4.4 MM specific procedures

24.0083GPPCore network protocolsMobile radio interface Layer 3 specificationRelease 18Stage 3TS

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

A MM specific procedure can only be started if no other MM specific procedure is running or no MM connection exists between the network and the mobile station. The end of the running MM specific procedure or the release of all MM connections have to be awaited before a new MM specific procedure can be started.

During the lifetime of a MM specific procedure, if a MM connection establishment is requested by a CM entity, this request will either be rejected or be delayed until the running MM specific procedure is terminated (this depends on the implementation).

Any MM common procedure (except IMSI detach) may be initiated during a MM specific procedure.

Unless it has specific permission from the network (follow-on proceed) the mobile station side should await the release of the RR connection used for a MM specific procedure before a new MM specific procedure or MM connection establishment is started.

NOTE: The network side may use the same RR connection for MM connection management.

4.4.1 Location updating procedure

The location updating procedure is a general procedure which is used for the following purposes:

– normal location updating (described in this subclause);

– periodic updating (see subclause 4.4.2); or

– IMSI attach (see subclause 4.4.3).

The normal location updating procedure is used to update the registration of the actual Location Area of a mobile station in the network. The location updating type information element in the LOCATION UPDATING REQUEST message shall indicate normal location updating. The conditions under which the normal location updating procedure is used by a mobile station in the MM IDLE state are defined for each service state in subclause 4.2.2.

Only applicable for mobile stations supporting VGCS listening or VBS listening: A mobile station in RR group receive mode is in the MM IDLE state, substate RECEIVING GROUP CALL (NORMAL SERVICE) or RECEIVING GROUP CALL (LIMITED SERVICE). To perform a location updating, the MS in RR group receive mode shall leave the group receive mode, establish an independent dedicated RR connection to perform the location updating as described above and return to the RR group receive mode afterwards.

The MS shall also start the normal location updating procedure:

a) if the network indicates that the mobile station is unknown in the VLR as a response to MM connection establishment request;

b) void

c) when the MS, configured to use CS fallback and SMS over SGs, or SMS over SGs only, enters a GERAN or UTRAN cell in network operation mode II and timer T3423 has expired or is in the GERAN or UTRAN cell in network operation mode II when timer T3423 expires;

NOTE 1: Timer T3423 is specified in 3GPP TS 24.301 [120].

d) when the MS, configured to use CS fallback and SMS over SGs, or SMS over SGs only, enters a GERAN or UTRAN cell after intersystem change from S1 mode to Iu or A/Gb mode, if timer T3346 is running, and the location area of the current cell is the same as the stored location area;

NOTE 2: If inter-system change is due to a mobile originating CS call, the location updating procedure can be performed after the RR connection is released unless the MS moves back to E-UTRAN.

e) when the MS is both IMSI attached for GPRS and non-GPRS services and enters a new routing area where the network operates in network operation mode I and timer T3346 is running.

f) when the network is operating in network operation mode I, timer T3346 is running, timer T3246 is not running, and due to manual CSG selection the MS has selected a CSG cell whose CSG identity and associated PLMN identity are not included in the Allowed CSG list or in the Operator CSG list of the MS;

g) when due to a manual CSG selection the MS has selected a CSG cell whose CSG identity and associated PLMN identity are not included in the MS’s Allowed CSG list or in the MS’s Operator CSG list;

h) when the network is operating in network operation mode I, T3346 is running, update status is not U1 UPDATED and the user manually selects the current PLMN; or

i) when the MS is configured to use CS fallback and SMS over SGs, or SMS over SGs only, and the TIN indicates "GUTI", enters a GERAN or UTRAN cell after intersystem change from S1 mode to Iu or A/Gb mode in NMO II and timer T3412 is not running.

If the MS, configured to use CS fallback and SMS over SGs, enters a GERAN or UTRAN cell, after intersystem change from S1 mode to Iu or A/Gb mode due to CS fallback, and the location area of the current cell is not available, the MS may initiate the location updating procedure.

When the MS supporting N1 mode in MS operation modes A or B moves from NG-RAN coverage to GERAN coverage, or from NG-RAN coverage to UTRAN coverage, and the network operates in network operation mode II, the MS may intiate the normal location updating procedure.

To limit the number of consecutive unsuccessful location updating attempts made, an attempt counter is used. The detailed handling of the attempt counter is described in subclauses 4.4.4.5 to 4.4.4.9.

The mobile equipment shall contain a list of "forbidden location areas for roaming", as well as a list of "forbidden location areas for regional provision of service". These lists shall be erased when the MS is switched off or when the SIM/USIM is removed, and periodically (with period in the range 12 to 24 hours). When the lists are erased, the MS performs a cell selection according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98]. The location area identification received on the BCCH that triggered the location updating request shall be added to the suitable list whenever a LOCATION AREA UPDATING REJECT message is received with the cause "Roaming not allowed in this location area", "Location Area not allowed", or "No suitable cells in Location Area". The lists shall accommodate each 10 or more location area identifications. When the list is full and a new entry has to be inserted, the oldest entry shall be deleted.

In a shared network, the MS shall choose one of the PLMN identities as specified in 3GPP TS 23.122 [14]. The MS shall construct the Location Area Identification of the cell from this chosen PLMN identity and the LAC received on the BCCH. If the constructed LAI is different from the stored LAI, the MS shall initiate the location updating procedure. For:

– a shared GERAN, in A/Gb mode, the chosen PLMN identity shall be indicated to the GERAN in the LOCATION UPDATING REQUEST message using the Skip Indicator IE as specified in subclause 10.3.1.

– a shared UTRAN, the chosen PLMN identity shall be indicated to the UTRAN in the RRC INITIAL DIRECT TRANSFER message (see 3GPP TS 25.331 [23c]).

For GERAN Iu mode, network sharing is not supported.

Whenever a LOCATION UPDATING REJECT message with the cause "PLMN not allowed" is received by the MS, the PLMN identity used to construct the LAI which triggered the location updating procedure shall be stored in the "forbidden PLMN list" and if the MS is configured to use timer T3245 (see 3GPP TS 24.368 [135] or 3GPP TS 31.102 [112]) then the MS shall start timer T3245 and proceed as described in subclause 4.1.1.6. Whenever a LOCATION UPDATING REJECT message is received by the MS with the cause "Roaming not allowed in this location area", "Location Area not allowed", or "No suitable cells in Location Area", the constructed LAI which triggered the location updating procedure shall be stored in the suitable list.

The cell selection processes in the different states are described in 3GPP TS 43.022 [82] and 3GPP TS 45.008 [34].

The location updating procedure is always initiated by the mobile station.

In the case that the mobile station is initiating an emergency call but, due to cell re-selection or redirection by the network, it moves to a different LAI then the mobile station may delay the location updating procedure in the new LA until after the emergency call is completed.

4.4.2 Periodic updating

Periodic updating may be used to notify periodically the availability of the mobile station to the network. Periodic updating is performed by using the location updating procedure. The location updating type information element in the LOCATION UPDATING REQUEST message shall indicate periodic updating.

The procedure is controlled by the timer T3212 in the mobile station. The MS indicates in the MS network feature support IE whether it supports the extended value for timer T3212. If the MS receives the Per MS T3212 IE in the LOCATION UPDATING ACCEPT message, the MS shall use this IE to determine the value of T3212 instead of the value of T3212 that is broadcast. If the MS does not receive the Per MS T3212 IE in the LOCATION UPDATING ACCEPT message, the MS shall use the value of T3212 that is broadcast . If the timer is not already started, the timer is started each time the mobile station enters the MM IDLE substate NORMAL SERVICE or ATTEMPTing TO UPDATE. When the MS leaves the MM Idle State the timer T3212 shall continue running until explicitly stopped.

The timer is stopped (shall be set to its initial value for the next start) when:

– a LOCATION UPDATING ACCEPT or LOCATION UPDATING REJECT message is received;

– an AUTHENTICATION REJECT message is received;

– the first MM message is received, or security mode setting is completed in the case of MM connection establishment, except when the most recent service state is LIMITED SERVICE;

– the mobile station has responded to paging and thereafter has received the first correct layer 3 message except RR message;

– the mobile station is deactivated (i.e. equipment powered down or SIM/USIM removed).

When the timer T3212 expires, the location updating procedure is started and the timer shall be set to its initial value for the next start. If the mobile station is in other state than MM Idle when the timer expires the location updating procedure is delayed until the MM Idle State is entered.

The conditions under which the periodic location updating procedure is used by a mobile station in the MM IDLE state are defined for each service state in subclause 4.2.2.

If the mobile station is in service state NO CELL AVAILABLE, LIMITED SERVICE, PLMN SEARCH or PLMN SEARCH-NORMAL SERVICE when the timer expires the location updating procedure is delayed until this service state is left.

In A/Gb mode and GERAN Iu mode, the (periodic) location updating procedure is not started if the BCCH information at the time the procedure is triggered indicates that periodic location shall not be used. The timeout value is broadcasted in the L3-RR SYSTEM INFORMATION TYPE 3 message on the BCCH, in the Control channel description IE, see 3GPP TS 44.018 [84] subclause 10.5.2.11.

In UTRAN Iu mode, the (periodic) location updating procedure is not started if the information on BCCH or in the last received dedicated system information at the time the procedure is triggered indicates that periodic location shall not be used. The timeout value is included in the CS domain specific system information element.

The T3212 timeout value shall not be changed in the NO CELL AVAILABLE, LIMITED SERVICE, PLMN SEARCH and PLMN SEARCH-NORMAL SERVICE states.

If the MS, configured to use CS fallback and SMS over SGs, or SMS over SGs only, enters a GERAN or UTRAN cell after intersystem change from S1 mode to Iu or A/Gb mode in NMO II, the TIN indicates "GUTI", and the location area of the current cell is the same as the stored location area, the MS shall start timer T3212, with a value set to the shorter of the values of the remaining value of timer T3412, and the broadcast T3212 timeout value.

When the MS supporting N1 mode in MS operation modes A or B moves from NG-RAN coverage to GERAN coverage, or from NG-RAN coverage to UTRAN coverage, the network operates in network operation mode II, the location area of the current cell is the same as the stored location area, the broadcast value of T3212 does not indicate "deactivated" and the T3212 has expired, the MS may intiate the periodic location updating procedure.

When a change of the broadcast T3212 timeout value has to be taken into account and the timer is running (at change of the serving cell or, change of the broadcast value of T3212), the MS shall behave as follows: let t1 be the new T3212 timeout value and let t be the current timer value at the moment of the change to the new T3212 timeout value; then the timer shall be restarted with the value t modulo t1.

When the mobile station is activated, or when a change of the broadcast T3212 timeout value has to be taken into account and the timer is not running, the mobile station shall behave as follows: let t1 be the new T3212 timeout value, the new timer shall be started at a value randomly, uniformly drawn between 0 and t1.

4.4.3 IMSI attach procedure

The IMSI attach procedure is the complement of the IMSI detach procedure (see subclause 4.3.4). It is used to indicate the IMSI as active in the network.

In A/Gb mode and GERAN Iu mode, the network indicates whether the IMSI attach/detach procedures are required by using the ATT flag which is broadcast in the L3-RR SYSTEM INFORMATION TYPE 3 message (see 3GPP TS 44.018 [84] subclause 10.5.2.11).

In UTRAN Iu mode, the network indicates whether the IMSI attach/detach procedures are required by using the ATT flag which is included in the CS domain specific system information element (see subclause 10.5.1.12.2).

The IMSI attach procedure is invoked if the ATT flag indicates that the IMSI detach/attach procedures are required and an IMSI is activated in a mobile station (i.e. activation of a mobile station with plug-in SIM/USIM, insertion of a card in a card-operated mobile station etc.) within coverage area from the network or a mobile station with an IMSI activated outside the coverage area enters the coverage area. The IMSI attach procedure is used only if the update status is U1 UPDATED and if the stored location area identification is the same as the one which is actually broadcasted on the BCCH of the current serving cell.

In a shared network, the MS shall choose one of the PLMN identities as specified in 3GPP TS 23.122 [14]. The MS shall use the IMSI attach procedure only if the update status is U1 UPDATED and the stored location area identification is equal to the combination of the chosen PLMN identity and the LAC received on the BCCH. Otherwise a normal location updating procedure (see subclause 4.4.1) is invoked independently of the ATT flag indication.

The IMSI attach procedure is performed by using the location updating procedure (see subclause 4.4.1). The location updating type information element in the LOCATION UPDATING REQUEST message shall in this case indicate IMSI attach.

4.4.4 Generic Location Updating procedure

4.4.4.1 Location updating initiation by the mobile station

Any timer used for triggering the location updating procedure (e.g. T3211, T3212) is stopped if running.

As no RR connection exists at the time when the location updating procedure has to be started, the MM sublayer within the mobile station will request the RR sublayer to establish a RR connection and enter state WAIT FOR RR CONNECTION (LOCATION UPDATE). The procedure for establishing an RR connection is described in 3GPP TS 44.018 [84] subclause 3.3 and 3GPP TS 25.331 [23c].

The mobile station initiates the location updating procedure by sending a LOCATION UPDATING REQUEST message to the network, starts the timer T3210 and enters state LOCATION UPDATING INITIATED. The location updating type information element shall indicate what kind of updating is requested.

If the MS is configured for "AttachWithIMSI" as specified in 3GPP TS 24.368 [135] or 3GPP TS 31.102 [112] and the selected PLMN is neither the registered PLMN nor in the list of equivalent PLMNs, the MS shall include the IMSI in the Mobile identity IE in the LOCATION UPDATING REQUEST message.

If the mobile station is configured to use CS fallback and SMS over SGs, or SMS over SGs only, and TIN indicates "RAT-related TMSI" the mobile station shall set the TIN to "P-TMSI" unless the mobile station had already received the EMM cause #18 during a combined attach procedure (see subclause 5.5.1.3.4.3 of 3GPP TS 24.301 [120]) or a combined tracking area updating procedure (see subclause 5.5.3.3.4.3 of 3GPP TS 24.301 [120]) on the same PLMN, but not disabled the E-UTRAN capability.

4.4.4.1a Network Request for Additional mobile station Capability Information

In A/Gb mode, the network may initiate the classmark interrogation procedure, for example, to obtain further information on the mobile station’s encryption capabilities.

4.4.4.2 Identification request from the network

The network may initiate the identification procedure, e.g. if the network is unable to get the IMSI based on the TMSI and LAI used as identification by the mobile station (see subclause 4.3.3).

4.4.4.3 Authentication by the network

The authentication procedure (see subclause 4.3.2) may be initiated by the network upon receipt of the LOCATION UPDATING REQUEST message from the mobile station. (See the cases defined in 3GPP TS 42.009 [5]).

4.4.4.4 Security mode setting by the network

In A/Gb mode, the security mode setting procedure (see 3GPP TS 44.018 [84] subclause 3.4.7) may be initiated by the network, e.g., if a new TMSI has to be allocated.

In Iu mode, the security mode control procedure (see 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111]) may be initiated by the network, e.g., if a new TMSI has to be allocated.

4.4.4.5 Location Update Attempt Counter

To limit the number of consecutive unsuccessful location updating attempts, an location update attempt counter is used. The location update attempt counter counts the number of consecutive unsuccessful location updating attempts.

The location update attempt counter shall be incremented as specified in subclause 4.4.4.9.

The location update attempt counter shall be reset when:

– the mobile station is powered on;

– a SIM/USIM is inserted;

– a location updating procedure is successfully completed;

– a location updating procedure is rejected with cause:

a) #11, #12, #13, #15 or #25 (see subclause 4.4.4.7);

b) #22 and T3346 value IE indicating neither zero nor deactivated (see subclause 4.4.4.7);

– a normal or periodic routing area updating procedure or combined routing updating is not accepted by the network with cause #11, #12, #13, #15 or #25 (see subclause 4.7.5.1.4 and 4.7.5.2.4);

– GPRS attach or combined GPRS attach procedure is not accepted by the network with cause #11, #12, #13, or #15 (see subclause 4.7.3.1.4 and 4.7.3.2.4);

– service request procedure is not accepted by the network with cause #12, #13, or #15 (see subclause 4.7.13.4);

– network initiated GPRS detach procedure is completed with cause #12, #13, or #15 (see subclause 4.7.4.2.2);

– combined GPRS attach or combined routing area updating procedure is successful for GPRS and non-GPRS services; or

– a new PLMN is selected.

and additionally when the mobile station is in the state MM IDLE sub-state ATTEMPTING to UPDATE:

– a new location area is entered;

– expiry of timer T3212;

– a location updating procedure is triggered upon entering MM IDLE after the release of the last MM connection, as defined in subclause 4.5.3.1;

– a location updating procedure is triggered by CM sublayer requests; or

– timer T3246 is started.

The location update attempt counter shall be used when deciding whether to re-attempt a location updating procedure after expiry of timer T3211 as specified in subclause 4.4.4.9.

4.4.4.6 Location updating accepted by the network

If the location updating is accepted by the network a LOCATION UPDATING ACCEPT message is transferred to the mobile station.

In case the identity confidentiality service is active (see subclauses 4.3.1 and 4.4.4.4), the TMSI reallocation may be part of the location updating procedure. The TMSI allocated is then contained in the LOCATION UPDATING ACCEPT message together with the location area identifier LAI. The network shall in this case start the supervision timer T3250 as described in subclause 4.3.1.

In a shared network, if the MS is a network sharing supporting MS, the network shall indicate in the LAI the PLMN identity of the CN operator that has accepted the location updating; if the MS is a network sharing non-supporting MS, the network shall indicate the PLMN identity of the common PLMN (see 3GPP TS 23.251 [109]).

In a multi-operator core network (MOCN) with common GERAN, the network shall indicate in the LAI the common PLMN identity (see 3GPP TS 23.251 [109]).

If the network wishes to prolong the RR connection to allow the mobile station to initiate MM connection establishment (for example if the mobile station has indicated in the LOCATION UPDATING REQUEST that it has a follow-on request pending) the network shall send "follow on proceed" in the LOCATION UPDATING ACCEPT and start timer T3255.

If the mobile station has indicated "CS fallback mobile terminating call" in the LOCATION UPDATING REQUEST message, the network shall maintain the RR connection for an implementation dependent duration to allow for mobile terminating call establishment. If the mobile station has also indicated in the LOCATION UPDATING REQUEST message that it has a follow-on request pending, it is implementation dependent whether the network proceeds with the mobile terminating call establishment or allows for a mobile initiated MM connection establishment.

The mobile station receiving a LOCATION UPDATING ACCEPT message shall store the received location area identification LAI, stop timer T3210, reset the location update attempt counter and set the update status in the SIM/USIM to UPDATED. If the message contains an IMSI, the mobile station is not allocated any TMSI, and shall delete any TMSI in the SIM/USIM accordingly. If the message contains a TMSI, the mobile station is allocated this TMSI, and shall store this TMSI in the SIM/USIM and a TMSI REALLOCATION COMPLETE shall be returned to the network. If neither IMSI nor TMSI is received in the LOCATION UPDATING ACCEPT message, the old TMSI if any available shall be kept.

If the MS has initiated the location updating procedure due to manual CSG selection and receives a LOCATION UPDATING ACCEPT message, and the MS sent the LOCATION UPDATING REQUEST message in a CSG cell, the MS shall check if the CSG ID and associated PLMN identity of the cell are contained in the Allowed CSG list. If not, the MS shall add that CSG ID and associated PLMN identity to the Allowed CSG list and the MS may add the HNB Name (if provided by lower layers) to the Allowed CSG list if the HNB Name is present in neither the Operator CSG list nor the Allowed CSG list.

If the LAI or PLMN identity contained in the LOCATION UPDATING ACCEPT message is a member of the list of "forbidden location areas for regional provision of service", the list of "forbidden location areas for roaming" or the "forbidden PLMN list" then such entries shall be deleted.

If the MS receives the LOCATION UPDATING ACCEPT message from a PLMN for which a PLMN-specific attempt counter is maintained (see subclause 4.1.1.6A), then the MS shall reset this counter. If the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services", then the MS shall reset this counter.

The network may also send a list of "equivalent PLMNs" in the LOCATION UPDATING ACCEPT message. Each entry of the list contains a PLMN code (MCC+MNC). If the location updating procedure is initiated during a CS fallback procedure and the network is configured to support the return to the last registered E-UTRAN PLMN after CS fallback as specified in 3GPP TS 23.272 [133], and the PLMN identity which is provided as part of the RAI contained in the ROUTING AREA UPDATE ACCEPT message differs from the last registered E-UTRAN PLMN identity, the network shall include the last registered E-UTRAN PLMN identity in the list of "equivalent PLMNs" in the LOCATION UPDATING ACCEPT message.

NOTE 1: The network can determine a location updating procedure is initiated during a CS fallback procedure as specified in 3GPP TS 23.272 [133].

NOTE 2: The last registered E-UTRAN PLMN identity can be derived by the network as specified in 3GPP TS 23.272 [133].

The mobile station shall store the list, as provided by the network, except that any PLMN code that is already in the "forbidden PLMN list" shall be removed from the "equivalent PLMNs" list before it is stored by the mobile station. If the mobile station is supporting S1 mode, it shall also remove any PLMN code that is already in the list of "forbidden PLMNs for GPRS service" before storing the list. In addition the mobile station shall add to the stored list the PLMN code of the registered PLMN that sent the list. All PLMNs in the stored list shall be regarded as equivalent to each other for PLMN selection, cell selection/re-selection and handover. The stored list in the mobile station shall be replaced on each occurrence of the LOCATION UPDATING ACCEPT message. If no list is contained in the message, then the stored list in the mobile station shall be deleted. The list shall be stored in the mobile station while switched off so that it can be used for PLMN selection after switch on.

After that, the mobile station shall act according to the presence of the "Follow-on proceed" information element in the LOCATION UPDATING ACCEPT; if this element is present and the mobile station has a CM application request pending, it shall send a CM SERVICE REQUEST to the network and proceed as in subclause 4.5.1.1. Otherwise, it shall start timer T3240 and enter state WAIT FOR NETWORK COMMAND.

Furthermore, the network may grant authorisation for the mobile station to use GSM-Cordless Telephony System (CTS) in the Location Area and its immediate neighbourhood. The mobile should memorise this permission in non-volatile memory. If the "CTS permission" IE is not present in the message, the mobile is not authorised to use GSM-CTS, and shall accordingly delete any memorised permission.

NOTE 3: The interaction between CTS and GPRS procedures are not yet defined.

The network may also send a Local Emergency Numbers List with local emergency numbers in the LOCATION UPDATING ACCEPT, by including the Emergency Number List IE. The mobile equipment shall store the Local Emergency Numbers List, as provided by the network. The Local Emergency Numbers List stored in the mobile equipment shall be replaced on each receipt of the Emergency Number List IE. The received Local Emergency Numbers List shall be provided to the upper layers.

The emergency number(s) received in the Emergency Number List IE are valid only in networks in the same country as the cell on which this IE is received. If no list is contained in the LOCATION UPDATING ACCEPT message, then the stored Local Emergency Numbers List in the mobile equipment shall be kept, except if the mobile equipment has successfully registered to a PLMN in a country different from that of the PLMN that sent the Local Emergency Numbers List.

The mobile equipment shall use the stored Local Emergency Numbers Lt of emergency numbers received from the network in addition to the emergency numbers stored on the SIM/USIM or ME to detect that the number dialled is an emergency number.

NOTE 4: The mobile equipment may use the Local Emergency Numbers List to assist the end user in determining whether the dialled number is intended for an emergency service or for another destination, e.g. a local directory service. The possible interactions with the end user are implementation specific.

NOTE 5: An MS that supports procedures specified in 3GPP TS 24.302 [156], can get additional local emergency numbers through those procedures, which can be used based on operator policy (see 3GPP TS 24.302 [156]) to detect that the number dialled is an emergency number.

The Local Emergency Numbers List shall be deleted at switch off and removal of the SIM/USIM. The mobile equipment shall be able to store up to ten local emergency numbers received from the network.

4.4.4.7 Location updating not accepted by the network

If the location updating cannot be accepted, the network sends a LOCATION UPDATING REJECT message to the mobile station. The mobile station receiving a LOCATION UPDATING REJECT message containing a reject cause other than MM cause value #25 or the message is integrity protected, shall stop the timer T3210, store the reject cause, start the timer T3240, enter state LOCATION UPDATING REJECTED, await the release of the RR connection triggered by the network, and for all causes except #12, #15, #22 and #25 deletes the list of "equivalent PLMNs".

If the LOCATION UPDATING REJECT message containing the MM cause value #25 was received without integrity protection, then the MS shall discard the message.

If the location updating is rejected due to general NAS level mobility management congestion control, the network shall set the MM cause value to #22 "congestion" and assign a back-off timer T3246 (see 3GPP TS 23.012 [140]).

Upon the release of the RR connection, the mobile station shall take the following actions depending on the stored reject cause:

# 2: (IMSI unknown in HLR);

# 3: (Illegal MS); or

# 6: (Illegal ME).

The mobile station shall set the update status to ROAMING NOT ALLOWED (and store it in the SIM/USIM according to subclause 4.1.2.2), and delete any TMSI, stored LAI and ciphering key sequence number and shall consider the SIM/USIM as invalid for non-GPRS services until switch-off or the SIM/USIM is removed or the timer T3245 expires as described in subclause 4.1.1.6. If the message has been successfully integrity checked by the lower layers and the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services", then the MS shall set this counter to MS implementation-specific maximum value.

# 11: (PLMN not allowed);

The mobile station shall delete any LAI, TMSI and ciphering key sequence number stored in the SIM/USIM, reset the location update attempt counter, and set the update status to ROAMING NOT ALLOWED (and store it in the SIM/USIM according to subclause 4.1.2.2). The mobile station shall store the PLMN identity in the "forbidden PLMN list" and if the MS is configured to use timer T3245 (see 3GPP TS 24.368 [135] or 3GPP TS 31.102 [112]) then the MS shall start timer T3245 and proceed as described in subclause 4.1.1.6. If the message has been successfully integrity checked by the lower layers and the MS maintains a PLMN-specific attempt counter for that PLMN, then the MS shall set this counter to the MS implementation-specific maximum value.

The MS shall perform a PLMN selection when back to the MM IDLE state according to 3GPP TS 23.122 [14].

An MS in GAN mode shall request a PLMN list in GAN (see 3GPP TS 44.318 [76b]) prior to performing a PLMN selection from this list according to 3GPP TS 23.122 [14].

# 12: (Location Area not allowed);

The mobile station shall store the LAI in the list of "forbidden location areas for regional provision of service".

The MS shall perform a cell selection when back to the MM IDLE state according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98].

NOTE 1: The cell selection procedure is not applicable for an MS in GAN mode.

# 13: (Roaming not allowed in this location area).

The mobile station shall reset the location update attempt counter, and set the update status to ROAMING NOT ALLOWED (and store it in the SIM/USIM according to subclause 4.1.2.2).

The mobile station shall store the LAI in the list of "forbidden location areas for roaming".

The mobile station shall perform a PLMN selection instead of a cell selection when back to the MM IDLE state according to 3GPP TS 23.122 [14].

An MS in GAN mode shall request a PLMN list in GAN (see 3GPP TS 44.318 [76b]) prior to performing a PLMN selection from this list according to 3GPP TS 23.122 [14].

# 15: (No Suitable Cells In Location Area).

The mobile station shall reset the location update attempt counter, set the update status to ROAMING NOT ALLOWED (and store it in the SIM/USIM according to subclause 4.1.2.2).

The mobile station shall store the LAI in the list of "forbidden location areas for roaming".

The mobile station shall search for a suitable cell in another location area or a tracking area according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98] or 3GPP TS 36.304 [121].

NOTE 2: The cell selection procedure is not applicable for an MS in GAN mode.

# 22: (Congestion).

If the T3246 value IE is present in the LOCATION UPDATING REJECT message and the value indicates that this timer is neither zero nor deactivated, the mobile station shall proceed as described below, otherwise it shall be considered as an abnormal case and the behaviour of the MS for this case is specified in subclause 4.4.4.9.

The mobile station shall abort the location updating procedure, reset the location update attempt counter, set the MM update status to U2 NOT UPDATED and change to state MM IDLE sub-state ATTEMPTING TO UPDATE.

The MS shall stop timer T3246 if it is running.

If the LOCATION UPDATING REJECT message is integrity protected, the mobile station shall start timer T3246 with the value provided in the T3246 value IE.

If the LOCATION UPDATING REJECT message is not integrity protected, the mobile station shall start timer T3246 with a random value from the default range specified in table 11.1.

The mobile station stays in the current serving cell and applies the normal cell reselection process. The MM connection establishment is started, if still necessary, when timer T3246 expires or is stopped.

# 25: (Not authorized for this CSG ).

Cause #25 is only applicable in UTRAN Iu mode and when received from a CSG cell. Other cases are considered as abnormal cases and the specification of the mobile station behaviour is given in subclause 4.4.4.9.

The MS shall reset the location update attempt counter, and set the update status to ROAMING NOT ALLOWED (and store it in the SIM/USIM according to subclause 4.1.2.2).

If the CSG ID and associated PLMN identity of the cell where the MS has sent the LOCATION UPDATING REQUEST message are contained in the Allowed CSG list stored in the MS, the MS shall remove the entry corresponding to this CSG ID and associated PLMN identity from the Allowed CSG list.

If the CSG ID and associated PLMN identity of the cell where the MS has sent the LOCATION UPDATING REQUEST message are contained in the Operator CSG list, the MS shall proceed as specified in 3GPP TS 23.122 [14] subclause 3.1A.

The MS shall search for a suitable cell according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98].

Other values are considered as abnormal cases and the specification of the mobile station behaviour in those cases is given in subclause 4.4.4.9.

4.4.4.8 Release of RR connection after location updating

When the Location updating procedure is finished (see subclauses 4.4.4.6 and 4.4.4.7) the mobile station shall (except in the case where the mobile has a follow-on CM application request pending and has received the follow-on proceed indication, see subclause 4.4.4.6) set timer T3240 and enter the state WAIT FOR NETWORK COMMAND, expecting the release of the RR connection. The network may decide to keep the RR connection for network initiated establishment of a MM connection, or to allow for mobile initiated MM connection establishment.

Any release of the RR connection shall be initiated by the network according to subclause 3.5 in 3GPP TS 44.018 [84], and 3GPP TS 25.331 [23c]. If the RR connection is not released within a given time controlled by the timer T3240, the mobile station shall abort the RR connection. In both cases, either after a RR connection release triggered from the network side or after a RR connection abort requested by the MS-side, the MS shall return to state MM IDLE.

At transition to state MM IDLE, substates NORMAL SERVICE or RECEIVING GROUP CALL (NORMAL SERVICE) or ATTEMPTING TO UPDATE either timer T3212 or timer T3211 is started as described in subclause 4.4.4.9, or, timer T3246 is started as described in subclauses 4.4.4.7, 4.4.4.9 and 4.5.1.1.

If the MS receives the "Extended wait time" for CS domain from the lower layers when no location updating or CM service request procedure is ongoing, the MS shall ignore the "Extended wait time".

4.4.4.9 Abnormal cases on the mobile station side

The different abnormal cases that can be identified are the following:

a) Access barred because of access class control or EAB

The location updating procedure is not started. The mobile station stays in the current serving cell and applies normal cell reselection process. The procedure is started as soon as possible and if still necessary (when the barred state is ended or because of a cell change).

b) The answer to random access is an IMMEDIATE ASSIGNMENT REJECT message (A/Gb mode only)

The location updating is not started. The mobile station stays in the chosen cell and applies normal cell selection process. The waiting timer T3122 is reset when a cell change occurs. The procedure is started as soon as possible after T3122 timeout if still necessary.

c) Random access failure (A/Gb mode only)

Timer T3213 is started. When it expires the procedure is attempted again if still necessary.

NOTE 1: As specified in 3GPP TS 45.008 [34], a cell reselection then takes place, with return to the cell inhibited for 5 seconds if there is at least one other suitable cell. Typically the selection process will take the mobile station back to the cell where the random access failed after 5 seconds.

If at the expiry of timer T3213 a new cell has not been selected due to the lack of valid information (see 3GPP TS 45.008 [34]), the mobile station may as an option delay the repeated attempt for up to 8 seconds to allow cell re-selection to take place. In this case the procedure is attempted as soon as a new cell has been selected or the mobile station has concluded that no other cell can be selected.

If random access failure occurs for two successive random access attempts for location updating the mobile station proceeds as specified below.

d) RR connection failure

The procedure is aborted and the mobile station proceeds as specified below.

e) T3210 timeout

The procedure is aborted, the RR connection is aborted and the MS proceeds as specified below.

f) RR release without "Extended Wait Time" received from lower layers before the normal end of procedure

The procedure is aborted and the mobile station proceeds as specified below, except in the following implementation option case f.1.

f.1) RR release in Iu mode (i.e. RRC connection release) with, for example, cause "Normal", "User inactivity" or "Directed signalling connection re-establishment" (see 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111])

The location updating procedure shall be initiated again, if the following conditions apply:

i) The original location updating procedure was initiated over an existing RRC connection; and

ii) No SECURITY MODE COMMAND message and no Non-Access Stratum (NAS) messages relating to the CS signalling connection (e.g. CS authentication procedures, see subclause 4.3.2), were received after the LOCATION UPDATING REQUEST message was transmitted.

NOTE 2: The RRC connection release cause that triggers the re-initiation of the location updating procedure is implementation specific.

g) Location updating reject, other causes than those treated in subclause 4.4.4.7, and cases of MM cause values #22 and #25, if considered as abnormal cases according to subclause 4.4.4.7

Upon reception of the cause codes #22, # 95, # 96, # 97, # 99 and # 111 the MS should set the location update attempt counter to 4. The MS waits for release of the RR connection as specified in subclause 4.4.4.8.

The MS shall proceed as described below.

h) RR connection establishment failure without "Extended Wait Time" received from lower layers (Iu mode only)

The procedure is aborted and the mobile station proceeds as specified below.

NOTE 3: Case h) covers all cases when the signalling connection cannot be established, including random access failure and access reject. As the RRC protocol has error specific retransmission mechanisms (see 3GPP TS 25.331 [23c]), there is no need to distinguish between the different error cases within MM.

i) "Extended wait time" for CS domain from the lower layers

The MS shall abort the location updating procedure and stop timer T3210 if still running.

If the LOCATION UPDATING REQUEST message contained the low priority indicator set to "MS is configured for NAS signalling low priority", the MS shall start timer T3246 with the "Extended wait time" value and reset the location update attempt counter.

In other cases the MS shall ignore the "Extended wait time".

Additionally, the MS shall set the MM update status to U2 NOT UPDATED and change to state MM IDLE sub-state ATTEMPTING TO UPDATE. The MS stays in the current serving cell and applies normal cell reselection process. The location updating procedure is started, if still necessary, when timer T3246 expires or is stopped, and the MS proceeds as specified below.

j) Timer T3246 is running

The location updating procedure shall not be initiated unless the MS is establishing an emergency call or the MS is an MS configured to use AC11 – 15 in selected PLMN. The MS stays in the current serving cell and applies normal cell reselection process. The location updating procedure is started, if still necessary, when timer T3246 expires or is stopped.

In cases d) to i) (except in the case f.1 and except in the case i) when timer T3246 is started) above, and, for repeated failures as defined in c) above, the mobile station proceeds as follows. Timer T3210 is stopped if still running. The RR Connection is aborted in case of timer T3210 timeout. The location update attempt counter is incremented. The next actions depend on the Location Area Identities (stored and received from the BCCH of the current serving cell) and the value of the location update attempt counter.

– the update status is UPDATED, and the stored LAI is equal to the one received on the BCCH from the current serving cell and the location update attempt counter is smaller than 4:

The mobile station shall keep the update status to UPDATED, the MM IDLE sub-state after the RR connection release is NORMAL SERVICE. The mobile station shall memorize the location updating type used in the location updating procedure. It shall start timer T3211 when the RR connection is released. When timer T3211 or T3246 expires the location updating procedure is triggered again with the memorized location updating type;

– either the update status is different from UPDATED, or the stored LAI is different from the one received on the BCCH from the current serving cell, or the location update attempt counter is greater or equal to 4:

When the RR connection is released the mobile station shall delete any LAI, TMSI, ciphering key sequence number stored in the SIM/USIM, and set the update status to NOT UPDATED. A mobile station which is not a GPRS MS shall also delete the list of equivalent PLMNs. The mobile station shall enter the MM IDLE sub-state ATTEMPTING TO UPDATE (see subclause 4.2.2.2 for the subsequent actions) or optionally the MM IDLE sub-state PLMN SEARCH (see subclause 4.2.1.2) in order to perform a PLMN selection according to 3GPP TS 23.122 [14]. If the location update attempt counter is smaller than 4, the mobile station shall memorize that timer T3211 is to be started when the RR connection is released, otherwise it shall memorize that timer T3212 is to be started when the RR connection is released.

4.4.4.10 Abnormal cases on the network side

a) RR connection failure

If a RR connection failure occurs during a common procedure integrated with the location updating procedure, the behaviour of the network should be according to the description of that common procedure.

If a RR connection failure occurs when a common procedure does not exist, the location updating procedure towards the mobile station should be aborted.

b) protocol error

If the LOCATION UPDATING REQUEST message is received with a protocol error, the network should, if possible, return a LOCATION UPDATING REJECT message with one of the following Reject causes:

#96: Mandatory information element error

#99: Information element non-existent or not implemented

#100: Conditional IE error

#111: Protocol error, unspecified

Having sent the response, the network should start the channel release procedure (see subclause 3.5).

Figure 4.5/3GPP TS 24.008: Location updating sequence

4.4.5 Void

4.4.6 Void

4.4.7 eCall inactivity procedure

The eCall inactivity procedure is applicable only to an eCall only mobile station (as determined by information configured in USIM). The procedure shall be started when:

– the mobile station is in any MM Idle state except NO IMSI, NO CELL AVAILABLE or PLMN SEARCH;

– the mobile station is in GMM-NULL or GMM-DEREGISTERED state; and

– one of the following conditions applies:

– timer T3242 expires or is found to have already expired and T3243 is not running;

– timer T3243 expires or is found to have already expired and T3242 is not running; or

– timer T3242 and timer T3243 expire or are found to have already expired.

The mobile station shall then stop other running timers (e.g. T3211, T3212, T3213) and shall perform the IMSI detach procedure if required by the serving network and if the update state is U1. The mobile station then enters MM Idle eCALL INACTIVE state and the mobile station shall delete any LAI, TMSI, ciphering key sequence number stored in the SIM/USIM and set the update state to U4 Updating Disabled.

While in eCALL INACTIVE state, the mobile station maintains awareness of a potential serving cell in a potential serving network but initiates no MM signalling with the network and ignores any paging requests.

The mobile station shall leave eCALL INACTIVE state only when one of the following events occur:

– if the SIM or USIM is removed, the mobile station enters the NO IMSI state;

– if coverage is lost, the mobile station enters PLMN SEARCH state;

– if the mobile station is deactivated (e.g. powered off) by the user: the mobile station enters the NULL state;

– if there is a CM request for an emergency services call: the mobile station should follow the procedure for return to state MM-IDLE in subclause 4.2.3 and attempt a location update. The MS then uses the MM and CM procedures to establish the emergency call at the earliest opportunity; or

NOTE 1: If an eCall only device has not successfully completed a location update procedure, PSAP callback will not be possible due to its calling line identity being unavailable at the PSAP.

NOTE 2: An eCall only device uses the CS domain to originate an emergency services call when in A/Gb or Iu mode, even if the device is capable of eCall over IMS.

– if there is a CM request for a call to an HPLMN designated non-emergency MSISDN for the purpose of accessing test and terminal reconfiguration services: the mobile station follows the procedure for return to state MM-IDLE in subclause 4.2.3 and attempts a normal location update. Once this is complete, further MM and CM procedures are used to establish the non-emergency call.

NOTE 3: An eCall only device uses the CS domain to originate a call to an HPLMN designated non-emergency MSISDN for the purpose of accessing test and terminal reconfiguration services when in A/Gb or Iu mode, even if the device is capable of eCall over IMS.