5.3 General on elementary EMM procedures

24.3013GPPNon-Access-Stratum (NAS) protocol for Evolved Packet System (EPS)Release 18Stage 3TS

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

5.3.1 EMM modes and NAS signalling connection

5.3.1.1 Establishment of the NAS signalling connection

When the UE is in EMM-IDLE mode without suspend indication and needs to transmit an initial NAS message, the UE shall request the lower layer to establish a RRC connection. In this request to the lower layer the NAS shall provide to the lower layer the RRC establishment cause and the call type as specified in annex D of this specification and, for the case specified in clause 5.6.1.2.2, shall also provide the initial NAS message, otherwise NAS may also provide the initial NAS message.

Initial NAS messages are:

– ATTACH REQUEST;

– DETACH REQUEST;

– TRACKING AREA UPDATE REQUEST;

– SERVICE REQUEST;

– EXTENDED SERVICE REQUEST; and

– CONTROL PLANE SERVICE REQUEST.

When the UE is in EMM-IDLE mode with suspend indication, the UE shall proceed the behaviour as specified in clauses 5.3.1.3.

For the routing of the initial NAS message to the appropriate MME, the UE NAS provides the lower layers with either the S-TMSI, the registered globally unique MME identifier (GUMMEI) that consists of the PLMN ID, the MME group ID, and the MME code (see 3GPP TS 23.003 [2]), or none of them according to the following rules:

– If the UE has received the interworking without N26 interface indicator set to "interworking without N26 interface not supported" from the network, the UE holds a valid 5G-GUTI and:

a) the UE performs an initial EPS attach procedure or tracking area updating procedure following an inter-system change from N1 mode to S1 mode; or

b) the UE which was previously registered in N1 mode before entering state 5GMM-DEREGISTERED, performs an initial EPS attach procedure,

then the UE NAS shall provide the lower layers with the MME identifier part of the mapped GUTI, which is generated from the 5G-GUTI as specified in 3GPP TS 23.003 [4], an indication that the identifier is a native GUMMEI and an indication that the identifier is mapped from 5GS;

– If the TIN indicates "GUTI" or "RAT-related TMSI", or the TIN is not available, and the UE holds a valid GUTI:

a) When the UE in EMM-IDLE mode initiates a tracking area updating or combined tracking area updating procedure for load balancing purposes, the UE NAS shall provide the lower layers with neither S-TMSI nor registered MME identifier;

b) When the tracking area of the current cell is in the list of tracking areas that the UE previously registered in the MME during the NAS signalling connection establishment, the UE NAS shall provide the lower layers with the S-TMSI, but shall not provide the registered MME identifier to the lower layers; or

c) When the tracking area of the current cell is not in the list of tracking areas that the UE previously registered in the MME during the NAS signalling connection establishment, the UE NAS shall provide the lower layers with the MME identifier part of the valid GUTI with an indication that the identifier is a native GUMMEI.

– If the TIN indicates "P-TMSI", or the TIN is not available, and the UE holds a valid P-TMSI and RAI, the UE NAS shall provide the lower layers with the MME identifier part of the mapped GUTI, which is generated from the P-TMSI and RAI with an indication that the identifier is a mapped GUMMEI; or

– Otherwise, the UE NAS does not provide the lower layers with the S-TMSI, the registered GUMMEI and the mapped GUMMEI.

The UE NAS also provides the lower layers with the identity of the selected PLMN (see 3GPP TS 36.331 [22]). In a shared network, the UE shall choose one of the PLMN identities as specified in 3GPP TS 23.122 [6].

When an ATTACH REQUEST message, or a TRACKING AREA UPDATE REQUEST message when the current TAI of the current cell is not included in the TAI list, is sent to establish a signalling connection, the UE NAS also provides the lower layers with the DCN-ID according to the following rules:

a) if a DCN-ID for the PLMN code of the selected PLMN is available in the UE, the UE NAS shall provide this DCN-ID to the lower layers; or

b) if no DCN-ID for the PLMN code of the selected PLMN is available but a Default_DCN_ID value is available in the UE, as specified in 3GPP TS 24.368 [15A] or in USIM file NAS_CONFIG as specified in 3GPP TS 31.102 [17], the UE NAS shall provide this DCN-ID to the lower layers.

If a relay node is attaching for relay node operation (see 3GPP TS 23.401 [10]), the NAS in the relay node shall indicate to the lower layers that the establishment of the NAS signalling connection is for a relay node.

In S1 mode, when the RRC connection has been established successfully, the UE shall enter EMM-CONNECTED mode and consider the NAS signalling connection established.

In S101 mode, when the cdma2000^® HRPD access network resources are available for tunnelled NAS signalling, the UE shall enter EMM-CONNECTED mode and consider the S101 mode NAS signalling connection established.

5.3.1.2 Release of the NAS signalling connection

5.3.1.2.1 General

The signalling procedure for the release of the NAS signalling connection is initiated by the network.

In S1 mode, when the RRC connection has been released, the UE shall enter EMM-IDLE mode and consider the NAS signalling connection released.

If the UE is configured for eCall only mode as specified in 3GPP TS 31.102 [17] then:

– if the NAS signalling connection that was released had been established for eCall over IMS, the UE shall start timer T3444; and

– if the NAS signalling connection that was released had been established for a call to an HPLMN designated non-emergency MSISDN or URI for test or terminal reconfiguration service, the UE shall start timer T3445.

The UE shall start the SGC timer T3447 with the service gap time value available in the UE when the NAS signalling connection is released if:

– the UE supports SGC feature, and the service gap timer value is available in the UE and does not indicate zero; and

– the NAS signalling connection that was released had been established for mobile originated request for transfer of uplink data.

If the UE receives the "Extended wait time" from the lower layers when no attach, tracking area updating or service request procedure is ongoing, the UE shall ignore the "Extended wait time".

To allow the network to release the NAS signalling connection, the UE:

a) shall start the timer T3440 if the UE receives any of the EMM cause values #11, #12, #13, #14 (not applicable to the service request procedure), #15, #25, #31, #35 or #42;

b) shall start the timer T3440 if:

– the UE receives a TRACKING AREA UPDATE ACCEPT message which does not include a UE radio capability ID deletion indication IE;

– the UE has not set the "active" flag in the TRACKING AREA UPDATE REQUEST message;

– the UE has not set the "signalling active" flag in the TRACKING AREA UPDATE REQUEST message;

– the tracking area updating or combined tracking area updating procedure has been initiated in EMM-IDLE mode, or the UE has set Request type to "NAS signalling connection release" in the UE request type IE in the TRACKING AREA UPDATE REQUEST message and the NAS signalling connection release bit is set to "NAS signalling connection release supported" in the EPS network feature support IE of the TRACKING AREA UPDATE ACCEPT message; and

– the user plane radio bearers have not been set up;

c) shall start the timer T3440 if the UE receives a DETACH ACCEPT message and the UE has set the detach type to "IMSI detach" in the DETACH REQUEST message and user plane radio bearers have not been set up;

d) shall start the timer T3440 if the UE receives a TRACKING AREA UPDATE REJECT message indicating:

– any of the EMM cause values #9 or #10 and the UE has no CS fallback emergency call, CS fallback call, 1xCS fallback emergency call, or 1xCS fallback call pending; or

– the EMM cause values #40, the TRACKING AREA UPDATE message was not triggered due to receiving a paging for CS fallback or a paging for 1xCS fallback, and the UE has no CS fallback emergency call, CS fallback call, 1xCS fallback emergency call, or 1xCS fallback call pending;

e) shall start the timer T3440 if the UE receives a SERVICE REJECT message indicating any of the EMM cause values #9, #10 or #40 as a response to a SERVICE REQUEST message CONTROL PLANE SERVICE REQUEST message, or an EXTENDED SERVICE REQUEST message with service type set to "packet services via S1";

f) may start the timer T3440 if the UE receives any of the EMM cause values #3, #6, #7 or #8 or if it receives an AUTHENTICATION REJECT message;

g) shall start the timer T3440 if the UE receives a SERVICE REJECT message indicating the EMM cause value #39 and the UE has initiated EXTENDED SERVICE REQUEST in EMM-IDLE and the user plane radio bearers have not been set up;

h) shall start the timer T3440 if the UE receives a SERVICE REJECT, SERVICE ACCEPT, ATTACH ACCEPT or TRACKING AREA UPDATE ACCEPT message with control plane data back-off timer;

i) shall start the timer T3440 if the UE receives the EMM cause value #22 along with a T3346 value, and the value indicates that the timer T3346 is neither zero nor deactivated;

j) shall start the timer T3440 if the UE receives a SERVICE ACCEPT message and the UE has set Request type to "NAS signalling connection release" or to "Rejection of paging" in the UE request type IE in the EXTENDED SERVICE REQUEST or CONTROL PLANE SERVICE REQUEST message;

k) shall start the timer T3440 if the UE receives a SERVICE ACCEPT message, the UE has set the Control plane service type of the CONTROL PLANE SERVICE REQUEST message to "mobile terminating request" and the "active" flag in the Control plane service type IE to 0, the user plane radio bearers have not been set up, and the CONTROL PLANE SERVICE REQUEST message was sent from EMM-IDLE mode; or

l) shall start the timer T3440 if the UE receives a DETACH ACCEPT message and the UE has set the detach type to "EPS detach" or "combined EPS/IMSI detach" in the DETACH REQUEST message.

Upon expiry of T3440,

– in cases a, b, c, f, h, i, j and l, the UE shall locally release the established NAS signalling connection; or

– in cases d and e, the UE shall locally release the established NAS signalling connection and the UE shall initiate the attach procedure as described in clause 5.5.3.2.5, 5.5.3.3.5 or 5.6.1.5.

In cases b, c and g,

– upon an indication from the lower layers that the user plane radio bearers are set up, the UE shall stop timer T3440 and may send uplink signalling via the existing NAS signalling connection or user data via the user plane bearers. If the uplink signalling is for CS fallback for emergency call, or for establishing a PDN connection for emergency bearer services, the UE shall send the uplink signalling via the existing NAS signalling connection; or

In cases b, c, g and j,

– upon receipt of a DETACH REQUEST message, the UE shall stop timer T3440 and respond to the network initiated detach as specified in clause 5.5.2.3.

In case b, j and k,

– upon receiving a request from upper layers to send NAS signalling not associated with establishing either a CS emergency call or a PDN connection for emergency bearer services, the UE shall wait for the local release of the established NAS signalling connection upon expiry of timer T3440 or T3440 being stopped before proceeding;

– upon receiving a request from upper layers to establish either a CS emergency call or a PDN connection for emergency bearer services, the UE shall stop timer T3440 and shall locally release the NAS signalling connection, before proceeding as specified in clause 5.6.1;

– upon receipt of ESM DATA TRANSPORT message, as an implementation option, the UE may reset and restart timer T3440;

– upon receipt of a DOWNLINK NAS TRANSPORT or DOWNLINK GENERIC NAS TRANSPORT message, the UE which is in EMM-REGISTERED without PDN connections shall stop timer T3440 and may send uplink signalling via the existing NAS signalling connection;

– upon receipt of an ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST, MODIFY EPS BEARER CONTEXT REQUEST, DEACTIVATE EPS BEARER CONTEXT REQUEST, DOWNLINK NAS TRANSPORT or DOWNLINK GENERIC NAS TRANSPORT message, if the UE is using control plane CIoT EPS optimization, the UE shall stop timer T3440 and may send uplink signalling via the existing NAS signalling connection; or

– upon initiation of tracking area updating procedure or combined tracking area updating procedure due to detecting the current TAI is not in the TAI list as specified in clause 5.5.3.2.6 for cases e, i, j, clause 5.5.3.2.2 for case a or clause 5.5.3.3.2 for case a, the UE shall stop timer T3440.

In case c,

– upon receiving a request from upper layers to send NAS signalling not associated with establishing a PDN connection for emergency bearer services, the UE shall wait for the local release of the established NAS signalling connection upon expiry of timer T3440 or T3440 being stopped before proceeding; or

– upon receiving a request from upper layers to establish a PDN connection for emergency bearer services, the UE shall stop timer T3440 and shall locally release the NAS signalling connection, before proceeding as specified in clause 5.6.1.

In cases d and e,

– upon an indication from the lower layers that the RRC connection has been released, the UE shall stop timer T3440 and perform a new attach procedure as specified in clause 5.5.3.2.5, 5.5.3.3.5 or 5.6.1.5; or

In cases a and f,

In case g,

In case h,

– upon an indication from the lower layers that the user plane radio bearers are set up or upon receiving a request from upper layers to send NAS signalling not associated with ESM DATA TRANSPORT, the UE shall stop timer T3440; or

– the UE shall not send ESM DATA TRANSPORT message until expiry of timer T3440 or times T3440 being stopped.

In EMM-CONNECTED mode, if the UE moves to EMM-SERVICE-REQUEST-INITIATED state upon receipt of a CS SERVICE NOTIFICATION message, the UE shall stop timer T3440.

In S101 mode, when the cdma2000^® HRPD radio access connection has been released, the UE shall enter EMM-IDLE mode and consider the S101 mode NAS signalling connection released.

If the timer T3440 is not running when the UE enters state EMM-DEREGISTERED.PLMN-SEARCH or EMM-REGISTERED.PLMN-SEARCH, the UE may locally release the NAS signalling connection.

5.3.1.2.2 UE is using EPS services with control plane CIoT EPS optimization

Upon receipt of the indication from the ESM layer to release the NAS signalling connection (see clause 6.6.4.2), unless the MME has additional downlink user data or signalling pending, the MME shall initiate release of the NAS signalling connection.

5.3.1.3 Suspend and resume of the NAS signalling connection

Suspend of the NAS signalling connection can be initiated by the network in EMM-CONNECTED mode when user plane CIoT EPS optimization is used. Resume of the suspended NAS signalling connection is initiated by the UE.

In the UE, when user plane CIoT EPS optimization is used:

– Upon indication from the lower layers that the RRC connection has been suspended, the UE shall enter EMM-IDLE mode with suspend indication, shall not consider the NAS signalling connection released and shall not consider the secure exchange of NAS messages terminated (see clause 4.4.2.3 and 4.4.5). Based on further indications provided by the lower layers, the UE shall update the status of the suspend indication for the EMM-IDLE mode;

– Upon trigger of a procedure using an initial NAS message when in EMM-IDLE mode with suspend indication, the UE shall:

i) if the initial NAS message is a TRACKING AREA UPDATE REQUEST message which includes a UE radio capability information update needed IE, enter EMM-IDLE mode without suspend indication and proceed with the tracking area updating procedure; and

ii) otherwise, request the lower layer to resume the RRC connection. In this request to the lower layer the NAS shall provide to the lower layer the RRC establishment cause and the call type according to annex D of this document;

NOTE 1: In NB-S1 mode, in the request to the lower layer the data volume information of the initial NAS message is provided to the lower layers. Interactions between the NAS and the lower layers in order to obtain the data volume information of the initial NAS message (see 3GPP TS 36.321 [49], 3GPP TS 36.331 [22]) is left to implementations.

– Upon indication from the lower layers that the RRC connection has been resumed when in EMM-IDLE mode with suspend indication, the UE shall enter EMM-CONNECTED mode. If the pending NAS message is:

i) a SERVICE REQUEST message;

ii) a CONTROL PLANE SERVICE REQUEST message, and the UE did not include any ESM message container, NAS message container, EPS bearer context status information element, or UE request type information element; or

iii) an EXTENDED SERVICE REQUEST message, and the Service type information element indicates "packet services via S1" and the UE did not include any EPS bearer context status information element, or UE request type information element;

the message shall not be sent. Otherwise the UE shall cipher the message as specified in clause 4.4.5 and send the pending initial NAS message upon entering EMM-CONNECTED mode;

NOTE 2: If a NAS message is discarded and not sent to the network, the uplink NAS COUNT value corresponding to that message is reused for the next uplink NAS message to be sent.

– Upon fallback indication from the lower layers at RRC connection resume when in EMM-IDLE mode with suspend indication, the UE shall enter EMM-IDLE mode without suspend indication, send any pending initial NAS message and proceed as if RRC connection establishment had been requested;

– Upon indication from the lower layers that the RRC connection resume has failed and indication from the lower layers that the RRC connection is suspended, the UE shall enter EMM-IDLE mode with suspend indication and restart the ongoing NAS procedure if required; and

– Upon indication from the lower layers that the RRC connection resume has failed and indication from the lower layers that the RRC connection is not suspended, the UE shall enter EMM-IDLE mode without suspend indication and restart the ongoing NAS procedure if required.

In the network, when user plane CIoT EPS optimization is used:

– Upon indication from the lower layers that the RRC connection has been suspended, the network shall enter EMM-IDLE mode with suspend indication, shall not consider the NAS signalling connection released and shall not consider the secure exchange of NAS messages terminated; and

– Upon indication from the lower layers that the RRC connection has been resumed when in EMM-IDLE mode with suspend indication, the network shall enter EMM-CONNECTED mode.

For the case that not all suspended bearers are resumed, see clause 6.4.4.6.

5.3.2 Lists of forbidden tracking areas

The UE shall store a list of "forbidden tracking areas for roaming", as well as a list of "forbidden tracking areas for regional provision of service". These lists shall be erased when the UE is switched off or when the UICC containing the USIM is removed, and periodically (with a period in the range 12 to 24 hours). When the lists are erased, the UE performs cell selection according to 3GPP TS 36.304 [21]. One or more tracking areas is removed from the list of "forbidden tracking areas for roaming" in the UE, as well as the list of "forbidden tracking areas for regional provision of service" if, after a subsequent procedure e.g. attach procedure, tracking area updating procedure and GUTI reallocation procedure, one or more tracking areas in the lists is received from the network. If the UE has only one PDN connection established which is for emergency bearer services, the tracking areas shall not be removed from these lists if one or more tracking areas in the lists are received from the network.

In S1 mode, the UE shall update the suitable list whenever an ATTACH REJECT, TRACKING AREA UPDATE REJECT, SERVICE REJECT or DETACH REQUEST message is received with the Forbidden TAI(s) for the list of "forbidden tracking areas for roaming" IE or the Forbidden TAI(s) for the list of "forbidden tracking areas for regional provision of service" IE, or is received with the EMM cause #12 "tracking area not allowed", #13 "roaming not allowed in this tracking area", or #15 "no suitable cells in tracking area" or an ATTACH ACCEPT or a TRACKING AREA UPDATE ACCEPT message is received with the forbidden TAI(s).

Each list shall accommodate 40 or more TAIs. When the list is full and a new entry has to be inserted, the oldest entry shall be deleted.

5.3.3 List of forbidden PLMNs for attach in S101 mode

A UE supporting S101 mode shall store a list of "forbidden PLMNs for attach in S101 mode". The UE shall erase this list when the UE is switched off or when the USIM is removed.

In S101 mode, the UE shall add to the "forbidden PLMNs for attach in S101 mode" list the PLMN identity provided with the indication from the lower layers to prepare for an S101 mode to S1 mode handover whenever an ATTACH REJECT message is received with the EMM cause #11 "PLMN not allowed", #12 "tracking area not allowed", #13 "roaming not allowed in this tracking area", #14 "EPS services not allowed in this PLMN", #15 "no suitable cells in tracking area", or #35 "Requested service option not authorized in this PLMN" as specified in clause 5.5.1.2.5.

The maximum number of possible entries in the "forbidden PLMNs for attach in S101 mode" list is implementation dependent, but the list shall accommodate at least one PLMN identity. When the list is full and a new PLMN identity has to be inserted, the UE shall delete the oldest PLMN identity.

5.3.3a Forbidden PLMNs for EPS services

The forbidden PLMNs for EPS services are contained in the "forbidden PLMNs for GPRS service" list, as defined in 3GPP TS 24.008 [13]. The UE updates this list as part of the attach procedure, tracking area updating procedure and network initiated detach procedure as described respectively in clauses 5.5.1, 5.5.3 and 5.5.2.3.2.

5.3.4 Equivalent PLMNs list

The UE shall store a list of equivalent PLMNs. These PLMNs shall be regarded by the UE as equivalent to each other for PLMN selection and cell selection/re-selection. The same list is used by 5GMM, EMM, GMM and MM.

The UE shall update or delete this list at the end of each attach or combined attach or tracking area updating or combined tracking area updating procedure. The stored list consists of a list of equivalent PLMNs as downloaded by the network plus the PLMN code of the registered PLMN that downloaded the list. When the UE is switched off, it shall keep the stored list so that it can be used for PLMN selection after switch on. The UE shall delete the stored list if the USIM is removed or when the UE attached for emergency bearer services or access to RLOS enters the state EMM-DEREGISTERED. The maximum number of possible entries in the stored list is 16.

5.3.5 Handling of the periodic tracking area update timer and mobile reachable timer (S1 mode only)

The periodic tracking area updating procedure is used to periodically notify the availability of the UE to the network. The procedure is controlled in the UE by timer T3412. The value of timer T3412 is sent by the network to the UE in the ATTACH ACCEPT message and can be sent in the TRACKING AREA UPDATE ACCEPT message. The UE shall apply this value in all tracking areas of the list of tracking areas assigned to the UE until a new value is received.

If timer T3412 received by the UE in an ATTACH ACCEPT or TRACKING AREA UPDATE ACCEPT message contains an indication that the timer is deactivated or the timer value is zero, then timer T3412 is deactivated and the UE shall not perform the periodic tracking area updating procedure.

Timer T3412 is reset and started with its initial value, when the UE changes from EMM-CONNECTED to EMM-IDLE mode. Timer T3412 is stopped when the UE enters EMM-CONNECTED mode or the EMM-DEREGISTERED state.

If the UE is attached for emergency bearer services, and timer T3412 expires, the UE shall not initiate a periodic tracking area updating procedure, but shall locally detach from the network. When the UE is camping on a suitable cell, it may re-attach to regain normal service.

When a UE is not attached for emergency bearer services, and timer T3412 expires, the periodic tracking area updating procedure shall be started and the timer shall be set to its initial value for the next start.

If the UE is not attached for emergency bearer services, and is in a state other than EMM-REGISTERED.NORMAL-SERVICE when timer T3412 expires, the periodic tracking area updating procedure is delayed until the UE returns to EMM-REGISTERED.NORMAL-SERVICE.

NOTE 1: When the UE returns to EMM-REGISTERED.NORMAL-SERVICE and it needs to initiate other EMM procedure than the periodic tracking area updating procedure then, based on UE implementation, the EMM procedure can take precedence.

If ISR is activated, the UE shall keep both timer T3412 and timer T3312. The two separate timers run in the UE for updating MME and SGSN independently. The UE shall start timer T3423, if timer T3412 expires, and timer T3346 is running or the UE is in one of the following states:

– EMM-REGISTERED.NO-CELL-AVAILABLE;

– EMM-REGISTERED.PLMN-SEARCH;

– EMM-REGISTERED.UPDATE-NEEDED; or

– EMM-REGISTERED.LIMITED-SERVICE.

The UE shall initiate the tracking area updating procedure and stop timer T3423 when it enters state EMM-REGISTERED.NORMAL-SERVICE before timer T3423 expires. After expiry of timer T3423 the UE shall set its TIN to "P-TMSI".

If timer T3423 expires the UE shall memorize that it has to initiate a tracking area updating procedure when it returns to state EMM-REGISTERED.NORMAL-SERVICE.

If the UE is attached to both EPS and non-EPS services, and if timer T3412 expires or timer T3423 expires when the UE is in EMM-REGISTERED.NO-CELL-AVAILABLE state, then the UE shall initiate the combined tracking area updating procedure indicating "combined TA/LA updating with IMSI attach" when the UE returns to EMM-REGISTERED.NORMAL-SERVICE state.

When the network includes T3412 extended value IE in the ATTACH ACCEPT message or TRACKING AREA UPDATE ACCEPT message, the network uses timer T3412 extended value IE as the value of timer T3412.

The network supervises the periodic tracking area updating procedure of the UE by means of the mobile reachable timer.

If the UE is not attached for emergency bearer services, the mobile reachable timer shall be longer than T3412. In this case, by default, the mobile reachable timer is 4 minutes greater than timer T3412.

If ISR is not activated, the network behaviour upon expiry of the mobile reachable timer is network dependent, but typically the network stops sending paging messages to the UE on the first expiry, and may take other appropriate actions.

If the UE is attached for emergency bearer services, the MME shall set the mobile reachable timer with a value equal to timer T3412. When the mobile reachable timer expires, the MME shall locally detach the UE.

The mobile reachable timer shall be reset and started with the value as indicated above, when the MME releases the NAS signalling connection for the UE. The mobile reachable timer shall be stopped when a NAS signalling connection is established for the UE.

Upon expiry of the mobile reachable timer the network shall start the implicit detach timer. The value of the implicit detach timer is network dependent. If ISR is activated, the default value of the implicit detach timer is 4 minutes greater than timer T3423. If the implicit detach timer expires before the UE contacts the network, the network shall implicitly detach the UE. If the MME includes timer T3346 in the TRACKING AREA UPDATE REJECT message or the SERVICE REJECT message and timer T3346 is greater than timer T3412, the MME sets the mobile reachable timer and the implicit detach timer such that the sum of the timer values is greater than timer T3346.

If the network includes the T3324 value IE in the ATTACH ACCEPT message or TRACKING AREA UPDATE ACCEPT message, and if the UE is not attached for emergency bearer services and has no PDN connection for emergency bearer services the MME shall set the active timer to a value equal to the value of timer T3324.

NOTE 2: Timer T3324 is specified in 3GPP TS 24.008 [13].

If the UE has established a PDN connection for emergency services after receiving the timer T3324 value IE in the ATTACH ACCEPT message or the last TRACKING AREA UPDATE ACCEPT message, the active timer shall not be started.

The active timer shall be reset and started with the value as indicated above, when the MME releases the NAS signalling connection for the UE. The active timer shall be stopped when an NAS signalling connection is established for the UE.

The network behaviour upon expiry of the active timer is network dependent, but typically the network stops sending paging messages to the UE on the first expiry, and may take other appropriate actions.

NOTE 3: ISR is not activated when the network includes the T3324 value IE in the ATTACH ACCEPT message or TRACKING AREA UPDATE ACCEPT message.

The implicit detach timer shall be stopped when a NAS signalling connection is established for the UE.

5.3.6 Handling of timer T3402

The value of timer T3402 can be sent by the network to the UE in the ATTACH ACCEPT message and TRACKING AREA UPDATE ACCEPT message. If the value is different from "deactivated", the UE shall apply this value in all tracking areas of the list of tracking areas assigned to the UE, until a new value is received.

The value of timer T3402 can be sent by the network to the UE in the ATTACH REJECT message. If an ATTACH REJECT message including timer T3402 value different from "deactivated", was received integrity protected, the UE shall apply this value until a new value is received with integrity protection or a new PLMN is selected. Otherwise, the default value of this timer is used.

The default value of this timer is also used by the UE in the following cases:

– ATTACH ACCEPT message or TRACKING AREA UPDATE ACCEPT message is received without a value specified;

– the network indicates that the timer is "deactivated";

– the UE does not have a stored value for this timer;

– a new PLMN which is not in the list of equivalent PLMNs has been entered, the tracking area updating fails and the tracking area updating attempt counter is equal to 5; or

– a new PLMN which is not in the list of equivalent PLMNs has been entered, the attach procedure fails, the attach attempt counter is equal to 5 and no ATTACH REJECT message was received from the new PLMN.

5.3.7 Handling of the Local Emergency Numbers List and the Extended Local Emergency Numbers List

The Local Emergency Numbers List and the Extended Local Emergency Numbers list contain additional local emergency numbers used by the serving network. These lists can be downloaded by the network to the UE at successful registration and subsequent registration updates. There is only one Local Emergency Numbers List and only one Extended Local Emergency Numbers list in the UE. The Local Emergency Numbers List can be updated with EMM procedures if the UE is in S1 mode, with GMM and MM procedures if the UE is in A/Gb or Iu mode, and with 5GMM procedures, as specified in 3GPP TS 24.501 [54], if UE is in N1 mode. The Extended Local Emergency Numbers List can be updated with EMM procedures if the UE is in S1 mode and with 5GMM procedures, as specified in 3GPP TS 24.501 [54], if UE is in N1 mode.

The UE shall use the stored Local Emergency Numbers List and the stored Extended Local Emergency Numbers List received from the network in addition to the emergency numbers stored on the USIM or user equipment to detect that the number dialled is an emergency number.

If the UE determines that the number dialled is an emergency number, the procedures specified in 3GPP TS 23.167 [45] and 3GPP TS 24.229 [13D] are utilised to select a domain for the emergency session attempt.

If the domain selected for the emergency session attempt is the PS domain, then the UE shall perform the session establishment procedures specified in 3GPP TS 24.229 [13D] to initiate an emergency session.

If the domain selected for the emergency session attempt is the CS domain (e.g. the UE has selected GERAN or UTRAN radio access technology), then the UE shall use the stored Local Emergency Numbers List, in addition to the emergency numbers stored on the USIM and the ME, to determine if:

– the UE is to send an EXTENDED SERVICE REQUEST message:

1) for CS fallback, indicating "mobile originating CS fallback or 1xCS fallback"; or

2) for CS fallback for emergency call, indicating "mobile originating CS fallback emergency call or 1xCS fallback emergency call"; and

– the call control entity of the UE specified in 3GPP TS 24.008 [13] is to send an EMERGENCY SETUP message or a SETUP message to the network.

NOTE 1: The checking of whether the dialled number is an emergency number and the determination of whether an emergency call is to be initiated in the CS domain, can end once a match is found. The Extended Local Emergency Numbers List does not apply when the CS domain is selected.

NOTE 2: The user equipment can use the emergency numbers in each of the stored lists to assist the end user in determining whether the dialled number is intended for an emergency service or for another destination, e.g. a local directory service. The possible interactions with the end user are implementation specific.

NOTE 3: A UE that supports procedures specified in 3GPP TS 24.302 [48], can get additional local emergency numbers through those procedures, which can be used based on operator policy, see 3GPP TS 24.302 [48].

The network may send a Local Emergency Numbers List or an Extended Local Emergency Numbers List or both, in the ATTACH ACCEPT or in the TRACKING AREA UPDATE ACCEPT messages, by including the Emergency number list IE and the Extended emergency number list IE, respectively. The user equipment shall store the Local Emergency Numbers List and the Extended Local Emergency Numbers List, as provided by the network. The Local Emergency Numbers List stored in the user equipment shall be replaced on each receipt of the Emergency number list IE. The Extended Local Emergency Numbers List stored in the user equipment shall be replaced on each receipt of the Extended emergency number list IE. The received Local Emergency Numbers List or the received Extended Local Emergency Numbers list or both shall be provided to the upper layers.

The emergency number(s) received in the Emergency number list IE are valid only in networks in the same country as the PLMN from which this IE is received. If no Local Emergency Numbers List is contained in the ATTACH ACCEPT or in the TRACKING AREA UPDATE ACCEPT message, then the stored Local Emergency Numbers List in the user equipment shall be kept, except if the user equipment has successfully registered to a PLMN in a country different from that of the PLMN that sent the list.

The emergency number(s) received in the Extended emergency number list IE are valid only in:

– networks in the same country as the PLMN from which this IE is received, if the Extended Emergency Number List Validity (EENLV) field within the Extended emergency number list IE indicates "Extended Local Emergency Numbers List is valid in the country of the PLMN from which this IE is received"; and

– the PLMN from which this IE is received, if the EENLV field within the Extended emergency number list IE indicates "Extended Local Emergency Numbers List is valid only in the PLMN from which this IE is received".

If no Extended Local Emergency Numbers List is contained in the ATTACH ACCEPT or in the TRACKING AREA UPDATE ACCEPT message, and the registered PLMN has not changed, then the stored Extended Local Emergency Numbers List in the user equipment shall be kept. If no Extended Local Emergency Numbers List is contained in the ATTACH ACCEPT or in the TRACKING AREA UPDATE ACCEPT message, but the registered PLMN has changed, then:

– if the last received indication in the EENLV field within the Extended emergency number list IE indicates "Extended Local Emergency Numbers List is valid only in the PLMN from which this IE is received", the stored Extended Local Emergency Numbers List in the user equipment shall be deleted; and

– if the last received indication in the EENLV field within the Extended emergency number list IE indicates "Extended Local Emergency Numbers List is valid in the country of the PLMN from which this IE is received" the list shall be kept except if the user equipment has successfully registered to a PLMN in a country different from that of the PLMN that sent the list.

NOTE: To prevent the misrouting of emergency calls, all operators within a country need to follow the regulation or agree on the setting of the Extended emergency number list IE in accordance to national agreement – either to indicate validity within a country or to indicate validity only within the PLMN.

The Local Emergency Numbers List and the Extended Local Emergency Numbers List shall be deleted at switch off and removal of the USIM. The user equipment shall be able to store up to ten entries in the Local Emergency Numbers List and up to twenty entries in the Extended Local Emergency Numbers List, received from the network.

5.3.7a Specific requirements for UE configured to use timer T3245

The following requirement applies for an UE that is configured to use timer T3245 (see 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17]):

When the UE adds a PLMN identity to the "forbidden PLMN list", the "forbidden PLMNs for attach in S101 mode" list, or the "forbidden PLMNs for GPRS service" list or sets the USIM as invalid for non-EPS services or EPS services or both, and timer T3245 (see 3GPP TS 24.008 [13]) is not running, the UE shall start timer T3245 as specified in 3GPP TS 24.008 [13], clause 4.1.1.6.

Upon expiry of the timer T3245, the UE shall erase the "forbidden PLMN list", the "forbidden PLMNs for GPRS service" list, and the "forbidden PLMNs for attach in S101 mode" list and set the USIM to valid for non-EPS and EPS services. When the lists are erased, the UE performs cell selection according to 3GPP TS 36.304 [21].

If the UE is switched off when the timer T3245 is running, the UE shall behave as follows when the UE is switched on and the USIM in the UE remains the same:

– let t1 be the time remaining for T3245 timeout at switch off and let t be the time elapsed between switch off and switch on. If t1 is greater than t, then the timer shall be restarted with the value t1 – t. If t1 is equal to or less than t, then the UE will follow the behaviour as defined in the paragraph above upon expiry of the timer T3245. If the UE is not capable of determining t, then the UE shall restart the timer with the value t1.

5.3.7b Specific requirements for UE when receiving non-integrity protected reject messages

This clause specifies the requirements for a UE that is not configured to use timer T3245 (see 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17]) and receives an ATTACH REJECT, TRACKING AREA UPDATE REJECT or SERVICE REJECT message without integrity protection with specific EMM causes.

NOTE 1: Additional UE requirements for this case, requirements for other EMM causes, and requirements for the case when the UE receives an integrity protected reject message are specified in clauses 5.5.1, 5.5.3 and 5.6.1.

The UE may maintain a list of PLMN-specific attempt counters and a list of PLMN-specific PS-attempt counters (see 3GPP TS 24.008 [13]). The maximum number of possible entries in each list is implementation dependent.

Additionally, the UE may maintain one counter for "SIM/USIM considered invalid for non-GPRS services" events and one counter for "SIM/USIM considered invalid for GPRS services" events (see 3GPP TS 24.008 [13]).

If the UE maintains the above lists of attempt counters and the event counters, a UE supporting N1 mode, shall store them in its non-volatile memory. The UE shall erase the lists and reset the event counters to zero when the UICC containing the USIM is removed. The counter values shall not be affected by the activation or deactivation of power saving mode or MICO mode (see 3GPP TS 24.501 [54]).

If the UE receives an ATTACH REJECT, TRACKING AREA UPDATE REJECT or SERVICE REJECT message without integrity protection with EMM cause value #3, #6, #7, #8, #11, #12, #13, #14, #15, #31 or #35 before the network has established secure exchange of NAS messages for the NAS signalling connection, the UE shall start timer T3247 (see 3GPP TS 24.008 [13]) with a random value uniformly drawn from the range between 30 minutes and 60 minutes, if the timer is not running, and take the following actions:

1) if the EMM cause value received is #3, #6, #7 or #8, and

a) if the UE maintains a counter for "SIM/USIM considered invalid for GPRS services" events and the counter has a value less than a UE implementation-specific maximum value, the UE shall:

i) set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI;

– if the EMM cause value received is #3, #6 or #8, delete the list of equivalent PLMNs if any;

– increment the counter for "SIM/USIM considered invalid for GPRS services" events;

– if the EMM cause value received is #3, #6 or #8, and if the UE maintains a counter for "SIM/USIM considered invalid for non-GPRS services" and the counter has a value less than a UE implementation-specific maximum value, increment the counter;

– if an attach, tracking area updating or a service request procedure was performed, reset the attach attempt counter, the tracking area updating attempt counter or the service request attempt counter, respectively;

– if A/Gb mode or Iu mode is supported by the UE, handle the GMM parameters GPRS attach attempt counter, routing area updating attempt counter or service request attempt counter, GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number as specified in 3GPP TS 24.008 [13] for the case when the GPRS attach, routing area updating or service request procedure is rejected with the GMM cause of the same value in a NAS message without integrity protection;

– If the UE is operating in single-registration mode and the EMM cause value received is #3, #6 or #7, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, registration attempt counter or service request attempt counter, 5G-GUTI, last visited registered TAI, TAI list and ngKSI as specified in 3GPP TS 24.501 [54] for the case when the registration request or service request procedure performed over 3GPP access is rejected with the 5GMM cause with the same value in a NAS message without integrity protection.

– If the UE is operating in single-registration mode and the EMM cause value received is #8, the UE shall in addition set the 5GMM state to 5GMM-DEREGISTERED, the 5GS update status to 5U3 ROAMING NOT ALLOWED, shall reset the registration attempt counter and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI for 3GPP access.

– store the current TAI in the list of "forbidden tracking areas for roaming", memorize the current TAI was stored in the list of "forbidden tracking areas for roaming" for non-integrity protected NAS reject message and enter the state EMM-DEREGISTERED.LIMITED-SERVICE; and

– search for a suitable cell in another tracking area or in another location area according to 3GPP TS 36.304 [21]; or

ii) proceed as specified in clauses 5.5.1, 5.5.3 and 5.6.1;

– increment the counter for "SIM/USIM considered invalid for GPRS services" events; and

b) else the UE shall proceed as specified in clauses 5.5.1, 5.5.3 and 5.6.1;

2) if the EMM cause value received is #12, #13 or #15, the UE shall additionally proceed as specified in clauses 5.5.1, 5.5.3 and 5.6.1;

3) if the EMM cause value received is #11, #14 or #35 and the UE is in its HPLMN or EHPLMN (if the EHPLMN list is present),

– the UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI. The UE shall delete the list of equivalent PLMNs. Additionally, if an attach, tracking area updating or service request procedure was performed, the UE shall reset the attach attempt counter or the tracking area updating attempt counter or the service request attempt counter, respectively.

– For the EMM cause #11 and #14, if A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and GPRS attach attempt counter or routing area updating attempt counter or service request attempt counter as specified in 3GPP TS 24.008 [13] for the case when the procedure is rejected with the GMM cause with the same value in a NAS message without integrity protection;

– For the EMM cause #35, if A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and GPRS attach attempt counter or routing area updating attempt counter or service request attempt counter as specified in 3GPP TS 24.008 [13] for the case when the procedure is rejected with the GMM cause value #11 in a NAS message without integrity protection;

– If the UE is operating in single-registration mode and the EMM cause value received is #11, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, registration attempt counter or service request attempt counter, 5G-GUTI, last visited registered TAI, TAI list and ngKSI as specified in 3GPP TS 24.501 [54] for the case when the registration request procedure or service request procedure performed over 3GPP access is rejected with the 5GMM cause with the same value in a NAS message without integrity protection.

– If the UE is operating in single-registration mode and the EMM cause value received is #14 or #35, the UE shall in addition set the 5GMM state to 5GMM-DEREGISTERED, the 5GS update status to 5U3 ROAMING NOT ALLOWED, shall reset the registration attempt counter or service request attempt counter, and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI for 3GPP access.

– the UE shall store the current TAI in the list of "forbidden tracking areas for roaming", memorize the current TAI was stored in the list of "forbidden tracking areas for roaming" for non-integrity protected NAS reject message and enter the state EMM-DEREGISTERED.LIMITED-SERVICE; and

– the UE shall search for a suitable cell in another tracking area or in another location area in the same PLMN according to 3GPP TS 36.304 [21];

4) if the EMM cause value received is #11 or #35 and the UE is not in its HPLMN or EHPLMN (if the EHPLMN list is present), in addition to the UE requirements specified in clause 5.5.1, 5.5.3 and 5.6.1,

if the UE maintains a list of PLMN-specific attempt counters and the PLMN-specific attempt counter for the PLMN sending the reject message has a value less than a UE implementation-specific maximum value, the UE shall increment the PLMN-specific attempt counter for the PLMN;

5) if the EMM cause value received is #14 and the UE is not roaming in its HPLMN or EHPLMN (if the EHPLMN list is present), in addition to the UE requirements specified in clause5.5.1, 5.5.3 and 5.6.1,

if the UE maintains a list of PLMN-specific PS-attempt counter and the PLMN-specific PS-attempt counter of the PLMN sending the reject message has a value less than a UE implementation-specific maximum value, the UE shall increment the PS-attempt counter of the PLMN; and

6) if the EMM cause value received is #31 for a UE that has indicated support for CIoT optimizations, the UE may discard the message or alternatively the UE should:

– set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.3);

– search for a suitable cell in another tracking area according to 3GPP TS 36.304 [21].

Upon expiry of timer T3247, the UE shall

– remove all tracking areas from the list of "forbidden tracking areas for regional provision of service" and the list of "forbidden tracking areas for roaming", which were stored in these lists for non-integrity protected NAS reject message;

– set the USIM to valid for EPS services, if

– the UE does not maintain a counter for "SIM/USIM considered invalid for GPRS services" events; or

– the UE maintains a counter for "SIM/USIM considered invalid for GPRS services" events and this counter has a value less than a UE implementation-specific maximum value;

– set the USIM to valid for non-EPS services, if

– the UE does not maintain a counter for "SIM/USIM considered invalid for non-GPRS services" events; or

– the UE maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events and this counter has a value less than a UE implementation-specific maximum value;

– if the UE maintains a list of PLMN-specific attempt counters, for each PLMN-specific attempt counter that has a value greater than zero and less than a UE implementation-specific maximum value, remove the respective PLMN from the extension of the "forbidden PLMNs" list;

– if the UE maintains a list of PLMN-specific PS-attempt counters, for each PLMN-specific PS-attempt counter that has a value greater than zero and less than a UE implementation-specific maximum value, remove the respective PLMN from the "forbidden PLMNs for GPRS service" list. If the resulting "forbidden PLMNs for GPRS service" list is empty, the UE shall re-enable the E-UTRA capability (see clause 4.5);

– if the UE is supporting A/Gb mode or Iu mode, perform the actions as specified in 3GPP TS 24.008 [13] for the case when timer T3247 expires;

– if the UE is supporting N1 mode, perform the actions as specified in 3GPP TS 24.501 [54], clause 5.3.20.2 for the case when timer T3247 expires; and

– initiate an EPS attach procedure or tracking area updating procedure, if still needed, dependent on EMM state and EPS update status, or perform PLMN selection according to 3GPP TS 23.122 [6].

If the UE maintains a list of PLMN-specific attempt counters and PLMN-specific PS-attempt counters, when the UE is switched off, the UE shall, for each PLMN-specific attempt counter that has a value greater than zero and less than the UE implementation-specific maximum value, remove the respective PLMN from the forbidden PLMN list. When the USIM is removed, the UE should perform this action.

NOTE 2: If the respective PLMN was stored in the extension of the "forbidden PLMNs" list, then according to 3GPP TS 23.122 [6] the UE will delete the contents of this extension when the UE is switched off or the USIM is removed.

5.3.8 Abnormal cases in the UE

The following abnormal case can be identified:

a) EMM uplink message transmission failure indication by lower layers

When it is specified in the relevant procedure that it is up to the UE implementation to rerun the ongoing procedure that triggered that procedure, the procedure can typically be re-initiated using a retransmission mechanism of the uplink message (the one that has previously failed to be transmitted) with new sequence number and message authentication code information thus avoiding to restart the whole procedure.

5.3.9 Handling of NAS level mobility management congestion control

The network may detect EMM signalling congestion and perform NAS level mobility management congestion control. NAS level mobility management congestion control consists of general NAS level mobility management congestion control and subscribed APN based congestion control.

Under general overload conditions the network may reject mobility management signalling requests from UEs as specified in 3GPP TS 23.401 [10]. The network should not reject the following requests:

– requests for emergency bearer services;

– DETACH REQUEST message;

– service request or tracking area update request triggered by paging;

– requests from UEs that were received via NAS signalling connections established with RRC establishment cause "High priority access AC 11 – 15";

– requests for attach, normal tracking area updating or periodic tracking area updating, when emergency is indicated by lower layers; and

– requests for CS fallback emergency call or 1xCS fallback emergency call.

When subscribed APN based mobility management congestion control is active for a particular APN, the network may reject attach requests from UEs with a subscription to this APN.

In mobility management the network may detect NAS signalling congestion and start or stop performing the subscribed APN based congestion control based on mobility management level criteria such as:

– rate of mobility management NAS messages from a group of UEs with a subscription to a particular APN exceeds or falls below certain thresholds; and/or

– setting in network management.

When the NAS level mobility management congestion control is active, the network may include a value for the mobility management back-off timer T3346 in the reject messages. The UE starts the timer T3346 with the value received in the mobility management reject messages. To avoid that large numbers of UEs simultaneously initiate deferred requests, the network should select the value for the timer T3346 for the rejected UEs so that timeouts are not synchronised.

For subscribed APN based congestion control the value of timer T3346 for a particular APN may be APN dependent.

If the timer T3346 is running when the UE enters state EMM-DEREGISTERED, the UE remains switched on, and the USIM in the UE remains the same, then timer T3346 is kept running until it expires or it is stopped.

If the UE is switched off when the timer T3346 is running, the UE shall behave as follows when the UE is switched on and the USIM in the UE remains the same:

– let t1 be the time remaining for T3346 timeout at switch off and let t be the time elapsed between switch off and switch on. If t1 is greater than t, then the timer shall be restarted with the value t1 – t. If t1 is equal to or less than t, then the timer need not be restarted. If the UE is not capable of determining t, then the UE shall restart the timer with the value t1; and

– if prior to switch off, timer T3346 was started due to a NAS request message (ATTACH REQUEST, TRACKING AREA UPDATE REQUEST, CONTROL PLANE SERVICE REQUEST or EXTENDED SERVICE REQUEST) which contained the low priority indicator set to "MS is configured for NAS signalling low priority", then if timer T3346 is restarted at switch on, the UE configured for dual priority shall handle mobility management requests as indicated in clauses 5.5.1.2.6, 5.5.3.2.6 and 5.6.1.6.

If the UE enters a new PLMN while timer T3346 is running, and the new PLMN is not equivalent to the PLMN where the UE started timer T3346, the UE shall stop timer T3346 when initiating mobility management procedures in the new PLMN.

After change in TAI which is not part of TAI list, if the timer T3346 is running and EMM update status is EU1 UPDATED then UE shall set the EMM update status to EU2 NOT UPDATED and enter state EMM-REGISTERED.ATTEMPTING-TO-UPDATE.

5.3.9A Handling of congestion control for transport of user data via the control plane

The network may activate congestion control for transport of user data via the control plane, as specified in 3GPP TS 23.401 [10].

If the congestion control for transport of user data via the control plane is active and if the UE has indicated support for the control plane data back-off timer, the network shall include a value for the control plane data back-off timer T3448 in ATTACH ACCEPT, TRACKING AREA UPDATE ACCEPT, SERVICE ACCEPT or SERVICE REJECT message, and shall store a control plane data back-off time on a per UE basis. The UE starts the timer T3448 with the value informed in the message. To avoid that large numbers of UEs simultaneously initiate deferred requests, the network should select the value for the timer T3448 for the informed UEs so that timeouts are not synchronised.

The network sends TRACKING AREA UPDATE ACCEPT message or SERVICE ACCEPT message without T3448 value IE to stop the timer T3448 running in the UE as specified in clause 5.5.3.2.4 and clause 5.6.1.4.2.

Based on the stored control plane data back-off time for the UE, the network may reject the transfer of user data via the control plane initiated by the UE.

While the timer T3448 is running, the UE in EMM-IDLE mode shall not initiate the transport of user data via the control plane procedure (see clause 6.6.4), except if the UE is allowed to use exception data reporting (see the ExceptionDataReportingAllowed leaf of the NAS configuration MO in 3GPP TS 24.368 [15A] or the USIM file EF_NASCONFIG in 3GPP TS 31.102 [17]) and the user data is related to an exceptional event.

Upon entering the state EMM-DEREGISTERED or a new PLMN which is not equivalent to the PLMN where the UE started the timer T3448, or upon being switched off while the timer T3448 is running, the UE shall stop the timer T3448. For further criteria to stop of timer T3448, refer to clause 5.5.3.2.4 and clause 5.6.1.4.2.

5.3.10 Access class control

The network can restrict the access for certain groups of UEs by means of barring their access class.

The UE shall evaluate the access control information as specified in 3GPP TS 36.331 [22] for:

– Access Class Barring;

– Access Control for CSFB and Extended Access Barring (EAB);

– Access Control for Application specific Congestion control for Data Communication (ACDC), if the UE supports ACDC; and

– Access Barring.

5.3.11 Power saving mode

The UE can request the use of power saving mode (PSM) during an attach or tracking area updating procedure (see 3GPP TS 23.682 [11A] and 3GPP TS 23.401 [10]). The UE shall not request the use of PSM during:

– an attach for emergency bearer services procedure;

– an attach procedure for initiating a PDN connection for emergency bearer services with attach type not set to "EPS emergency attach";

– a tracking area updating procedure for initiating a PDN connection for emergency bearer services;

– a tracking area updating procedure when the UE has a PDN connection established for emergency bearer services; or

– an attach for access to RLOS.

The network accepts the use of PSM by providing a specific value for timer T3324 when accepting the attach or tracking area updating procedure. The UE may use PSM only if the network has provided the T3324 value IE during the last attach or tracking area updating procedure with a value different from "deactivated".

NOTE: Timer T3324 is specified in 3GPP TS 24.008 [13].

Upon expiry of the timer T3324 or if the T3324 value provided by the network is zero, the UE may deactivate the AS layer and activate PSM by entering the state EMM-REGISTERED.NO-CELL-AVAILABLE if:

a) the UE is not attached for emergency bearer services;

b) the UE has no PDN connection for emergency bearer services;

c) the UE is in EMM-IDLE mode;

d) in the EMM-REGISTERED.NORMAL-SERVICE state; and

e) the UE is not attached for access to RLOS.

If conditions a, b, c and e are fulfilled, but the UE is in a state other than EMM-REGISTERED.NORMAL-SERVICE when timer T3324 expires, the UE may activate PSM when the MS returns to state EMM-REGISTERED.NORMAL-SERVICE.

A UE that has already been allocated timer T3324 with a value different from "deactivated" and the timer T3324 has expired, may activate PSM if it receives an "Extended wait time" from lower layers.

When PSM is activated all NAS timers are stopped and associated procedures aborted except for T3412, T3346, T3396, T3447, any backoff timers, and the timer T controlling the periodic search for HPLMN or EHPLMN (if the EHPLMN list is present) or higher prioritized PLMNs (see 3GPP TS 23.122 [6]).

If the UE is attached for emergency bearer services or has a PDN connection for emergency bearer services, the UE shall not activate PSM.

If the UE is attached for access to RLOS, the UE shall not activate PSM.

The UE may deactivate PSM and activate the AS layer at any time. Upon deactivating PSM, the UE may initiate EMM procedures (e.g. for the transfer of mobile originated signalling or user data).

5.3.12 Extended idle-mode DRX cycle

The UE may request the use of extended idle-mode DRX cycle (eDRX) during an attach or tracking area updating procedure by including the extended DRX parameters IE (see 3GPP TS 23.682 [11A] and 3GPP TS 23.401 [10]). The UE shall not request the use of eDRX during:

– an attach for emergency bearer services procedure;

– a tracking area updating procedure for the UE attached for emergency bearer services; or

– an attach for access to RLOS.

The UE and the network may negotiate eDRX parameters during a tracking area updating procedure when the UE has a PDN connection for emergency bearer services.

The network accepts the request to use the eDRX by providing the extended DRX parameters IE when accepting the attach or the tracking area updating procedure. The UE shall use eDRX only if it received the extended DRX parameters IE during the last attach or tracking area updating procedure and the UE does not have a PDN connection for emergency bearer services.

NOTE: If the UE wants to keep using eDRX, the UE includes the extended DRX parameters IE in each attach or tracking area updating procedure.

If the UE received the extended DRX parameters IE during the last attach or tracking area updating procedure, upon successful completion of the PDN disconnect procedure of the PDN connection for emergency bearer services or EPS bearer context deactivation procedure of the EPS bearer context for emergency, the UE shall resume eDRX.

If the network has provided the extended DRX parameters IE during the last attach or tracking area updating procedure, upon successful completion of the PDN disconnect procedure of the PDN connection for emergency bearer services or EPS bearer context deactivation procedure of the EPS bearer context for emergency, the network shall resume eDRX.

If the UE or the network locally releases the PDN connection for emergency bearer service, the UE or the network shall not use eDRX until the UE receives eDRX parameters during a tracking area updating procedure with EPS bearer context synchronization or upon successful completion of a service request procedure.

If the UE did not receive the extended eDRX parameters IE, or if the UE has a PDN connection for emergency bearer services, the UE shall use the stored UE specific DRX parameter, if available.

If the network did not accept the request to use eDRX, or if the UE has a PDN connection for emergency bearer services, the network shall use the stored UE specific DRX parameter, if available.

If the network provided the extended DRX parameters IE and also assigned a new GUTI for the UE as described in clause 5.5.3.2.4 during the last tracking area updating procedure, the network shall use the stored UE specific DRX parameter, if available, with the old GUTI and use the eDRX provided by the network with the new GUTI until the old GUTI can be considered as invalid by the network (see clause 5.4.1.4).

5.3.13 Interaction between power saving mode and extended idle mode DRX cycle

The UE can request the use of both PSM and eDRX during an attach or tracking area updating procedure but it is up to the network to decide to enable none, one of them or both (see 3GPP TS 23.682 [11A] and 3GPP TS 23.401 [10]).

If the network accepts the use of both PSM (see clause 5.3.11) and eDRX (see clause 5.3.12), the extended DRX parameters IE provided to the UE should allow for multiple paging occasions before the active timer expires.

5.3.14 Dedicated core network

The network may reject mobility management signalling requests from UEs due to dedicated core network as specified in 3GPP TS 23.401 [10]. When the network rejects mobility management signalling requests due to dedicated core network, the mechanism for general NAS level mobility management congestion control as specified in clause 5.3.9 shall be followed.

5.3.15 CIoT EPS optimizations

CIoT EPS optimizations provide improved support of small data and SMS transfer. A UE supporting CIoT EPS optimizations can indicate the CIoT network behaviour the UE can support and prefers to use during attach or tracking area updating procedure (see 3GPP TS 23.401 [10]). The UE may indicate the support for control plane CIoT EPS optimization, user plane CIoT EPS optimization, EMM-REGISTERED without PDN connection, S1-U data transfer and header compression (see clause 9.9.3.34). The UE may also request to use SMS transfer without combined attach procedure during the attach procedure. Furthermore, the UE may, separately from the indication of support, indicate preference for control plane CIoT EPS optimization or user plane CIoT EPS optimization (see clause 9.9.3.0B). The indication of preference is also considered as the request to use. A UE supporting CIoT 5GS optimizations can also indicate the 5GS CIoT network behaviour the UE can support during attach or tracking area updating procedure. Furthermore, the UE may, separately from the indication of support, indicate preference for control plane CIoT 5GS optimization or user plane CIoT 5GS optimization.

NOTE 1: The UE supporting control plane CIoT EPS optimization and S1-U data transfer but not user plane CIoT EPS optimization does not indicate preference for user plane CIoT EPS optimization.

The UE can be in NB-S1 mode or WB-S1 mode when requesting the use of CIoT EPS optimizations during an attach or tracking area updating procedure. A UE in NB-S1 mode always indicates support for control plane CIoT EPS optimization. A UE in NB-S1 mode can also request SMS transfer without combined procedure by using the normal attach or tracking area updating procedure (see clause 5.5.1 and 5.5.3).

In NB-S1 mode, the UE, when requesting the use of CIoT EPS optimization, does not:

– request an attach for emergency bearer services procedure;

– request an attach procedure for initiating a PDN connection for emergency bearer services with attach type not set to "EPS emergency attach";

– indicate voice domain preference and UE’s usage setting; or

– request an attach for access to RLOS.

The network does not indicate to the UE support of emergency bearer services when the UE is in NB-S1 mode (see clause 5.5.1.2.4 and 5.5.3.2.4).

The control plane CIoT EPS optimization enables support of efficient transport of user data (IP, non-IP, Ethernet) or SMS messages over control plane via the MME without triggering data radio bearer establishment. The support of control plane CIoT EPS optimization is mandatory for the network in NB-S1 mode and optional in WB-S1 mode. Optional header compression of IP data can be applied to IP PDN type PDN connections that are configured to support header compression.

The user plane CIoT EPS optimization enables support for change from EMM-IDLE mode to EMM-CONNECTED mode without the need for using the service request procedure (see clause 5.3.1.3).

If the UE indicates support of EMM-REGISTERED without PDN connection in the attach request, the UE may include an ESM DUMMY MESSAGE instead of a PDN CONNECTIVITY REQUEST message as part of the attach procedure. If the EMM-REGISTERED without PDN connection is supported by the network, the UE and the network can at any time release all the PDN connections and the UE still remains EPS attached.

NOTE 2: For both the UE and the network, the term "EMM-REGISTERED without PDN connection" is equivalent to the term "EPS attach without PDN connectivity" as specified in 3GPP TS 23.401 [10].

In NB-S1 mode, if the UE indicates "SMS only" during a normal attach or tracking area updating procedure, the MME supporting CIoT EPS optimisations provides SMS so that the UE is not required to perform a combined attach or tracking area updating procedure.

If the UE supports user plane CIoT EPS optimization, it shall also support S1-U data transfer.

If the UE indicates support of one or more CIoT EPS optimizations and the network supports one or more CIoT EPS optimizations and decides to accept the attach or tracking area update request, the network indicates the supported CIoT EPS optimizations to the UE per TAI list when accepting the UE request. Network indication of support is interpreted by the UE as the acceptance to use the respective feature. After completion of the attach or tracking area updating procedure, the UE and the network can then use the accepted CIoT EPS optimizations for the transfer of user data (IP, non-IP, Ethernet and SMS).

The UE supporting control plane CIoT EPS optimization may indicate support for control plane MT-EDT during the attach or tracking area updating procedure. For a UE that supports control plane MT-EDT and for which the network has accepted the use of control plane CIoT EPS optimization, the network may trigger the delivery of downlink data to the UE, when available, using procedures for control plane MT-EDT as specified in 3GPP TS 23.401 [10].

The UE supporting user plane CIoT EPS optimization may indicate support for user plane MT-EDT during the attach or tracking area updating procedure. For a UE that supports user plane MT-EDT and for which the network has accepted the use of user plane CIoT EPS optimization, the network may trigger the delivery of downlink data to the UE, when available, using procedures for user plane MT-EDT as specified in 3GPP TS 23.401 [10].

If the UE and the network support both the control plane CIoT EPS optimization and S1-U data transfer, then when receiving the UE’s request for a PDN connection, the MME decides whether the PDN connection should be SCEF PDN connection or SGi PDN connection as specified in 3GPP TS 23.401 [10]:

– if SCEF PDN connection is to be established for non-IP data type, the MME shall include Control plane only indication for the requested PDN connection;

– if SGi PDN connection is to be established and existing SGi PDN connections for this UE were established with Control plane only indication, the MME shall include Control plane only indication for the newly requested SGi PDN connection;

– if SGi PDN connection is to be established and existing SGi PDN connections for this UE were established without Control plane only indication, the MME shall not include Control plane only indication for the newly requested SGi PDN connection; and

– if SGi PDN connection is to be established and no SGi PDN connection for this UE exists, the MME determine whether to include Control plane only indication for the requested SGi PDN connection based on local policies, the UE’s preferred CIoT network behaviour and the supported CIoT network behaviour.

If the network supports user plane CIoT EPS optimization, it shall also support S1-U data transfer.

Broadcast system information may provide information about support of CIoT EPS optimizations (see 3GPP TS 36.331 [22]). At reception of new broadcast system information, the lower layers deliver it to the EMM layer in the UE. The information provided by lower layers is per PLMN and used by the UE to determine whether certain CIoT EPS optimizations are supported in the cell.

The UE shall not attempt to use CIoT EPS optimizations which are indicated as not supported.

In NB-S1 mode, when the UE requests the lower layer to establish a RRC connection and the UE requests the use of EMM-REGISTERED without PDN connection or user plane CIoT EPS optimization, the UE shall pass an indication of the requested CIoT EPS optimizations to the lower layers. If the UE requests the use of S1-U data transfer without user plane CIoT optimization, then the UE shall also pass an indication of user plane CIoT EPS optimization to lower layers.

In WB-S1 mode, when the UE requests the lower layer to establish a RRC connection and the UE requests the use of EMM-REGISTERED without PDN connection, control plane CIoT EPS optimization or user plane CIoT EPS optimization, the UE shall pass an indication of the requested CIoT EPS optimizations to the lower layers.

5.3.16 Restriction on use of enhanced coverage

In order to deal with use of extensive resources from the network, the operator may prevent specific subscribers from using enhanced coverage (see 3GPP TS 23.401 [10]). When in NB-S1 mode, the UE shall indicate support for restriction on use of enhanced coverage. When in WB-S1 mode, the UE supporting either CE mode A or CE mode B shall indicate support for restriction on use of enhanced coverage. The UE supporting restriction on use of enhanced coverage indicates its support for restriction on use of enhanced coverage in the ATTACH REQUEST and TRACKING AREA UPDATE REQUEST message. If the UE supports restriction on use of enhanced coverage, the MME indicates whether the use of enhanced coverage is restricted or not in the ATTACH ACCEPT message and TRACKING AREA UPDATE ACCEPT message (see clause 5.5.1.2 and clause 5.5.3.2). If the use of enhanced coverage is restricted, the UE shall not use enhanced coverage in the registered PLMN and in any PLMN which is in the list of equivalent PLMNs.

If the UE supports CE mode B and the network determines that

– the use of enhanced coverage is not restricted for the UE; or

– CE mode B is not restricted for the UE;

the applicable NAS timer values shall be calculated by the network as described in clause 4.8.

5.3.17 Service Gap Control

The network may control the frequency UEs can transit from EMM-IDLE mode to EMM-CONNECTED mode via the service gap control (SGC) as specified in 3GPP TS 23.401 [10]. If the network supports service gap control (SGC) feature and the service gap time value is available in the EMM context of the UE, the MME shall consider SGC as active for the UE.

The UE and the network negotiate usage of the service gap control (SGC) feature during the attach and tracking area updating procedures:

– the UE supporting service gap control indicates its support for service gap control in the ATTACH REQUEST and TRACKING AREA UPDATE REQUEST message. If the UE supports service gap control and the SGC is active for the UE, the MME shall include service gap timer T3447 value in the ATTACH ACCEPT message and TRACKING AREA UPDATE ACCEPT message (see clause 5.5.1.2 and clause 5.5.3.2). The UE shall store the service gap time value; and

– for UEs that do not support the optional SGC feature when the network rejects mobility management signalling requests due to service gap control is active in the network, the mechanism for general NAS level mobility management congestion control as specified in clause 5.3.9 applies.

The UE shall start the SGC timer T3447 when the NAS signalling connection is released and if:

– the UE supports SGC feature, and the service gap timer value is available in the UE and does not indicate zero; and

– the NAS signalling connection released was not established for:

– paging;

– attach requests without PDN connection request; or

– tracking area update requests without "active" or "signalling active" flag set.

If the SGC is active in the network, after the UE transitions from EMM-CONNECTED mode to EMM-IDLE mode except when the UE was in EMM-CONNECTED mode due to:

– paging;

– attach requests without PDN connection request; or

– tracking area update requests without "active" or "signalling active" flag set,

the network shall start the SGC timer T3447:

– with the service gap time value available in the EMM context minus 4 minutes, if the UE supports SGC feature and the service gap time value has been sent to the UE with a non-zero value; or

– with the service gap time value available in the EMM context if the UE does not support SGC feature.

When the SGC timer T3447 is running, the network allows:

– requests for emergency bearer services;

– requests for exception data reporting;

– attach requests without PDN connection request;

– tracking area update requests without "active" or "signalling active" flag set;

– requests from UEs that were received via NAS signalling connections established with RRC establishment cause "High priority access AC 11 – 15"; and

– mobile terminated service requests triggered by paging and subsequent MO signalling or MO data, if any, until the UE enters EMM-IDLE mode.

If the MME determines that the UE operating in single-registration mode has performed an inter-system change from S1 mode to N1 mode and the timer T3447 is running in the MME, the MME stops the T3447.

Upon inter-system change from N1 mode to S1 mode, if the UE supports service gap control, T3447 is running in the UE, and the T3447 value is included in the ATTACH ACCEPT message or TRACKING AREA UPDATE ACCEPT message received from the MME (see clause 5.5.1.2 and clause 5.5.3.2), the UE shall keep T3447 running. Additionally, the UE shall store and replace the currently stored T3447 value with the received T3447 value. Upon expiry of the running T3447 timer, the UE shall use the new value when starting T3447 again.

The UE or the network with a running service gap timer shall keep the timer running when the UE transits from EMM-IDLE mode to EMM-CONNECTED mode.

NOTE: If the UE transitions from EMM-IDLE mode to EMM-CONNECTED mode due to attach request without PDN connection request or tracking area update request without "active" or "signalling active" flag set, the UE initiates no further MO signalling except for tracking area update request without "active" or "signalling active" flag set until the UE receives network-initiated signalling (e.g. DOWNLINK NAS TRANSPORT message for MT SMS) or MT data over user plane, or after the UE has moved to EMM-IDLE state and the service gap timer is not running.

If the timer T3447 is running when the UE enters state EMM-DEREGISTERED, the UE remains switched on, and the USIM in the UE remains the same, then timer T3447 is kept running until it expires.

If the UE is switched off when the timer T3447 is running, the UE shall behave as follows when the UE is switched on and the USIM in the UE remains the same:

– let t1 be the time remaining for T3447 timeout at switch off and let t be the time elapsed between switch off and switch on. If t1 is greater than t, then the timer shall be restarted with the value t1 – t. If t1 is equal to or less than t, then the timer need not be restarted. If the UE is not capable of determining t, then the UE shall restart the timer with the value t1.

5.3.18 Restricted local operator services

Restricted local operator services (RLOS) is an optional feature that enables operators to offer access to restricted local operator services to the unauthenticated UEs in limited service state (see 3GPP TS 23.401 [10]). Authenticated UEs in limited service state may also be able to access restricted local operator services. The UE requests access to RLOS during the attach procedure by setting the attach type to "EPS RLOS attach" in the ATTACH REQUEST message. Subject to regulation and local operator policy, if the MME is configured to support access to RLOS, the MME accepts the UE’s attach request regardless of the authentication result or skips the authentication procedure.

When the UE requests the lower layer to establish an RRC connection for access to RLOS, the UE indicates in the RRC signalling that the RRC connection is for access to RLOS to the lower layers.

The UE supporting access to RLOS shall perform PLMN selection according to 3GPP TS 23.122 [6]. Broadcast system information may provide information about support of access to RLOS (see 3GPP TS 36.331 [22]). At reception of new broadcast system information, the lower layers deliver it to the EMM layer in the UE. The information provided by lower layers is per PLMN and used by the UE to determine whether the PLMN is configured to support access to RLOS. The UE shall not attempt to request access to RLOS if the PLMN does not support access to RLOS.

NOTE: Only authorized applications on the UE are allowed to trigger the initiation of RLOS connection (see 3GPP TS 33.401 [19]).

For UE attached for access to RLOS, only UE originated access to RLOS requests are supported. Mobile terminated access to RLOS request and network triggered service request are not allowed. The UE is not allowed to initiate UE requested PDN connectivity for any additional PDN connection. In addition, intersystem change to other RAT including GERAN and UTRAN and handover between 3GPP and non-3GPP accesses are not supported.

Access to RLOS is applicable to the UEs in WB-S1 mode only. The UEs in NB-S1 mode shall not request access to RLOS.

Location service does not apply to access to RLOS.

If a UE attached for access to RLOS needs to initiate an emergency call, the UE shall first perform a local detach prior to initiating an attach procedure for emergency bearer services.

5.3.19 Core Network selection and redirection for UEs using CIoT optimizations

5.3.19.1 Core network selection

A UE that supports CIoT optimizations performs core network selection as specified in clause 4.8.4A.1 of 3GPP TS 24.501 [54].

5.3.19.2 Redirection of the UE by the core network

The network that supports CIoT optimizations can redirect a UE between EPC and 5GCN as specified in clause 5.31.3 of 3GPP TS 23.501 [58]. The network can take into account the UE’s N1 mode capability or S1 mode capability, the CIoT network behaviour supported and preferred by the UE or the CIoT network behaviour supported by the network to determine the redirection.

NOTE: It is assumed that the network would avoid redirecting the UE back and forth between EPC and 5GCN.

The network redirects the UE to 5GCN by rejecting the attach request, or tracking area update request, or service request with the EMM cause #31 "Redirection to 5GCN required" as specified in clause 5.5.1.2.5, 5.5.1.3.5, 5.5.3.2.5, 5.5.3.3.5 and 5.6.1.5. Upon receipt of reject message, the UE disables the E-UTRA capability as specified in clause 4.5 and enables the N1 mode capability if it was disabled in order to move to 5GCN.

The network that supports CIoT optimizations can also redirect a UE from 5GCN to EPC as specified in clause 4.8.4A.2 of 3GPP TS 24.501 [54].

5.3.20 UE radio capability signalling optimisation

UE radio capability signalling optimisation (RACS) is a feature that is optional at both the UE and the network and which aims to optimise the transmission of UE radio capability over the radio interface (see 3GPP TS 23.401 [10]). RACS works by assigning an identifier to represent a set of UE radio capabilities. This identifier is called the UE radio capability ID. A UE radio capability ID can be either manufacturer-assigned or network-assigned. The UE radio capability ID is an alternative to the signalling of the radio capabilities container over the radio interface.

In this release of the specification, RACS is not applicable to NB-S1 mode.

If the UE supports RACS:

– the UE shall indicate support for RACS by setting the RACS bit to "RACS supported" in the UE network capability IE of the ATTACH REQUEST and TRACKING AREA UPDATE REQUEST messages;

– if the UE performs an attach procedure and the UE has an applicable UE radio capability ID for the current UE radio configuration in the selected network, the UE shall include the UE radio capability ID availability IE in the ATTACH REQUEST message and set the IE to "UE radio capability ID available";

– if the UE performs a tracking area updating procedure and the UE has an applicable UE radio capability ID for the current UE radio configuration in the selected network, the UE shall include the UE radio capability ID availability IE in the TRACKING AREA UPDATE REQUEST message and set the IE to "UE radio capability ID available";

– If the UE is requested to provide the UE radio capability ID by the network during a security mode control procedure, the UE shall include the UE radio capability ID in the UE radio capability ID IE of the SECURITY MODE COMPLETE message according to the rules in clause 5.4.3.3.;

– if the radio configuration at the UE changes (for instance because the UE has disabled a specific radio capability) then:

a) if the UE has an applicable UE radio capability ID for the new UE radio configuration, the UE shall initiate a tracking area updating procedure, include a UE radio capability information update needed IE in the TRACKING AREA UPDATE REQUEST message and set the URCIDA bit to "UE radio capability ID available" in the UE radio capability ID availability IE in the TRACKING AREA UPDATE REQUEST message; and

b) if the UE does not have an applicable UE radio capability ID for the new UE radio configuration, the UE shall initiate a tracking area updating procedure and shall include a UE radio capability information update needed IE in the TRACKING AREA UPDATE REQUEST message;

NOTE: Performing the tracking area updating procedure with the UE radio capability information update needed IE included in the TRACKING AREA UPDATE REQUEST message and without the UE radio capability ID availability IE set to "UE radio capability ID available" in the TRACKING AREA UPDATE REQUEST message as specified in b) above can trigger the network to assign a new UE radio capability ID to the UE.

– upon receiving a network-assigned UE radio capability ID in the ATTACH ACCEPT message, in the TRACKING AREA UPDATE ACCEPT message or in the GUTI REALLOCATION COMMAND message, the UE shall store the network-assigned UE radio capability ID and the PLMN ID of the serving network along with a mapping to the current UE radio configuration in its non-volatile memory as specified in annex C. The UE shall be able to store at least the last 16 received network-assigned UE radio capability IDs with the associated PLMN ID and the mapping to the corresponding UE radio configuration;

– the UE shall not use a network-assigned UE radio capability ID in PLMNs equivalent to the PLMN which assigned it; and

– upon receiving a UE radio capability ID deletion indication IE set to "Network-assigned UE radio capability IDs deletion requested" in the ATTACH ACCEPT message, in the TRACKING AREA UPDATE ACCEPT message or in the GUTI REALLOCATION COMMAND message, the UE shall delete all network-assigned UE radio capability IDs stored at the UE for the serving network and initiate a tracking area updating procedure. If the UE has an applicable manufacturer-assigned UE radio capability ID for the current UE radio configuration in the selected network, the UE shall include a UE radio capability ID availability IE set to "UE radio capability ID available" in the TRACKING AREA UPDATE REQUEST message.

If the network supports RACS:

– if the UE has included the UE radio capability ID availability IE in the ATTACH REQUEST message and set the IE to "UE radio capability ID available", the network shall initiate a security mode control procedure to retrieve the UE radio capability ID from the UE;

– if the UE has included the UE radio capability ID availability IE in the TRACKING AREA UPDATE REQUEST message and set the IE to "UE radio capability ID available", the network may initiate a security mode control procedure to retrieve the UE radio capability ID from the UE;

– if the UE has included the UE radio capability ID availability IE in the TRACKING AREA UPDATE REQUEST message, set the URCIDA bit to "UE radio capability ID available" in the UE radio capability ID availability IE and no UE radio capability ID is available in the UE context in the MME, the network shall initiate a security mode control procedure to retrieve the UE radio capability ID from the UE;

– the network may assign a network-assigned UE radio capability ID to a UE which supports RACS by including a UE radio capability ID IE in the ATTACH ACCEPT message, in the TRACKING AREA UPDATE ACCEPT message or in the GUTI REALLOCATION COMMAND message; and

– the network may trigger the UE to delete all network-assigned UE radio capability IDs stored at the UE for the serving network by including a UE radio capability ID deletion indication IE set to "Network-assigned UE radio capability IDs deletion requested" in the ATTACH ACCEPT message, in the TRACKING AREA UPDATE ACCEPT message or in the GUTI REALLOCATION COMMAND message.

5.3.21 Wake-up signal assistance

A UE supporting wake-up signal (WUS) assistance can indicate its WUS assistance capability during attach or tracking area updating procedure (see 3GPP TS 23.401 [10]). The UE supporting WUS assistance may include its UE paging probability information in the Requested WUS assistance information IE during an attach or tracking area updating procedure (see 3GPP TS 23.401 [10]). The UE shall not include its UE paging probability information during:

– an attach for emergency bearer services procedure;

– an attach procedure for initiating a PDN connection for emergency bearer services with attach type not set to "EPS emergency attach";

– a tracking area updating procedure for initiating a PDN connection for emergency bearer services; or.

– a tracking area updating procedure when the UE has a PDN connection established for emergency bearer services.

The UE and the network may negotiate the UE paging probability information during an attach or tracking area updating procedure when the UE is not attached for emergency bearer services. The UE paging probability information is an assistance information used to determine the WUS group for paging UE (see 3GPP TS 23.401 [10], 3GPP TS 36.300 [20]).

NOTE: The determination of UE paging probability information is up to UE implementation.

If the UE is not attached for emergency bearer services and the network accepts the use of the WUS assistance for the UE, the network determines the negotiated UE paging probability information for the UE based on the requested UE paging probability information, if any, local configuration or previous statistical information for the UE, and then indicates the negotiated UE paging probability information in the Negotiated WUS assistance information IE to the UE when accepting the attach or the tracking area updating procedure. The network shall store the negotiated UE paging probability information in the EMM context of the UE for paging.

The UE shall use WUS assistance only if it received the Negotiated WUS assistance information IE during the last attach or tracking area updating procedure. If the UE did not receive the Negotiated WUS assistance information IE during the last attach or tracking area updating procedure, the UE shall delete any existing WUS assistance information received from the network.

If the network did not accept the request to use WUS assistance, the network shall delete the stored negotiated UE paging probability information for the UE, if available.

When a PDN connection for emergency bearer service is successfully established after the UE received the Negotiated WUS assistance information IE during the last attach or tracking area updating procedure, the UE and the network shall not use WUS assistance information until:

– the successful completion of the PDN disconnect procedure of the PDN connection for emergency bearer services or EPS bearer context deactivation procedure of the EPS bearer context for emergency, or

– the UE receives WUS assistance information during a tracking area updating procedure with EPS bearer context synchronization or upon successful completion of a service request procedure, if the UE or the network locally releases the PDN connection for emergency bearer service.

5.3.1 EMM modes and NAS signalling connection

5.3.1.1 Establishment of the NAS signalling connection

5.3.1.2 Release of the NAS signalling connection

5.3.1.2.1 General

5.3.1.2.2 UE is using EPS services with control plane CIoT EPS optimization

5.3.1.3 Suspend and resume of the NAS signalling connection

5.3.2 Lists of forbidden tracking areas

5.3.3 List of forbidden PLMNs for attach in S101 mode

5.3.3a Forbidden PLMNs for EPS services

5.3.4 Equivalent PLMNs list

5.3.5 Handling of the periodic tracking area update timer and mobile reachable timer (S1 mode only)

5.3.6 Handling of timer T3402

5.3.7 Handling of the Local Emergency Numbers List and the Extended Local Emergency Numbers List

5.3.7a Specific requirements for UE configured to use timer T3245

5.3.7b Specific requirements for UE when receiving non-integrity protected reject messages

5.3.8 Abnormal cases in the UE

5.3.9 Handling of NAS level mobility management congestion control

5.3.9A Handling of congestion control for transport of user data via the control plane

5.3.10 Access class control

5.3.11 Power saving mode

5.3.12 Extended idle-mode DRX cycle

5.3.13 Interaction between power saving mode and extended idle mode DRX cycle

5.3.14 Dedicated core network

5.3.15 CIoT EPS optimizations

5.3.16 Restriction on use of enhanced coverage

5.3.17 Service Gap Control

5.3.18 Restricted local operator services

5.3.19 Core Network selection and redirection for UEs using CIoT optimizations

5.3.19.1 Core network selection

5.3.19.2 Redirection of the UE by the core network

5.3.20 UE radio capability signalling optimisation

5.3.21 Wake-up signal assistance

5.3.22 Void