4.7.3 GPRS attach procedure

24.0083GPPCore network protocolsMobile radio interface Layer 3 specificationRelease 18Stage 3TS

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

The GPRS attach procedure is used for the following purposes:

– normal GPRS attach, performed by the MS to IMSI attach for GPRS services only. The normal GPRS attach procedure shall be used:

– by GPRS MSs in MS operation mode C, independent of the network operation mode;

– by GPRS MSs in MS operation modes A or B if the network operates in network operation mode II; and

– by GPRS MSs in MS operation mode A, independent of the network operation mode, if a circuit-switched transaction is ongoing;

– combined GPRS attach procedure, used by GPRS MSs in MS operation modes A or B to attach the IMSI for GPRS and non-GPRS services provided that the network operates in network operation mode I.

– GPRS attach for emergency bearer services, performed by the MS to IMSI or IMEI attach to emergency bearer services.

The lower layers indicate to NAS that the network does not support emergency bearer services for the MS in limited service state (see 3GPP TS 25.331 [23c]). This information is taken into account when deciding whether to initiate attach for emergency bearer services.

With a successful GPRS attach procedure a GMM context is established.

When the timer T3346 is running, MS is allowed to initiate an attach procedure if:

– the MS is an MS configured to use AC11 – 15 in selected PLMN;

– the MS is attaching for emergency bearer services; or

– the MS has timer T3346 running because a request from an MS with the low priority indicator set to "MS is configured for NAS signalling low priority" was rejected, and the MS needs to attach without the low priority indicator, or with the low priority indicator set to "MS is not configured for NAS signalling low priority".

An eCall only mobile station that is not capable of eCall over IMS shall not perform a normal or combined GPRS attach procedure.

An eCall only mobile station that is capable of eCall over IMS may perform a normal or combined GPRS attach procedure only upon failure of a routing area updating procedure following intersystem change from S1 mode to A/Gb or Iu mode.

When the MS moves from NG-RAN coverage to GERAN coverage, or from NG-RAN coverage to UTRAN coverage, the MS shall perform a normal or combined GPRS attach procedure, if the following applies:

– the MS initiated a registration procedure while in N1 mode; and

– since then the MS did not perform a successful EPS attach or tracking area updating procedure in S1 mode or GPRS attach or routing area updating procedure in A/Gb mode or Iu mode.

Subclause 4.7.3.1 describes the GPRS attach procedure to attach the IMSI only for GPRS services. The combined GPRS attach procedure used to attach the IMSI for both GPRS and non-GPRS services is described in subclause 4.7.3.2. GPRS attach for emergency bearer services is described as part of subclause 4.7.3.1.

If an IMSI attach for non-GPRS services is requested and a GMM context exists, the routing area updating procedure shall be used as described in subclause 4.7.5.2.

To limit the number of consecutive rejected attach attempts, a GPRS attach attempt counter is introduced. The GPRS attach attempt counter shall be incremented as specified in subclause 4.7.3.1.5. Depending on the value of the GPRS attach attempt counter, specific actions shall be performed. The GPRS attach attempt counter shall be reset when:

– the MS is powered on;

– a SIM/USIM is inserted;

– a GPRS attach or combined GPRS attach procedure is successfully completed;

– an attach or combined attach procedure is successfully completed in S1 mode;

– a combined GPRS attach procedure is completed for GPRS services only with cause #2, #16, #17, #22 or #28;

– a GPRS attach or combined GPRS attach procedure is rejected with cause #11, #12, #13, #14 ,#15 or #25;

– a network initiated detach procedure is completed with cause #11, #12, #13, #14, #15 or #25; or

– a new PLMN is selected;

and additionally when the MS is in substate ATTEMPTING-TO-ATTACH:

– expiry of timer T3302;

– a new routing area is entered;

– an attach is triggered by CM sublayer requests;

– timer T3346 is started.

The mobile equipment shall contain a list of "forbidden location areas for roaming", as well as a list of "forbidden location areas for regional provision of service". The handling of these lists is described in subclause 4.4.1; the same lists are used by GMM and MM procedures.

In a shared network, the MS shall choose one of the PLMN identities as specified in 3GPP TS 23.122 [14]. The MS shall construct the Routing Area Identification of the cell from this chosen PLMN identity, and the LAC and the RAC received on the BCCH. For:

– a shared GERAN, in A/Gb mode, the chosen PLMN identity is indicated to the GERAN in the first RLC data block of an upper layer PDU (see 3GPP TS 44.060 [76]) when a foreign TLLI or a random TLLI is used by the network sharing supporting MS for the transmission.

– a shared UTRAN, the chosen PLMN identity shall be indicated to the UTRAN in the RRC INITIAL DIRECT TRANSFER message (see 3GPP TS 25.331 [23c]).

For GERAN Iu mode, network sharing is not supported.

Whenever an ATTACH REJECT message with the cause "PLMN not allowed" is received by the MS, the chosen PLMN indentity shall be stored in the "forbidden PLMN list" and if the MS is configured to use timer T3245 (see 3GPP TS 24.368 [135] or 3GPP TS 31.102 [112]) then the MS shall start timer T3245 and proceed as described in subclause 4.1.1.6. Whenever an ATTACH REJECT message is received by the MS with the cause "Roaming not allowed in this location area", "Location Area not allowed", or "No suitable cells in Location Area", the LAI that is part of the constructed RAI shall be stored in the suitable list.

The network informs the MS about the support of specific features, such as LCS-MOLR, MBMS, IMS voice over PS session, emergency bearer services in Iu mode in the Network feature supporti nformation element. The information is either explicitly given by sending the Network feature support IE or implicitly by not sending it. The handling in the network is described in subclause 9.4.2.9. The network can also use the Additional network feature support IE in order to inform the MS about the support of specific features such as the delivery of SMS via GPRS (GPRS-SMS) or implicitly by not sending it. The MS may use the support indications for LCS-MOLR, MBMS and GPRS-SMS to inform the user about the availability of the appropriate services. The MS shall not request the LCS-MOLR or MBMS services, if the service has not been indicated as available. The indication for MBMS is defined in subclause "MBMS feature support indication" in 3GPP TS 23.246 [106]. In an MS with IMS voice over PS capability, the IMS voice over PS session indicator and the emergency bearer services indicator shall be provided to the upper layers. The upper layers take the IMS voice over PS session indicator into account as specified in 3GPP TS 23.221 [131], subclause 7.2a and subclause 7.2b, when selecting the access domain for voice sessions or calls in Iu mode. When initiating an emergency call in Iu mode, the upper layers also take the emergency bearer services indicator into account for the access domain selection. The MS may use the GPRS-SMS indication in order to obtain SMS.

4.7.3.1 GPRS attach procedure for GPRS services

The GPRS attach procedure is a GMM procedure used by GPRS MSs to IMSI attach for GPRS services. The procedure is also used by GPRS MSs to IMSI or IMEI attach for emergency bearer services.

The attach type information element shall indicate "GPRS attach". For an MS attaching for emergency bearer services the attach type information element shall indicate "Emergency attach".

4.7.3.1.1 GPRS attach procedure initiation

In state GMM-DEREGISTERED, the MS initiates the GPRS attach procedure by sending an ATTACH REQUEST message to the network, starts timer T3310 and enters state GMM-REGISTERED-INITIATED. If timer T3302 is currently running, the MS shall stop timer T3302. If timer T3311 is currently running, the MS shall stop timer T3311.

If the MS is configured for "AttachWithIMSI" as specified in 3GPP TS 24.368 [135] or 3GPP TS 31.102 [112] and the selected PLMN is neither the registered PLMN nor in the list of equivalent PLMNs, the MS shall include the IMSI in the Mobile identity IE in the ATTACH REQUEST message.

For all other cases:

If the MS does not support S1 mode:

– the MS capable of both Iu mode and A/Gb mode or only of A/Gb mode shall include a valid P-TMSI, if any is available, the P-TMSI signature associated with the P-TMSI and the routing area identity associated with the P-TMSI in the ATTACH REQUEST message. In addition, the MS shall include P-TMSI type IE with P-TMSI type set to "native P-TMSI". If there is no valid P-TMSI available, the IMSI shall be included instead of the P-TMSI and P-TMSI signature.

If the MS supports S1 mode:

– if the TIN indicates "GUTI" and the MS holds a valid GUTI allocated by an MME, the MS shall map the GUTI into the Mobile identity IE, P‑TMSI signature IE and Old routing area identification IE. The MS shall also include P-TMSI type IE with P-TMSI type set to "mapped P-TMSI". Additionally, if the MS holds a valid P-TMSI and RAI, the MS shall indicate the P-TMSI in the Additional mobile identity IE and the RAI in the Additional old routing area identification IE.

NOTE: The mapping of the GUTI to the P-TMSI, P-TMSI signature and RAI is specified in 3GPP TS 23.003 [10].

– If the TIN indicates "P-TMSI" or "RAT‑related TMSI" and the MS holds a valid P-TMSI and a RAI, the MS shall indicate the P-TMSI in the Mobile identity IE and the RAI in the Old routing area identification IE. The MS shall also include P-TMSI type IE with P-TMSI type set to "native P-TMSI". If a P-TMSI signature is associated with the P-TMSI, the MS shall include it in the Old P-TMSI signature IE.

– If the TIN is deleted and

– the MS holds a valid P-TMSI and a RAI, the MS shall indicate the P-TMSI in the Mobile identity IE and the RAI in the Old routing area identification IE. The MS shall also include P-TMSI type IE with P-TMSI type set to "native P-TMSI". If a P-TMSI signature is associated with the P-TMSI, the MS shall include it in the Old P-TMSI signature IE; or

– the MS does not hold a valid P-TMSI and RAI, but holds a valid GUTI allocated by an MME, the MS shall map the GUTI into the Mobile identity IE, P‑TMSI signature IE and Old routing area identification IE. The MS shall also include P-TMSI type IE with P-TMSI type set to "mapped P-TMSI"; or

– the MS does not hold a valid P-TMSI, RAI or GUTI, the MS shall include the IMSI in the Mobile identity IE.

– Otherwise the MS shall include the IMSI in the Mobile identity IE.

In the cases when the MS maps a GUTI into the Mobile identity IE, P‑TMSI signature IE and Old routing area identification IE, then:

– If a current EPS security exists, the P-TMSI signature shall include a truncated NAS token as specified in 3GPP TS 33.401 [123]. In the GPRS ciphering key sequence number IE, the MS shall indicate the value of the eKSI associated with the current EPS security context. The MS shall derive CK’ and IK’ from the K_ASME and the NAS uplink COUNT value corresponding to the NAS token derived and handle the START value as specified in 3GPP TS 25.331 [23c]. Then, the MS shall store the mapped UMTS security context replacing the established UMTS security context for the PS domain.

– If a current EPS security does not exist, the MS shall set the truncated NAS token included in the P-TMSI signature to all zeros and the GPRS ciphering key sequence number to "No key is available".

If the MS is attaching for emergency bearer services and does not hold a valid GUTI, P-TMSI or IMSI as described above, the IMEI shall be included in the Mobile identity IE.

The MS shall also indicate within the DRX parameters whether it supports the split pg cycle option on CCCH. The optional support of the split pg cycle on CCCH by the network is indicated in SI13 or PSI1. Split pg cycle on CCCH is applied by both the network and the MS when the split pg cycle option is supported by both (see 3GPP TS 45.002 [32]).

If the MS supports eDRX and requests the use of eDRX, the MS shall include the extended DRX parameters IE in the ATTACH REQUEST message.

In Iu mode, if the MS wishes to prolong the established PS signalling connection after the GPRS attach procedure (for example, the MS has any CM application request pending), it may set a follow-on request pending indicator on (see subclause 4.7.13).

An MS attaching for emergency bearer services shall set the follow-on request pending indicator.

If the MS supports PSM and requests the use of PSM, then the MS shall include the T3324 value IE with a requested timer value in the ATTACH REQUEST message. When the MS includes the T3324 value IE and the MS indicates support for extended periodic timer value in the MS network feature support IE, it may also include the T3312 extended value IE to request a particular T3312 value to be allocated.

In A/Gb mode, if the MS supports the restriction on use of enhanced coverage, then the MS shall set the Restriction on use of enhanced coverage capability bit to "Mobile station supports restriction of use of enhanced coverage" in the MS network capability IE of the ATTACH REQUEST message.

If the MS supports dual connectivity of E-UTRA with New Radio (NR), then the MS shall set the Dual connectivity of E-UTRA with NR capability bit to "Mobile station supports dual connectivity of E-UTRA with NR" in the MS network capability IE of the ATTACH REQUEST message.

In A/Gb mode, if a UMTS security context is available and if the MS indicates support of integrity protection in the MS network capability IE included in the ATTACH REQUEST message, then the MS shall derive a GPRS GSM Kint key as described in subclause 4.7.7.3b and a GPRS GSM Kc₁₂₈ key as described in subclause 4.7.7.3a. The MS shall then assign the GPRS GSM Kint key, the GPRS GSM Kc₁₂₈ key, the GPRS GSM integrity algorithm and the GPRS GSM ciphering algorithm (identified by the information in the Ciphering Algorithm IE and Integrity Algorithm IE stored in the non-volatile ME memory) to the LLC layer, and indicate to the LLC layer that it shall start integrity protection. This shall be done so that the LLC layer can integrity protect, but not cipher, the ATTACH REQUEST message. The MS shall include the CKSN in the CKSN IE in the ATTACH REQUEST message. If the MS has no UMTS security context available, then the MS shall not integrity protect the ATTACH REQUEST message in the LLC layer. In this case the MS shall set the CKSN IE to the value "no key is available" and send the ATTACH REQUEST unprotected.

4.7.3.1.2 GMM common procedure initiation

If the network receives an ATTACH REQUEST message containing the P-TMSI type IE and the Mobile identity IE with type of identity indicating "TMSI/P-TMSI/M-TMSI", and the network does not follow the use of the most significant bit of the LAC as specified in 3GPP TS 23.003 [10] subclause 2.8.2.2.2, the network shall use the P-TMSI type IE to determine whether the mobile identity included in the Mobile identity IE is a native P‑TMSI or a mapped P‑TMSI.

The network may initiate GMM common procedures, e.g. the GMM identification and GMM authentication and ciphering procedure, depending on the received information such as IMSI, CKSN, old RAI, P-TMSI and P-TMSI signature.

4.7.3.1.3 GPRS attach accepted by the network

During an attach for emergency bearer services, if not restricted by local regulations, the network shall not check for mobility and access restrictions, regional restrictions, subscription restrictions, or perform CSG access control when processing the ATTACH REQUEST message. The network shall not apply subscribed APN based congestion control during an attach procedure for emergency bearer services.

If the GPRS attach request is accepted by the network, an ATTACH ACCEPT message is sent to the MS.

In A/Gb mode, if the MS indicates support of integrity protection in the MS network capability IE in the ATTACH REQUEST message, and if the network supports integrity protection, then the network shall store all octets received from the MS in the MS network capability IE and in the MS Radio Access Capability IE, up to the maximum length defined for the respective information element.

NOTE 1: The network needs to store the MS network capability IE and the MS Radio Access Capability IE exactly as received from the MS and network is not allowed to ignore the "higher" octets sent by the MS even if the network does not support any features indicated in the higher octets. Otherwise the replay check of the MS network capability and the MS Radio Access Capability will fail in the MS.

In A/Gb mode, if a UMTS security context is available in the network and if the MS indicates support of integrity protection in the ATTACH REQUEST message and the network supports integrity protection if integrity protection of the ATTACH REQUEST message is successfully verified in the LLC layer in the network , the network may decide to continue using the stored: GPRS GSM Kint integrity key, the GPRS GSM Kc₁₂₈ ciphering key, the GPRS GSM ciphering algorithm and the GPRS GSM integrity algorithm in the LLC layer without initiating an authentication and ciphering procedure. If the MS and network continue to use the same ciphering mode as when the MS was previously attached to the network, ciphering or no ciphering, the ciphering mode is re-established without the need to run an authentication and ciphering procedure. The network shall replay the MS network capability IE and the MS radio access capability IE received from the MS in the ATTACH REQUEST message, by including the MS network capability IE and the MS radio access capability IE in the ATTACH ACCEPT message to the MS. The GMM layer in the network shall assign the stored GPRS GSM Kint key, the GPRS GSM Kc₁₂₈ key, the GPRS GSM integrity algorithm and the GPRS GSM ciphering algorithm to the LLC layer. The GMM layer in the network shall then indicate to the LLC layer that it shall start integrity protection and ciphering in the LLC layer before sending the ATTACH ACCEPT message to the MS. If the integrity protection of the ATTACH REQUEST message is not successfully verified in the LLC layer or if the ATTACH REQUEST message is received without integrity protection, then the network shall progress the ATTACH REQUEST message and initiate an authentication and ciphering procedure in order to authenticate the MS and activate integrity protection and ciphering in the MS.

In A/Gb mode, if a UMTS security context is available in the network and if the MS indicates support of integrity protection in the ATTACH REQUEST message and the network supports integrity protection, and if the network is not able to verify the message authentication code in the LLC layer protecting the ATTACH REQUEST message, due to the LLC layer at the network not having been configured yet with the integrity key and integrity algorithm for this MS, then the network shall progress the ATTACH REQUEST message at GMM layer anyway. If the CKSN included in the ATTACH REQUEST message belongs to an UMTS security context available in the network, then the network may re-establish integrity protection and ciphering of layer 3 signalling messages in the LLC layer without initiating an authentication and ciphering procedure.

In A/Gb mode, if the MS indicates support of integrity protection of user plane data in the MS network capability IE in the ATTACH REQUEST message, and if the network supports and accepts integrity protection of user plane data, then the network shall indicate integrity protection of user plane data to the MS in the ATTACH ACCEPT message. The MS shall indicate to the LLC layer to start integrity protection of user plane data after the reception of the ATTACH ACCEPT message. The same GPRS GSM Kint key and the same GPRS GSM integrity algorithm used for integrity protection of layer 3 signalling messages shall be used for integrity protection of user plane data in the LLC layer. The network shall indicate to the LLC layer to start integrity protection of user plane data after sending off the ATTACH ACCEPT message to the MS. If the network does not indicate to the MS in the ATTACH ACCEPT message that it accepts the use of integrity protection of user plane, and if the MS does not accept such a network, then the MS shall detach from the network.

The P-TMSI reallocation may be part of the GPRS attach procedure. When the ATTACH REQUEST includes the IMSI or IMEI, the SGSN shall allocate the P-TMSI. The P-TMSI that shall be allocated is then included in the ATTACH ACCEPT message together with the routing area identifier. The network shall, in this case, change to state GMM-COMMON-PROCEDURE-INITIATED and shall start timer T3350 as described in subclause 4.7.6. Furthermore, the network may assign a P-TMSI signature for the GMM context which is then also included in the ATTACH ACCEPT message. If the LAI or PLMN identity that has been transmitted in the ATTACH ACCEPT message is a member of any of the "forbidden" lists, any such entry shall be deleted. If the attach procedure is for emergency bearer services, the "forbidden" lists shall remain unchanged. Additionally, the network shall include the radio priority level to be used by the MS for mobile originated SMS transfer in the ATTACH ACCEPT message.

In a shared network, if the MS is a network sharing supporting MS, the network shall indicate the PLMN identity of the CN operator that has accepted the GPRS attach request in the RAI contained in the ATTACH ACCEPT message; if the MS is a network sharing non-supporting MS, the network shall indicate the PLMN identity of the common PLMN (see 3GPP TS 23.251 [109]). If the PLMN identity of the common PLMN included in the RAI does not identify the CN operator that has accepted the GPRS attach request, the network may include the PLMN identity of the CN operator that has accepted the GPRS attach request in the ATTACH ACCEPT message.

In a multi-operator core network (MOCN) with common GERAN, the network shall indicate in the RAI the common PLMN identity (see 3GPP TS 23.251 [109]).

If the common PLMN identity included in the RAI does not identify the CN operator that has accepted the GPRS attach request, the network may include the PLMN identity of the CN operator that has accepted the GPRS attach request in the ATTACH ACCEPT message.

If the MS has indicated in the ATTACH REQUEST message that it supports PS inter-RAT handover from GERAN to UTRAN Iu mode, the network may include in the ATTACH ACCEPT message a request to provide the Inter RAT information container.

If the MS has included the MS network capability IE or the UE network capability IE or both in the ATTACH REQUEST message, the network shall store all octets received from the MS, up to the maximum length defined for the respective information element.

NOTE 2: This information is forwarded to the new SGSN during inter-SGSN handover or to the new MME during intersystem handover to S1 mode.

If the DRX parameter was included in the DRX Parameter IE in the ATTACH REQUEST message, the network shall replace any stored DRX parameter with the received parameter and use it for the downlink transfer of signalling and user data.

The network shall include the extended DRX parameters IE in the ATTACH ACCEPT message only if the extended DRX parameters IE was included in the ATTACH REQUEST message, and the network supports and accepts the use of eDRX.

In A/Gb mode, the Cell Notification information element shall be included in the ATTACH ACCEPT message by the network which indicates that the Cell Notification is supported by the network.

In Iu mode, the network should prolong the PS signalling connection if the mobile station has indicated a follow-on request pending in ATTACH REQUEST. The network may also prolong the PS signalling connection without any indication from the mobile terminal.

The MS, receiving an ATTACH ACCEPT message, stores the received routing area identification, stops timer T3310, resets the GPRS attach attempt counter, resets the routing area updating attempt counter, resets the service request attempt counter, enters state GMM-REGISTERED and sets the GPRS update status to GU1 UPDATED.

If the message contains a P-TMSI, the MS shall use this P-TMSI as the new temporary identity for GPRS services. In this case, an ATTACH COMPLETE message is returned to the network. The MS shall delete its old P-TMSI and shall store the new one. If no P-TMSI has been included by the network in the ATTACH ACCEPT message, the old P-TMSI, if any available, shall be kept.

If the message contains a P-TMSI signature, the MS shall use this P-TMSI signature as the new temporary signature for the GMM context. The MS shall delete its old P-TMSI signature, if any is available, and shall store the new one. If the message contains no P-TMSI signature, the old P-TMSI signature, if available, shall be deleted.

If the network supports delivery of SMS via GPRS (3GPP TS 23.060 [74]) and this delivery is enabled (see 3GPP TS 29.272 [150]), then the network shall include the Additional network feature support IE in the ATTACH ACCEPT message and set the GPRS-SMS indicator.

If the network supports the extended protocol configuration options IE and the MS indicated support of the extended protocol configuration options IE, then the network shall include the Additional network feature support IE in the ATTACH ACCEPT message and set the ePCO IE indicator to "extended protocol configuration options IE supported".

Upon receiving the ATTACH ACCEPT message an MS supporting S1 mode shall set the TIN to "P-TMSI".

If the network has requested the provision of Inter RAT handover information, the MS shall return an ATTACH COMPLETE message including the Inter RAT handover information IE to the network.

The network may also send a list of "equivalent PLMNs" in the ATTACH ACCEPT message. Each entry of the list contains a PLMN code (MCC+MNC). The mobile station shall store the list, as provided by the network, and if the GPRS attach procedure is not for emergency bearer services, any PLMN code that is already in the "forbidden PLMN" list shall be removed from the "equivalent PLMNs" list before it is stored by the mobile station. If the mobile station is operating in MS operation mode C or the mobile station is supporting S1 mode, it shall also remove any PLMN code that is already in the list of "forbidden PLMNs for GPRS service" before storing the list. In addition the mobile station shall add to the stored list the PLMN code of the registered PLMN that sent the list. All PLMNs in the stored list shall be regarded as equivalent to each other for PLMN selection, cell selection/re-selection and handover. The stored list in the mobile station shall be replaced on each occurrence of the ATTACH ACCEPT message. If no list is contained in the message, then the stored list in the mobile station shall be deleted. An MS attached for emergency bearer services shall delete the stored list when the MS enters the state GMM-DEREGISTERED. The list shall be stored in the mobile station while switched off so that it can be used for PLMN selection after switch on.

The network shall include the T3324 value IE in the ATTACH ACCEPT message only if the T3324 value IE was included in the ATTACH REQUEST message, and the network supports and accepts the use of PSM.

If the network supports and accepts the use of PSM, and the MS included the T3312 extended value IE in the ATTACH REQUEST message, then the network shall take into account the T3312 value requested when providing the Periodic RA update timer IE and the T3312 extended value IE in the ATTACH ACCEPT message.

NOTE 3: Besides the value requested by the MS, the network can take local configuration into account when selecting a value for T3312 (see 3GPP TS 23.060 [74] subclause 5.3.13.54).

In A/Gb mode, if the MS indicates support for restriction on use of enhanced coverage in the ATTACH REQUEST message, and the network restricts enhanced coverage for the MS, then the network shall set the RestrictEC bit to "Enhanced coverage restricted" in the Additional network feature support IE of the ATTACH ACCEPT message.

In Iu mode, if the network wishes to prolong the PS signalling connection (for example, if the mobile station has indicated "follow-on request pending" in ATTACH REQUEST message) the network shall indicate the "follow-on proceed" in the ATTACH ACCEPT message. If the network wishes to release the PS signalling connection, the network shall indicate "no follow-on proceed" in the ATTACH ACCEPT message.

After that in Iu mode, the mobile station shall act according to the follow-on proceed flag included in the Attach result information element in the ATTACH ACCEPT message (see subclause 4.7.13).

In A/Gb mode, if the ATTACH ACCEPT message contains the Cell Notification information element, then the MS shall start to use the LLC NULL frame to perform cell updates. The network receiving an ATTACH COMPLETE message stops timer T3350, changes to GMM-REGISTERED state and considers the P-TMSI sent in the ATTACH ACCEPT message as valid.

If the ATTACH ACCEPT message contains the T3312 extended value IE, then the MS shall use the value in T3312 extended value IE as periodic routing area update timer (T3312). If the ATTACH ACCEPT message does not contain T3312 extended value IE, then the MS shall use the value in the Periodic RA update timer IE as periodic routing area update timer (T3312).

If the ATTACH ACCEPT message contains the T3324 value IE, then the MS shall use the included timer value for T3324 as specified in subclause 4.7.2.8.

If the ATTACH ACCEPT message contains the DCN-ID IE, then the MS shall store the included DCN-ID value together with the PLMN code of the registered PLMN in a DCN-ID list in a non-volatile memory in the ME as described in 3GPP TS 24.301 [120], annex C.

In a shared network or in a multi-operator core network (MOCN) with common GERAN, if the ATTACH ACCEPT message contains the DCN-ID IE and the PLMN identity of the CN operator IE, the MS shall store the included DCN-ID value with the PLMN identity indicated in the PLMN identity of the CN operator IE, and the included DCN-ID value with the PLMN identity indicated in the RAI in a DCN-ID list in a non-volatile memory in the ME as described in 3GPP TS 24.301 [120], annex C.

If the MS receives the ATTACH ACCEPT message from a PLMN for which a PLMN-specific attempt counter or PLMN-specific PS-attempt counter is maintained (see subclause 4.1.1.6A), then the MS shall reset these counters. If the MS maintains a counter for "SIM/USIM considered invalid for GPRS services", then the MS shall reset this counter.

The network may also send a Local Emergency Numbers List with local emergency numbers in the ATTACH ACCEPT, by including the Emergency Number List IE. The mobile equipment shall store the Local Emergency Numbers List, as provided by the network. The Local Emergency Numbers List stored in the mobile equipment shall be replaced on each receipt of the Emergency Number List IE. The received Local Emergency Numbers List shall be provided to the upper layers.

The emergency number(s) received in the Emergency Number List IE are valid only in networks in the same country as the cell on which this IE is received. If no list is contained in the ATTACH ACCEPT message, then the stored Local Emergency Numbers List in the mobile equipment shall be kept, except if the mobile equipment has successfully registered to a PLMN in a country different from that of the PLMN that sent the Local Emergency Numbers List.

The mobile equipment shall use the stored Local Emergency Numbers List of emergency numbers received from the network in addition to the emergency numbers stored on the SIM/USIM or ME to detect that the number dialled is an emergency number.

NOTE 4: The mobile equipment may use the Local Emergency Numbers List to assist the end user in determining whether the dialled number is intended for an emergency service or for another destination, e.g. a local directory service. The possible interactions with the end user are implementation specific.

NOTE 5: An MS that supports procedures specified in 3GPP TS 24.302 [156], can get additional local emergency numbers through those procedures, which can be used based on operator policy (see 3GPP TS 24.302 [156]) to detect that the number dialled is an emergency number.

The Local Emergency Numbers List shall be deleted at switch off and removal of the SIM/USIM. The mobile equipment shall be able to store up to ten local emergency numbers received from the network.

If the MS has initiated the attach procedure due to manual CSG selection and receives an ATTACH ACCEPT message, and the MS sent the ATTACH REQUEST message in a CSG cell, the MS shall check if the CSG ID and associated PLMN identity of the cell are contained in the Allowed CSG list. If not, the MS shall add that CSG ID and associated PLMN identity to the Allowed CSG list and the MS may add the HNB Name (if provided by lower layers) to the Allowed CSG list if the HNB Name is present in neither the Operator CSG list nor the Allowed CSG list.

In A/Gb mode, if a UMTS security context is available, if the MS indicates support of integrity protection in the ATTACH REQUEST message and the network supports integrity protection, then if the MS receives replayed capabilities IE’s in ATTACH ACCEPT, then the MS shall check if the replayed MS network capability IE and replayed MS Radio Access Capability IE received in the ATTACH ACCEPT message has not been altered compared to the MS network capability IE and the MS Radio Access Capability IE that the MS sent to the network in ATTACH REQUEST message. If the replayed MS network capability IE and the replayed MS Radio Access Capability IE are not the same, then the MS shall ignore the ATTACH ACCEPT message.

4.7.3.1.4 GPRS attach not accepted by the network

If the attach request cannot be accepted by the network, an ATTACH REJECT message is transferred to the MS. The MS receiving the ATTACH REJECT message containing a reject cause other than GMM cause value #25 or the message is integrity protected, shall stop the timer T3310 and for all causes except #7, #12, #14, #15, #22 and #25 deletes the list of "equivalent PLMNs".

If the ATTACH REJECT message containing GMM cause value cause #25 was received without integrity protection, then the MS shall discard the message.

If the attach request is rejected due to NAS level mobility management congestion control, the network shall set the GMM cause value to #22 "congestion" and assign a back-off timer T3346.

The MS shall then take one of the following actions depending upon the reject cause:

# 3 (Illegal MS);

# 6 (Illegal ME);

The MS shall set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2) and shall delete any P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number. The new GMM state is GMM-DEREGISTERED.NO-IMSI. The SIM/USIM shall be considered as invalid for GPRS services until switching off or the SIM/USIM is removed or the timer T3245 expires as described in subclause 4.1.1.6. If the message has been successfully integrity checked by the lower layers and the MS maintains a counter for "SIM/USIM considered invalid for GPRS services", then the MS shall set this counter to MS implementation-specific maximum value.

If the MS is IMSI attached, the MS shall in addition set the update status to U3 ROAMING NOT ALLOWED, shall delete any TMSI, LAI and ciphering key sequence number. If the MS is operating in MS operation mode A and an RR connection exists, the MS shall abort the RR connection, unless an emergency call is ongoing. The SIM/USIM shall be considered as invalid also for non-GPRS services until switching off or the SIM/USIM is removed. If the message has been successfully integrity checked by the lower layers and the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services", then the MS shall set this counter to MS implementation-specific maximum value.

If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status, GUTI, last visited registered TAI, TAI list and KSI as specified in 3GPP TS 24.301 [120] for the case when the attach procedure is rejected with the EMM cause with the same value.

# 7 (GPRS services not allowed);

The MS shall set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2) and shall delete any P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number. The SIM/USIM shall be considered as invalid for GPRS services until switching off or the SIM/USIM is removed. The new state is GMM-DEREGISTERED. If the message has been successfully integrity checked by the lower layers and the MS maintains a counter for "SIM/USIM considered invalid for GPRS services", then the MS shall set this counter to MS implementation-specific maximum value.

NOTE 1: Optionally the MS starts the timer T3340 as described in subclause 4.7.1.9

# 8 (GPRS services and non-GPRS services not allowed);

NOTE 2: Optionally the MS starts the timer T3340 as described in subclause 4.7.1.9.

The MS shall set the update status to U3 ROAMING NOT ALLOWED, shall delete any TMSI, LAI and ciphering key sequence number. If the MS is operating in MS operation mode A and an RR connection exists, the MS shall abort the RR connection, unless an emergency call is ongoing. The SIM/USIM shall be considered as invalid for GPRS and non-GPRS services until switching off or the SIM/USIM is removed. If the message has been successfully integrity checked by the lower layers and the MS maintains a counter for "SIM/USIM considered invalid for GPRS services", then the MS shall set this counter to MS implementation-specific maximum value. If the message has been successfully integrity checked by the lower layers and the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services", then the MS shall set this counter to MS implementation-specific maximum value.

# 11 (PLMN not allowed);

The MS shall delete any RAI, P-TMSI, P-TMSI signature, and GPRS ciphering key sequence number stored, shall set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2), shall reset the GPRS attach attempt counter and shall change to state GMM-DEREGISTERED.

The MS shall store the PLMN identity in the "forbidden PLMN list" and if the MS is configured to use timer T3245 (see 3GPP TS 24.368 [135] or 3GPP TS 31.102 [112]) then the MS shall start timer T3245 and proceed as described in subclause 4.1.1.6. If the message has been successfully integrity checked by the lower layers and the MS maintains a PLMN-specific attempt counter for that PLMN, then the MS shall set this counter to the MS implementation-specific maximum value.

The MS shall start timer T3340 as described in subclause 4.7.1.9.

If no RR connection exists, the MS shall perform the following additional actions immediately. If the MS is operating in MS operation mode A and an RR connection exists, the MS shall perform these actions when the RR connection is subsequently released:

– If the MS is IMSI attached, the MS shall set the update status to U3 ROAMING NOT ALLOWED, shall delete any TMSI, LAI and ciphering key sequence number and shall reset the location update attempt counter. The new MM state is MM IDLE.

– The MS shall perform a PLMN selection according to 3GPP TS 23.122 [14].

An MS in GAN mode shall request a PLMN list in GAN (see 3GPP TS 44.318 [76b]) prior to perform a PLMN selection from this list according to 3GPP TS 23.122 [14].

If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status, GUTI, last visited registered TAI, TAI list, KSI and attach attempt counter as specified in 3GPP TS 24.301 [120] for the case when attach procedure is rejected with the EMM cause with the same value.

# 12 (Location area not allowed);

The MS shall delete any RAI, P-TMSI, P-TMSI signature and GPRS ciphering key sequence number, shall set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to clause 4.1.3.2) and shall reset the GPRS attach attempt counter. The state is changed to GMM-DEREGISTERED.LIMITED-SERVICE.

The mobile station shall store the LAI in the list of "forbidden location areas for regional provision of service".

The MS shall start timer T3340 as described in subclause 4.7.1.9.

– The MS shall perform a cell selection according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98].

NOTE 3: The cell selection procedure is not applicable for an MS in GAN mode.

If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status, GUTI, last visited registered TAI, TAI list, KSI and attach attempt counter as specified in 3GPP TS 24.301 [120] for the case when the attach procedure is rejected with the EMM cause with the same value.

# 13 (Roaming not allowed in this location area);

The MS shall store the LAI in the list of "forbidden location areas for roaming".

The MS shall start timer T3340 as described in subclause 4.7.1.9.

– The MS shall perform a PLMN selection according to 3GPP TS 23.122 [14].

An MS in GAN mode shall request a PLMN list in GAN (see 3GPP TS 44.318 [76b]) prior to perform a PLMN selection from this list according to 3GPP TS 23.122 [14].

If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status, GUTI, last visited registered TAI, TAI list, KSI and attach attempt counter as specified in 3GPP TS 24.301 [120] for the case when the attach procedure is rejected with the EMM cause with the same value.

# 14 (GPRS services not allowed in this PLMN);

The MS shall delete any RAI, P-TMSI, P-TMSI signature, and GPRS ciphering key sequence number stored, shall set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2) , shall reset the GPRS attach attempt counter and shall change to state GMM-DEREGISTERED.

The MS shall store the PLMN identity in the "forbidden PLMNs for GPRS service" list and if the MS is configured to use timer T3245 (see 3GPP TS 24.368 [135] or 3GPP TS 31.102 [112]) then the MS shall start timer T3245 and proceed as described in subclause 4.1.1.6. A GPRS MS operating in MS operation mode C shall perform a PLMN selection instead of a cell selection. If the message has been successfully integrity checked by the lower layers and the MS maintains a PLMN-specific PS-attempt counter for that PLMN, then the MS shall set this counter to the MS implementation-specific maximum value.

A GPRS MS operating in MS operation mode A or B in network operation mode II, is still IMSI attached for CS services in the network.

As an implementation option, a GPRS MS operating in operation mode A or B may perform the following additional action. If no RR connection exists the MS may perform the action immediately. If the MS is operating in MS operation mode A and an RR connection exists, the MS may only perform the action when the RR connection is subsequently released:

– The MS may perform a PLMN selection according to 3GPP TS 23.122 [14].

If an MS in GAN mode performs a PLMN selection, it shall request a PLMN list in GAN (see 3GPP TS 44.318 [76b]) prior to perform a PLMN selection from this list according to 3GPP TS 23.122 [14].

The MS shall not perform the optional PLMN selection in the case where the PLMN providing this reject cause is:

– On the "User Controlled PLMN Selector with Access Technology" list;

– On the "Operator Controlled PLMN Selector with Access Technology" list;

– On the "PLMN Selector" list for an MS using a SIM/USIM without access technology information storage (i.e. the "User Controlled PLMN Selector with Access Technology" and the "Operator Controlled PLMN Selector with Access Technology" data files are not present); or

– A PLMN identified as equivalent to any PLMN, within the same country, contained in the lists above.

If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status, GUTI, last visited registered TAI, TAI list, KSI and attach attempt counter as specified in 3GPP TS 24.301 [120] for the case when the attach procedure is rejected with the EMM cause with the same value.

# 15 (No Suitable Cells In Location Area);

The MS shall delete any RAI, P-TMSI, P-TMSI signature and GPRS ciphering key sequence number, shall set the GPRS update status to GU3 ROAMING NOT ALLOWED(and shall store it according to clause 4.1.3.2) and shall reset the GPRS attach attempt counter. The state is changed to GMM-DEREGISTERED.LIMITED-SERVICE.

The MS shall store the LAI in the list of "forbidden location areas for roaming".

The MS shall start timer T3340 as described in subclause 4.7.1.9.

– The MS shall search for a suitable cell in another location area or a tracking area according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98] or 3GPP TS 36.304 [121].

NOTE 4: The cell selection procedure is not applicable for an MS in GAN mode.

If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status, GUTI, last visited registered TAI, TAI list, KSI and attach attempt counter as specified in 3GPP TS 24.301 [120] for the case when the attach procedure is rejected with the EMM cause with the same value.

# 22 (Congestion);

If the T3346 value IE is present in the ATTACH REJECT message and the value indicates that this timer is neither zero nor deactivated, the MS shall proceed as described below, otherwise it shall be considered as an abnormal case and the behaviour of the MS for this case is specified in subclause 4.7.3.1.5.

The MS shall abort the attach procedure, reset the GPRS attach attempt counter, set the GPRS update status to GU2 NOT UPDATED and enter state GMM-DEREGISTERED.ATTEMPTING-TO-ATTACH.

The MS shall stop timer T3346 if it is running.

If the ATTACH REJECT message is integrity protected, the MS shall start timer T3346 with the value provided in the T3346 value IE.

If the ATTACH REJECT message is not integrity protected, the MS shall start timer T3346 with a random value from the default range specified in table 11.3a.

The MS stays in the current serving cell and applies the normal cell reselection process. The attach procedure is started if still needed when timer T3346 expires or is stopped.

If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status, and attach attempt counter as specified in 3GPP TS 24.301 [120] for the case when the attach procedure is rejected with the EMM cause with the same value.

# 25 (Not authorized for this CSG);

Cause #25 is only applicable in UTRAN Iu mode and when received from a CSG cell. Other cases are considered as abnormal cases and the specification of the mobile station behaviour is given in subclause 4.7.3.1.5.

The MS shall set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2), reset the GPRS attach attempt counter and enter the state GMM-DEREGISTERED.LIMITED-SERVICE.

If the CSG ID and associated PLMN identity of the cell where the MS has sent the ATTACH REQUEST message are contained in the Allowed CSG list stored in the MS, the MS shall remove the entry corresponding to this CSG ID and associated PLMN identity from the Allowed CSG list.

If the CSG ID and associated PLMN identity of the cell where the MS has sent the ATTACH REQUEST message are contained in the Operator CSG list stored in the MS, the MS shall proceed as specified in 3GPP TS 23.122 [14] subclause 3.1A.

The MS shall start timer T3340 as described in subclause 4.7.1.9.

The MS shall search for a suitable cell according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98].

If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status, GUTI, last visited registered TAI, TAI list, KSI and attach attempt counter as specified in 3GPP TS 24.301 [120] for the case when the attach procedure is rejected with the EMM cause with the same value.

Other values are considered as abnormal cases. The specification of the MS behaviour in those cases is specified in subclause 4.7.3.1.5.

4.7.3.1.4a GPRS attach for emergency bearer services not accepted by the network (UTRAN Iu mode only)

If the attach request for emergency bearer services cannot be accepted by the network, an ATTACH REJECT message is transferred to the MS. The ATTACH REJECT message includes GMM cause #5 "IMEI not accepted" or one of the GMM cause values as described in subclause 4.7.3.1.4.

NOTE 1: If GMM cause #11 is sent to a MS of a roaming subscriber attaching for emergency bearer services and the MS is in automatic network selection mode, it cannot obtain normal service provided by this PLMN.

Upon receiving the ATTACH REJECT message including GMM cause #5, the MS shall enter the state GMM-DEREGISTERED.NO-IMSI.

Upon receiving the ATTACH REJECT message including one of the other GMM cause values, the MS shall perform the actions as described in subclause 4.7.3.1.4 with the following addition: the MS shall inform the upper layers of the failure of the procedure.

NOTE 2: This can result in the upper layers requesting establishment of a CS emergency call (if not already attempted in the CS domain), or other implementation specific mechanisms, e.g. procedures specified in 3GPP TS 24.229 [13D] can result in the emergency call being attempted to another IP-CAN.

If the attach request for emergency bearer services fails due to abnormal case a) in subclause 4.7.3.1.5, the MS shall perform the actions as described in subclause 4.7.3.1.5 and inform the upper layers of the failure to access the network.

NOTE 3: This can result in the upper layers requesting establishment of a CS emergency call (if not already attempted in the CS domain), or other implementation specific mechanisms, e.g. procedures specified in 3GPP TS 24.229 [13D] can result in the emergency call being attempted to another IP-CAN.

If the attach request for emergency bearer services fails due to abnormal cases b), c) or d) in subclause 4.7.3.1.5, the MS shall perform the actions as described in subclause 4.7.3.1.5 with the following addition: the MS shall inform the upper layers of the failure of the procedure.

NOTE 4: This can result in the upper layers requesting establishment of a CS emergency call (if not already attempted in the CS domain), or other implementation specific mechanisms, e.g. procedures specified in 3GPP TS 24.229 [13D] can result in the emergency call being attempted to another IP-CAN.

In a shared network, upon receiving the ATTACH REJECT message, the MS shall perform the actions as described in subclause 4.7.3.1.4, and shall:

a) inform the upper layers of the failure of the procedure; or

NOTE 5: This can result in the upper layers requesting establishment of a CS emergency call (if not already attempted in the CS domain), or other implementation specific mechanisms, e.g. procedures specified in 3GPP TS 24.229 [13D] can result in the emergency call being attempted to another IP-CAN.

b) attempt the attach for emergency bearer services to another PLMN in the shared network.

In a shared network, if the attach request for emergency bearer services fails due to abnormal case a) in subclause 4.7.3.1.5, the MS shall perform the actions as described in subclause 4.7.3.1.5 and shall:

a) inform the upper layers of the failure to access the network; or

NOTE 6: This can result in the upper layers requesting establishment of a CS emergency call (if not already attempted in the CS domain), or other implementation specific mechanisms, e.g. procedures specified in 3GPP TS 24.229 [13D] can result in the emergency call being attempted to another IP-CAN.

b) attempt the attach for emergency bearer services to another PLMN in the shared network.

In a shared network, if the attach request for emergency bearer services fails due to abnormal cases b), c) or d) in subclause 4.7.3.1.5, the MS shall perform the actions as described in subclause 4.7.3.1.5, and shall:

a) inform the upper layers of the failure of the procedure; or

NOTE 7: This can result in the upper layers requesting establishment of a CS emergency call (if not already attempted in the CS domain), or other implementation specific mechanisms, e.g. procedures specified in 3GPP TS 24.229 [13D] can result in the emergency call being attempted to another IP-CAN.

b) attempt the attach for emergency bearer services to another PLMN in the shared network.

4.7.3.1.4b Attach for initiating a PDN connection for emergency bearer services not accepted by the network (UTRAN Iu mode only)

If the network cannot accept the attach request for initiating a PDN connection for emergency bearer services with attach type not set to "emergency attach", the MS shall perform the procedures as described in subclause 4.7.3.1.4. Then if the MS is in the same selected PLMN where the last attach request was attempted, the MS shall:

a) inform the upper layers of the failure of the procedure; or

NOTE 1: This can result in the upper layers requesting establishment of a CS emergency call (if not already attempted in the CS domain) or other implementation specific mechanisms, e.g. procedures specified in 3GPP TS 24.229 [95] that can result in the emergency call being attempted to another IP-CAN.

b) attempt GPRS attach for emergency bearer services.

If the attach request for initiating a PDN connection for emergency bearer services with attach type not set to "emergency attach" fails due to abnormal case a) in subclause 4.7.3.1.5, the MS shall perform the procedures as described in subclause 4.7.3.1.5 and inform the upper layers of the failure to access the network.

NOTE 2: This can result in the MS attempting a CS emergency call (if not already attempted in the CS domain) or other implementation specific mechanisms, e.g. procedures specified in 3GPP TS 24.229 [95] that can result in the emergency call being attempted to another IP-CAN.

If the attach request for initiating a PDN connection for emergency bearer services with attach type not set to "emergency attach" fails due to abnormal cases b), c) or d) in subclause 4.7.3.1.5, the MS shall perform the procedures as described in subclause 4.7.3.1.5. Then if the MS is in the same selected PLMN where the last attach request was attempted, the MS shall:

a) inform the upper layers; or

NOTE 3: This can result in the MS attempting a CS emergency call (if not already attempted in the CS domain) or other implementation specific mechanisms, e.g. procedures specified in 3GPP TS 24.229 [95] that can result in the emergency call being attempted to another IP-CAN.

b) attempt GPRS attach for emergency bearer services.

4.7.3.1.5 Abnormal cases in the MS

The following abnormal cases can be identified:

a) Access barred because of access class control, EAB or ACDC

The GPRS attach procedure shall not be started. The MS stays in the current serving cell and applies normal cell reselection process. The GPRS attach procedure is started as soon as possible, i.e. when access is granted or because of a cell change.

If access is barred because of access class control, ACDC is applicable to the request from the upper layers and the MS supports ACDC, then the GPRS attach procedure shall be started.

If access is barred for a certain ACDC category, a request with a higher ACDC category is received from the upper layers and the MS supports ACDC, then the GPRS attach procedure shall be started.

If an access request for an uncategorized application is barred due to ACDC, a request with a certain ACDC category is received from the upper layers and the MS supports ACDC, then the GPRS attach procedure shall be started.

b) Lower layer failure without "Extended Wait Time" received from lower layers before the ATTACH ACCEPT or ATTACH REJECT message is received

The procedure shall be aborted and the MS shall proceed as described below, except in the following implementation option cases b.1 and b.2.

b.1) Release of PS signalling connection in Iu mode before the completion of the GPRS attach procedure

If the release of the PS signalling connection occurs before completion of the GPRS attach procedure, then the GPRS attach procedure shall be initiated again, if the following conditions apply:

i) The original GPRS attach procedure was initiated over an existing PS signalling connection; and

ii) The GPRS attach procedure was not due to timer T3310 expiry; and

iii) No SECURITY MODE COMMAND message and no Non-Access Startum (NAS) messages relating to the PS signalling connection (e.g. PS authentication procedure, see subclause 4.7.7) were received after the ATTACH REQUEST message was transmitted.

b.2) RR release in Iu mode (i.e. RRC connection release) with, for example, cause "Normal", or "User inactivity" (see 3GPP TS 25.331 [23c] and 3GPP TS 44.118 [111])

The GPRS attach procedure shall be initiated again, if the following conditions apply:

i) The original GPRS attach procedure was initiated over an existing RRC connection; and

ii) The GPRS attach procedure was not due to timer T3310 expiry; and

iii) No SECURITY MODE COMMAND message and no Non-Access Stratum (NAS) messages relating to the PS signalling connection (e.g. PS authentication procedure, see subclause 4.7.7) were received after the ATTACH REQUEST message was transmitted.

NOTE 1: The RRC connection release cause that triggers the re-initiation of the GPRS attach procedure is implementation specific.

c) T3310 time-out

On the first expiry of the timer, the MS shall reset and restart timer T3310 and shall retransmit the ATTACH REQUEST message. This retransmission is repeated four times, i.e. on the fifth expiry of timer T3310, the MS shall abort the GPRS attach procedure and, in Iu mode, release the PS signalling connection (see 3GPP TS 25.331 [23c]). The MS shall proceed as described below.

d) ATTACH REJECT, other causes than those treated in subclause 4.7.3.1.4, and cases of GMM cause values #22 and #25, if considered as abnormal cases according to subclause 4.7.3.1.4

If the attach request is neither for emergency bearer services nor for initiating a PDN connection for emergency bearer services with attach type not set to "emergency attach", upon reception of the cause codes # 95, # 96, # 97, # 99 and # 111 the MS should set the GPRS attach attempt counter to 5.

The MS shall proceed as described below.

e) Change of cell within the same RA (A/Gb mode only)

If a cell change occurs within the same RA when the MS is in state GMM-REGISTERED-INITIATED, then the cell update procedure shall be performed before completion of the attach procedure.

f) Change of cell into a new routing area

If a cell change into a new routing area occurs before an ATTACH ACCEPT or ATTACH REJECT message has been received, the GPRS attach procedure shall be aborted and re-initiated immediately. If a routing area border is crossed when the ATTACH ACCEPT message is received but before an ATTACH COMPLETE message is sent, the GPRS attach procedure shall be aborted and the routing area updating procedure shall be initiated. If a P-TMSI was allocated during the GPRS attach procedure, this P-TMSI shall be used in the routing area updating procedure. If a P-TMSI signature was allocated together with the P-TMSI during the GPRS attach procedure, this P-TMSI signature shall be used in the routing area updating procedure.

g) Mobile originated detach required

If the MS is in state GMM-REGISTERED-INITIATED, the GPRS attach procedure shall be aborted and the GPRS detach procedure shall be performed (see subclause 4.7.4.1).

h) Detach procedure collision

If the MS receives a DETACH REQUEST message from the network in state GMM-REGISTERED-INITIATED with detach type "re-attach not required" and no cause code, or "re-attach not required"’ and the cause code is not #2 "IMSI unknown in HLR", the GPRS detach procedure shall be progressed and the GPRS attach procedure shall be aborted. Otherwise the GPRS attach procedure shall be progressed and the DETACH REQUEST message shall be ignored.

i) "Extended wait time" for PS domain from the lower layers

If the ATTACH REQUEST message contained the low priority indicator set to "MS is configured for NAS signalling low priority", the MS shall start timer T3346 with the "Extended wait time" value and reset the attach attempt counter.

In other cases the MS shall ignore the "Extended wait time".

The MS shall abort the attach procedure, stay in the current serving cell, change the state to GMM-DEREGISTERED.ATTEMPTING-TO-ATTACH and apply the normal cell reselection process.

j) Timer T3346 is running

The MS shall not start the GPRS attach procedure unless the MS needs to attach for emergency bearer services or the MS is an MS configured to use AC11 – 15 in selected PLMN or the MS needs to attach without the NAS signalling low priority indication and if the timer T3346 was started due to rejection of a NAS request message (e.g. ATTACH REQUEST, ROUTING AREA UPDATE REQUEST or SERVICE REQUEST) which contained the low priority indicator set to "MS is configured for NAS signalling low priority". The MS stays in the current serving cell and applies normal cell reselection process.

NOTE 2: It is considered an abnormal case if the MS needs to initiate an attach procedure while timer T3346 is running independent on whether timer T3346 was started due to an abnormal case or a non successful case.

In cases b, c, d, i and j, the MS shall proceed as follows:

– Timer T3310 shall be stopped if still running.

– For the cases b, c, d, and i when the "Extended wait time" is ignored, if the attach request is neither for emergency bearer services nor for initiating a PDN connection for emergency bearer services with attach type not set to "emergency attach", the GPRS attach attempt counter shall be incremented.

– If the GPRS attach attempt counter is less than 5:

– for the cases i and j, the GPRS attach procedure is started, if still necessary, when timer T3346 expires or is stopped.

– for the cases b, c, d, and i when the "Extended wait time" is ignored, if the attach request is neither for emergency bearer services nor for initiating a PDN connection for emergency bearer services with attach type not set to "emergency attach", timer T3311 is started and the state is changed to GMM-DEREGISTERED.ATTEMPTING-TO-ATTACH.

– If the GPRS attach attempt counter is greater than or equal to 5:

– the MS shall delete any RAI, P-TMSI, P-TMSI signature, list of equivalent PLMNs, and GPRS ciphering key sequence number, shall set the GPRS update status to GU2 NOT UPDATED, shall start timer T3302. The state is changed to GMM-DEREGISTERED. ATTEMPTING-TO-ATTACH or optionally to GMM-DEREGISTERED.PLMN-SEARCH (see subclause 4.2.4.1.2) in order to perform a PLMN selection according to 3GPP TS 23.122 [14].

– If S1 mode is supported by the MS, the MS shall in addition handle the EMM parameters EMM state, EPS update status, GUTI, last visited registered TAI, TAI list and KSI as specified in 3GPP TS 24.301 [120] for the abnormal case when a normal attach procedure fails and the attach attempt counter is equal to 5.

4.7.3.1.6 Abnormal cases on the network side

The following abnormal cases can be identified:

a) Lower layer failure

If a low layer failure occurs before the message ATTACH COMPLETE has been received from the MS and a new P-TMSI (or a new P-TMSI and a new P-TMSI signature) has been assigned, the network shall consider both the old and new P-TMSI each with its corresponding P-TMSI-signature as valid until the old P-TMSI can be considered as invalid by the network (see subclause 4.7.1.5) or the GMM context which has been marked as detached in the network is released, and shall not resent the message ATTACH ACCEPT. During this period the network may:

– use the identification procedure followed by a P-TMSI reallocation procedure if the old P-TMSI is used by the MS in a subsequent message.

b) Protocol error

If the ATTACH REQUEST message is received with a protocol error, the network shall return an ATTACH REJECT message with one of the following reject causes:

#96: Mandatory information element error;

#99: Information element non-existent or not implemented;

#100: Conditional IE error;

#111: Protocol error, unspecified.

c) T3350 time-out

On the first expiry of the timer, the network shall retransmit the ATTACH ACCEPT message and shall reset and restart timer T3350.

This retransmission is repeated four times, i.e. on the fifth expiry of timer T3350, the GPRS attach procedure shall be aborted. If a new P-TMSI or a new P-TMSI together with a new P-TMSI signature were allocated in the ATTACH ACCEPT message, the network shall consider both the old and new P-TMSI each together with the corresponding P-TMSI signatures as valid until the old P-TMSI can be considered as invalid by the network (see subclause 4.7.1.5) or the GMM context which has been marked as detached in the network is released. During this period the network acts as specified for case a.

d.1) ATTACH REQUEST received after the ATTACH ACCEPT message has been sent and before the ATTACH COMPLETE message is received

– If one or more of the information elements in the ATTACH REQUEST message differ from the ones received within the previous ATTACH REQUEST message, the previously initiated GPRS attach procedure shall be aborted if the ATTACH COMPLETE message has not been received and the new GPRS attach procedure shall be progressed, or

– If the information elements do not differ, then the ATTACH ACCEPT message shall be resent and the timer T3350 shall be restarted if an ATTACH COMPLETE message is expected. In that case, the retransmission counter related to T3350 is not incremented.

d.2) More than one ATTACH REQUEST received and no ATTACH ACCEPT or ATTACH REJECT message has been sent

– If one or more of the information elements in the ATTACH REQUEST message differs from the ones received within the previous ATTACH REQUEST message, the previously initiated GPRS attach procedure shall be aborted and the new GPRS attach procedure shall be progressed;

– If the information elements do not differ, then the network shall continue with the previous attach procedure and shall not treat any further this ATTACH REQUEST message.

e) ATTACH REQUEST received in state GMM-REGISTERED

If an ATTACH REQUEST message is received in state GMM-REGISTERED the network may initiate the GMM common procedures; if it turned out that the ATTACH REQUEST message was send by an MS that has already been attached, the GMM context, PDP contexts and MBMS contexts, if any, are deleted and the new ATTACH REQUEST is progressed.

f) ROUTING AREA UPDATE REQUEST message received before ATTACH COMPLETE message.

Timer T3350 shall be stopped. The allocated P-TMSI shall be considered as valid and the routing area updating procedure shall be progressed as described in subclause 4.7.5.

g) DETACH REQUEST message received before ATTACH COMPLETE message.

The network shall abort the attach procedure and shall progress the detach procedure as described in subclause 4.7.4.1.

Figure 4.7.3/1 3GPP TS 24.008: GPRS attach procedure and combined GPRS attach procedure

4.7.3.2 Combined GPRS attach procedure for GPRS and non-GPRS services

The combined GPRS attach procedure is a GMM procedure used by a GPRS MS operating in MS operation modes A or B for IMSI attach for GPRS and non-GPRS services if the network operates in network operation mode I.

If a GPRS MS operating in MS operation modes A or B is already attached for non-GPRS services by use of the MM specific IMSI attach procedure, but additionally wishes to perform an IMSI attach for GPRS services, the combined GPRS attach procedure shall also be used.

The attach type information element shall indicate "combined GPRS/IMSI attach". In this case, the messages ATTACH ACCEPT, ATTACH COMPLETE, and ATTACH REJECT used by the combined GPRS attach procedure carry information for both the GPRS and the non-GPRS services.

A GPRS MS in MS operation mode A shall perform the normal GPRS/IMSI attach procedure during an ongoing circuit-switched transaction.

4.7.3.2.1 Combined GPRS attach procedure initiation

If the MS is in GMM state GMM-DEREGISTERED and in MM state MM IDLE, the MS initiates the combined GPRS attach procedure by sending an ATTACH REQUEST message to the network, starts timer T3310 and enters state GMM-REGISTERED-INITIATED and MM LOCATION UPDATING PENDING. If timer T3302 is currently running, the MS shall stop timer T3302. If timer T3311 is currently running, the MS shall stop timer T3311.

The MS shall set the Mobile identity IE, old RAI and P-TMSI signature in the ATTACH REQUEST message as specified in subclause 4.7.3.1.1. Furthermore the MS shall include the TMSI status IE if no valid TMSI is available.

If the MS initiates a combined GPRS attach procedure for GPRS services and "SMS-only service", the MS shall indicate "SMS only" in the Additional update type IE.

If the MS has stored a valid LAI and the MS supports EMM combined procedures, the MS shall include it in the Old location area identification IE in the ATTACH REQUEST message.

If the MS has stored a valid TMSI, the MS shall include the TMSI based NRI container IE in the ATTACH REQUEST message.

In Iu mode, if the MS wishes to prolong the established PS signalling connection after the GPRS attach (for example, the MS has any CM application request pending), it may set a follow-on request pending indicator on (see subclause 4.7.13).

4.7.3.2.2 GMM Common procedure initiation

4.7.3.2.3 Combined GPRS attach accepted by the network

Depending on the value of the attach result IE received in the ATTACH ACCEPT message, two different cases can be distinguished:

Case 1) The attach result IE value indicates "combined GPRS attach": IMSI attach for GPRS and non-GPRS services have been successful.

Case 2) The attach result IE value indicates "GPRS only": IMSI attach for GPRS services has been successful but IMSI attach for non-GPRS services has not been successful.

After that in Iu mode, the mobile station shall act according to the follow-on proceed flag included in the Attach result information element in the ATTACH ACCEPT message (see subclause 4.7.13).

4.7.3.2.3.1 Combined attach successful for GPRS and non-GPRS services

The description for IMSI attach for GPRS services as specified in subclause 4.7.3.1.3 shall be followed. In addition, the following description for IMSI attach for non-GPRS services applies.

The TMSI reallocation may be part of the combined GPRS attach procedure. The TMSI allocated is then included in the ATTACH ACCEPT message together with the location area identification (LAI). The network shall, in this case, change to state GMM-COMMON-PROCEDURE-INITIATED and shall start timer T3350 as described in subclause 4.7.6.

The MS, receiving an ATTACH ACCEPT message, stores the received location area identification, stops timer T3310, reset the location update attempt counter and sets the update status to U1 UPDATED. If the message contains an IMSI, the mobile station is not allocated any TMSI, and shall delete any TMSI accordingly. If the message contains a TMSI, the MS shall use this TMSI as the new temporary identity. The MS shall delete its old TMSI and shall store the new TMSI. In this case, an ATTACH COMPLETE message is returned to the network. If neither a TMSI nor an IMSI has been included by the network in the ATTACH ACCEPT message, the old TMSI, if any available, shall be kept. The new MM state is MM IDLE, the new GMM state is GMM-REGISTERED.

If the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events (see subclause 4.1.1.6A), then the MS shall reset this counter.

If the network has requested the provision of Inter RAT handover information, the MS shall return an ATTACH COMPLETE message including the Inter RAT handover information IE to the network.

If the MS is not configured for NAS signalling low priority then the MS may stop timer T3246 if running.

Any timer used for triggering the location update procedure (e.g T3211, T3212) shall be stopped if running.

The network receiving an ATTACH COMPLETE message stops timer T3350, changes to state GMM-REGISTERED.

NOTE: Upon receiving an ATTACH COMPLETE message, the SGSN sends a BSSAP+-TMSI-REALLOCATION-COMPLETE message as specified in 3GPP TS 29.018 [149].

4.7.3.2.3.2 Combined attach successful for GPRS services only

Apart from the actions on the routing area updating attempt counter, the description for IMSI attach for GPRS services as specified in subclause 4.7.3.1.3 shall be followed. In addition, the following description for IMSI attach for non-GPRS services applies.

The SGSN shall use GMM cause #28 "SMS provided via GPRS in this routing area" in the ATTACH ACCEPT message only if the MS requested "SMS-only service" by including the Additional update type IE in the ATTACH REQUEST message.

The MS receiving the ATTACH ACCEPT message takes one of the following actions depending on the GMM cause:

# 2 (IMSI unknown in HLR)

The MS shall stop timer T3310 if still running and shall reset the routing area updating attempt counter. The MS shall set the update status to U3 ROAMING NOT ALLOWED and shall delete any TMSI, LAI and ciphering key sequence number. The MS shall enter state GMM-REGISTERED.NORMAL-SERVICE. The new MM state is MM IDLE. The SIM/USIM shall be considered as invalid for non-GPRS services until switching off or the SIM/USIM is removed. If the message has been successfully integrity checked by the lower layers and the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services", then the MS shall set this counter to MS implementation-specific maximum value.

# 16 (MSC temporarily not reachable); or

# 17 (Network failure)

The MS shall stop timer T3310 if still running, and shall enter state MM-IDLE. The routing area updating attempt counter shall be incremented.

If the routing area updating attempt counter is less than 5, and the stored RAI is equal to the RAI of the current serving cell and the GMM update status is equal to GU1 UPDATED:

– the MS shall keep the GMM update status GU1 UPDATED and changes state to GMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM. The MS shall start timer T3311. When timer T3311 expires the combined routing area update procedure indicating "combined RA/LA updating with IMSI attach" is triggered again.

If the routing area updating attempt counter is greater than or equal to 5:

– the MS shall start timer T3302 and shall change to state GMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM;

– a GPRS MS operating in MS operation mode A shall then proceed with appropriate MM specific procedure; a GPRS MS operating in MS operation mode B may then proceed with appropriate MM specific procedures. The MM sublayer shall act as in network operation mode II as long as the combined GMM procedures are not successful and no new RA is entered.

# 22 (Congestion)

The MS shall change to state GMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM, shall stop timer T3310 if still running, and shall enter state MM-IDLE. The MS shall set the routing area updating attempt counter to 5 and shall start the timer T3302.

# 28 (SMS provided via GPRS in this routing area);

The MS stays in the current serving cell and applies the normal cell reselection process.

Other GMM causevalues and the case that no GMM cause IE was received are considered as abnormal cases. The combined attach procedure shall be considered as failed for non-GPRS services. The behaviour of the MS in those cases is specified in subclause 4.7.3.2.5.

4.7.3.2.4 Combined GPRS attach not accepted by the network

If the attach request can neither be accepted by the network for GPRS nor for non-GPRS services, an ATTACH REJECT message is transferred to the MS. The MS receiving the ATTACH REJECT message containing a reject cause other than GMM cause value #25 or the message is integrity protected, shall stop the timer T3310, and for all causes except #7, #12, #14, #15, #22 and #25 deletes the list of "equivalent PLMNs".

If the ATTACH REJECT message containing GMM cause value #25 was received without integrity protection, then the MS shall discard the message.

If the attach request is rejected due to NAS level mobility management congestion control, the network shall set the GMM cause value to #22 "congestion" and assign a back-off timer T3346.

The MS shall then take one of the following actions depending upon the reject cause:

# 3 (Illegal MS);

# 6 (Illegal ME), or

# 8 (GPRS services and non-GPRS services not allowed);

The MS shall set the GPRS update status to GU3 ROAMING NOT ALLOWED (shall store it according to subclause 4.1.3.2) and shall delete any P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number. The new GMM state is GMM-DEREGISTERED.NO-IMSI. The new MM state is MM IDLE.

The MS shall set the update status to U3 ROAMING NOT ALLOWED, shall delete any TMSI, LAI and ciphering key sequence number. The SIM/USIM shall be considered as invalid for GPRS and non-GPRS services until switching off or the SIM/USIM is removed or the timer T3245 expires as described in subclause 4.1.1.6.

If the message has been successfully integrity checked by the lower layers and the MS maintains a counter for "SIM/USIM considered invalid for GPRS services", then the MS shall set this counter to MS implementation-specific maximum value. If the message has been successfully integrity checked by the lower layers and the MS maintains a counter for "SIM/USIM considered invalid for non-GPRS services", then the MS shall set this counter to MS implementation-specific maximum value.

NOTE 1: Optionally the MS starts the timer T3340 as described in subclause 4.7.1.9 for reject cause #8

If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status, GUTI, last visited registered TAI, TAI list and KSI as specified in 3GPP TS 24.301 [120] for the case when the combined attach procedure is rejected with the EMM cause with the same value.

# 7 (GPRS services not allowed);

The MS shall set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2) and shall delete any P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number. The SIM/USIM shall be considered as invalid for GPRS services until switching off or the SIM/USIM is removed. The new GMM state is GMM-DEREGISTERED; the MM state is MM IDLE.

NOTE 2: Optionally the MS starts the timer T3340 as described in subclause 4.7.1.9.

A GPRS MS operating in MS operation mode A or B which is already IMSI attached for CS services in the network is still IMSI attached for CS services in the network.

A GPRS MS operating in MS operation mode A or B shall proceed with the appropriate MM specific procedure according to the MM service state.

If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status, GUTI, last visited registered TAI, TAI list and KSI as specified in 3GPP TS 24.301 [120] for the case when the combined attach procedure is rejected with the EMM cause with the same value.

# 11 (PLMN not allowed);

The MS shall delete any RAI, P-TMSI, P-TMSI signature and GPRS ciphering key sequence number stored, shall set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2), shall reset the GPRS attach attempt counter and changes to state GMM-DEREGISTERED.

The MS shall set the update status to U3 ROAMING NOT ALLOWED, reset the location update attempt counter and shall delete any TMSI, LAI and ciphering key sequence number. The new MM state is MM IDLE.

The MS shall start timer T3340 as described in subclause 4.7.1.9.

The MS shall perform a PLMN selection according to 3GPP TS 23.122 [14].

An MS in GAN mode shall request a PLMN list in GAN (see 3GPP TS 44.318 [76b]) prior to perform a PLMN selection from this list according to 3GPP TS 23.122 [14].

If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status, GUTI, last visited registered TAI, TAI list, KSI and attach attempt counter as specified in 3GPP TS 24.301 [120] for the case when the combined attach procedure is rejected with the EMM cause with the same value.

# 12 (Location area not allowed);

The MS shall delete any RAI, P-TMSI, P-TMSI signature GPRS ciphering key sequence number, shall set the GPRS update status to GU3 ROAMING NOT ALLOWED(and shall store it according to clause 4.1.3.2) and shall reset the GPRS attach attempt counter. The state is changed to GMM-DEREGISTERED.LIMITED-SERVICE.

The MS shall set the update status to U3 ROAMING NOT ALLOWED, reset the location update attempt counter and shall delete any TMSI, LAI and ciphering key sequence number. The new MM state is MM IDLE.

The MS shall store the LAI in the list of "forbidden location areas for regional provision of service".

The MS shall start timer T3340 as described in subclause 4.7.1.9.

The MS shall perform a cell selection according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98].

NOTE 3: The cell selection procedure is not applicable for an MS in GAN mode.

If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status, GUTI, last visited registered TAI, TAI list, KSI and attach attempt counter as specified in 3GPP TS 24.301 [120] for the case when the combined attach procedure is rejected with the EMM cause with the same value.

# 13 (Roaming not allowed in this location area);

The MS shall delete any RAI, P-TMSI, P-TMSI signature and GPRS ciphering key sequence number, shall set the GPRS update status to GU3 ROAMING NOT ALLOWED(and shall store it according to clause 4.1.3.2) and shall reset the GPRS attach attempt counter. The state is changed to GMM-DEREGISTERED.LIMITED-SERVICE or optionally to GMM-DEREGISTERED.PLMN-SEARCH.

The MS shall set the update status to U3 ROAMING NOT ALLOWED, reset the location update attempt counter and shall delete any TMSI, LAI and ciphering key sequence number. The new MM state is MM IDLE.

The mobile station shall store the LAI in the list of "forbidden location areas for roaming".

The MS shall start timer T3340 as described in subclause 4.7.1.9.

The MS shall perform a PLMN selection according to 3GPP TS 23.122 [14].

An MS in GAN mode shall request a PLMN list in GAN (see 3GPP TS 44.318 [76b]) prior to perform a PLMN selection from this list according to 3GPP TS 23.122 [14].

If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status, GUTI, last visited registered TAI, TAI list, KSI and attach attempt counter as specified in 3GPP TS 24.301 [120] for the case when the combined attach procedure is rejected with the EMM cause with the same value.

# 14 (GPRS services not allowed in this PLMN);

The MS shall store the PLMN identity in the "forbidden PLMNs for GPRS service" list and if the MS is configured to use timer T3245 (see 3GPP TS 24.368 [135] or 3GPP TS 31.102 [112]) then the MS shall start timer T3245 and proceed as described in subclause 4.1.1.6. If the message has been successfully integrity checked by the lower layers and the MS maintains a PLMN-specific PS-attempt counter for that PLMN, then the MS shall set this counter to the MS implementation-specific maximum value.

As an implementation option, a GPRS MS operating in operation mode A or B may perform a PLMN selection according to 3GPP TS 23.122 [14].

If an MS in GAN mode performs a PLMN selection, it shall request a PLMN list in GAN (see 3GPP TS 44.318 [76b]) prior to perform a PLMN selection from this list according to 3GPP TS 23.122 [14].

The MS shall not perform the optional PLMN selection in the case where the PLMN providing this reject cause is:

– On the "User Controlled PLMN Selector with Access Technology";

– On the "Operator Controlled PLMN Selector with Access Technology" list;

– A PLMN identified as equivalent to any PLMN, within the same country, contained in the lists above.

If the MS does not perform a PLMN selection then a GPRS MS operating in MS operation mode A or B which is not yet IMSI attached for CS services in the network shall then perform an IMSI attach for non-GPRS services according to the conditions for the MM IMSI attach procedure (see subclause 4.4.3).

A GPRS MS operating in MS operation mode A or B which is already IMSI attached for CS services in the network is still IMSI attached for CS services in the network.

A GPRS MS operating in MS operation mode A or B shall proceed with the appropriate MM specific procedure according to the MM service state.

If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status, GUTI, last visited registered TAI, TAI list, KSI and attach attempt counter as specified in 3GPP TS 24.301 [120] for the case when the combined attach procedure is rejected with the EMM cause with the same value.

# 15 (No Suitable Cells In Location Area);

The MS shall delete any RAI, P-TMSI, P-TMSI signature and GPRS ciphering key sequence number, shall set the GPRS update status to GU3 ROAMING NOT ALLOWED(and shall store it according to clause 4.1.3.2) and shall reset the GPRS attach attempt counter. The state is changed to GMM-DEREGISTERED.LIMITED-SERVICE.

The MS shall set the update status to U3 ROAMING NOT ALLOWED, reset the location update attempt counter and shall delete any TMSI, LAI and ciphering key sequence number. The new MM state is MM IDLE.

The MS shall store the LAI in the list of "forbidden location areas for roaming".

The MS shall start timer T3340 as described in subclause 4.7.1.9.

The MS shall search for a suitable cell in another location area or a tracking area according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98] or 3GPP TS 36.304 [121].

NOTE 4: The cell selection procedure is not applicable for an MS in GAN mode.

If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status, GUTI, last visited registered TAI, TAI list, KSI and attach attempt counter as specified in 3GPP TS 24.301 [120] for the case when the combined attach procedure is rejected with the EMM cause with the same value.

# 22 (Congestion);

The MS shall abort the attach procedure, reset the GPRS attach attempt counter, set the GPRS update status to GU2 NOT UPDATED and enter state GMM-DEREGISTERED.ATTEMPTING-TO-ATTACH.

The MS shall stop timer T3346 if it is running.

If the ATTACH REJECT message is integrity protected, the MS shall start timer T3346 with the value provided in the T3346 value IE.

If the ATTACH REJECT message is not integrity protected, the MS shall start timer T3346 with a random value from the default range specified in table 11.3a.

The MS stays in the current serving cell and applies the normal cell reselection process. The attach procedure is started, if still necessary, when timer T3346 expires or is stopped.

A GPRS MS operating in MS operation mode A or B which is already IMSI attached for CS services in the network is still IMSI attached for CS services in the network.

# 25 (Not authorized for this CSG)

The MS shall set the GPRS update status to GU3 ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2) and shall reset the GPRS attach attempt counter. The state is changed to GMM-DEREGISTERED.LIMITED-SERVICE.

If the CSG ID and associated PLMN identity of the cell where the MS has sent the ATTACH REQUEST message are contained in the Operator CSG list, the MS shall proceed as specified in 3GPP TS 23.122 [14] subclause 3.1A.

The MS shall start timer T3340 as described in subclause 4.7.1.9.

If the MS is IMSI attached for non-GPRS services, the MS shall set the update status to U3 ROAMING NOT ALLOWED and shall reset the location update attempt counter. The new MM state is MM IDLE.

The MS shall search for a suitable cell according to 3GPP TS 43.022 [82] and 3GPP TS 25.304 [98].

If S1 mode is supported in the MS, the MS shall handle the EMM parameters EMM state, EPS update status, GUTI, last visited registered TAI, TAI list, KSI and attach attempt counter as specified in 3GPP TS 24.301 [120] for the case when the combined attach procedure is rejected with the EMM cause with the same value.

Other values are considered as abnormal cases. The specification of the MS behaviour in those cases is specified in subclause 4.7.3.2.5.

4.7.3.2.5 Abnormal cases in the MS

The MS shall proceed as follows:

1) If the combined attach was successful for GPRS services only and the ATTACH ACCEPT message contained a cause value not treated in subclause 4.7.3.2.3.2 or the GMM Cause IE is not included in the message, the MS shall proceed as follows:

a) The MS shall stop timer T3310 if still running, and shall enter state MM IDLE. The routing area updating attempt counter shall be incremented;

b) If the routing area updating attempt counter is less than 5, and the stored RAI is equal to the RAI of the current serving cell and the GMM update status is equal to GU1 UPDATED:

c) If the routing area updating attempt counter is greater than or equal to 5:

– the MS shall start timer T3302 and shall change to state GMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM; and

2) Otherwise, the abnormal cases specified in subclause 4.7.3.1.5 apply with the following modification.

If the GPRS attach attempt counter is incremented according to subclause 4.7.3.1.5 the next actions depend on the Location Area Identities (stored on SIM/USIM and the one of the current serving cell) and the value of the attach attempt counter:

– if the update status is U1 UPDATED, and the stored LAI is equal to the one of the current serving cell and the attach attempt counter is smaller than 5, then the mobile station shall keep the update status to U1 UPDATED, the new MM state is MM IDLE substate NORMAL SERVICE;

– if the attach attempt counter is smaller than 5 and, additionally, the update status is different from U1 UPDATED or the stored LAI is different from the one of the current serving cell, then the mobile station shall delete any LAI, TMSI, ciphering key sequence number stored in the SIM/USIM and list of equivalent PLMNs and set the update status to U2 NOT UPDATED. The MM state remains MM LOCATION UPDATING PENDING; or

– if the attach attempt counter is greater or equal to 5, then the mobile station shall delete any LAI, TMSI, ciphering key sequence number stored in the SIM/USIM and list of equivalent PLMNs and set the update status to U2 NOT UPDATED.
A GPRS MS operating in MS operation mode A shall then proceed with appropriate MM specific procedure; a GPRS MS operating in MS operation mode B may then proceed with appropriate MM specific procedures.
The MM sublayer shall act as in network operation mode II as long as the combined GMM procedures are not successful and no new RA is entered. The new MM state is MM IDLE substate ATTEMPTING TO UPDATE or optionally MM IDLE substate PLMN SEARCH in order to perform a PLMN selection according to 3GPP TS 23.122 [14].

4.7.3.2.6 Abnormal cases on the network side

The abnormal cases specified in subclause 4.7.3.1.6 apply.