUT_OF_RANGE NO_EXTENDED_ERROR_CODE
product_type_bitmap VALUE_OUT_OF_RANGE NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

4.10.40 Command 79: Force Tune

The SMS uses this command to force the STB to tune to a given TV program (i.e. a service).
The SMS identifies this service using three parameters. For a detailed description, refer to the
DVB specifications.
network: the DVB network of the service
transport: the transport ID of the service within the network
service: the program number to which the STB must tune within the transport
Important
▪ For backward compatibility, the CAS supports the following fields in both a decimal
and a hexadecimal data format:
– Network_id
– Transport_id
– Service_id
▪ The SMS provides data in either a decimal (mode 1 as illustrated below) or a
hexadecimal format (mode 2). The default CAS package complies with mode 1. For
mode 2, a special CAS package should be installed.
Important
▪ For STB with a Nagravision CAK when strong pairing used: unlike the other
commands described in this document, command 79 takes into account the pairing
status of the smart card and the STB: command 79 will work only if the STB is paired
with its smart card.
Command 79: Force Tune – Mode 1 (Decimal Format)

network_id 5 r_num Range: 00000 to 65535
transport_id 5 r_num Range: 00000 to 65535
service_id 5 r_num Range: 00000 to 65535
Command 79: Force Tune – Mode 2 (Hexadecimal Format)

network_id 4 hex Range: 0000 to FFFF
transport_id 4 hex Range: 0000 to FFFF
service_id 4 hex Range: 0000 to FFFF
CONFIDENTIAL
CONFIDENTIAL

The SAS detects the format used automatically, both formats can be used.

CONFIDENTIAL
CONFIDENTIAL

4.10.41 Command 84: Send PRM Credentials

The SMS uses this command to send credentials to the PRMLib hosted on a decoder. The PRMLib
will execute an operation based on the credentials instruction (ex: provide a VOD license to
STB, etc.). In other words, this command is not intended to modify the data of the smartcard,
but it is intended to start an action executed by the decoder. The CAS provides with this
command a secure transport mechanism between the head-end and the STB.
Important
▪ This command can only be used to send a PRM credentials to a STB having a
Nagravision CAK (i.e. it cannot be used with MediaGuard STB without Nagravision
CAK). The CAS does check the STB context to accept or reject this SMS command.
▪ This command carries the credentials using IRD commands. Thus this command can
only be processed once the STB is correctly paired with the smart card or Set Top Box
/ CAK).. The pairing means either “strong pairing” or “secured channel”.
▪ The pairing function is achieved with command 52.
Command 84: Send PRM Credentials

credentials_op_id 3 r_num The operation identifier of the credentials.
Range: 000 to 063
The values currently supported are:
000 = VOD license
credentials_len 5 r_num Length of the credentials in bytes.
Range: 00000 to 16065
credentials 2x r_text This field contains a string of characters
credentials_len (see note representing hexadecimal data encoded in the
below) ASCII format (two characters for one byte).
Important
▪ As indicated in the table above, the format of the credentials field is r_text. However,
it does not contain a regular string: it is not a text field, such as “this is a sentence
with characters and 1 2 3 4 numerical values”. The data in the bitmap field is a
sequence of hexadecimal numbers encoded in a text format. Consequently, the field
will only accept alpha characters A, B, C, D, E, F representing the numbers 10 to 15
in a hexadecimal form.
▪ As an example – the CAS will accept the following credential value:
A0BCD12A29327B9F. In this example, credentials_len is equal to 8.

credentials_op_id BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
credentials_len BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
credentials BAD_COMMAND_SYNTAX BAD_DATA_FORMAT
CONFIDENTIAL
CONFIDENTIAL

4.10.42 Command 88: Send BAEKey At Activation

The SMS uses this command to initialize the BAE Key of the new device. This command is
applicable only to DLK SCs.
The initialization of a device can occur several times and has no effect on the entitlements
stored in the device.
Important
▪ The purpose of this command is to enable/disable the BAE key for the virtual SC.
▪ This command does not refurbish a smart card in any way.
Command 88: Send BAE Key at activation


INVALID_LICENSE LICENSE_CORRUPTED
INVALID_LICENSE LICENSE_COUNT_EXPIRED
INVALID_LICENSE LICENSE_NOT_FOUND
INVALID_LICENSE LICENSE_BAECNT_SYNC
INVALID_LICENSE PROTECT_LICENSE_ERROR
CONFIDENTIAL
CONFIDENTIAL

4.10.30 Command 91: Anti-splitter Configuration

This command allows to configure the security feature known as “anti-splitter” on a smartcard by
setting the profile that is applicable to this smartcard.
The profiles depend on the number of live and PVR streams supported by the STB in which the card
is inserted, and are defined by the operator. The SAS can optionally be configured to know the list
of supported asp_profile_id, and to reject the command if an unsupported profile is used.
This command also allows to (re)activate the anti-splitter by setting the new applicable profile in
case the anti-splitter was disabled. It is however not possible to disable the anti-splitter from the
SMS.
COMMAND 91: ANTI-SPLITTER CONFIGURATION

asp_profile_id 2 num The ID of the anti-splitter configuration which must
be applied by the smartcard. The range is comprised
between 00 and 99.

asp_profile_id BAD_USAGE ASP_PROFILE_ID_NOT_AUTHORIZED
CONFIDENTIAL
CONFIDENTIAL

4.10.43 Command 96: Purge PPV and IPPV Records

The SMS uses this command to purge individual smart cards from ENT (containing access rights
of non-impulsive and impulsive purchases) record data that match a deletion condition. The two
examples below illustrate how this command works:
Example 1: to purge old PPV and IPPV records stored in smart cards when end users complain
that their smart card is full. As a result of the operation, the end user will be able to make IPPV
purchases in the future.
Example 2: to prevent useless PPV and IPPV records from filling up the smart card. This can be
seen as a preventive cleanup task. In this example, each time an end user calls the SMS center
for additional credit, the SMS will issue command 96.
Important
▪ This command will purge only impulsive purchases (e.g. IPPV) set to “call collected”.
▪ The value (price) of PPVs or IPPVs that are not watched can be credited to the smart
card. This feature is activated when the SAS is configured accordingly.
▪ For Aladin smart card : in the case of the system is deployed:

▪ Without return path: the condition_date shall be equal to cleanup_date.
Thus, the command will purge all IPPV records.
▪ With a return path: the condition_date shall be set to 19920101. In this
case, only the IPPV records flagged as “call collected” will be purged.
Command 96: Purge PPV and IPPV Records

cleanup_date 8 YYYYMMDD Purge the smart card of all ENT records for which the
expiration date antedates cleanup_date.
condition_date 8 YYYYMMDD Merlin: This date is ignored by system but shall be set
to a valid date (e.g. 19920101).
Aladin:
– If a return path exists, condition_date =
19920101
– If no return path exists, condition_date =
cleanup_date
CONFIDENTIAL
CONFIDENTIAL


cleanup_date BAD_COMMAND_SYNTAX BAD_DATE_FORMAT
cleanup_date BAD_COMMAND_SYNTAX DATE_NOT_IN_THE_PAST
condition_date BAD_COMMAND_SYNTAX BAD_DATE_FORMAT
CONFIDENTIAL
CONFIDENTIAL

4.10.44 Command 97: Set IPPV Records as Reported

SAS replaces MOP by SOP no
The SMS uses this command to identify IPPV records on an individual smart card as reported.
This command should be used to address only decoders working in prepaid mode without the
return path mode. A decoder without a return path is a decoder that is not connectable to a
Nagravision Call Collector.
Important
▪ This command should only be used in prepaid mode environments.
This command should be used by the SMS prior to cleaning up the IPPVs in the smart card. The
two typical examples below illustrate how to use this command. In both cases, the objective is
the same: to prevent useless IPPV records from filling up the smart cards. This can be seen as a
preventive cleanup task. What differentiates the two examples is the condition that triggers the
operation:
Example 1: the SMS periodically and automatically sends command 97 to specific smart cards.
Example 2: each time an end user asks for additional credit (in prepaid mode), the SMS issues
command 97.
Command 97: Set IPPV Records As Reported

collect_date 8 YYYYMMDD Identifies any IPPV record stored in a smart card
as reported (flag call-collected = 1) if the
IPPV expiration date antedates or matches
parameter collect_date.

collect_date BAD_COMMAND_SYNTAX BAD_DATE_FORMAT
collect_date BAD_COMMAND_SYNTAX DATE_NOT_IN_THE_PAST
CONFIDENTIAL
CONFIDENTIAL

4.10.45 Command 99: Send Generic IRD Command II

The SMS uses this command to send an IRD command to a decoder. The decoder will execute
an operation based on the instruction in the IRD command (e.g.: set the network ID, force
tune, etc.). In other words, this command is not intended to modify the data in the smart card,
but rather to have the decoder execute an action. To complement command 99, the CAS
provides a secure transport mechanism between the head end and the STB.
Important
▪ Use this command to send an IRD command to an STB with a CAK
▪ For native Nagravision STBs with a CAK, IRD commands can only be processed once
the STB is correctly paired with the smart card (here the term “pairing” means either
“strong pairing” or “secure channel”).
▪ For STBs with a Nagravision CAK when strong pairing is used: unlike the other
commands described in this document, command 99 takes into consideration the
pairing status of the smart card and the STB: command 99 will work only if the STB
is paired with its smart card.
Examples are provided below (see sections 4.10.45.1 and 4.10.45.2).
Command 99: Send Generic IRD Command II

IRD_command_id 3 r_num The command_id field of the IRD command_body.
Value 254 is reserved for specifying that the
command targets an MG STB without CAK.
Range: 000 to 255
IRD_operation 3 r_num The Operation field of the IRD command_body
(for STBs with a CAK) or the Type field of the
IRD action (for MG STBs without CAK).
Range: 000 to 255
IRD_data_length 3 r_num Length of IRD_data, in bytes.
Range: 000 to 255 – the following restrictions
may apply depending on the STB context:
• 000 to 048 for DNASP-2 Nagravision CAKs
(Aladin)
(Merlin)
• 000 to 142 for cardless Nagravision CAKs
• 000 to 088 for STBs with a native MG CAK
(IRD action)
The CAS does not perform any consistency check
between IRD_data_length and the STB context.
IRD_data 2x r_text This field contains a string of characters
IRD_data_length (see note representing hexadecimal data encoded in the
below) ASCII format (two characters for one byte).
Important
▪ As indicated in the table above, the format of the IRD_data field is r_text. However, it
CONFIDENTIAL
CONFIDENTIAL

characters and 1 2 3 4 numerical values”. The data in the IRD_data field is a

sequence of hexadecimal numbers encoded in a text format. Consequently, the field
will only accept alpha characters A, B, C, D, E, F representing the numbers 10 to 15
in a hexadecimal form.
▪ As an example – the CAS will accept the following IRD_data_byte value:
A0BCD12A29327B9F. Therefore, the value of IRD_data_length is 8.

IRD_command_id BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IRD_operation BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IRD_data_length BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IRD_data BAD_COMMAND_SYNTAX BAD_DATA_FORMAT
4.10.45.1 Example: an STB with a Nagravision CAK

The IRD_command_id field has a value different from 254.
The following describes the structure of the data sent to the STB. The SMS gateway computes
fields sequence_number and checksum for the SMS: the SMS does not provide these two
parameters.
command_body{
command_id 8 uimsbf
operation 8 uimsbf
for (i=0;i<N;i++){
data 8 uimsbf
}
checksum 8 uimsbf
}
As explained above, the purpose of an IRD command is to provide a message that will instruct
the decoder to execute an action (e.g.: set the network ID). The command_id and operation
parameters provided to the decoder contain two indexes that indicate which subroutine the
decoder should execute.
Nagravision provides STB manufacturers with a list of command_id and operation values for a
list of specific actions. This document is entitled “Conditional Access Kernel – IRD Command
Specification” (see reference [2]).
4.10.45.2 Example: an STB with a native MG CAK

The IRD_command_id field is set to 254.
The following describes the structure of the data sent to the STB. The SMS Gateway computes
field sequence number (named index in the MG terminology) for the SMS: the SMS does not
provide this parameter.
command_body{
type 8 uimsbf
CONFIDENTIAL
CONFIDENTIAL

for (i=0;i<N;i++){
data 8 uimsbf
}
}
As explained above, the purpose of an IRD command is to provide a message that will instruct
the decoder to execute an action (e.g.: reset the PIN code). The type parameter provided to
the decoder contain an index that indicate which subroutine the decoder should execute.
Nagravision provides STB manufacturers with a list of type values for a list of specific actions.
This document is entitled “Mediaguard DVB Header Specification & Clear EMM Specification”.
CONFIDENTIAL
CONFIDENTIAL

4.11 CONTROL commands (1nn)

Commands of the 1nn series are used to set the Call Collector module data that is related to a
subscriber but not sent to the device (smartcard or Set Top Box / CAK).callbacks generated by
the STBs. The data provided in 1nn commands is stored in the CAS database. This means that
the data is persistent.
4.11.1 Command 100: Redefine Credit Limit
The SMS uses this command update the Call Collector database to set or change the amount of
credit that will be added during any callback in an individual user’s smart card.
The Call Collector will automatically update the credit information in the smart card, but only at
the next callback from the STB of the smart card.
The new credit in the smart card will be the sum of credit_limit and the current smart card
debit.
Important
▪ The credit_limit field in the command is a 7-digit value. However, the smart card
reads this value as a 5-digit integer unit, followed by 2 digits representing cents.
Furthermore, the greatest value applicable to the smart card is 65,535.99. As a
consequence, for countries where the currency contains several figures (e.g.: Japan),
the credit value should be considered as a result of a division of the currency value,
i.e. the value divided by 100 or 1000.
▪ In a pay-TV site with prepaid mode where STBs have a return path, credit_limit
should be set to 00,000.00. This means that the smart card credit will not be updated
during any callback.
Command 100: Redefine Credit Limit

credit_limit 7 r_num Credit limit. Range: 00,000.00 to 65,535.99

credit_limit BAD_COMMAND_SYNTAX BAD_CREDIT_FORMAT
CONFIDENTIAL
CONFIDENTIAL

4.11.2 Command 101: Set Authorized Phone Number
The SMS uses this command to set or update an individual end user’s phone numbers in the Call
Collector database. Those numbers are the authorized phone numbers from which a smart card
is allowed to perform callbacks.
Upon each callback, the caller ID (i.e. the phone number from which the STB of the smart card
is calling) will be checked against those authorized phone numbers. The CAS will generate
warning command 205 if the phone number used during the callback is not authorized.
Command 101: Set Authorized Phone Number

phone_number_1 16 p_num The primary phone number. For numbers that do
not require 16 digits, this field must be padded
with trailing ASCII space characters.
phone_number_2 16 p_num The alternate phone number. For numbers that do
phone_number_3 16 p_num The alternate phone number. For numbers that do

phone_number_1 BAD_COMMAND_SYNTAX BAD_PHONE_NUMBER_FORMAT
CONFIDENTIAL
CONFIDENTIAL

4.11.3 Command 104: Create ICC in Call Collector
The SMS uses this command to create a new ICC record in the Call Collector database.
Important
▪ This command is redundant with respect to command 51: Initialize Smart Card. This
command is supported solely for the sake of backward compatibility with SMS
packages operating under DN2 systems. Consequently, new SMS–CAS interfaces
should not use this command.
Command 104: Create ICC in Call Collector

command_id 4 0104 command_id = 0104
STU_number 14 num The Nagravision STB serial number in a decimal form: 10
digits with 4 trailing space characters.
E.g.: “1234567890 ”

STU_number STU_ALREADY_EXISTS NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

4.11.4 Command 105: Cancel ICC in Call Collector
The SMS uses this command to cancel an existing device record in the CAS database. This
command should be issued when the device is deleted from the SMS database.
Important
▪ The end user’s records in the CAS database are cancelled. As a result of this
command, the CAS will accept no more callbacks from the STB. Furthermore, a smart
card that has been cancelled in the Call Collector will not report command 206 (STB
Responding Status).
Command 105: Cancel ICC in Call Collector


CONFIDENTIAL
CONFIDENTIAL

4.11.5 Command 106: Set Purchase Profile
Sets or updates the operator’s Call Collector database to attributes from the subscriber’s
purchase profile.
Important
▪ This command is only supported for backward compatibility purpose. Use SMS
command 107 instead.
Command 106: Set Purchase Profile

category 3 r_num Subscriber’s category.
Range: 000 to 255
Category 0 is reserved for using the standard
product price instead of tier pricing.
enable_online_purchase 1 r_text A flag specifying whether or not online purchases
(i.e. any transaction performed through the return
path) must be accepted. The value is either Y
(accepted) or N (forbidden).
enable_PPV_purchase 1 r_text A flag specifying whether or not purchases in the
PPV, N-of-M and Coins product categories must be
accepted. This applies to both online and SMS
purchase modes. The value is either Y (accepted) or
N (forbidden).
enable_automatic_payment 1 r_text A flag specifying whether or not online purchases
should be automatically debited from the
subscriber’s account. The value is either Y
(accepted) or N (forbidden).

category BAD_COMMAND_SYNTAX INVALID_CATEGORY
enable_online_purchase BAD_COMMAND_SYNTAX BAD_FLAG_VALUE
enable_PPV_purchase BAD_COMMAND_SYNTAX BAD_FLAG_VALUE
enable_automatic_payment BAD_COMMAND_SYNTAX BAD_FLAG_VALUE
CONFIDENTIAL
CONFIDENTIAL

4.11.6 Command 107: Set Purchase Profile With Free Programming
Sets or updates the operator’s Call Collector database to attributes from the subscriber’s
purchase profile.
Command 107: Set Purchase Profile With Free Programming

category 3 r_num The subscriber’s category. Range: 000 to 255
Category 0 is reserved for using the standard
product price instead of tier pricing.
enable_online_purchase 1 r_text A flag specifying whether online purchases (any
transaction over the return path) must be accepted.
The value is either Y (accepted) or N (forbidden).
enable_PPV_purchase 1 r_text A flag specifying whether PPV, N-of-M and Coins
product purchases must be accepted. This applies to
both online and SMS purchase modes. The value is
either Y (accepted) or N (forbidden).
enable_automatic_payment 1 r_text A flag specifying whether online purchases are
automatically debited from the subscriber’s account.
The value is either Y (accepted) or N (forbidden).
free_product_mode 1 r_text Specifies whether the free product quantity figures
are absolute or relative values.
A (Absolute): sets the number of free products
available to the customer for the given product
category.
R (Relative Positive): increases the number of free
products available to the customer for the given
product category.
N (Relative Negative): decreases the number of free
products available to the customer for the given
product category.
nb_of_product_categories 3 r_num The number of product categories provided in this
command. Range: 000 to 010
for(i=0;i<nb_of_product_ A counter.
categories;i++) {
product_category 3 r_num The product category ID.
Range: 000 to 009
nb_of_free_products 2 num The Number of free PPV or PPT products for the
product category. It is either an absolute value that
replaces the currently defined value or a relative
value that is added to or subtracted from the
currently defined value.
Range: 00 to 99
}

CONFIDENTIAL
CONFIDENTIAL


free_product_mode BAD_COMMAND_SYNTAX BAD_FREE_PRODUCT_MODE
nb_of_product_catgories BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
product_category BAD_COMMAND_SYNTAX BAD_PRODUCT_CAT_FORMAT
product_category PRODUCT_CAT_NOT_FOUND NO_EXTENDED_ERROR_CODE
nb_of_free_products BAD_COMMAND_SYNTAX BAD_NB_FREE_PROD_FORMAT
CONFIDENTIAL
CONFIDENTIAL

4.11.7 Command 110: EMM Cleanup
The SMS uses this command to delete all EMMs in the CAS and EMM broadcaster for an
individual device (smart card or Set Top Box / CAK).. This command should be used when a
discrepancy is suspected between the SMS customer data and the EMMs for this customer.
Command 110: EMM Cleanup


4.11.8 Command 111: Get History From CC
The SMS uses this command to request the history from CC of the smart card.
That information comes from the CAS database. The status is returned asynchronously using
either of commands 202/203/216/217: PPV Purchase List.
Command 123: Get Smart Card Synchronization Status


None MESSAGE_NOT_FOUND BAD_SOURCE_ID
None TOO_MANY_ITEMS NO_EXTENDED_ERROR_CODE
MOP_PPID INVALID_PPID NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

4.11.9 Command 120: Enable Callback Rules
The SMS uses this command to activate callback rules in the Call Collector for a smart card.
During the next callback from the STB, the Call Collector will check the PPV purchase history of
the corresponding end user against the various callback rules defined in the CAS database. The
first matching rule may define a new credit limit and a new callback interval for the smart card.
Refer to the SAS ITM DNASP-3 User Guide for a complete description of this marketing facility.
Command 120: Enable Callback Rules

command_id 4 0120 command_ID = 0120

CONFIDENTIAL
CONFIDENTIAL

4.11.10 Command 121: Disable Callback Rules
The SMS uses this command to deactivate, in the Call Collector, the processing of the callback
rules for a smart card and to use a new credit limit as well as a new callback interval for the
smart card.
During the next callback from the STB, the Call Collector will no longer check the purchase
history of the corresponding end user against the various callback rules defined in the CAS
database. Instead, it will use the new credit limit to renew the credit on the smart card and will
compute the next regular callback date using the new callback interval specified in the
command.
Refer to the SAS ITM DNASP-3 User Guide for a complete description of this marketing facility.
Command 121: Disable Callback Rules

credit_limit 7 0000000 to The new credit limit. Range: 0.00 to 65,535.99
6553599
call_freq 2 01 annual
02 semiannual
03 quarterly
04 monthly
05 semimonthly
1m every m days (1 should be considered as a flag)

CONFIDENTIAL
CONFIDENTIAL

4.11.11 Command 122: Set Network

Command 122 sets or updates the CAS network ID and the STB context associated with the
ICC.
In an advanced broadcast system, there are several data paths for the EMMs. The CAS network
ID is one of the CAS parameters that allow setting this data path.
In non-Nagravision native STBs, the external format of the EMMs is different. The STB context
value allows the CAS system to specify the appropriate EMM external format.
Note
▪ If the device does not yet exist in the SAS database, this command will create an
entry for the device.
When
several CAS
networks or
STB
contexts are
applicable
to a single
head end,
thisUsage
▪ For a new smart card:
▪ This command must be the first command issued by the SMS for a new
device.(before the SMS commands initializing the smart card). Otherwise, the
EMMs generated by the SMS commands will either not be routed to the
appropriate CAS network or not be processed by the STB (the EMMs will be in
the wrong external format). An entry for this smart card will be created in
SAS database as it doesn’t exist.
▪ It’s recommended to use the broadcast mode ‘W’ to send this
command. So, EMMs updating the GUA of the smart card will be not sending
on air. These EMMs are not necessary because EMMs updating GUA will be
generated with SMS command initializing the smart card and therefore the
EMMs of this SMS command 122 will be contradicted.
▪ For an existing smart card (re-hit or network ID/ STB context update):
▪ This command shall be sent on each activate MOP to update the GUA of
each MOP and avoid that EMM-GR shall not receive by smart card.
▪ If the CAS network changes, the EMMs that are still broadcast over the
previous CAS network will not move to the new CAS network.
Command 122: Set Network

CAS_network_id 3 r_num The CAS network identifier.
Range: 000 to 999
CONFIDENTIAL
CONFIDENTIAL

Command 122: Set Network

STB_context 2 r_num The STB context. A combination of STB types
(e.g.: native Nagravision STBs or MediaGuard
STBs) and CAK types (e.g.: Merlin or
MediaGuard).
Range: 00 to 99
Currently supported values:
• 00 = Undefined
• 01 = CAK DN2
• 02 = CAK DN3
• 03 = CAK DN4
• 10 = MG (MediaGuard) STB
• 11 = MG STB, downloadable with a CAK
• 20 = BetaCrypt STB

CAS_network_id BAD_COMMAND_SYNTAX BAD_NETWORK_FORMAT
CAS_network_id NETWORK_NOT_FOUND NO_EXTENDED_ERROR_CODE
STB_context BAD_COMMAND_SYNTAX BAD_STB_CONTEXT_FORMAT
STB_context STB_CONTEXT_NOT_FOUND NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

4.11.12 Command 123: Trigger Broadcast of Conditional EMM
This command triggers the start of the broadcast of a conditional add product previously built
using a tool such as CAS Console.
Note
▪ The conditional add product must previously be defined using a tool such as CAS
Console.
▪ The conditional add product is tested in U and S addressing modes using CAS
Console; CAS Console then builds the EMM in G (global) addressing mode. The EMM
is not broadcast until this SMS command triggers the start of the broadcast.
▪ Note that the value of address_type, as provided in the address header, must be
equal to G (global).
Command 123: Trigger Broadcast of Conditional EMM

conditional_id 20 r_num The identifier of the conditional add product.
This field must be right-padded with trailing
space characters.

address_type BAD_USAGE BAD_ADDRESS_TYPE
conditional_id BAD_COMMAND_SYNTAX BAD_CONDITIONAL_ID_FORMAT
conditional_id CONDITIONAL_ID_NOT_FOUND NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

4.11.13 Command 124: Get Smart Card Synchronization Status
The SMS uses this command to request the synchronization status of the smart card.
That information comes from the CAS database. The status is returned asynchronously using
command 218: Smartcard Synchronization Status.
Command 123: Get Smart Card Synchronization Status


CONFIDENTIAL
CONFIDENTIAL

4.11.14 Command 125: Set Subscriber Private Data
The SMS uses this command to store subscribers’ private data in the CAS database. The data is
provided in a string. The format of that string is specified by the SMS. The CAS is only used for
storing the data: it does not check the format or content of the data, neither does it process on
the data in any way. This command is typically used to store the account number.
Important
▪ When the SMS issues this command, any previous value stored in the CAS database
is overwritten by the new value.
▪ The subscriber data is not altered by the CAS. The data is stored as it is in the CAS
database.
▪ The subscriber data must only contain printable characters.
▪ There is no SMS command provided for retrieving the subscribers’ private data.
Command 125: Set Subscriber Private Data

sub_data_length 3 r_num The number of characters forming the subscriber
data.
Range: 000 to 064
sub_data sub_data_length r_text A string of characters representing the subscriber
data (this string must only contain printable
characters).

sub_data_length BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
sub_data BAD_COMMAND_SYNTAX BAD_DATA_FORMAT
CONFIDENTIAL
CONFIDENTIAL

4.11.15 Command 126: Assign Virtual UA to NUID
The SMS uses this command to associate a Virtual UA to NUID and get this one in the
acknowledgment command returned by CAS (see SMS ‘1003-Acknoledge Command with Virtual
UA’).
Introduced three modes.
Legacy Mode:
Introduced feature instead of reading nuid-chipset association from NuidChipsetAssociation

parameter from the RTM configuration file.
The CAS assigns a virtual UA to NUID (and stores the link into CAS database) if NUID is not
already linked to virtual UA . Else, it returns the virtual UA already linked to NUID.
NewMode 1(Greenfield with Legacy STB):
PSTE provides Assosciation package which contains NUID and NOCS type information ,not
providing the VUA information(assume that VUA is not allocated for NUID).In this case Virtual
UA is stored as zero in chipset table.
EKI stores all these information in chipset table in CASDB.
CAS assigns virtual UA to NUID and update Virtual UA column in chipset table assosciated with
provided NUID.
NewMode 2(Greenfield completely new):
PSTE provides Assosciation package which contains NUID,Virtual UA and NOCS type
information.
EKI stores all these information in CASDB and SMS command returns PSTE allocated VUA for
provided NUID as a Acknowledgment.
Important
▪ This command shall be sent for the devices without smart card only. And it shall be
the first SMS command sent. The device could not be initialized if this command is
not sent before.
Command 126: Assign Virtual UA to NUID

NUID 10 r_num Identifier of the STB chipset.
Range: 0000000001 to 4,294,967,295

Command_id NO_VUA_AVAILABLE NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL


NUID BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
NUID NUID_BLACKLISTED NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

4.11.16 Command 127: Get all products
The SMS uses this command to request a list of all the products owned by a subscriber for the
MOP indicated in the root header field MOP_PPID.
That information comes from the CAS database. If the command can be executed successfully,
the acknowledgement and result is provided with SMS command 1004 "Acknowledge command
with data".
The data returned by this acknowledgement contains:
• The device suspended flag (type 0x00). Only present if the device is suspended.
• One product properties block for each product (type 0x01). This block contains:
o The product ID (type 0x02)
o The product suspended flag (type 0x03). Only present if the product is
suspended.
o The a-la-carte product services (type 0x04). Only present if the product is an
a-la-carte product.
o The start date (type 0x05). Only present for a-la-carte products.
o The end date (type 0x06). Only present for a-la-carte products.
The example of SMS command 1004 shows a typical answer for this SMS command.
Command 127: Get all products


CONFIDENTIAL
CONFIDENTIAL

4.11.17 Command 150: SNP Override
The SMS uses this command to correct or override the NUID mapping for the IRDSN and the
UA.
Important
▪ This command shall be used only for new customers. It shall be used when they
intend to correct the NUID mapping which is missing in the CASN files.
▪ This command is not supported for CHF families.
Command 126: Assign Virtual UA to NUID

STU_Number 14 r_num The serial number of the conditional access (CA)
STB, in a decimal form.
Range: 0000000001 to 4,294,967,295

UA DATABASE_ERROR BAD_PARAM_IN_CASDB
STU_number CARD_NOT_PAIRED NO_EXTENDED_ERROR_CODE
NUID BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
CONFIDENTIAL
CONFIDENTIAL

4.12 Feedback Commands (2nn)

The commands described in this section are sent to the SMS by the Nagravision CAS system.
The feedback commands are used to provide the SMS with information and data related to the
IPPV features available to a customer. For instance, the feedback command will provide the
SMS with the list of events (movies) that have been impulsively purchased by the customer. In
this context, an impulsive purchase means a movie purchased with the customer’s remote
control.
Depending on the configuration of the CAS, the following feedback commands will be generated
and sent to the SMS:
Command 211: Start of Report
Command 201: Current Credit and Debit
for (I=0; I<nb_new_PPV; I++)
{
Command 202 or 204 or 216 (only one type is configurable)
}
Command 205: Calling Phone Discrepancies (if ANI is enabled)
Command 206: STU Responding Status (responding = Y)
Command 212: End of Report
If an STB does not call back within the time frame, as defined in the Call Collector database, the
following feedback command will be generated:
Command 206: STU Responding Status (responding = N)
Important
▪ In the scenario described above, the CAS will only issue command 206. Commands
211 and 212 will not be sent.
CONFIDENTIAL
CONFIDENTIAL

4.12.1 Command 200: Low-Credit Alarm
The CAS uses this command to notify the SMS that the origin of the last callback (by the smart
card) was due to a low-credit condition.
The low-credit condition is reached when the credit and debit in the smart card fall below the
threshold credit level.
Command 200: Low-Credit Alarm

STU_number 14 num The Nagravision STB serial number.
credit 7 r_num The credit level. Range: 00,000.00 to 65,535.99
debit 7 r_num The debit level. Range: 00,000.00 to 65,535.99

credit BAD_COMAMND_SYNTAX BAD_CREDIT_FORMAT
debit BAD_COMMAND_SYNTAX BAD_DEBIT_FORMAT
CONFIDENTIAL
CONFIDENTIAL

4.12.2 Command 201: Current Debit and Credit
The CAS uses this command to report the credit and debit level of the smart card to the SMS,
as reported by the smart card during the last callback.
Command 201: Current Debit and Credit

STU_number 14 num The serial number of the CA STB, e.g.: 72664281
will be formatted as 00000072664281.
credit 7 r_num The credit level. Range: 00,000.00 to 65,535.99
debit 7 r_num The debit level. Range: 00,000.00 to 65,535.99

credit BAD_COMAMND_SYNTAX BAD_CREDIT_FORMAT
debit BAD_COMMAND_SYNTAX BAD_DEBIT_FORMAT
CONFIDENTIAL
CONFIDENTIAL

4.12.3 Command 202: PPV Purchase List
The CAS uses this command to notify the SMS of each new IPPV item that the smart card has
reported during the last callback. Consequently, this command is sent as many times as there
are new IPPV items reported during the last callback.
Command 202: PPV Purchase List

4 r_num command_id = 0202
IMS_product_id 12 num The IMS_product_id of the event product
purchased impulsively through the EPG.
purchase_date 8 YYYYMMDD The date of the IPPV purchase (in UTC).
watched_status 1 r_text Indicates if the IPPV has been watched (Y or N).
The IPPV is considered watched when the
accumulated viewing time exceeds the limit defined
for the event or the predefined limit for the service
carrying the event.

IMS_product_id BAD_COMAMND_SYNTAX BAD_IMS_PRODUCT_ID_FORMAT
purchase_date BAD_COMMAND_SYNTAX BAD_DATE_FORMAT
watched_status BAD_COMMAND_SYNTAX BAD_FLAG_VALUE
CONFIDENTIAL
CONFIDENTIAL

4.12.4 Command 203: PPV Purchase List Report
The CAS uses this command to provide the SMS with the full list of new IPPV items that the
smart card has reported during the last callback. Consequently, this command is sent only once
with the complete list of new IPPV items reported during the last callback.
Command 203: PPV Purchase List Report

nb_of_ppv 2 num The number of PPVs reported in this command.
for(i=0; i<nb_of_ppv; i++) { A counter.
IMS_product_id 12 num The IMS product ID of the event product purchased
impulsively through the EPG.
watched_status 1 r_text Indicates if the IPPV has been watched (Y or N).
The IPPV is considered watched when the
accumulated viewing time exceeds the limit defined
for the event or the predefined limit for the service
carrying the event.
}

CONFIDENTIAL
CONFIDENTIAL

4.12.5 Command 204: PPV Purchase List With Payment Status
The CAS sends this command to the SMS when there is one or several IPPV item(s) that has
(have) been purchased by a smart card.
This command is sent only once with the complete list of new IPPV items provided.
Command 204: PPV Purchase List With Payment Status

Category 3 num The subscriber’s category.
nb_of_ppv 2 num The number of PPVs provided in this
command.
for(i=0;i<nb_of_ppv;i++) { A counter.
IMS_product_id 12 num IMS_product_id of the event product
purchase_date 8 YYYYMMDD The date of the IPPV purchase (UTC).
purchase_time 6 HHMMSS The time stamp of the IPPV purchase (UTC).
price 7 0000100 to The price presented to the subscriber at the
6553599 end of the purchase.
A figure representing 1.00 to 65,535.99.
payment_type 2 num 00: Free (i.e. the product price is null)
01: SMS billing (automatic payment included)
02: Credit card – manual
03: Credit card – TIBC chip
04: Credit card – WG10 chip
05: Cash card – TIBC chip
06: Cash card – WG10 chip
If payment_type >= 02 {
context 10 num Context identifier
bank 4 Alphanumeric The bank identifier, left-padded with zeros if
needed.
issuer 10 num The identifier of the VT or STF that authorized
the purchase, padded left with zeros if
needed.
transaction 10 num The identifier of the transaction, left-padded
with zeros if needed.
If payment_type is equal to 02, 03 or 04 {
credit_card_number 20 num The credit card number, without space
characters: xxxxxxxxxxxxxxxxxxxx, left-
padded with zeros if needed.
authorization 6 Alphanumeric The authorization code, left-padded with zeros
if needed.
} // paym. 2,3,4
} // paym. >= 2
} // for loop
CONFIDENTIAL
CONFIDENTIAL


Category BAD_COMMAND_SYNTAX INVALID_CATEGORY
purchase_time BAD_COMMAND_SYNTAX BAD_TIME_FORMAT
payment_type BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
context BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
bank BAD_COMMAND_SYNTAX NO_EXTENDED_ERROR_CODE
issuer BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
transaction BAD_COMMAND_SYNTAX NO_EXTENDED_ERROR_CODE
credit_card_number BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
authorization BAD_COMMAND_SYNTAX NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

4.12.6 Command 205: Phone Discrepancies
The CAS uses this command to notify the SMS that there was a phone discrepancy during the
last callback (by the smart card).
A phone discrepancy warning occurs when the customer’s phone number (caller_ID) does not
match any of the authorized phone numbers stored in the CAS database for that customer.
The number can be a phone number, an IP address or a MAC address. Refer to the definitions of
commands 49, 54 or 55.
Command 205: Phone Discrepancies

4 r_num command_id = 0205
STU_number 14 num The serial number of the CA STB, e.g.:
72664281 will be formatted as 00000072664281.
phone_number_1 16 num The first phone number stored in the Call
Collector (CC).
phone_number_2 16 num The second phone number stored in the CC.
phone_number_3 16 num The third phone number stored in the CC.
abnormal_phone 16 num The number used by the STB to call the CC.

Phone_number_1 BAD_COMAMND_SYNTAX BAD_PHONE_NUMBER_FORMAT
Phone_number_2 BAD_COMMAND_SYNTAX BAD_PHONE_NUMBER_FORMAT
Phone_number_3 BAD_COMMAND_SYNTAX BAD_PHONE_NUMBER_FORMAT
abnormal_phone BAD_COMMAND_SYNTAX BAD_PHONE_NUMBER_FORMAT
CONFIDENTIAL
CONFIDENTIAL

4.12.7 Command 206: STU Responding Status
The CAS uses this command to notify the SMS that an end user’s smart card did not make a
callback as expected. Command 206 only pertains to automatic and immediate callbacks.
An STB is deemed non-responding on the basis of criteria defined by the callback expiration
parameter of the Call Collector.
Command 206: STU Responding Status

responding 1 r_text Whether an STB is responding: Y or N.

responding BAD_COMAMND_SYNTAX BAD_FLAG_VALUE
CONFIDENTIAL
CONFIDENTIAL

4.12.8 Command 207: ICC Memory Full Alarm
The CAS uses this command to notify the SMS that the origin of the last callback (by the smart
card) was due to a smart card memory full condition.
This information is retrieved by the Call Collector during the latest callback. The obsolete data
(i.e. expired subscriptions or IPPVs) in the smart card will be deleted. The smart card memory
will therefore be released for subsequent use.
Important
▪ If the smart card contains IPPV items for movies that are to be broadcast in the
future, those items will not be deleted.
Command 207: ICC Memory Full Alarm


CONFIDENTIAL
CONFIDENTIAL

4.12.9 Command 211: Start of Report
The CAS uses this command to warn the SMS of the impending arrival of a set of feedback
messages (i.e. 2nn commands) for a certain end user. The set of messages are bound or
terminated by command 212.
Command 211: Start of Report

STU_callback_date 8 YYYYMMDD Date (UTC) of the callback being reported
STU_callback_time 6 HHMMSS Time (UTC) of the callback being reported

STU_callback_date BAD_COMMAND_SYNTAX BAD_DATE_FORMAT
STU_callback_time BAD_COMMAND_SYNTAX BAD_TIME_FORMAT
CONFIDENTIAL
CONFIDENTIAL

4.12.10 Command 212: End of Report
The CAS uses this command to warn the SMS of the termination of a set of feedback messages
(i.e. 2nn commands) for a certain end user.
Command 212: End of Report

number_of_IPPV 2 num The number of IPPV reports (occurrences of
command 202) that should have been sent in this
report.

number_of_IPPV BAD_COMMAND_SYNTAX BAD_NUMBER_OF_IPPV_FORMAT
CONFIDENTIAL
CONFIDENTIAL

4.12.11 Command 215: Products List
The CAS uses this command to provide the SMS with the list of subscription type products
known in the CAS database for a certain end user.
The SMS first sends command 71 (Get Products) over the EMM/CTRL channel. Then, the CAS
responds with command 215 (Product List) over the Feedback channel. Note that this command
does not return a-la-carte products. To return a-la-carte products, please use the SMS
command 127 instead.
Command 215: Products List

original_transacti 9 num The transaction number in the instance of
on_number command 71 that triggered the generation of
this command.
STU_number 14 r_num The serial number of the CA STB, e.g.:
72664281 will be formatted as
00000072664281. If the SC is paired with
multiple STB, the value 0 is returned in this
field.
ICC_suspended 1 r_text Smart card suspend state: Y or N.
nb_of_products 2 num The number of products returned in this
command
for(i=0;i<nb_of_products; i++) { A counter.
IMS_product_id 12 num The IMS product ID.
Range: 000000000000 to 004294967295.
product_suspended 1 r_text Product suspend state: Y or N.
}

original_transaction_number BAD_COMMAND_SYNTAX BAD_TRANSACTION_NUMBER_FORMAT
ICC_suspended BAD_COMMAND_SYNTAX BAD_FLAG_VALUE
nb_of_products BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
product_suspended BAD_COMMAND_SYNTAX BAD_FLAG_VALUE
CONFIDENTIAL
CONFIDENTIAL

4.12.12 Command 216: PPV Purchase List Extended
The CAS uses this command to report to the SMS each new IPPV item that has been
communicated by the smart card during the last callback.
This command is sent as many times as there are new IPPV items provided during the last
callback.
Important
▪ This command is similar to command 202: PPV Purchase List. It provides an
additional parameter: purchase_time.
Command 216: PPV Purchase List Extended

STU_number 14 num The serial number of the CA STB, e.g.:
72664281 will be formatted as 00000072664281.
IMS_product_id 12 num The IMS_product_id of the event product
purchase_time 6 HHMMSS The time stamp of the IPPV purchase (in UTC).
watched_status 1 r_text Indicates whether the IPPV has been watched
(Y) or not (N). The IPPV is considered watched
when the accumulated viewing time exceeds the
limit defined for the event or the limit predefined
for the service carrying the event.

CONFIDENTIAL
CONFIDENTIAL

4.12.13 Command 217: Impulse Purchase List
The CAS uses this command to report to the SMS the full list of new products (e.g. IPPV, ISUB)
that have been communicated by the smart card during the last callback. Consequently, this
command is sent only once with the complete list of purchased products provided during the
last callback.
Command 217: Impulse Purchase List

STU_number 14 num The CA serial number of the STB.
Example: 72664281 will be formatted as
00000072664281.
nb_of_products 2 num Number of products provided in this command
for(i=0; i<nb_of_products; i++) { A counter.
IMS_product_id 12 num The IMS product ID of the event product purchased
impulsively through the EPG.
product_type 2 num Type of product:
00: Unknown product type
01: The product contains subscription rights
02: The product contains pay-per-view rights
03: Rental DVR product (obsolete product type)
04: Free DVR product (obsolete product type)
05: VOD rental PPV
06: Pay-Per-Time (PPT) product on credit (also
known as PPT by coins)
07: The product contains pay-per-floating-period
(PPFP) rights
08: Flexible subscription product
09: Short-term subscription product
10: PPV N of M product
11: Credit product (also known as Coin product)
12: Pay-Per-Time by Points (PPTP) product
13: Not applicable
14: TVOD subscription product
purchase_date 8 YYYYMMDD The date of purchase of the product (in UTC).
purchase_time 6 HHMMSS The timestamp of the purchase of the product (in
UTC).
watched_status 1 r_text Indicates whether the product has been watched
(Y) or not (N). The product is considered watched
when the accumulated viewing time exceeds the
limit defined for the event or the limit predefined
for the service carrying the event.
payment_status 1 r_text Indicates whether the product has already been
paid (Y) or not (N). The product is paid when the
purchase has been made impulsively using prepaid
credit (i.e. the credit limit of the account used for
the purchase is null).
} // for loop
CONFIDENTIAL
CONFIDENTIAL


product_type BAD_COMAMND_SYNTAX BAD_NUMBER_FORMAT
product_type BAD_PRODUCT_TYPE NO_EXTENDED_ERROR_CODE
product_type VALUE_OUT_OF_RANGE NO_EXTENDED_ERROR_CODE
payment_status BAD_COMMAND_SYNTAX BAD_FLAG_VALUE
CONFIDENTIAL
CONFIDENTIAL

4.12.14 Command 218: Smart Card Synchronization Status
The CAS uses this command to notify the SMS of an end user’s synchronization status as it is
known to the CAS database.
The SMS first sends command 124 (Get Smart Card Synchronization Status) over the
EMM/CTRL channel. The CAS then answers with command 218 (Smart Card Synchronization
Status) over the FEEDBACK channel.
Command 218: Smart Card Synchronization Status

If there is no data available in the CAS database,
this field will be set to 00000000000000.
synchro_date 8 YYYYMMDD The date of the last synchronization (in UTC).
this field will set to 19920101.
synchro_time 6 HHMMSS The time of the last synchronization (in UTC).
synchro_status 2 r_num The status of the last synchronization:
0: Successful
1: Failed
5: In progress

synchro_date BAD_COMMAND_SYNTAX BAD_DATE_FORMAT
synchro_time BAD_COMMAND_SYNTAX BAD_TIME_FORMAT
synchro_status BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
CONFIDENTIAL
CONFIDENTIAL

4.13 Internal CAS commands (7nn)

The series of command 701 to 799 is reserved for private CAS commands.
4.14 MACRO EMM commands (9nn)

This chapter describes the data of the command section for the 9nn SMS command series.
Those commands are the same kind as the 0nn SMS command series (see previous chapter).
The aim of this series is to optimize the overall command message bandwidth of the SMS – CAS
interface. Indeed, for a large volume of end users, the amount of transactions (EMM command
messages) is very high. Thus the use of the interface should be optimized. The solution adopted
here is to concatenate several commands of the 0nn series into one macro command.
CONFIDENTIAL
CONFIDENTIAL

4.14.1 Command 901: Activate Smart card

SAS replaces MOP Please refer to individual
by SOP commands (0nn)
This command is a ‘one-shot’ initialization command designed to improve the performances of

the CAS when initializing a new smart card in the CAS database.
Important
▪ Read the Important note under command 2, 10, 13, 48, 49, 52, 61, 100, 101
▪ If the CAS must generate a negative acknowledgement (i.e. nack) upon processing
this SMS command, the body of the command will be truncated to 999 characters
long before being inserted in field ‘command_section’ of the negative
acknowledgement.
CONFIDENTIAL
CONFIDENTIAL

Command 901: Activate Smart card

zip_code 5 num The end user’s zip code. Range: 00,000 to 99,999
STU_number 14 r_num The serial number of the CA STB in a decimal form.
Range: see Important note in section 4.10.27.
credit 7 r_num The credit amount.
Range: 00,000.00 to 65,535.99
threshold_credit 7 r_num When this lower limit is reached, the smart card must carry out a
low-credit callback within range 0.00 to 00255.99.
Note: According to the currency coefficient defined in CAS

system, this value can be truncate because only the integer part
after the application of currency coefficient is taken into account.
credit_limit 7 r_num The credit limit, within range 00000.00 to 65,535.99.
call_freq 2 r_num_x 01 = annual
02 = semi-annual
03 = quarterly
04 = monthly
05 = semimonthly
date_first_call 8 YYYYMMDD First date (UTC) on which the smart card should call back.
cc_number_1 16 p_num Call Collector phone number. This field must be right padded with
trailing ASCII space characters.
phone_number_1 16 p_num Primary phone number for the Call Collector. This field must be
padded with trailing ASCII space characters for numbers not
requiring 16 digits.
phone_number_2 16 p_num Alternate phone number for the Call Collector.
phone_number_3 16 p_num Alternate phone number for the Call Collector.
nb_of_products 2 r_num Number of products provided in this command. Range: 00 to 99
IMS_product_id 12 num IMS product ID.
Range: 000000000000 to 004294967295
begin_date 8 YYYYMMDD Subscription begin date (in UTC). The subscription is not valid
before this date.
end_date 8 YYYYMMDD Subscription end date (in UTC). The subscription is not valid after
this date.
}
nb_of_ppv 2 r_num Number of PPV product provided in this command.
Range: 00 to 99
Range: 000000000000 to 004294967295
length_event_name 2 r_num Length of valid data in the event_name field. It must not exceed
30 bytes. This is due to storage limitations in the smart card.
event_name 32 text Event name as displayed in the PPV purchase history in the STB
user interface. The number of characters must match length
length_event_name. The remaining bytes should be filled-up with
space characters. See special note in section 4.6.1.
CONFIDENTIAL
CONFIDENTIAL

Command 901: Activate Smart card

price 5 num Price of the product. Range: 0.00 to 999.99
}

threshold credit BAD_COMMAND_SYNTAX BAD_THRESHOLD_CREDIT_FORMAT
threshold credit BAD_COMMAND_SYNTAX CREDIT_THRESHOLD_TOO_HIGH
date_first_call BAD_COMMAND_SYNTAX BAD_DATE_FORMAT
IMS_product_id BAD_PRODUCT_TYPE RECULAR_PRODUCT
CONFIDENTIAL
CONFIDENTIAL

4.14.2 Command 902: Activate Smart card Without Return Path

SAS replaces MOP Please refer to individual
by SOP commands (0nn)
This command is a ‘one-shot’ initialization command designed to improve the performances of

the CAS when initializing a new device in the CAS database.
Important
acknowledgement.
Command 902: Activate Smart card Without Return Path

zip_code 5 num The end user’s zip code. Range: 00000 to 99999
Range: see Important note in section 4.10.27.
nb_of_products 2 r_num Number of products provided in this command.
Range: 00 to 99
Range: 000000000000 to 004294967295
begin_date 8 YYYYMMDD Subscription begin date (in UTC). The subscription
is not valid before this date.
end_date 8 YYYYMMDD Subscription end date (in UTC). The subscription is
not valid after this date.
}
nb_of_ppv 2 num Number of PPV products provided in the command.
Range: 00 to 99
IMS_product_id 12 num IMS product ID.
Range: 000000000000 to 004294967295
length_event_name 2 r_num The length of valid data in the event_name field. It
must not exceed 30 bytes. This is due to storage
limitations in the smart card.
event_name 32 text Event name as displayed in the PPV purchase
history in the STB user interface. The number of
characters must match length length_event_name.
The remaining bytes should be filled-up with space
characters. See special note in section 4.6.1.
price 5 num Price of the product, representing 0.00 to 999.99
}
CONFIDENTIAL
CONFIDENTIAL


CONFIDENTIAL
CONFIDENTIAL

4.14.3 Command 903: Add List of Products

Usage Note
▪ For new development, it is advised to use SMS command 905 (Add Enhanced List of
Products) instead of SMS command 903.
The SMS uses this command to add a list of new products (service products, non-impulsively
purchasable event products and package products) in a smart card.
Important
acknowledgement.
If the RTM [Business]ackRightIsSuspended is set to true, SMS command 2 swill be
▪
Command 903: Add List of Products

Range: 00 to 99
Range: 000000000000 to 004294967295
begin_date 8 YYYYMMDD Subscription begin date (in UTC). The
subscription is not valid before this date.
end_date 8 YYYYMMDD Subscription end date (in UTC). The subscription
is not valid after this date.
}
nb_of_ppv 2 r_num Number of PPV product provided in this
command. Range: 00 to 99
Range: 000000000000 to 004294967295
length_event_name 2 r_num Length of valid data in the event_name field. It
must not exceed 30 bytes. This is due to storage
limitations in the smart card.
event_name 32 text Event name as displayed in the PPV purchase
history in the STB user interface. The number of
characters must match the length
length_event_name. The remaining bytes should
CONFIDENTIAL
CONFIDENTIAL

Command 903: Add List of Products

be filled-up with space characters. See special
note in section 4.6.1.
price 5 num Price of the product. Range: 0.00 to 999.99
}

CONFIDENTIAL
CONFIDENTIAL

4.14.4 Command 904: Cancel List of Products

The SMS uses this command to cancel a list of products (entitlements of services or/and PPV)
from a device (smart card or Set Top Box / CAK).
. This command is applicable for entitlements that have been purchased through the SMS or
impulsively. In other words, any entitlement impulsively purchased cannot be cancelled with
this command (whether or not they have been watched or call-collected).
The cancellation of entitlements impulsively purchased has no impact on the end user’s credit in
the smart card (no credit refund is done).
Important
▪ Read the Important note under command 6.
Command 904: Cancel List of Products

nb_of_products 2 r_num Number of products provided in this command. The
range is 00 to 99
Range: 000000000000 to 004294967295
}

CONFIDENTIAL
CONFIDENTIAL

4.14.5 Command 905: Add Enhanced List of Products

The SMS uses this command to add a list of new products (service products, non-impulsively
purchasable event products and package products) into a device (smart card or Set Top Box /
CAK)..
Important
▪ Read the Important note under commands 2, 10 and 903.
▪ A “re-hit purchase” is a case where customers purchase a product through the SMS,
and later complain that they do not have access to the requested product. The SMS
command is issued a second time. The SMS/SAS must make sure that the subscriber
will only have access to the same content and validity period as initially granted by
the first SMS command.
acknowledgement.
If the RTM [Business]ackRightIsSuspended is set to true, SMS command 2 swill be
▪
CONFIDENTIAL
CONFIDENTIAL

Command 905: Add Enhanced List of Products

Range: 00 to 99
Range: 000000000000 to 004294967295
purchase_mode 1 r_text A flag specifying whether the product purchase is a new
purchase (P) or a re-hit of the product ®.
This flag is only used with Merlin smart cards: it is ignored
with Aladin smart cards (the value is overwritten as P).
This flag is only applicable to multi-instance products
where the validity dates are specified by the SMS (Flexible
Subscription and PPT by points products). With other
product types (regular subscriptions and PPT by coins
products), the flag is ignored.
With Flexible Subscription and PPT by points, the SMS
command handling is as follows:
• A new purchase creates a new instance of the
product.
• A re-hit retrieves the active instances of the product
in the smart card and recreates the latest purchased
instance of the product. If no active instance is
found, then the SMS command will be handled as a
new purchase.
begin_date 8 YYYYMM Subscription begin date (generally in UTC). The
DD subscription is not valid before this date.
begin_time 6 HHMMSS Subscription begin time (generally in UTC). The
subscription is not valid before this time.
end_date 8 YYYYMM Subscription end date (generally in UTC). The subscription
DD is not valid after this date.
end_time 6 HHMMSS Subscription end time (generally in UTC). The subscription
is not valid after this time.
length_product_name 2 r_num The length of valid data in the product_name field. It must
not exceed 30 bytes. This is due to storage limitations in
the smart card.
product_name 32 Text The product name as displayed in the PPV purchase history
in the STB user interface. The number of characters must
match the length specified in length_product_name. The
remaining bytes should be padded with space characters.
See special note in section 4.6.1.
price 5 num The price of the product. Range: 000.00 to 999.99
}
nb_of_ppv 2 r_num The number of PPV products included in this command.
Range: 00 to 99
Continued…
CONFIDENTIAL
CONFIDENTIAL

Command 905: Add Enhanced List of Products (continued)

IMS_product_id 12 Num The IMS product ID.
Range: 000000000000 to 004294967295
purchase (P) or a re-hit of the product.
This flag is only used with Merlin smart cards: it is ignored
with Aladin smart cards (the value is overwritten as P).
This flag is only applicable to multi-instance products
where the validity dates are specified by the IMS (N of M
products) or computed by the SAS at purchase time (rental
PPVs and PPFPs), as well as to coin products. With rental
DVR products, the flag is ignored and the SMS command is
handled as a new purchase. With other product types
(short-term subscriptions and PPVs), the flag is ignored.
With N of M products, the SMS command is handled as
follows:
product.
• A re-hit retrieves the latest purchased instance in
the smart card and recreates the same instance of
the product. If no instance is found, then the SMS
command will be handled as a new purchase.
With rental PPV and PPFP products, the SMS command is
handled as follows:
product.
• A re-hit retrieves the active instance of the product
in the smart card and recreates the same instance of
the product. If no active instance is found, then the
SMS command will be handled as a new purchase.
With coin products, the SMS command is handled as
follows:
• A new purchase adds the amount of credit
associated with the product to the credit level in the
smart card.
• A re-hit sets the credit figure in the smart card to the
current absolute value of the smart card credit level.
length_product_name 2 r_num The length of valid data in the product_name field. It must
not exceed 30 bytes. This is due to storage limitations in
the smart card.
product_name 32 text The product name as displayed in the PPV purchase history
in the STB user interface. The number of characters must
match the length specified by length_product_name. The
remaining bytes should be padded with space characters.
See special note in section 4.6.1.
}
CONFIDENTIAL
CONFIDENTIAL


purchase_mode BAD_COMMAND_SYNTAX BAD_PURCHASE_MODE
begin_time BAD_COMMAND_SYNTAX BAD_TIME_FORMAT
end_time BAD_COMMAND_SYNTAX BAD_TIME_FORMAT
length_product_name BAD_COMMAND_SYNTAX LENGTH_TOO_LONG
length_product_name BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
CONFIDENTIAL
CONFIDENTIAL

4.14.6 Command 908: Set Families of Products

This command is for managing a-la-carte products but using the syntax of the subscription
family products as they were defined in Merlin 3.0 or earlier.
The SMS uses this command to specify an exhaustive list of services (identified by their
products ID) for a subscriber. The subscriber will only be granted access to products listed
within the relevant product family. In other words, if a subscriber previously had access to a
product and the product was later removed from the list, the customer would then be denied
access to this product.
No dates are supported for this command: the services are immediately available and will be
available until a cancel command is issued (either another 908 with less services or one of SMS
commands supporting a-la-carte products such as SMS 7, 909 or 925).
Important
Command 908: Set Families of Products

nb_of_families 2 r_num The number of product families included in this
command.
Range: 01 to 64
for(i=0;i<nb_of_families;i++) { A counter.
IMS_family_index 2 r_num The IMS family index.
Range: 00 to 63
nb_of_products 3 r_num The number of products included in this family.
Range: 000 to 256
for(i=0;i<nb_of_products;i++) { A counter.
IMS_product_id 12 num The IMS product ID.
Range: 000000000000 to 004294967295
}
}
CONFIDENTIAL
CONFIDENTIAL


nb_of_families BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IMS_family_index BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IMS_product_id BAD_PRODUCT_FAMILY NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

4.14.7 Command 909: A-la-carte management

This command is used to manage a-la-carte subscriptions attributed to subscribers. It has an

effect only on a-la-carte subscriptions (it is rejected if used on other types of products) and can
contain several operations.
Note that each "service" (also called service_index in this command) may represent one or
several channels, depending on how the services were configured in IMS.
The supported operations are:
• Set expiration date
This operation works in two different ways, depending on whether the renew field is set
to Y or N. If renew option is set to N:
o Define or modifies the expiration date of an a-la-carte product. It applies to all

services of the product.
o If the new expiration date is the same as the previous one and renew is not set,
this operation has no effect.
o If the new expiration date is earlier than (or equal to) the schedule date, all
scheduled services are immediately cancelled.
o If the new expiration date is earlier than (or equal to) the current date, all
services (scheduled or not) are immediately cancelled.
If the renew option is set, two use cases are supported (other cases are rejected):
o Case 1: The previous TE is expired. in that case the new TE is in the future and
all services that belonged to the subscriber before this expiration, the expired
services (if any) re immediately renewed and will be available until the new
expiration date.
o Case 2: The previous TE is not expired and the new TE is the same. This case
means that a 'rehit' operation is done, resending the full a-la-carte
• Set schedule date
Define or modifies the scheduled date of an a-la-carte product. This determines the date
when the next product updates (add/cancel scheduled) will occur.
If the new schedule date is earlier than (or equal to) the current date and the expiration
date is in the future, all scheduled services become immediately available.
If the new schedule date is later (or equal to) the expiration date, all scheduled services
are cancelled.
• Add service immediate
Add a service immediately. The service will be available immediately and will be
available until the expiration date defined with the 'Set expiration date' operation.
If the expiration date is in the past, the command is rejected.
The command is always sent to the subscriber (rehit).
CONFIDENTIAL
CONFIDENTIAL

• Cancel service immediate
Cancel a service immediately. The service will immediately be cancelled. It will also be
cancelled if it was scheduled to start at the date defined by the 'Set schedule date'
operation.
• Add service scheduled
Add a service at the schedule date. The subscriber will only be able to access the service
at the scheduled date, and it will be available until the expiration date is reached (which
is infinite if it has never been defined).
If the schedule is earlier than or equal to the current date, the command is rejected.
• Cancel service scheduled
The service will be cancelled at the schedule date.
If the schedule date is earlier than or equal to the current date, the operation is
rejected.
The order of operations is important and the result will be the same as if each operation had
been issued sequentially in consecutive SMS 909 commands. It is however much more efficient
to regroup multiple operations for the same UA in a single command.
Notes
• if the expiration date has never been set, any add/cancel operation will be rejected. The
value 1.1.2038 00:00:00 defines an infinite product duration.
• if the schedule date has never been set, any schedule command will be rejected. The
value 1.1.2038 00:00:00 cancels the schedule date.
• if at least one operation is rejected, the whole command is rejected.
Command 909: A-la-carte management

command_id 4 num command_id = 0909
IMS_product_ID 12 num The ID of the IMS a-la-carte product.
Range: 000000000000 to 004294967295
nb_operations 3 num The number of operations listed in this SMS
command
For each operation [1..nb_operations]
operation_id 2 num The operation ID
01 = Set expiration date
02 = Set schedule date
03 = Add service immediate
04 = Add service scheduled
05 = Cancel service immediate
06 = Cancel service scheduleds
CONFIDENTIAL
CONFIDENTIAL

Command 909: A-la-carte management

01 expiration_date 8 YYYYMMDD Expiration date
expiration_time 6 HHMMSS Expiration time
renew 1 r_text Y or N. See above description
02 schedule_date 8 YYYYMMDD Schedule date
schedule_time 6 HHMMSS Schedule time
03 service_index 4 num Index of the service in a-la-carte product
Range: 0001 to 2048
Range: 0001 to 2048
Range: 0001 to 2048
Range: 0001 to 2048
}

<operations> DATE_MISMATCH EXPIRATION_DATE
<operations> DATE_MISMATCH SCHEDULE_DATE
CONFIDENTIAL
CONFIDENTIAL

4.14.8 Commands 910 to 919: Reserved for Internal CAS Actions
4.14.9 Command 923: Activate Smart Card II
This macro command is a ‘one-shot’ initialization command designed to improve the

performances of the CAS when a new card is initialized in the CAS database.
This command is a substitute for several commands made available to the SMS in order to
initialize a smart card:
122 “Set Network”
51 “Initialize Smart Card”
52 “Pair the ICC with the STB” / 58 “Pair the ICC with multiple STBs” (optional)
48 “Set ZIP Code” / 47 “Set Alphanum Zip Code”
13 “Create Credit for Impulse Purchase” (optional)
100 “Redefine Credit Limit” (optional, if a return path must be enabled)
101 “Set Authorized Phone Number” (optional, if a return path must be enabled).
49 “Set Callback Phone Number” (optional, if a return path must be enabled)
61 “Enable Automatic Callback” (optional, if a return path must be enabled)
46 “Set Segment” (optional)
107 “Set Purchase Profile With Free Programming”/106 “Set Purchase Profile” (optional)
2 “Add Product”/10 “Add Event Product”/903 “Add List of Products”/905 “Add Enhanced List of
Products” (optional)
For DLK smartcards, the following actions are disabled: create credit, set the return path, set
the purchase profile and single/multipairing. Therefore, the fields related to these actions will
be ignored (although, if defined, their format will be checked).
Later on, use individual commands separately for making small changes (e.g.: setting a new zip
code, updating pairing).
When pairing multiple STBs, one and only one of these STBs could be a CAK V6 or CAK V7 AL
STB. In that case, this STB shall be specified at the first place (to be sure the HE will use slot0).
Important
▪ This command requires SOP privilege, although the PPID specified in the command
must be a MOP (the specified PPID must correspond to the MOP that is required to set
the purchase profile and to add the products).
▪ Read the Important note under commands 2, 10, 13, 46, 47, 48, 49, 51, 52, 58, 61,
100, 101, 106, 107, 122, 903 and 905.
▪ To reset a segment, set the segment subcategory of that segment category to zero.
▪ This command contains only the changes made in the segment: therefore, segments
not specified in the command remain unchanged.
▪ This command contains only the changes made in the product category: therefore,
product categories not specified in the command remain unchanged.
▪ Re-hits are cases where the customer purchases a product through the SMS and
complains later on that the requested product is not accessible. The SMS command is
then issued a second time. The SMS and the SAS must ensure that the subscriber will
only have access to the same content and validity period as have initially been
granted by the first SMS command.
▪ In cases where the CAS must generate a negative acknowledgement upon processing
this SMS command, the body of the command will be truncated (if necessary) to a
CONFIDENTIAL
CONFIDENTIAL

length of 999 characters before being inserted into field command_section of the
negative acknowledgement.
▪ In multi-pairing, the pairing slots are implicit with this command and SMS shall
specify all STB to pair. The command does not affect the other slots. For example, if
you want to pair the SC with 3 STB, the syntax will be nb_of_STB = 3, STU_number
= SN1, STU_number = SN2, STU_number = SN3 and the the pairing slots will be set
as below:
▪ Slot 0 = SN1
▪ Slot 1 = SN2
▪ Slot 2 = SN3
▪ Slot 3 = unchanged, keep the existing value
Command 923: Activate Card II

CAS_network_id 3 r_num The CAS network identifier. Range: 000 to 999
STB_context 2 r_num The STB context. This combines indications on both the STB
type (e.g.: Nagravision native STB or MediaGuard STB) and CAK
type (e.g. Merlin or MediaGuard CAK).
Range: 00 to 99
zip_code 9 r_text The subscriber’s zip code.
zip_code is right-padded with trailing space characters.
num The subscriber’s zip code.
The range is restricted to numeric values.
zip_code is left-padded with zeros.
Create credit
create_credit 1 r_text A flag specifying whether the credit must be created (Y) or not
(N).
credit 7 r_num The credit figure (in the local currency).
Range: 00000.00 to 65535.99
This field is used by the CAS only if credit must be created.
enable_return_path 1 r_text A flag specifying whether the return path is enabled. Its value is
either Y (the return path is enabled, therefore the callback
parameters are set) or N (the return path is disabled, therefore
the callback parameters are undefined).
threshold_credit 7 r_num When this lower limit is reached, the smart card must carry out
a low-credit callback within range 0.00 to 255.99.
This field is used by the CAS only if the return path is enabled.
Set return path
Note: According to the currency coefficient defined in CAS

system, this value can be truncate because only the integer part
after the application of currency coefficient is taken into
account.
credit_limit 7 r_num The credit limit within range 0.00 to 65535.99.
call_freq 2 r_num_x This field is used by the CAS only if the return path is enabled.
01 = annual
02 = semi-annual
03 = quarterly
04 = monthly
05 = semimonthly
CONFIDENTIAL
CONFIDENTIAL

Command 923: Activate Card II

date_first_call 8 YYYYMMDD The first date (UTC) on which the smart card should call back.
cc_number_1 16 p_num The phone number of the Call Collector. This field must be right
padded with trailing ASCII space characters.
This field is used only if the return path is enabled.
phone_number_1 16 p_num The primary phone number for the Call Collector. For numbers
not requiring 16 digits, this field must be padded with trailing
ASCII space characters.
phone_number_2 16 p_num An alternate phone number for the Call Collector.
phone_number_3 16 p_num An alternate phone number for the Call Collector.
Continued…
Command 923: Activate Card II (continued)

enable_purchase 1 r_text A flag specifying whether the purchase profile is enabled. Its
profile value is either Y (the purchase profile is enabled, therefore it is
defined) or N (the purchase profile is disabled, therefore it is
undefined).
category 3 r_num The subscriber’s category. Range: 000 to 255
This field is used by the CAS only if the purchase profile is
enabled.
Category 0 is reserved for using the standard product price
instead of tier pricing.
enable_online_ 1 r_text A flag specifying whether online purchases (i.e. any transaction
purchase performed through the return path) must be accepted. Its value
is either Y (accepted) or N (forbidden).
Set purchase profile
This field is used only if the purchase profile is enabled.

enable_PPV_ 1 r_text A flag specifying whether PPV purchases must be accepted. This
purchase applies to both the online and the SMS purchase modes. Its
value is either Y (accepted) or N (forbidden).
enabled.
enable_automatic_ 1 r_text A flag specifying whether online purchases should be
payment automatically debited from the subscriber’s account. Its value is
either Y (accepted) or N (forbidden).
This field is used only if the purchase profile is enabled.
free_product_mode 1 r_text free_product_mode specifies whether the figures for free
product numbers are absolute values or relative values.
A (absolute) Set the subscriber’s number of free products
for the relevant product category.
R (relative positive) Increase the subscriber’s number of free
products for the relevant product category.
N (relative negative): Decrease the subscriber’s number of free
products for the relevant product category.
CONFIDENTIAL
CONFIDENTIAL


nb_of_product_ 3 r_num The number of product categories included in this command.
categories Range is 000 to 010.
enabled.
for(i=0; A counter.
i<nb_of_product_categories;i++) { This field is used by the CAS only if the purchase profile is
enabled.
product_category 3 r_num The product category ID.
Range: 000 to 009
enabled.
nb_of_free_ 2 num The number of free PPV or PPT products for the product
products category. It is either an absolute value that replaces the
currently defined value or a relative value that is added or
removed from the currently defined value.
Range: 00 to 99
enabled.
}
Continued…

nb_of_STB 2 r_num The number of STBs with which the smart card must be paired.
Range: 00 to 04.
for(i=0;i<nb_of_STB;i++) { A counter.
Range 00000000000000 to 00004294967295
}
nb_of_segments 2 r_num The number of segments included in this command.
Range: 00 to 56
for(i=0;i<nb_of_segments;i++) { A counter.
segment_category 2 r_num Segment category. Range: 00 to 55
segment_subcategory 3 r_num Segment subcategory. Range: 000 to 255
}
nb_of_products 2 r_num The number of products included in this command.
Range: 00 to 99
for(i=0;i<nb_of_products;i++) { A counter.
IMS_product_id 12 num The IMS Product ID. Range: 000000000000 to 004294967295
CONFIDENTIAL
CONFIDENTIAL


purchase (P) or a re-hit of the pr®I(R).
This flag is only used with Merlin smart cards; it is ignored with
Aladin smart cards (the value is overwritten as P).
This flag is only applicable for multi-instance products where the
validity dates are specified by the SMS (Flexible Subscription
and PPT by points products). For other product types (regular
subscriptions and PPT by coins products), the flag is ignored.
For Flexible Subscription and PPT by points products, the SMS
command is handled as follows:
• A new purchase creates a new instance of the product.
• A re-hit retrieves the active instances of the product in the
smart card and recreates the latest purchased instance of the
product. If no active instance is found, then the SMS
begin_date 8 YYYYMMD Subscription begin date (generally in UTC). The subscription is
D not valid before this date.
begin_time 6 HHMMSS Subscription begin time (generally in UTC). The subscription is
not valid before this time.
end_date 8 YYYYMMD Subscription end date (generally in UTC). The subscription is not
D valid after this date.
end_time 6 HHMMSS Subscription end time (generally in UTC). The subscription is not
valid after this time.
length_product_name 2 r_num The length of valid data in field product_name. Due to storage
limitations in the smart card, it must not exceed 30 bytes.
product_name 32 text The product name as displayed in the PPV purchase history in
the STB user interface. The number of characters must match
the length specified in length_product_name. The remaining
bytes should be padded with space characters. See special note
in section 4.6.1.
}
Continued…

nb_of_ppv 2 r_num The number of PPV products included in this command.
Range: 00 to 99
for(i=0;i<nb_of_ppv;i++) { A counter.
IMS_product_id 12 num The IMS Product ID.
Range: 000000000000 to 004294967295
CONFIDENTIAL
CONFIDENTIAL


purchase (P) or a re-hit of the®Ict (R).
This flag is only used with Merlin smart cards; it is ignored with
Aladin smart cards (the value is overwritten as P).
This flag is only applicable to multi-instance products where the
validity dates are specified by the IMS (N of M products) or
computed by the SAS at purchase time (rental PPVs and PPFPs),
as well as to coin products. For rental DVR products, the flag is
ignored and the SMS command is handled as a new purchase.
With other product types (short-term subscriptions and PPVs),
the flag is ignored.
With N of M products, the SMS command is handled as follows:
• A re-hit retrieves the latest purchased instance in the
smart card and recreates the same instance of the
product. If no corresponding instance is found, then the
SMS command will be handled as a new purchase.
With rental PPV and PPFP products, the SMS command is
handled as follows:
• A re-hit retrieves the active instance of the product in the
given smart card and recreates the same instance of the
product. If no active instance is found, then the SMS
With coin products, the SMS command is handled as follows:
• A new purchase adds the amount of credit associated with
the product to credit level in the smart card.
• A re-hit sets credit figure in the smart card to the current
absolute value of the smart card credit level.
length_product_name 2 r_num The length of valid data in the product_name field. It must not
exceed 30 bytes. This is due to storage limitations in the smart
card.
product_name 32 text The product name as displayed in the PPV purchase history in
the STB user interface. The number of characters must match
the length specified by length_product_name. The remaining
bytes should be padded with space characters. See special note
in section 4.6.1.
Price 5 num The price of the product. Range: 000.00 to 999.99
}
CONFIDENTIAL
CONFIDENTIAL


CAS_network_id BAD_COMMAND_SYNTAX BAD_NETWORK_FORMAT
CAS_network_id NETWORK_NOT_FOUND NO_EXTENDED_ERROR_CODE
STB_context BAD_COMMAND_SYNTAX BAD_STB_CONTEXT_FORMAT
STB_context STB_CONTEXT_NOT_FOUND NO_EXTENDED_ERROR_CODE
create_credit BAD_COMMAND_SYNTAX BAD_FLAG_VALUE
enable_return_path BAD_COMMAND_SYNTAX BAD_FLAG_VALUE
threshold credit BAD_COMMAND_SYNTAX BAD_THRESHOLD_CREDIT_FORMAT
threshold credit BAD_COMMAND_SYNTAX CREDIT_THRESHOLD_TOO_HIGH
date_first_call BAD_COMMAND_SYNTAX BAD_DATE_FORMAT
free_product_mode BAD_COMMAND_SYNTAX BAD_FREE_PRODUCT_MODE
nb_of_product_catgories BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
product_category BAD_COMMAND_SYNTAX BAD_PRODUCT_CAT_FORMAT
product_category PRODUCT_CAT_NOT_FOUND NO_EXTENDED_ERROR_CODE
nb_of_free_products BAD_COMMAND_SYNTAX BAD_NB_FREE_PROD_FORMAT
nb_of_STB TOO_MANY_ITEMS NO_EXTENDED_ERROR_CODE
nb_of_STB BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
STU_number BAD_USAGE ALREADY_PAIRED_WITH_STB
STU_number BAD_USAGE BAD_STU_NUMBER_FORMAT
nb_of_segments BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
CONFIDENTIAL
CONFIDENTIAL

Continued…
List of error codes (continued):

segment_category BAD_COMMAND_SYNTAX BAD_CATEGORY_FORMAT
segment_category SEGMENT_NOT_FOUND NO_EXTENDED_ERROR_CODE
segment_subcategory BAD_COMMAND_SYNTAX BAD_SUBCATEGORY_FORMAT
segment_subcategory SEGMENT_NOT_FOUND NO_EXTENDED_ERROR_CODE
IMS_product_id BAD_PRODUCT_TYPE REGULAR_PRODUCT
purchase_mode BAD_COMMAND_SYNTAX BAD_PURCHASE_MODE
begin_date BAD_COMMAND_SYNTAX NO_EXTENDED_ERROR_CODE
begin_time BAD_COMMAND_SYNTAX BAD_TIME_FORMAT
end_date BAD_COMMAND_SYNTAX NO_EXTENDED_ERROR_CODE
end_time BAD_COMMAND_SYNTAX BAD_TIME_FORMAT
length_event_name BAD_COMMAND_SYNTAX NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

4.14.10 Command 925: Set a-la-carte services

This command defines completely and exhaustively the contents of the a-la-carte product of a
subscriber, including the dates.
Note that each "service" may represent one or several channels, depending on how the services
were configured in IMS.
Important
▪ An expiration date of 1.1.2038 00:00:00 means 'infinite duration'
▪ A schedule date of 1.1.1992 00:00:00 means there is no schedule date. In that case
there must not be any services listed as scheduled
▪ If the schedule date is higher than or equal to the expiration date, it is considered as
1.1.1992, i.e. schedule date is disabled
Command 925 : Set a-la-carte services

IMS_product_ID 12 num The a-la-carte IMS product ID
expiration_date 8 YYYYMMDD Expiration date
expiration_time 6 HHMMSS Expiration time
schedule_date 8 YYYYMMDD Schedule date
schedule_time 6 HHMMSS Schedule time
length_services = N 4 num Length of the services field (=N, in bytes) = number of
characters representing the hexadecimal of service
field. See example below.)
services N hex Contains 2 bits for each service, starting at service 1.
00 = The service is not available
01 = The service will be available at schedule date and
will end at expiration date
10 = The service is available immediately but will end
at schedule date
11 = The service is available immediately until the
expiration date
The bitmap can be truncated at the last hexadecimal

byte with a service that is not a 00, hence the variable
length. If the full bitmap (2048 services) is provided,
the length is 2048 / 2 = 1024 (1 hexadecimal digit
represents 4 bits, i.e. 2 services).
CONFIDENTIAL
CONFIDENTIAL

For example, a subscriber who has currently services 2,3 and 4 and who will has replaced
service 4 with service 5 starting next month (i.e. he will have services 2,3 and 5 next month)
has the following bitmap:
Bitmap = 3E4 Length_services= 0003
3 E 4
Bitmap 00 11 11 10 01 00
Service Nr 1 2 3 4 5 6 7 8 ….
Subscriber has the service

Subscriber will have the service at schedule date

nb_of_families BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IMS_family_index BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IMS_product_id BAD_PRODUCT_FAMILY NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

4.15 OPERATION commands (10nn and 20nn)
4.15.1 Command 1000: Acknowledge Command
The CAS and the SMS use this command to acknowledge a command issued by the other side of
the interface. Field “transaction_number” identifies the corresponding command that has been
processed successfully.
Important
▪ Fields IMS_product_id and SMS_product_id are no longer applicable since the series
of cmd 3nn is not supported by the interface. Consequently, these fields will be set to
000000000000 and 000000000000 respectively.
Command 1000: Acknowledge Command

transaction_ number 9 num Transaction number acknowledged.
Range: 000000000 to 999999999
IMS_product_id 12 num IMS product ID is always 000000000000
SMS_product_id 12 num SMS product ID is always 000000000000
CONFIDENTIAL
CONFIDENTIAL

4.15.2 Command 1001: Non-acknowledged Command
The command specified could not be completed because it is either REJECTED or POSTPONED. A
rejected command is a consequence of a mistake in the command format or in the command
processing. A postponed command is a consequence of a CAS system that is busy.
Important
▪ When a command is POSTPONED, the SMS should resubmit the command after a
delay of 60 min. Note that the resubmitted command should be identified with a new
transaction id.
Command 1001: Non-Acknowledge Command

command_id 4 r_num command_ID = 1001
transaction_ number 9 num transaction_number acknowledged
Range: 000000000 to 999999999
nack_status 1 r_num 1 = REJECTED means that the command has
been rejected because an error has been
detected.
2 = POSTPONED means that the command
could not be completed because the system is
busy.
error_code 4 r_num Main error code, refers to section 5.1
error_code_ext 4 r_num Extension error code, refers to section 5.2
length_of_command_body 3 num Length of the following section
command_section n Command section of the command that caused
the error, where n = length_of_command_body
CONFIDENTIAL
CONFIDENTIAL

4.15.3 Command 1002: No Command
The SMS should send this command in the following two conditions:
While the SMS opens a channel.
While there is no activity, i.e. no command to send or receive. The period should be 5 min.
The SMS should separately manage the EMM/CONTROL channel and the Feedback channel:
Command 1002: No Command

CONFIDENTIAL
CONFIDENTIAL

4.15.4 Command 1003: Acknowledge Command with Virtual UA
The CAS uses this command to acknowledge the SMS command ‘126-Assign Virtual UA to NUID’
issued by the SMS and to return the virtual UA that SAS has linked to given NUID.
Field “transaction_number” identifies the corresponding command that has been processed
successfully.
Command 1003: Acknowledge Command with Virtual UA

transaction_ number 9 num Transaction number acknowledged.
Range: 000000000 to 999999999
VUA 10 num Virtual UA associated to NUID given in SMS
command 126.
Range: 0000000001 to 4,294,967,295

Range: 0000000001 to 4,294,967,295
CONFIDENTIAL
CONFIDENTIAL

4.15.5 Command 1004: Acknowledge command with data
This command is a positive acknowledgement returned in answer to some SMS commands such
as SMS 127 (the description of the SMS command mention this point explicitly when SMS 1004
is used as a response instead of the usual SMS commands 1000 or 2000). In addition to
signaling that the command was processed successfully, it also returns additional information to
the SMS.
The returned information varies depending on the input command. The exact list of information
that can be returned is indicated in the section describing the command.
Command 1004: acknowledge command with data

transaction_number 9 num Transaction number acknowledged.
Range: 000000000 to 999999999
data_length 5 num Size of the data field (number of ASCII
characters following this field)
data data_length hex The data block in hexadecimal
Data is encoded with a set of TLV (Tag-Length-Value) triplets. A triplet is:
• Tag - on 1 byte (2 characters in hexadecimal representation). Indicates the kind of

information contained in the triplet. Refer to the table below
• Length - on 2 bytes (4 characters in hexadecimal representation). Indicates the size of

the "Value" field that follows, in bytes
• Value - the value itself. The value format is described in tha table below depending on
its tag. Its length was provided in the Length part of the triplet.
Here is the list of all tags supported by SMS command 1004.

Tag Description and properties
0x00 Device suspended flag. Indicates that the device is suspended. The length is always on 1
byte and its value is 0x01.
0x01 Product properties. This tag indicates that it contains several additional tags (using the
same Type-Length-Value scheme) all related to the description of a single product. The
length varies depending on the number of those tags.
0x02 Product ID. This tag contains an IMS product ID. Its length is always 4 bytes.
0x03 Product suspended flag. This tag indicates that a product is suspended. Its length is
always 1 byte and its value is 0x01.
0x04 A-la-carte product services. This tags contains a list of services belonging to an a-la-carte
product and is represented as a bitmap with 2 bits per channel starting at channel 1.
00 = The service is not available

01 = The service will be available at schedule date and will end at expiration date
10 = The service is available immediately but will end at schedule date
11 = The service is available immediately until the expiration date
CONFIDENTIAL
CONFIDENTIAL

The missing bits are implicitly set to 0.

For each pair of bits, the first indicates that the service is currently
0x05 Start date. This tag contains a date stored on 4 bytes as UNIX time. The date represents the
start date of the described element. For a-la-carte products, the start date is the schedule
date.
0x06 End date. This tag contains a date stored on 4 bytes as UNIX time. The date represents the
end or expiration date of the described element.
Important
▪ Tags which are not supported by the SMS shall be ignored. This allows upgrading the
CAS with new information without necessarily having to modify the SMS whenever
new tags are deployed.
Example: result of SMS 127
The following command 1004 is returned in answer to an SMS 127 "Get all products":
000052758050001000214121211220121004735963126000680000010101000B02000400004E
200300010101000D020004000061A804000340C002
This is decomposed as follows:
Root header of SMS command + SMS 1004 containing 68 characters Tag

000052758 05 0001 0002 14121 2112012 1004 735963126 00068 Length
Value
00 0001 01 (device suspended)
01 000B 02 0004 00004E20 03 0001 01 (product 20000, suspended)
01 000D 02 0004 000061A8 04 0003 40C002 05 0004 54001111 06 0004 59999ABC

(a-la-carte product 25000)
Bitmap 01 00 00 00 11 00 00 00 00 00 00 10
Service Nr 1 2 3 4 5 6 7 8 9 10 11 12
So this command means that the subscriber has:
• A suspended smartcard
• With product 20000 which is also suspended
• And with a-la-carte product 25000 containing
o current services 5 and 12
o services 1 and 5 will be available next update (service 1 replaces service 12)
o the next update (begin date) will occur on 29.8.2014 at 05:35:13
o the product will expires (end date) on 20.8.2017 at 14:20:44
CONFIDENTIAL
CONFIDENTIAL

4.15.6 Command 1005: Send business command
This command allows sending a business command through the SMS gateway interface.
Command 1005: Acknowledge business command

business_command_id 4 r_num Not used. Reserved
business_data_length 5 num Size of the business_data field (number
of ASCII characters following this field)
business_data business_data_l hex The data block in hexadecimal
ength
Specification of the business_data field is out of the scope of this document.
CONFIDENTIAL
CONFIDENTIAL

4.15.7 Command 1006: Acknowledge business command
This command is a positive acknowledgement returned in answer to a command sent with its
field command_type set to 06 in the root header.
Command 1005: Acknowledge business command

transaction_number 9 num Transaction number of the command being
acknowledged.
data data-length hex The data block in hexadecimal
Specification of the data field is out of the scope of this document.
CONFIDENTIAL
CONFIDENTIAL

4.15.8 Command 1007: Non-acknowledged business command
Important
▪ When a command is POSTPONED, the SMS should resubmit the command after a
delay of 60 min. Note that the resubmitted command should be identified with a new
transaction id.
Command 1006: Non-Acknowledged business command

command_id 4 r_num command_ID = 1007
transaction_ number 9 num transaction_number of the command being
acknowledged
nack_status 1 r_num 1 = REJECTED means that the command has
been rejected because an error has been
detected.
2 = POSTPONED means that the command
could not be completed because the system is
busy.
bus_error_code 4 r_num Business error code
error_text_length 4 r_num Length of field error_text, in bytes representing
ASCII characters
error_text error_text_ num Error message
length
data data-length hex The data block in hexadecimal
Specification of the data and error_code fields is out of the scope of this document.
CONFIDENTIAL
CONFIDENTIAL

4.15.9 Command 2000: EMM via Portal Acknowledge command
The CAS uses this command to acknowledge a command issued by the SMS when the
broadcasting mode specified in the Address Header of the EMM command or control command is
of type E (EMM via Portal). Field “transaction number” identifies the corresponding command
that has been processed successfully.
Command 2000: EMM via Portal Acknowledge command

Range: 000000000 to 999999999
nb_of_emm 3 num Number of EMM.
Range: 000 to 999
for(i=0; i<nb_of_emm; i++){
emm_data_length 3 num Length of emm_data, in bytes.
Range: 000 to 999
emm_data 2x r_text This field contains a string of characters
emm_data_length (see note representing hexadecimal data encoded in
below) the ASCII format (two characters for one
byte).
}
Important
▪ As indicated in the table above, the format of the emm_data field is r_text. However, it
characters and 1 2 3 4 numerical values”. The emm_data field contains a sequence of
hexadecimal numbers encoded in a text format. Consequently, the field will only
accept alpha characters A, B, C, D, E, F representing the numbers 10 to 15 in a
hexadecimal form.
▪ As an example – the CAS will accept the following data:
A0BCD12A29327B9F. Therefore, the value of emm_data_length is 8.
CONFIDENTIAL
CONFIDENTIAL

4.15.10 Command 2001: EMM via Portal Negative-Acknowledge command
Command 2001: EMM via Portal Negative-Acknowledge command

Range: 000000000 to 999999999
nack_status 1 r_num 1= REJECTED means that the command has been
rejected because an error has been detected.
2= POSTPONED means that the command could
not be completed because the system is busy.
error_code 4 r_num Main error code.
error_code_ext 4 r_num Error code extension.
The CAS will return the following error codes:

SYSTEM_ERROR with code extension EXTERNAL_SYSTEM_ERROR (nack postponed returned in SMS
command 2001 when the CAS is not ready to handle the request or in case of time-out with
the EME, etc.)
SYSTEM_ERROR with code extension CIPHERING_ERROR (nack rejected returned in SMS command
2001 in case of ciphering error)
CONFIDENTIAL
CONFIDENTIAL

5. Error codes
If an error occurs when executing an SMS command, it is reported by the use of an error code
and an error code extension. The error code indicates an error category and the error code
extension gives more details regarding the error source (e.g., an incorrectly specified field or
value exceeded).
An error code is always followed by an error code extension (possibly extension 0000:
NO_EXTENDED_ERROR_CODE). The error codes and extensions available are indicated in the
following tables.
5.1 Table of Error codes
Error Code Name Code Description

FATAL_ERROR 0000 The Oracle database interface returns an exception
as database error or protocol error due to a non-
understood field in the SMS command. All SMS EMM
commands might generate such FATAL_ERROR.
BAD_ROOT_HEADER_SYNTAX 0001 The syntax of the command root header is not
correct. See error code extension
BAD_HEADER_SYNTAX 0002 The syntax of the command header is not correct.
See error code extension
BAD_COMMAND_SYNTAX 0003 The syntax of the command is not correct. See error
code extension.
DATABASE_ERROR 0004 An error occurred during an CAS database query
processing.
MESSAGE_NOT_FOUND 0005 The message referenced in the command does not
exist.
PRODUCT_NOT_FOUND 0006 The product_id used in the command does not
exist in the CAS database.
CANCELED_CARD 0007 The smart card referenced in the command has
been canceled.
UA_NOT_FOUND 0008 The smart card UA referenced in the command does
not exist
PPV_IN_THE_PAST 0009 The command attempts to access a PPV whose
validity has expired.
STU_ALREADY_EXISTS 0010 The command attempts to create a smart card in
the CC database, but the smart card is bound to an
already existing STB.
SERVICE_NOT_FOUND 0011 The service referenced in the command does not
exist in the CAS database.
PRODUCT_ALREADY_EXISTS 0013 The command attempts to create an already existing
product.
UA_ALREADY_EXISTS 0014 The command attempts to create in the CC database
a smart card that already exists.
BAD_EPG_FORMAT 0015 The format of the EPG data feed is not correct.
DB_INCONSISTENT_TOO_MANY_ROWS 0021 Inconsistency in the CAS database
DB_INCONSISTENT_INVALID_PRODUCT 0022 Inconsistency in the CAS database
PRODUCT_INCONSISTENT 0024 There is an inconsistency between the product
definition received and the internal SMS Gateway
product database.
CONFIDENTIAL
CONFIDENTIAL


TOO_MANY_ITEMS 0025 Too many items are given in the list.
VALUE_OUT_OF_RANGE 0026 The value in the incoming command is out of the
authorized range.
BAD_USAGE 0027 The usage of this parameter is not correct. See error
code extension.
INVALID_PPID 0028 The MOP PPID used in this command is invalid.
SYSTEM_ERROR 0029 An error not related to the business or to the field
value occurs within the system. See error code
extension.
BAD_PRODUCT_TYPE 0030 The type of the product is wrong (not supported for
this command or for this addressing type).
BAD_PRODUCT_STATUS 0031 The status of the product does not allow the
execution of this command.
ACCOUNT_NOT_FOUND 0032 The account that corresponds to this UA and to this
MOP does not exist in the database.
CB_PROFILE_NOT_FOUND 0033 The callback profile that corresponds to this UA and
to this MOP does not exist in the database.
ZIP_NOT_FOUND 0034 The Zip code does not exist in the database.
RIGHT_NOT_FOUND 0035 The Right does not exist in the database
NO_LICENSE 0036 No license for this type of SMS command
NOT_AUTHORIZED 0037 This command is not authorized. The underlying
cause can be a misuse of one of the following
parameters:
• MOP
• SMS source ID
• bad product PA type vs MOP PA type
• bad product PA type vs addressing type
SMS_NOT_IDENTIFIED 0038 No cmd 1002 was received on Feedback channel
before this command
NO_ITM_PRESENT 0039 This error is returned if cmd 71 is issued but no ITM
is configured in the CAS system
NO_RTM_PRESENT 0040 A cmd 1002 is issued by SMS on EMM/control
channel, but no RTM is configured in the CAS
system.
SMS_NOT_AUTHORIZED 0041 Invalid source_ID used by SMS.
NOT_DEFAULT_FEEDBACK_SMS 0042 This error is returned if the SMS issues a cmd 1002
with a wrong source_ID
NO_SERVER_AVAILABLE 0043 There is no TM application available to handle the
command
TM_SERVER_ERROR 0044 Occurs when system returns a CORBA exception
SOURCE_ID_ALREADY_USED 0045 The SMS Source ID is already used by another
connection. Check why two different SMS are
connected with the same source_ID
UA_OUT_OF_RANGE 0046 smart card Unique Address is out of range for the
operator
EXPIRED_CARD 0047 The smart card life time has expired
COMMAND_THRESHOLD_OVERFLOW 0048 This error is generated back to the SMS if there are
too many commands for a certain smart card
coming in a short time frame.
INVALID_VOUCHER 0049 The voucher checked is invalid
NO_CIPHER_PRESENT 0050 There is no cipher available
CONFIDENTIAL
CONFIDENTIAL


CARD_NOT_PAIRED 0051 Card is not paired with STB.
SEGMENT_NOT_FOUND 0052 The segment requested in not defined in CAS.
PRODUCT_CAT_NOT_FOUND 0053 The product category requested in not defined in
CAS.
NETWORK_NOT_FOUND 0054 The network ID requested in not defined in CAS.
STB_CONTEXT_NOT_FOUND 0055 The STB context requested in not defined in CAS.
CONDITIONAL_ID_NOT_FOUND 0056 The conditional add ID requested is not defined in
CAS.
ONLINE_PURCHASE_REFUSED 0057 Online purchase has been refused.
NO_FREE_PAIRING_SLOT 0059 All the available pairing slots are already used.
SC_SET_ID_NOT_FOUND 0061 There is no smart card set ID defined in CAS for the
requested UA.
PPV_PURCHASE_NOT_ALLOWED 0062 The SMS sends a command to add a PPV for a
subscriber that is not authorized for PPV.
ALREADY_LINKED_CARD 0063 UA already linked to another UA.
NO_LINKED_CARD 0064 UA has not substitute UA linked to it.
BAD_CARD_TYPE 0066 The substitute UA is of the wrong smartcard type
and cannot be used as a new smartcard for the
swap.
BAD_PRODUCT_FAMILY 0067 There is an inconsistency between the IMS family
index specified in the SMS command and the one
assigned to the product.
BAD_REPLACED_CARD_TYPE 0068 The replaced UA is of the wrong smartcard type and
cannot be used for the swap.
DISCONNECTED_CARD 0069 The smartcard is disconnected.
SUSPENDED_CARD 0070 The smartcard is suspended.
SUSPENDED_MOP 0071 The MOP is suspended.
FOREIGN_SC 0072 The SC is a foreign SC.
CARD_REFURBISHMENT_FAILED 0074 An operation was attempted on a card which wasn't
refurbished successfully, and this operation is not
allowed on such cards.
VUA_NOT_LINKED_TO_NUID 0076 Virtual UA was not assigned to NUID.
Reasons:
• The SMS command ‘126-Assign Virtual UA
to NUID’ was not sent
Or the given virtual UA is not the virtual UA returned
in the acknowledgment of the SMS 126supported, or
the addressing mode is not supported for this
command.
NUID_OUT_OF_RANGE 0077 NUID is out of range for the operator.
NO_VUA_AVAILABLE 0078 All vUA defined in the system were already assigned
to NUID. A new range of vUA shall be deployed.
COMMAND_NOT_SUPPORTED 0079 The sent SMS command is not supported.
DATE_MISMATCH 0081 A check to ensure date consistency failed. The error
extension sometimes provides more information to
identify which date was being checked.
NUID_BLACKLISTED 0084 An NUID was blacklisted and therefor the pairing is
not done
INVALID_LICENSE 0090 Issue is related to DLK License
CONFIDENTIAL
CONFIDENTIAL

Table 5-1: Error codes
CONFIDENTIAL
CONFIDENTIAL

5.2 Table of Error code extensions
Error code extension Name Code Description

NO_EXTENDED_ERROR_CODE 0000 No error code extension is available for the
error code specified.
BAD_DEBIT_FORMAT 0001 The command contains a debit field whose
format is incorrect.
BAD_CREDIT_FORMAT 0002 The command contains a credit field whose
BAD_CREDIT_MODE 0003 The command contained a credit_mode
field whose value is not one of the
authorized ones.
BAD_DATE_FORMAT 0004 The command contains a date whose
BAD_DATE_SEQUENCE 0005 The command contains a begin date and
an end date that are out of sequence.
BAD_FREQUENCY_FORMAT 0006 The call_freq field of the command
contains a value whose format is incorrect.
BAD_STU_NUMBER_FORMAT 0007 The format of the STB number specified in
the command is incorrect.
BAD_IMS_PRODUCT_ID_FORMAT 0008 The format of the CAS_product_id of the
command is incorrect.
BAD_MESSAGE_NUMBER_FORMAT 0010 The value of the message_number field of
BAD_PHONE_NUMBER_FORMAT 0011 The format of the value of a phone_number
field of the command is incorrect.
BAD_PRICE_FORMAT 0013 The value of the price field of the
BAD_THRESHOLD_CREDIT_FORMAT 0014 The value of the threshold_credit field of
BAD_UA_FORMAT 0015 The value of the UA field of the command is
incorrect.
BAD_ZIP_CODE_FORMAT 0016 The value of the zip code field of the
DIFFERENT_PRODUCTS 0017 The command attempts to define a product
with a product_id already attributed to a
different product.
BAD_BROADCAST_MODE 0019 The broadcast mode is incorrect.
BAD_ADDRESS_TYPE 0020 The format of the value of the
address_type field of the command is
incorrect.
BAD_MOP_PPID 0021 The MOP_PPID indicated in the command is
not valid.
BAD_DEST_ID 0022 The dest_id indicated in the command is
not valid.
BAD_SOURCE_ID 0023 The source_id indicated in the command
is not valid.
BAD_COMMAND_TYPE 0024 This type of SMS command does not exist.
BAD_COMMAND_ID 0025 The command ID given in the SMS
command does not exist.
CONFIDENTIAL
CONFIDENTIAL


BAD_NUMBER_FORMAT 0027 A non-numerical character was found in
the content of a Num field.
BAD_ERROR_CODE 0032 The error code specified in the command
does not exist (section 8).
BAD_ERROR_CODE_EXT 0033 The error code extension specified in the
command does not exist (section 8).
BAD_SERVICE_UID_FORMAT 0040 The format of the value of a service_UID
field of the command is incorrect.
BAD_SERVICE_NUMBER_FORMAT 0041 The format of the value of the
service_number field of the command is
incorrect.
BAD_NUMBER_OF_IPPV_FORMAT 0044 The format of the number_of_IPPV field in
BAD_IP_ADDRESS_FORMAT 0045 The format of the IP address in the
EXTERNAL_SYSTEM_NOT_RESPONDING 0048 The other components of the CAS system
do not respond to the gateway process.
EXTERNEL_SYSTEM_ERROR 0049 The other components of the CAS system
have not successfully processed the
command.
BAD_SERVICE_ID_FORMAT 0052 The format of the service ID is incorrect.
BAD_TRANSPORT_ID_FORMAT 0053 The format of the transport ID is incorrect.
BAD_NETWORK_ID_FORMAT 0054 The format of the network ID is incorrect.
BAD_LID_FORMAT 0055 The format of the lid is incorrect.
BAD_PRIORITY_FORMAT 0056 The format of the priority is incorrect.
BAD_MODE_FORMAT 0057 The format of the mode is incorrect.
LENGTH_TOO_LONG 0058 The length is out of range.
BAD_FLAG_VALUE 0059 The flag value is not recognized.
BAD_CC_PORT_FORMAT 0060 The format of the CC port is incorrect.
BAD_TRANSACTION_NUMBER_FORMAT 0061 The format of the transaction number is
incorrect.
BAD_PURGE_MODE_FORMAT 0062 The format of the purge mode is incorrect.
BAD_CALLBACK_FORMAT 0063 The format of the callback type is incorrect
BAD_TIME_FORMAT 0064 The time format is incorrect
DATE_NOT_IN_THE_PAST 0065 This date must be set in the past
ACCESS_ERROR 0066 Error when trying to access database
TRANSACTION_ERROR 0067 An error occurs during a database
transaction (i.e. limitation reached,
overflow…)
DATA_ERROR 0068 An error related to the data contained in
database occurs (i.e. expected record is
missing).
TRANS_NR_ALREADY_IN_USE 0069 This transaction number is already in use
within the system.
COMMUNICATION_ERROR 0070 Communication error between components
within the system.
INTERNAL_ERROR 0071 System internal error.
SOURCE_NOT_AUTHORIZED 0072 Use of this source identifier is not allowed.
SOURCE_ALREADY_IN_USE 0073 This source identifier is already used by
another source.
CONFIDENTIAL
CONFIDENTIAL


DEST_NOT_AUTHORIZED 0074 Use of this destination identifier is not
allowed.
MOP_NOT_AUTHORIZED 0075 Use of this MOP PPID is not allowed.
DATE_IN_THE_FUTURE 0076 This date must be set in the present or in
the past.
CANCELLED_PRODUCT 0077 The product has been cancelled.
SUSPENDED_PRODUCT 0078 The product has been suspended.
INVALID_PURCHASE_DATE 0079 The purchase date is invalid.
DRAFT_PRODUCT 0080 The product is a draft.
PPV_PRODUCT 0081 The product is a PPV.
DATE_IN_THE_PAST 0082 This date must be set in the present or in
the future.
ADDRESS_TYPE_NOT_AUTHORIZED 0083 This type of address is not allowed for this
command.
ISD_MOP_NOT_FOUND 0084 The MOP record does not exist for this UA.
BAD_DATA_FORMAT 0085 The format of the data is invalid.
REGULAR_PRODUCT 0086 This product is a regular (subscription)
product.
INVALID_CATEGORY 0087 The category requested is not defined in
the CAS.
CORBA_EXCEPTION 0088 Low level system error
RENTAL_PRODUCT 0089 Operation not allowed with a rental product
FREE_RENTAL_PRODUCT 0090 Operation not allowed with a Free Rental
product
VOD_RENTAL_PPV 0091 Operation not allowed with a VOD Rental
product
PPT_PRODUCT 0092 Operation not allowed with a Pay Per Time
product
BAD_SECRET_CODE 0093 The secret code is incorrect
BAD_VERIFICATION_CODE 0094 The verification code is incorrect
BAD_THIRD_PARTY 0095 The third party is unknown
BAD_PARAM_IN_CASDB 0096 SAS is wrongly configured and cannot
properly handle the SMS command for the
specified UA.
BAD_CATEGORY_FORMAT 0097 The format of the category is incorrect
BAD_SUBCATEGORY_FORMAT 0098 The format of the subcategory is incorrect
BAD_FREE_PRODUCT_MODE 0099 The free product mode contains an
unauthorized value
BAD_PRODUCT_CAT_FORMAT 0100 The format of the product category is
incorrect
BAD_NB_FREE_PROD_FORMAT 0101 The format of the number of free product
is incorrect
BAD_NETWORK_FORMAT 0102 The format of the network ID is incorrect
BAD_STB_CONTEXT_FORMAT 0103 The format of the STB context is incorrect
BAD_PURCHASE_MODE 0104 The purchase mode contains an
unauthorized value
BAD_CONDITIONAL_ID_FORMAT 0105 The format of the conditional ID is
incorrect
CONFIDENTIAL
CONFIDENTIAL


BAD_ONLINE_PURCHASE_MODE 0106 The online purchase mode contains an
unauthorized value
BAD_PHONE_FIELD_FORMAT 0107 The format of the phone field is incorrect.
BAD_SYNCHRO_TYPE 0108 The format of the synchro_type field is
incorrect.
CIPHERING_ERROR 0109 The CAS is not able to cipher the request.
PRODUCT_NOT_AUTHORIZED 0110 This product is not allowed for this SMS
source.
BAD_CHIPSET_ID_FORMAT 0113 The format of the chipset ID specified in
ASP_PROFILE_ID_NOT_AUTHORIZED 0115 The ASP profile ID is not authorized
according to CAS configuration
ALREADY_PAIRED_WITH_STB 0116 The smart card is already paired with the
given STB on another slot.
EXPIRATION_DATE 0117 Indicates that the problem lisetd in the
error code relates to the expiration date
SCHEDULE_DATE 0118 Indicates that the problem listed in the
error code relates to the schedule date
WRONG_CALOGIC 0119 The operation is not supported for the
selected CA LOGIC (but it is supported for
at least one other logic)
LICENSE_CORRUPTED 0120 Decryption or encryption issue
LICENSE_COUNT_EXPIRED 0121 This indiactes that all the Licenses are
consumed.No Licenses left.
LICENSE_NOT_FOUND 0122 License file is not avialable
LICENSE_BAECNT_SYNC 0123 this indicates that counter is not in sync
with BAE flags
PROTECT_LICENSE_ERROR 0124 License Generic Exception
BAD_SCANNING_TYPE 0125 Given scanning type is out of range
(accepted range is 0..2)
BAD_SCANNING_ID 0126 Given scanning ID is out of range
according to the scanning type.
Table 5-2: Error code extensions
CONFIDENTIAL
CONFIDENTIAL

6. UA and CA-S/N checksum

This chapter describes the procedure to manage UAs (unique addresses) and CA-S/Ns
(conditional access serial numbers) at the customer site.
6.1 Definitions
The mandatory information to allow a CAS to fully recognize an individual customer is:
UA Unique address of the smart card. This is a 12-digits long number that
uniquely identifies the smart card. The first 10 digits represent the address
itself; the last 2 digits are a checksum allowing the SMS to verify the
number given by the customer. The preferred (but not mandatory) format
is:
nn nnnn nnnn cc This number is printed and bar-coded on the smart card and is normally
accessible through a set-top box menu on the TV screen.
CA-S/N Conditional access serial number. This is a 12-digits long number that
uniquely identifies the set-top box for the conditional access system. The
first 10 digits represent the serial number; the last 2 digits are a checksum
allowing the SMS to verify the number given by the customer. The
preferred (but not mandatory) format is:
nn nnnn nnnn cc This number may be printed (and possibly bar-coded) on a sticker on the
set-top box and is normally accessible through a set-top box menu on the
TV screen.
This number may differ (and usually differs) from the manufacturing S/N,
which identifies the set-top box for the manufacturer himself. We had to
use a common format throughout the system and different numbers for all
set-top boxes whatever the format chosen by the manufacturer.
6.2 Pairing operation

The pairing only applies to STBs with a Nagravision CAK. Therefore, it does not apply to STBs
with a MediaGuard CAK (this could change in the future).
The pairing operation links a smart card with a set-top box. The pairing operation is mandatory.
Without the pairing operation, the end user’s STB does not work and IRD commands cannot be
forwarded by the smart card to the STB.
There are two types of pairing:

Secure channel (no pairing command needs to be sent, global operator pairing).
Strong pairing:
▪ With soft hardware pairing,
▪ With chipset hardware pairing.
For strong pairing:

The end user will communicate his UA and his CA-S/N (and optionally his chipset ID, in cases
where there is chipset hardware pairing and where the CAS cannot retrieve the accurate
value) to the SMS during the installation process. Those numbers may be filled in the
contract or in any place the customer finds suitable for this purpose.
CONFIDENTIAL
CONFIDENTIAL

The pairing key(s), which is used to effectively prevent the use of a smart card in another set-
top box, is provided in the Nagravision system.
6.3 Data files

Nagravision usually provides the customer with files containing the list of the smart cards
produced. Those files contain a list of UA. They are given by production box (250 smart cards)
and/or by production batch (indeterminate number of boxes in one file).
On the other hand, the set-top box manufacturer has the responsibility to provide files
containing the list of set-top boxes effectively produced. Those files must contain a list or range
of CAS/N. If needed by the customer, those files may provide a link between the CAS/N and the
manufacturing S/N for each box, but this is not requested by the Nagravision system.
Nagravision may possibly provide the range of CAS/N allocated for each manufacturer but has
no view on what is effectively produced.
6.4 CA-S/N – Pairing keys

The CA-S/N is chosen by Nagravision and provided to the set-top box manufacturer, each of
them associated with a pairing key. This pairing key is a system security element and must not
be known by the end user, by the customer, or by any unauthorized people at the
manufacturing site. Thus this pairing key must not appear on any support (label, screen, paper,
accessible memory, file…). A violation of this rule is a severe security breach and may induce
Nagravision into litigation actions.
6.5 Checksum algorithm

The following C routine describes the formula used for the computation of the checksum:
unsigned char calcCheckSum (unsigned long SN)

{
return ((6*(SN/100000000L)+19*(SN/10000000L%10)+
8*(SN/10000L%1000)+(SN/100L%100))%23+
(SN%100))%100;
}
CONFIDENTIAL
CONFIDENTIAL

7. ASCII Table
Decimal Hex Binary Value

00 00 00000000 NUL (Null char.)
32 20 00100000 SP (space)
33 21 00100001 ! (exclamation mark)
34 22 00100010 “ (double quote)
35 23 00100011 # (number sign)
36 24 00100100 $ (dollar sign)
37 25 00100101 % (percent)
38 26 00100110 & (ampersand)
39 27 00100111 ‘ (single quote)
40 28 00101000 ( (left/opening parenthesis)
41 29 00101001 ) (right/closing parenthesis)
42 2A 00101010 * (asterisk)
43 2B 00101011 + (plus)
44 2C 00101100 , (comma)
45 2D 00101101 - (minus or dash)
46 2E 00101110 . (dot)
47 2F 00101111 / (forward slash)
48 30 00110000 0
49 31 00110001 1
50 32 00110010 2
51 33 00110011 3
52 34 00110100 4
53 35 00110101 5
54 36 00110110 6
55 37 00110111 7
56 38 00111000 8
57 39 00111001 9
58 3A 00111010 : (colon)
59 3B 00111011 ; (semi-colon)
60 3C 00111100 < (less than)
61 3D 00111101 = (equal sign)
62 3E 00111110 > (greater than)
63 3F 00111111 ? (question mark)
64 40 01000000 @ (AT symbol)
65 41 01000001 A
66 42 01000010 B
67 43 01000011 C
68 44 01000100 D
69 45 01000101 E
70 46 01000110 F
71 47 01000111 G
72 48 01001000 H
CONFIDENTIAL
CONFIDENTIAL


73 49 01001001 I
74 4A 01001010 J
75 4B 01001011 K
76 4C 01001100 L
77 4D 01001101 M
78 4E 01001110 N
79 4F 01001111 O
80 50 01010000 P
81 51 01010001 Q
82 52 01010010 R
83 53 01010011 S
84 54 01010100 T
85 55 01010101 U
86 56 01010110 V
87 57 01010111 W
88 58 01011000 X
89 59 01011001 Y
90 5A 01011010 Z
91 5B 01011011 [ (left/opening bracket)
92 5C 01011100 \ (back slash)
93 5D 01011101 ] (right/closing bracket)
94 5E 01011110 ^ (caret/cirumflex)
95 5F 01011111 _ (underscore)
96 60 01100000 `
97 61 01100001 a
98 62 01100010 b
99 63 01100011 c
100 64 01100100 d
101 65 01100101 e
102 66 01100110 f
103 67 01100111 g
104 68 01101000 h
105 69 01101001 i
106 6A 01101010 j
107 6B 01101011 k
108 6C 01101100 l
109 6D 01101101 m
110 6E 01101110 n
111 6F 01101111 o
112 70 01110000 p
113 71 01110001 q
114 72 01110010 r
115 73 01110011 s
116 74 01110100 t
117 75 01110101 u
CONFIDENTIAL
CONFIDENTIAL


118 76 01110110 v
119 77 01110111 w
120 78 01111000 x
121 79 01111001 y
122 7A 01111010 z
Table 7-1: ASCII Table
CONFIDENTIAL
CONFIDENTIAL

8. SMS Command Process

The process by which subscriber requests are granted is depicted in .
: STB : SAS : SMS
1: onlineSubPurchase(to_be_added_bitmap)
2: 801 onlinePurchase(authorization, {product_id})
3: 1003 onlinePurchaseAcknowledge(price)
4: requestConfirmationOnlineSubPurchase(price)
5: confirmOnlineSubPurchase( )
6: 801 onlinePurchase (confirm, {product_id})
7: 1003 onlinePurchaseAcknowledge (no_price)
8: acknowledgement( )
9: 905 AddEnhancedListOfPRoducts({product_id})
10: 1000 acknowledge( )
Figure 8-1: SMS commands
The individual steps are as follows:
1. The subscriber requests an online purchase of several commercial offers (subscription

products).
2. SAS issues a SMS command 801 “online purchase” to the SMS to request an online
purchase authorization for the given list of products. The SAS applies a formula to retrieve
the product ID on the basis of the commercial offers and SMS OPI.
3. The SMS responds to the SAS with the command 1003 “online purchase acknowledge” and
specifies the price that will be invoiced to the subscriber.
4. The SAS asks the subscriber to confirm the online purchase on the basis of the price
provided by the SMS.
5. The subscriber confirms the online purchase.
6. SAS issues a SMS command 801 “online purchase” to the SMS to confirm the online
purchase for the given list of products.
7. The SMS responds to the SAS with the command 1003 “online purchase acknowledge”.
CONFIDENTIAL
CONFIDENTIAL

8. The SAS acknowledges the online subscription confirmation provided by the STB.
9. Later on the SMS issues a SMS command 905 “add enhanced list of products” that includes
the list of products ID to be added.
10. The SAS generates the corresponding EMM and acknowledges the SMS command using an
SMS command 1000 “acknowledge”.
CONFIDENTIAL
CONFIDENTIAL

9. Examples
9.1 Device_IO connection establishment

The following example is a network capture of one whole Device_IO connection process.
Packet #1
Flags: 0x00
Status: 0x01
Packet Length:64
Timestamp: 18:04:12.473073 10/09/2001
Ethernet Header
Destination: 08:00:2B:C5:7E:2A
Source: 00:C0:F0:3D:7F:9D
Protocol Type: 0x0800 IP
IP Header - Internet Protocol Datagram
Version: 4
Header Length: 5 (20 bytes)
Type of Service: %00000000
Precedence: Routine, Normal Delay, Normal Throughput, Normal Reliability
Total Length: 44
Identifier: 63087
Fragmentation Flags: %010 Do Not Fragment Last Fragment
Fragment Offset: 0 (0 bytes)
Time To Live: 128
Protocol: 6 TCP - Transmission Control Protocol
Header Checksum: 0x82E9
Source IP Address: 192.168.0.31
Dest. IP Address: 192.168.0.3
No IP Options
9.2 TCP - Transport Control Protocol

Source Port: 1090 ff-fms
Destination Port: 20000 sms_gateway
Sequence Number: 55594
Ack Number: 0
Offset: 6 (24 bytes)
Reserved: %000000
Code: %000010 Synch
Window: 8192
Checksum: 0xCB26
Urgent Pointer: 0
TCP Options:
Option Type: 2 Maximum Segment Size
Length: 4
MSS: 1460
TCP Data Area: No more data.

Extra bytes (Padding):
.. 00 00
FCS - Frame Check Sequence
FCS (Calculated): 0x5FAFB276
Listing 9-1: Device_IO connection
CONFIDENTIAL
CONFIDENTIAL

Packet #2
Flags: 0x00
Status: 0x01
Packet Length:64
Timestamp: 18:04:12.473409 10/09/2001
Ethernet Header
Destination: 00:C0:F0:3D:7F:9D
Source: 08:00:2B:C5:7E:2A
Version: 4
Total Length: 44
Identifier: 56682
Time To Live: 60
Header Checksum: 0xDFEE
No IP Options
TCP - Transport Control Protocol
9.3 Source Port: 20000 sms_gateway

Destination Port: 1090 ff-fms
Ack Number: 55595
Reserved: %000000
Code: %010010 Ack Synch
Window: 33580
Checksum: 0x9939
Urgent Pointer: 0
TCP Options:
Option Type: 2 Maximum Segment Size
Length: 4
MSS: 1460

.. 00 00
FCS (Calculated): 0x36B97026
Packet #3
Flags: 0x00
Status: 0x01
Packet Length:64
Timestamp: 18:04:12.473450 10/09/2001
Ethernet Header
Version: 4
Total Length: 40
Identifier: 63343
Time To Live: 128
Header Checksum: 0x81ED
No IP Options

Ack Number: 1524200407
Reserved: %000000
Code: %010000 Ack
Window: 8760
Checksum: 0x11EB
Urgent Pointer: 0
No TCP Options
...... 00 00 00 00 00 00
Copyright © 2017
FCS Nagravision. All rights
(Calculated): reserved. Confidential and privileged information.
0x62217FDC 190
CONFIDENTIAL
CONFIDENTIAL

Listing 9-1 Device_IO connection (cont.)
CONFIDENTIAL
CONFIDENTIAL

Packet #4
Flags: 0x00
Status: 0x01
Packet Length:69
Timestamp: 18:04:12.485934 10/09/2001
Ethernet Header
Version: 4
Total Length: 51
Identifier: 63599
Time To Live: 128
Header Checksum: 0x80E2
No IP Options

Reserved: %000000
Code: %011000 Ack Push
Window: 8760
Checksum: 0xC9C3
Urgent Pointer: 0
No TCP Options
SMSgateway spec. 2.6.2 - decoder v.0.8
DeviceIO: message_1
len: 9
op_mode: 1 Fast data transfer (do not allow tracing)
ob_name_len: 7
ob_name: SMS_GWY
FCS (Calculated): 0xC6762DDA
Packet #5
Flags: 0x00
Status: 0x01
Packet Length:64
Timestamp: 18:04:12.486303 10/09/2001
Ethernet Header
Version: 4
Total Length: 43
Identifier: 56683
Time To Live: 60
Header Checksum: 0xDFEE
No IP Options

Ack Number: 55606
Reserved: %000000
Window: 33580
Checksum: 0xAADF
Urgent Pointer: 0
No TCP Options
DeviceIO: message_2
len: 1
value: 6
... 00 00 00
Copyright © 2017
FCS - Nagravision.
Frame Check All rights reserved. Confidential and privileged information.
Sequence 192
FCS (Calculated): 0xBDB648A1
CONFIDENTIAL
CONFIDENTIAL

CONFIDENTIAL
CONFIDENTIAL

Packet #6
Flags: 0x00
Status: 0x01
Packet Length:64
Timestamp: 18:04:12.640961 10/09/2001
Ethernet Header
Version: 4
Total Length: 40
Identifier: 63855
Time To Live: 128
Header Checksum: 0x7FED
No IP Options

Reserved: %000000
Code: %010000 Ack
Window: 8757
Checksum: 0x11E0
Urgent Pointer: 0
No TCP Options
...... 00 00 00 00 00 00
FCS (Calculated): 0xB161CF21
Packet #7
Flags: 0x00
Status: 0x01
Packet Length:64
Timestamp: 18:04:12.641152 10/09/2001
Ethernet Header
Version: 4
Total Length: 43
Identifier: 56686
Time To Live: 60
Header Checksum: 0xDFEB
No IP Options

Ack Number: 55606
Reserved: %000000
Window: 33580
Checksum: 0xB0DC
Urgent Pointer: 0
No TCP Options
DeviceIO: message_3
len: 1
value: 0
... 00 00 00
FCS (Calculated): 0x77CEA603
CONFIDENTIAL
CONFIDENTIAL

Packet #14
Flags: 0x00
Status: 0x01
Packet Length:64
Timestamp: 18:04:12.841621 10/09/2001
Ethernet Header
Version: 4
Total Length: 40
Identifier: 65135
Time To Live: 128
Header Checksum: 0x7AED
No IP Options

Reserved: %000000
Code: %010000 Ack
Window: 8754
Checksum: 0x11E0
Urgent Pointer: 0
No TCP Options
...... 00 00 00 00 00 00
FCS (Calculated): 0x22659BEF
9.10 Example of command 52

Raw data:
Listing 9-2: Example of command 52
CONFIDENTIAL
CONFIDENTIAL

Whole network packet, interpreted:
Figure 9-1: Entire network packet
—— END OF DOCUMENT ——
CONFIDENTIAL
CONFIDENTIAL

Glossary
Term Definition Description

ANI Automatic Number Also known as caller id
Identification
CAS Conditional Access System A generic term for a system used in pay
television.
CC Call Collector This is the sub-system of the CAS managing the
callback coming from the STB
DVB Digital Video Broadcasting DVB is a family of international standards for all
program delivery media: satellite, cable,
terrestrial, microwave, MDS, CATV, and SMATV.
EBNF Extended Backus-Naur Form A formal mathematical way to describe a
language
EMM Entitlement Management Carries data from the system to one or many
Message smart cards.
ICC Integrated Circuit Card Smart card
IPPV Impulse Pay Per View A PPV event product, which can be impulsively
purchased through the STB and results in the
acquisition of the related entitlement needed in
the SMART CARD.
ITM Interactive Transaction Manager This is the new name of the Call Collector
MOP Management Operator The operator who manages end users and
entitlements.
NVOD Near Video On Demand.
PA Positive Addressing
PPV Pay Per View
Product Product A single or group of services or events that may
be purchased as a single entity.
SAS Subscriber Authorization This is the sub-system of the CAS that converts
System the SMS command to EMM
SMS Subscriber Management System
SMSgw SMS Gateway SMSgw is an application and an interface
described in this document.
SOP Smart card Operator The operator who manages the system itself
(such as the creation of new MOPs, etc.).
STB Set-Top Box The decoder installed at the end user’s home
STU See STB
UA Unique Address This is the id or number of the smart card
UTC Coordinated Universal Time Formerly known as GMT (Greenwich mean
time).
CONFIDENTIAL
CONFIDENTIAL

Data formats
Format Description Samples Data
hex Raw hexadecimal 19 or 13(hex) in 2 bytes 0x00:0x13
value 88564006 or 0x05:0x47:0x61:0x26
05476126(hex) in 4 bytes
HHMMSS time hour-min-sec 102500 (10h25 and 00 0x31:0x30:0x32:0x35:0x30:0x30
represented in sec)
ASCII
ip_num human As an example the IP 9.10.1 0x30:0x30:0x31:0x
representation of an address 1.112.25.2 must 2E:0x31:0x31:0x32:0x2E
IP address. The be formatted as: 0x30:0x32:0x35:0x2E:0x30:0x30
length is fixed to 15 001.112.025.002 :0x32
bytes (4 x 3-digit
num value
separated with dot
characters).
num numerical value 206 0x32:0x30:0x36
represented in
ASCII.
num_x hexadecimal 6A10F9 0x36:0x3A:0x31:0x30:0x3F:0x39
numerical value
represented in
ASCII.
r_num numerical value see num samples
represented in
ASCII. The range is
restricted.
r_num_x hexadecimal value see num_x samples
represented in
ASCII. The range is
restricted.
r_p_num numerical value see p_num samples
represented in
ASCII and padded
with space
characters. The
range is restricted.
p_num numerical value 206__ (the value is a string 0x32:0x30:0x36:0x20:0x20
represented in of 5 digit, 3 significant digit
ASCII and padded and padded with 2 space
with space characters)
characters.
r_text any text N as No 0x4E
represented in Y as Yes 0x59
ASCII characters.
The range is
restricted.
text any text SMS_GWY 0x53:0x4D:0x53:0x5F:0x47:0x5
represented in 7:0x59
ASCII characters.
YYYYMMDD date year-month- 20030518 (18 May 2003) 0x32:0x30:0x30:0x33:0x30:0x35
day represented in :0x31:0x38
ASCII.
CONFIDENTIAL

SasGwy OneCAS 18.21 - Pub-1

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

SasGwy OneCAS 18.21 - Pub-1

Uploaded by

Copyright:

Available Formats

Nagravision SMS Gateway

Interface Definition: OneCAS (EIS 2.7)

Filename SasGwy OneCAS 18.21.docx

You are not allowed to disclose this document outside NagraVision.

Interface Definition: OneCAS (EIS 2.7)

Copyright © 2018 Nagravision. All rights reserved.

The information contained in this document is subject to change without notice.

Security Policy of Nagravision Kudelski Group

Interface Definition: OneCAS (EIS 2.7)

List of tables .................................................................................................. 6

List of figures ................................................................................................. 7

2. System overview .................................................................................. 12

3. SMS-SMSgw connections ...................................................................... 17

4. SMS commands ..................................................................................... 20

Interface Definition: OneCAS (EIS 2.7)

4.3 Time and date ................................................................................................. 21

Interface Definition: OneCAS (EIS 2.7)

Interface Definition: OneCAS (EIS 2.7)

4.14 MACRO EMM commands (9nn) ......................................................................... 135

5. Error codes ......................................................................................... 174

6. UA and CA-S/N checksum ................................................................... 182

7. ASCII Table ........................................................................................ 184

8. SMS Command Process ....................................................................... 187

9. Examples ............................................................................................ 189

Glossary ..................................................................................................... 197

Data formats .............................................................................................. 198

Interface Definition: OneCAS (EIS 2.7)

Table 4-1: Identifiers ................................................................................................... 22

Interface Definition: OneCAS (EIS 2.7)

Interface Definition: OneCAS (EIS 2.7)

Interface Definition: OneCAS (EIS 2.7)

How to use this document

Chapter 2: System overview and communication protocols

Chapter 3: SMS-SMSgw connection

Chapter 4: SMS commands

Chapter 5: Error codes

Chapter 6: UA and CA-S/N checksum

Chapter 7: ASCII Table

Chapter 8: SMS Command Process

Interface Definition: OneCAS (EIS 2.7)

Interface Definition: OneCAS (EIS 2.7)

2.1 Purpose of the SMSgw

SMS CAS Set-Top-Box

Figure 2-1: CAS overview

2.2 Communication protocols

SMS gateway command

Figure 2-2: SMSgw protocol – communication layers

2.2.2 TCP/IP protocol

Interface Definition: OneCAS (EIS 2.7)

Reading an incomplete message:

Reading one complete message:

Reading more than one message:

2.2.3 Device_IO protocol

The content of the payload section is described in the following chapters.

2.2.4 SMSgw protocol

The SMSgw protocol defines the application-oriented message. It is a high-level protocol in

2.3 Device_IO communication

Communication is established through entry points called services. An application establishes

Interface Definition: OneCAS (EIS 2.7)

For Device_IO communication between applications running on different machines,

2.3.2 Establishing a connection with a Device_IO server

SMS computer CAS computer

SMS DeviceIO SMSgw