All Siemens phones seem to make use of an TLV-encoded protocol encapsulated in <<ESCAPE-TO-PROPRIETARY>> information elements.

Basic message structure

All messages contain one or more proprietary information elements of the form:

Octet Contents
0 IE type
1 Length of contents (n)
2 First octet of content
... ...
n + 2 Last octet of content

This matches the S-format variable length information element structure. If multiple elements are present, they are concatenated.

Information Elements


When transporting messages over CISS, each request contains a <<CISS-REQUEST-SEQ>> IE. The receipient needs to return that sequence number in a <<CISS-ACKNOWLEDGEMENT-SEQ>> IE, otherwise the request will be resent using a new sequence number.


Octet Contents
1 Length of contents (1)
2 Sequence number


Octet Contents
1 Length of contents (1)
2 Sequence number



The <<TIME-DATE>> IE indicates the current time and date. It is transported in {FACILITY} messages.

<<TIME-DATE>>: 0x3b

Octet Contents
1 Length of contents (9)
2 ? Date Header ? (0x03)
3 Day (BCD encoded)
4 Month (BCD encoded)
5 Year (BCD encoded)
6 Unknown (0x00)
7 ? Time Header ? (0x04)
8 Hours (BCD encoded)
9 Minutes (BCD encoded)
10 Seconds (BCD encoded) / ? Mode 12/24 h ?



The <<DISPLAY>> IE supplies some text to the PP to permanently display. It is transported in {FACILITY} messages. The size appears to be limited to less that a full line.

<<DISPLAY>>: 0x54

Octet Contents
1 Length of contents (n)
2 Handset number
3 First character
... ...
n + 2 Last character



The <<UNNAMED>> IE appears to be used for various purposes. It contains an inner structure that again follows the TLV-encoding of variable length S-format messages (see Basic message structure). It is transported in {FACILITY} messages.

<<UNNAMED>>: 0x58

Octet Contents
1 Length of contents (n)

One or more of these inner structures are present:

2 Subtype
3 Length of subtype (m)
4 First octet of subtype contents
... ...
4+m Last octet of subtype contents

Event notification subtype

Subtype: 0x02

Some kind of event notification. In case of Sinus 501: first octets control the "T-Com message waiting" notification button: { 0x1, num } number of SMS waiting, {0x4, num } number of missed calls. Remaining octets unknown, general format seems to be { type, num }.

Display subtype

Subtype: 0x03

Contains contents to be displayed, apparently preceeded by some control characters

Prefix/Number? subtypes

All these subtypes contain the IA5 encoded number as content:

Octet Content
0 Subtype
1 Length (n)
2 First digit
... ...
n + 2 Last digit
Call prefix for national area codes subtype

Subtype: 0x09

Call prefix for country codes subtype

Subtype: 0x0a

Local area code subtype

Subtype: 0x0b

Country code subtype

Subtype: 0x0c


<<CALLER-ID>> : 0x28

Octet Contents
1 0x80 (unknown)
2 length (n)
3 first digit
... ...
n + 3 Last digit




The example/fp-siemens-proprietary program from libdect can be used for testing.

Last modified 10 years ago Last modified on Jan 24, 2012, 2:01:11 PM