5.5.1 Attach procedure

24.3013GPPNon-Access-Stratum (NAS) protocol for Evolved Packet System (EPS)Release 18Stage 3TS

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

5.5.1.1 General

The attach procedure is used to attach to an EPC for packet services in EPS.

The attach procedure is used for the following purposes:

– by a UE in PS mode of operation to attach for EPS services only;

– by a UE in CS/PS mode 1 or CS/PS mode 2 of operation to attach for both EPS and non-EPS services;

– by a UE supporting NB-S1 mode only in PS mode of operation to attach for EPS services and "SMS only";

– to attach for emergency bearer services; or

– an attach for access to RLOS.

The lower layers indicate to NAS that the network does not support emergency bearer services for the UE in limited service state (3GPP TS 36.331 [22]). This information is taken into account when deciding whether to initiate attach for emergency bearer services in WB-S1 mode.

If the MME does not support an attach for emergency bearer services, the MME shall reject any request to attach with an attach type set to "EPS emergency attach".

If the MUSIM UE initiates the attach procedure and sets the attach type to "EPS emergency attach" in the ATTACH REQUEST message, the network shall not indicate the support of:

– the NAS signalling connection release;

– the paging indication for voice services;

– the reject paging request;

– the paging restriction; or

– the paging timing collision control;

in the ATTACH ACCEPT message.

The lower layers may indicate to NAS whether the network supports access to RLOS (3GPP TS 36.331 [22]). This information is taken into account when deciding whether to initiate attach for access to RLOS in WB-S1 mode.

With a successful attach procedure, a context is established for the UE in the MME. Furthermore, if the UE requested PDN connectivity, a default bearer is established between the UE and the PDN GW, thus enabling always-on IP connectivity to the UE. In WB-S1 mode, the network may also initiate the activation of dedicated bearers as part of the attach procedure. In NB-S1 mode the network shall not initiate the activation of dedicated bearers.

With a successful attach procedure in NB-S1 mode, a context is established for the UE in the MME. If the attach request included information to request PDN connectivity, a default bearer is also established between the UE and the PDN.

If EMM-REGISTERED without PDN connection is supported by the UE and the MME, a default bearer need not be requested by the UE during the attach procedure. If EMM-REGISTERED without PDN connection is not supported by the UE or the MME, then the UE shall request establishment of a default bearer.

During the attach procedure with default bearer establishment, the UE may also obtain the home agent IPv4 or IPv6 address or both.

In a shared network, the UE shall choose one of the PLMN identities as specified in 3GPP TS 23.122 [6]. The UE shall construct the TAI of the cell from this chosen PLMN identity and the TAC received for this PLMN identity as part of the broadcast system information. The chosen PLMN identity shall be indicated to the E-UTRAN (see 3GPP TS 36.331 [22]). Whenever an ATTACH REJECT message with the EMM cause #11 "PLMN not allowed" is received by the UE, the chosen PLMN identity shall be stored in the "forbidden PLMN list" and if the UE is configured to use timer T3245 (see 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17]) then the UE shall start timer T3245 and proceed as described in clause 5.3.7a. Whenever an ATTACH REJECT message with the EMM cause #14 "EPS services not allowed in this PLMN" is received by the UE, the chosen PLMN identity shall be stored in the "forbidden PLMNs for GPRS service" and if the UE is configured to use timer T3245 (see 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17]) then the UE shall start timer T3245 and proceed as described in clause 5.3.7a. Whenever an ATTACH REJECT message is received by the UE with the EMM cause #12 "tracking area not allowed", #13 "roaming not allowed in this tracking area", or #15 "no suitable cells in tracking area", the constructed TAI shall be stored in the suitable list.

An attach attempt counter is used to limit the number of subsequently rejected attach attempts. The attach attempt counter shall be incremented as specified in clause 5.5.1.2.6. Depending on the value of the attach attempt counter, specific actions shall be performed. The attach attempt counter shall be reset when:

– the UE is powered on;

– a USIM is inserted;

– an attach or combined attach procedure is successfully completed;

NOTE: The attach procedure can be initiated in S1 or S101 mode as described in clause 5.5.1.

– a GPRS attach or combined GPRS attach procedure is successfully completed in A/Gb or Iu mode;

– a registration procedure for initial registration performed over 3GPP access is successfully completed in N1 mode and the UE is operating in single-registration mode;

– a combined attach procedure is completed for EPS services only with cause #2, #16, #17, #18 or #22;

– an attach or combined attach procedure is rejected with cause #11, #12, #13, #14, #15, #25 or #35:

– a network initiated detach procedure is completed with cause #11, #12, #13, #14, #15 or #25; or

– a new PLMN is selected.

Additionally the attach attempt counter shall be reset when the UE is in substate EMM-DEREGISTERED.ATTEMPTING-TO-ATTACH and:

– a new tracking area is entered;

– timer T3402 expires; or

– timer T3346 is started.

5.5.1.2 Attach procedure for EPS services

5.5.1.2.1 General

This procedure can be used by a UE to attach for:

– EPS services only; or

– EPS services and "SMS only" if the UE supports NB-S1 mode only.

When the UE initiates the attach procedure for normal service, the UE shall indicate "EPS attach" in the EPS attach type IE.

When the UE initiates the attach procedure for emergency bearer services, the UE shall indicate "EPS emergency attach" in the EPS attach type IE. The attach procedure for emergency bearer services is not applicable for NB-S1 mode (see 3GPP TS 23.401 [10]).

This procedure can also be used by a UE in limited service state to attach for access to RLOS.

When the UE initiates the attach procedure for access to RLOS, the UE shall indicate "EPS RLOS attach" in the EPS attach type IE. The attach procedure for access to RLOS is not applicable for NB-S1 mode (see 3GPP TS 23.401 [10]).

5.5.1.2.2 Attach procedure initiation

In state EMM-DEREGISTERED, the UE initiates the attach procedure by sending an ATTACH REQUEST message to the MME, starting timer T3410 and entering state EMM-REGISTERED-INITIATED (see example in figure 5.5.1.2.2.1). If timer T3402 is currently running, the UE shall stop timer T3402. If timer T3411 is currently running, the UE shall stop timer T3411.

The UE shall include the IMSI in the EPS mobile identity IE in the ATTACH REQUEST message if the selected PLMN is neither the registered PLMN nor in the list of equivalent PLMNs and:

a) the UE is configured for "AttachWithIMSI" as specified in 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17]; or

b) the UE is in NB-S1 mode.

For all other cases, the UE shall handle the EPS mobile identity IE in the ATTACH REQUEST message as follows:

a) if the UE operating in the single-registration mode is performing an inter-system change from N1 mode to S1 mode or the UE was previously registered in N1 mode before entering state 5GMM-DEREGISTERED and:

1) the UE has received the interworking without N26 interface indicator set to "interworking without N26 interface supported" from the network and:

i) if the UE holds a valid GUTI, the UE shall include the valid GUTI into the EPS mobile identity IE, include Old GUTI type IE with GUTI type set to "native GUTI" and include the UE status IE with a 5GMM registration status set to "UE is not in 5GMM-REGISTERED state".

ii) if the UE does not hold a valid GUTI, the UE shall include the IMSI in the EPS mobile identity IE; or

2) the UE has received the interworking without N26 interface indicator set to "interworking without N26 interface not supported" from the network and:

i) if the UE holds a valid native 5G-GUTI, the UE shall include a GUTI, mapped from the 5G-GUTI into the EPS mobile identity IE, include Old GUTI type IE with GUTI type set to "native GUTI" and include the UE status IE with a 5GMM registration status set to "UE is not in 5GMM-REGISTERED state";

ii) if the UE holds a valid GUTI and does not hold a valid 5G-GUTI, the UE shall indicate the GUTI in the EPS mobile identity IE and include Old GUTI type IE with GUTI type set to "native GUTI"; or

iii) if the UE holds neither a valid GUTI nor a valid 5G-GUTI, the UE shall include the IMSI in the EPS mobile identity IE; or

NOTE 1: The value of the EMM registration status included by the UE in the UE status IE is not used by the MME.

b) otherwise:

1) if the UE supports neither A/Gb mode nor Iu mode, the UE shall include in the ATTACH REQUEST message a valid GUTI together with the last visited registered TAI, if available. In addition, the UE shall include Old GUTI type IE with GUTI type set to "native GUTI". If there is no valid GUTI available, the UE shall include the IMSI in the ATTACH REQUEST message; or

2) If the UE supports A/Gb mode or Iu mode or both and:

i) if the TIN indicates "P-TMSI" and the UE holds a valid native P-TMSI and RAI, the UE shall map the P-TMSI and RAI into the EPS mobile identity IE, and include Old GUTI type IE with GUTI type set to "mapped GUTI". If a P-TMSI signature is associated with the P-TMSI, the UE shall include it in the Old P-TMSI signature IE. Additionally, if the UE holds a valid GUTI, the UE shall indicate the GUTI in the Additional GUTI IE;

NOTE 2: The mapping of the P-TMSI and the RAI to the GUTI is specified in 3GPP TS 23.003 [2].

ii) if the TIN indicates "GUTI" or "RAT-related TMSI" and the UE holds a valid GUTI, the UE shall indicate the GUTI in the EPS mobile identity IE, and include Old GUTI type IE with GUTI type set to "native GUTI";

iii) if the TIN is deleted and:

– the UE holds a valid GUTI, the UE shall indicate the GUTI in the EPS mobile identity IE, and include Old GUTI type IE with GUTI type set to "native GUTI";

– the UE does not hold a valid GUTI but holds a valid native P-TMSI and RAI, the UE shall map the P-TMSI and RAI into the EPS mobile identity IE, and include Old GUTI type IE with GUTI type set to "mapped GUTI". If a P-TMSI signature is associated with the P-TMSI, the UE shall include it in the Old P-TMSI signature IE; or

– the UE does not hold a valid GUTI, P-TMSI or RAI, the UE shall include the IMSI in the EPS mobile identity IE; or

iv) otherwise the UE shall include the IMSI in the EPS mobile identity IE.

If the UE is operating in the dual-registration mode and it is in 5GMM state 5GMM-REGISTERED, the UE shall include the UE status IE with the 5GMM registration status set to "UE is in 5GMM-REGISTERED state".

NOTE 3: The value of the EMM registration status included by the UE in the UE status IE is not used by the MME.

If the UE is attaching for emergency bearer services and does not hold a valid GUTI, P-TMSI or IMSI as described above, the IMEI shall be included in the EPS mobile identity IE.

If the UE in limited service state is attaching for access to RLOS and does not hold a valid GUTI, P-TMSI or IMSI as described above, the IMEI shall be included in the EPS mobile identity IE.

If the UE supports A/Gb mode or Iu mode or if the UE needs to indicate its UE specific DRX parameter to the network, the UE shall include the UE specific DRX parameter in the DRX parameter IE in the ATTACH REQUEST message. If the UE in NB-S1 mode needs to indicate the UE specific DRX parameter in NB-S1 mode to the network, it shall include the UE specific DRX parameter in NB-S1 mode in the DRX parameter in NB-S1 mode IE in the ATTACH REQUEST message.

If the UE supports eDRX and requests the use of eDRX, the UE shall include the extended DRX parameters IE in the ATTACH REQUEST message.

If the UE supports WUS assistance, then the UE shall set the WUSA bit to "WUS assistance supported" in the UE network capability IE, and if the UE is not attaching for emergency bearer services, the UE may include its UE paging probability information in the Requested WUS assistance information IE of the ATTACH REQUEST message.

If the UE supports SRVCC to GERAN/UTRAN, the UE shall set the SRVCC to GERAN/UTRAN capability bit to "SRVCC from UTRAN HSPA or E-UTRAN to GERAN/UTRAN supported".

If the UE supports vSRVCC from S1 mode to Iu mode, then the UE shall set the H.245 after handover capability bit to "H.245 after SRVCC handover capability supported" and additionally set the SRVCC to GERAN/UTRAN capability bit to "SRVCC from UTRAN HSPA or E-UTRAN to GERAN/UTRAN supported" in the ATTACH REQUEST message.

If the UE supports PSM and requests the use of PSM, then the UE shall include the T3324 value IE with a requested timer value in the ATTACH REQUEST message. When the UE includes the T3324 value IE and the UE indicates support for extended periodic timer value in the MS network feature support IE, it may also include the T3412 extended value IE to request a particular T3412 value to be allocated.

If the UE supports ProSe direct discovery, then the UE shall set the ProSe bit to "ProSe supported" and set the ProSe direct discovery bit to "ProSe direct discovery supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports ProSe direct communication, then the UE shall set the ProSe bit to "ProSe supported" and set the ProSe direct communication bit to "ProSe direct communication supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports acting as a ProSe UE-to-network relay, then the UE shall set the ProSe bit to "ProSe supported" and set the ProSe UE-to-network relay bit to "acting as a ProSe UE-to-network relay supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports NB-S1 mode, Non-IP or Ethernet PDN type, N1 mode, UAS services or if the UE supports DNS over (D)TLS (see 3GPP TS 33.501 [24]), then the UE shall support the extended protocol configuration options IE.

NOTE 4: Support of DNS over (D)TLS is based on the informative requirements as specified in 3GPP TS 33.501 [24].

If the UE supports the extended protocol configuration options IE, then the UE shall set the ePCO bit to "extended protocol configuration options supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports providing PDU session ID in the protocol configuration option IE or the extended protocol configuration option IE when its N1 mode capability is disabled, then the UE shall set the ePCO bit to "extended protocol configuration options supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports the restriction on use of enhanced coverage, then the UE shall set the RestrictEC bit to "Restriction on use of enhanced coverage supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports the control plane data back-off timer T3448, the UE shall set the CP backoff bit to "back-off timer for transport of user data via the control plane supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports EPS-UPIP, the UE shall set the EPS-UPIP bit to "EPS-UPIP supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE is in NB-S1 mode, then the UE shall set the Control plane CIoT EPS optimization bit to "Control plane CIoT EPS optimization supported" in the UE network capability IE of the ATTACH REQUEST message. If the UE is capable of NB-N1 mode, then the UE shall set the Control plane CIoT 5GS optimization bit to "Control plane CIoT 5GS optimization supported" in the N1 UE network capability IE of the ATTACH REQUEST message.

If the UE is in NB-S1 mode, supports NB-S1 mode only, and requests to attach for EPS services and "SMS only", the UE shall indicate the SMS only requested bit to "SMS only" in the additional update type IE and shall set the EPS attach type IE to "EPS attach" in the ATTACH REQUEST message.

If the UE supports CIoT EPS optimizations, it shall indicate in the UE network capability IE of the ATTACH REQUEST message whether it supports EMM-REGISTERED without PDN connection.

If the UE supports S1-U data transfer and multiple user plane radio bearers (see 3GPP TS 36.306 [44], 3GPP TS 36.331 [22]) in NB-S1 mode, then the UE shall set the Multiple DRB support bit to "Multiple DRB supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports control plane MT-EDT, then the UE shall set the CP-MT-EDT bit to "Control plane Mobile Terminated-Early Data Transmission supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports user plane MT-EDT, then the UE shall set the UP-MT-EDT bit to "User plane Mobile Terminated-Early Data Transmission supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports V2X communication over E-UTRA-PC5, then the UE shall set the V2X PC5 bit to "V2X communication over E-UTRA-PC5 supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports V2X communication over NR-PC5, then the UE shall set the V2X NR-PC5 bit to "V2X communication over NR-PC5 supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports service gap control, then the UE shall set the SGC bit to "service gap control supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports dual connectivity with New Radio (NR), then the UE shall set the DCNR bit to "dual connectivity with NR supported" in the UE network capability IE of the ATTACH REQUEST message and shall include the UE additional security capability IE in the ATTACH REQUEST message.

If the UE supports N1 mode for 3GPP access, the UE shall set the N1mode bit to "N1 mode for 3GPP access supported" in the UE network capability IE of the ATTACH REQUEST message and shall include the UE additional security capability IE in the ATTACH REQUEST message.

If the UE supports signalling for a maximum number of 15 EPS bearer contexts, then the UE shall set the 15 bearers bit to "Signalling for a maximum number of 15 EPS bearer contexts supported" in the UE network capability IE of the ATTACH REQUEST message.

If the MUSIM UE supports the NAS signalling connection release, then the UE shall set the NAS signalling connection release bit to "NAS signalling connection release supported" in the UE network capability IE of the ATTACH REQUEST message otherwise the UE shall not set the NAS signalling connection release bit to "NAS signalling connection release supported" in the UE network capability IE of the ATTACH REQUEST message.

If the MUSIM UE supports the paging indication for voice services, then the UE shall set the paging indication for voice services bit to "paging indication for voice services supported" in the UE network capability IE of the ATTACH REQUEST message otherwise the UE shall not set the paging indication for voice services bit to "paging indication for voice services supported" in the UE network capability IE of the ATTACH REQUEST message.

If the MUSIM UE supports the reject paging request, then the UE shall set the reject paging request bit to "reject paging request supported" in the UE network capability IE of the ATTACH REQUEST message otherwise the UE shall not set the reject paging request bit to "reject paging request supported" in the UE network capability IE of the ATTACH REQUEST message.

If the MUSIM UE sets:

– the reject paging request bit to "reject paging request supported";

– the NAS signalling connection release bit to "NAS signalling connection release supported"; or

– both of them;

and supports the paging restriction, then the UE shall set the paging restriction bit to "paging restriction supported" in the UE network capability IE of the ATTACH REQUEST message otherwise the UE shall not set the paging restriction bit to "paging restriction supported" in the UE network capability IE of the ATTACH REQUEST message.

If the MUSIM UE supports the paging timing collision control, then the UE shall set the paging timing collision control bit to "paging timing collision control supported" in the UE network capability IE of the ATTACH REQUEST message otherwise the UE shall not set the paging timing collision control bit to "paging timing collision control supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports ciphered broadcast assistance data and needs to obtain new ciphering keys, the UE shall include the Additional information requested IE with the CipherKey bit set to "ciphering keys for ciphered broadcast assistance data requested" in the ATTACH REQUEST message.

For MUSIM UE if the UE needs to indicate an IMSI offset value to the network, the UE shall include the IMSI offset value in the Requested IMSI offset IE in the ATTACH REQUEST message.

If EMM-REGISTERED without PDN connection is not supported by the UE or the MME, or if the UE wants to request PDN connection with the attach procedure, the UE shall send the ATTACH REQUEST message together with a PDN CONNECTIVITY REQUEST message contained in the ESM message container IE.

If EMM-REGISTERED without PDN connection is supported by the UE and the MME, and the UE does not want to request PDN connection with the attach procedure, the UE shall send the ATTACH REQUEST message together with an ESM DUMMY MESSAGE contained in the ESM message container information element.

In WB-S1 mode, if the UE supports RACS, the UE shall:

a) set the RACS bit to "RACS supported" in the UE network capability IE of the ATTACH REQUEST message; and

b) if the UE has an applicable UE radio capability ID for the current UE radio configuration in the selected PLMN, set the URCIDA bit to "UE radio capability ID available" in the UE radio capability ID availability IE of the ATTACH REQUEST message.

If the attach procedure is initiated following an inter-system change from N1 mode to S1 mode in EMM-IDLE mode or the UE which was previously registered in N1 mode before entering state 5GMM-DEREGISTERED initiates the attach procedure:

a) if the UE has received an "interworking without N26 interface not supported" indication from the network and a valid 5G NAS security context exists in the UE, the UE shall integrity protect the ATTACH REQUEST message combined with the message included in the ESM message container IE using the 5G NAS security context;

b) otherwise:

1) if a valid EPS security context exists, the UE shall integrity protect the ATTACH REQUEST message combined with the message included in the ESM message container IE using the EPS security context; or

2) if the UE does not have a valid EPS security context, the ATTACH REQUEST message combined with the message included in the ESM message container IE is not integrity protected.

Figure 5.5.1.2.2.1: Attach procedure and combined attach procedure

5.5.1.2.3 EMM common procedure initiation

The network may initiate EMM common procedures, e.g. the identification, authentication and security mode control procedures during the attach procedure, depending on the information received in the ATTACH REQUEST message (e.g. IMSI, GUTI and KSI).

If the network receives an ATTACH REQUEST message containing the Old GUTI type IE and the EPS mobile identity IE with type of identity indicating "GUTI", and the network does not follow the use of the most significant bit of the <MME group id> as specified in 3GPP TS 23.003 [2], clause 2.8.2.2.2, the network shall use the Old GUTI type IE to determine whether the mobile identity included in the EPS mobile identity IE is a native GUTI or a mapped GUTI.

During an attach for emergency bearer services or an attach for access to RLOS, the MME may choose to skip the authentication procedure even if no EPS security context is available and proceed directly to the execution of the security mode control procedure as specified in clause 5.4.3.

5.5.1.2.4 Attach accepted by the network

During an attach for emergency bearer services, if not restricted by local regulations, the MME shall not check for mobility and access restrictions, regional restrictions, subscription restrictions, or perform CSG access control when processing the ATTACH REQUEST message. The network shall not apply subscribed APN based congestion control during an attach procedure for emergency bearer services.

During an attach for access to RLOS, the MME shall not check for access restrictions, regional restrictions and subscription restrictions when processing the ATTACH REQUEST message.

If the attach request is accepted by the network, the MME shall send an ATTACH ACCEPT message to the UE and start timer T3450.

If the attach request included the PDN CONNECTIVITY REQUEST message in the ESM message container information element to request PDN connectivity, the MME when accepting the attach request shall:

– send the ATTACH ACCEPT message together with an ESM DUMMY MESSAGE contained in the ESM message container information element and discard the ESM message container information element included in the attach request if:

– the UE indicated support of EMM-REGISTERED without PDN connection in the UE network capability IE of the ATTACH REQUEST message;

– the MME supports EMM-REGISTERED without PDN connection and PDN connection is restricted according to the user’s subscription data;

– the attach type is not set to "EPS emergency attach" or "EPS RLOS attach"; and

– the request type of the UE requested PDN connection is not set to "handover of emergency bearer services", "emergency" or "RLOS";

– otherwise, send the ATTACH ACCEPT message together with an ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message contained in the ESM message container information element to activate the default bearer (see clause 6.4.1). In WB-S1 mode, the network may also initiate the activation of dedicated bearers towards the UE by invoking the dedicated EPS bearer context activation procedure (see clause 6.4.2). In NB-S1 mode the network shall not initiate the activation of dedicated bearers.

If EMM-REGISTERED without PDN connection is supported by the UE and the MME, and the UE included an ESM DUMMY MESSAGE in the ESM message container information element of the ATTACH REQUEST message, the MME shall send the ATTACH ACCEPT message together with an ESM DUMMY MESSAGE contained in the ESM message container information element.

If the attach request is accepted by the network, the MME shall delete the stored UE radio capability information or the UE radio capability ID, if any.

In NB-S1 mode, if the attach request is accepted by the network, the MME shall set the EMC BS bit to zero in the EPS network feature support IE included in the ATTACH ACCEPT message to indicate that support of emergency bearer services in NB-S1 mode is not available.

If the UE has included the UE network capability IE or the MS network capability IE or both in the ATTACH REQUEST message, the MME shall store all octets received from the UE, up to the maximum length defined for the respective information element.

NOTE 1: This information is forwarded to the new MME during inter-MME handover or to the new SGSN during inter-system handover to A/Gb mode or Iu mode.

NOTE 2: For further details concerning the handling of the MS network capability and UE network capability in the MME see also 3GPP TS 23.401 [10].

If the UE specific DRX parameter was included in the DRX Parameter IE in the ATTACH REQUEST message, the MME shall replace any stored UE specific DRX parameter with the received parameter and use it for the downlink transfer of signalling and user data in WB-S1 mode.

In NB-S1 mode, if the DRX parameter in NB-S1 mode IE was included in the ATTACH REQUEST message, the MME shall provide to the UE the Negotiated DRX parameter in NB-S1 mode IE in the ATTACH ACCEPT message. The MME shall replace any stored UE specific DRX parameter in NB-S1 mode with the negotiated DRX parameter and use it for the downlink transfer of signalling and user data in NB-S1 mode.

NOTE 3: In NB-S1 mode, if a DRX parameter was included in the Negotiated DRX parameter in NB-S1 mode IE in the ATTACH ACCEPT message, then the UE stores and uses the received DRX parameter in NB-S1 mode (see 3GPP TS 36.304 [21]). If the UE did not receive a DRX parameter in the Negotiated DRX parameter in NB-S1 mode IE, or if the Negotiated DRX parameter in NB-S1 mode IE was not included in the ATTACH ACCEPT message, then the UE uses the cell specific DRX value in NB-S1 mode (see 3GPP TS 36.304 [21]).

In NB-S1 mode, if the UE requested "SMS only" in the Additional update type IE, supports NB-S1 mode only and the MME decides to accept the attach request for EPS services and "SMS only", the MME shall indicate "SMS only" in the Additional update result IE and shall set the EPS attach result IE to "EPS only" in the ATTACH ACCEPT message.

The MME shall include the extended DRX parameters IE in the ATTACH ACCEPT message only if the extended DRX parameters IE was included in the ATTACH REQUEST message, and the MME supports and accepts the use of eDRX.

– the UE supports WUS assistance; and

– the MME supports and accepts the use of WUS assistance,

then the MME shall determine the negotiated UE paging probability information for the UE, store it in the EMM context of the UE, and if the UE is not attaching for emergency bearer services, the MME shall include it in the Negotiated WUS assistance information IE in the ATTACH ACCEPT message. The MME may take into account the UE paging probability information received in the Requested WUS assistance information IE when determining the negotiated UE paging probability information for the UE.

NOTE 4: Besides the UE paging probability information requested by the UE, the MME can take local configuration or previous statistical information for the UE into account when determining the negotiated UE paging probability information for the UE (see 3GPP TS 23.401 [10]).

The MME shall assign and include the TAI list the UE is registered to in the ATTACH ACCEPT message. The MME shall not assign a TAI list containing both tracking areas in NB-S1 mode and tracking areas in WB-S1 mode. The UE, upon receiving an ATTACH ACCEPT message, shall delete its old TAI list and store the received TAI list.

NOTE 5: When assigning the TAI list, the MME can take into account the eNodeB’s capability of support of CIoT EPS optimization.

The MME may include T3412 extended value IE in the ATTACH ACCEPT message only if the UE indicates support of the extended periodic timer T3412 in the MS network feature support IE in the ATTACH REQUEST message.

The MME shall include the T3324 value IE in the ATTACH ACCEPT message only if the T3324 value IE was included in the ATTACH REQUEST message, and the MME supports and accepts the use of PSM.

If the MME supports and accepts the use of PSM, and the UE included the T3412 extended value IE in the ATTACH REQUEST message, then the MME shall take into account the T3412 value requested when providing the T3412 value IE and the T3412 extended value IE in the ATTACH ACCEPT message.

NOTE 6: Besides the value requested by the UE, the MME can take local configuration or subscription data provided by the HSS into account when selecting a value for T3412 (3GPP TS 23.401 [10] clause 4.3.17.3).

If the UE indicates support for EMM-REGISTERED without PDN connection in the ATTACH REQUEST message and the MME supports EMM-REGISTERED without PDN connection, the MME shall indicate support for EMM-REGISTERED without PDN connection in the EPS network feature support IE of the ATTACH ACCEPT message. The UE and the MME shall use the information whether the peer entity supports EMM-REGISTERED without PDN connection as specified in the present clause 5 and in clause 6.

If the UE requests "control plane CIoT EPS optimization" in the Additional update type IE, indicates support of control plane CIoT EPS optimization in the UE network capability IE and the MME decides to accept the requested CIoT EPS optimization and the attach request, the MME shall indicate "control plane CIoT EPS optimization supported" in the EPS network feature support IE.

If the MME supports NB-S1 mode, non-IP or Ethernet PDN type, inter-system change with 5GS, UAS services or the network wants to enforce the use of DNS over (D)TLS (see 3GPP TS 33.501 [24]), then the MME shall support the extended protocol configuration options IE.

NOTE 7: Support of DNS over (D)TLS is based on the informative requirements as specified in 3GPP TS 33.401 [19] and it is implemented based on the operator requirement.

If the MME supports the extended protocol configuration options IE and the UE indicated support of the extended protocol configuration options IE, then the MME shall set the ePCO bit to "extended protocol configuration options supported" in the EPS network feature support IE of the ATTACH ACCEPT message.

If the UE indicates support for restriction on use of enhanced coverage in the ATTACH REQUEST message, and the network decides to restrict the use of enhanced coverage for the UE, then the MME shall set the RestrictEC bit to "Use of enhanced coverage is restricted" in the EPS network feature support IE of the ATTACH ACCEPT message.

If the UE has indicated support for the control plane data back-off timer, and the MME decides to activate the congestion control for transport of user data via the control plane, then the MME shall include the T3448 value IE in the ATTACH ACCEPT message.

If the UE indicates support for dual connectivity with NR in the ATTACH REQUEST message, and the MME decides to restrict the use of dual connectivity with NR for the UE, then the MME shall set the RestrictDCNR bit to "Use of dual connectivity with NR is restricted" in the EPS network feature support IE of the ATTACH ACCEPT message.

If the UE indicates support for N1 mode in the ATTACH REQUEST message and the MME supports inter-system interworking with 5GS, the MME may set the IWK N26 bit to either:

– "interworking without N26 interface not supported" if the MME supports N26 interface; or

– "interworking without N26 interface supported" if the MME does not support N26 interface

in the EPS network feature support IE in the ATTACH ACCEPT message.

If the UE requests ciphering keys for ciphered broadcast assistance data in the ATTACH REQUEST message and the MME has valid ciphering key data applicable to the UE’s subscription, then the MME shall include the ciphering key data in the Ciphering key data IE of the ATTACH ACCEPT message.

If the UE indicates support of the NAS signalling connection release in the ATTACH REQUEST message and the network decides to accept the NAS signalling connection release, then the MME shall set the NAS signalling connection release bit to "NAS signalling connection release supported" in the EPS network feature support IE of the ATTACH ACCEPT message.

If the UE indicates support of the paging indication for voice services in the ATTACH REQUEST message and the network decides to accept the paging indication for voice services, then the MME shall set the paging indication for voice services bit to "paging indication for voice services supported" in the EPS network feature support IE of the ATTACH ACCEPT message. Upon receipt of ATTACH ACCEPT message with the paging indication for voice services bit set to "paging indication for voice services supported", the UE NAS layer informs the lower layers that paging indication for voice services is supported. Otherwise, the UE NAS layer informs the lower layers that paging indication for voice services is not supported.

If the UE indicates support of the reject paging request in the ATTACH REQUEST message and the network decides to accept the reject paging request, then the MME shall set the reject paging request bit to "reject paging request supported" in the EPS network feature support IE of the ATTACH ACCEPT message.

If the UE indicates support of the paging restriction in the ATTACH REQUEST message, and the MME sets:

– the reject paging request bit to "reject paging request supported";

– the NAS signalling connection release bit to "NAS signalling connection release supported"; or

– both of them;

in the EPS network feature support IE of the ATTACH ACCEPT message, and the network decides to accept the paging restriction, then the MME shall set the paging restriction bit to "paging restriction supported" in the EPS network feature support IE of the ATTACH ACCEPT message.

If the UE indicates support of the paging timing collision control in the ATTACH REQUEST message and the network decides to accept the paging timing collision control, then the MME shall set the paging timing collision control bit to "paging timing collision control supported" in the EPS network feature support IE of the ATTACH ACCEPT message.

If the MUSIM UE has included a Requested IMSI offset IE in the ATTACH REQUEST message and if the MME supports paging timing collision control, the MME shall include the Negotiated IMSI offset IE in the ATTACH ACCEPT message, and the MME shall set the IMSI offset value to:

– A value that is different than what the UE has provided, if the MME has a different value; or

– A value that is same as what the UE has provided, if the MME does not have a different value;

and the MME shall calculate an alternative IMSI value using the IMSI offset value and store it in the UE context as specified in 3GPP TS 23.401 [10]. The alternative IMSI value is used for deriving the paging occasion as specified in 3GPP TS 36.304 [21].

If the MUSIM UE has not included a Requested IMSI offset IE in the ATTACH REQUEST message, the MME shall erase any stored alternative IMSI value for that UE, if available.

If due to operator policies unsecured redirection to a GERAN cell is not allowed in the current PLMN, the MME shall set the redir-policy bit to "Unsecured redirection to GERAN not allowed" in the Network policy IE of the ATTACH ACCEPT message.

The MME may include the T3447 value IE set to the service gap time value in the ATTACH ACCEPT message if:

– the UE has indicated support for service gap control; and

– a service gap time value is available in the EMM context.

If the network supports signalling for a maximum number of 15 EPS bearer contexts and the UE indicated support of signalling for a maximum number of 15 EPS bearer contexts in the ATTACH REQUEST message, then the MME shall set the 15 bearers bit to "Signalling for a maximum number of 15 EPS bearer contexts supported" in the EPS network feature support IE of the ATTACH ACCEPT message.

Upon receiving the ATTACH ACCEPT message, the UE shall stop timer T3410.

The GUTI reallocation may be part of the attach procedure. When the ATTACH REQUEST message includes the IMSI or IMEI, or the MME considers the GUTI provided by the UE is invalid, or the GUTI provided by the UE was assigned by another MME, the MME shall allocate a new GUTI to the UE. The MME shall include in the ATTACH ACCEPT message the new assigned GUTI together with the assigned TAI list. In this case the MME shall enter state EMM-COMMON-PROCEDURE-INITIATED as described in clause 5.4.1.

For a shared network, the TAIs included in the TAI list can contain different PLMN identities. The MME indicates the selected core network operator PLMN identity to the UE in the GUTI (see 3GPP TS 23.251 [8B]).

If the ATTACH ACCEPT message contains a GUTI, the UE shall use this GUTI as the new temporary identity. The UE shall delete its old GUTI and store the new assigned GUTI. If no GUTI has been included by the MME in the ATTACH ACCEPT message, the old GUTI, if any available, shall be kept.

If A/Gb mode or Iu mode is supported in the UE, the UE shall set its TIN to "GUTI" when receiving the ATTACH ACCEPT message.

If the ATTACH ACCEPT message contains the T3412 extended value IE, then the UE shall use the value in T3412 extended value IE as periodic tracking area update timer (T3412). If the ATTACH ACCEPT message does not contain T3412 extended value IE, then the UE shall use the value in T3412 value IE as periodic tracking area update timer (T3412).

If the ATTACH ACCEPT message contains the T3324 value IE, then the UE shall use the included timer value for T3324 as specified in 3GPP TS 24.008 [13], clause 4.7.2.8.

If the ATTACH ACCEPT message contains the DCN-ID IE, then the UE shall store the included DCN-ID value together with the PLMN code of the registered PLMN in a DCN-ID list in a non-volatile memory in the ME as specified in annex C.

If the ATTACH ACCEPT message contains Negotiated IMSI offset IE, the MUSIM UE shall forward the IMSI offset value to lower layers. If the ATTACH ACCEPT message does not contain Negotiated IMSI offset IE, the MUSIM UE shall indicate to lower layers to erase any IMSI offset value, if available.

The MME may also include a list of equivalent PLMNs in the ATTACH ACCEPT message. Each entry in the list contains a PLMN code (MCC+MNC). The UE shall store the list as provided by the network, and if the attach procedure is neither for emergency bearer services nor for access to RLOS, the UE shall remove from the list any PLMN code that is already in the list of "forbidden PLMNs" or in the list of "forbidden PLMNs for GPRS service". In addition, the UE shall add to the stored list the PLMN code of the registered PLMN that sent the list. The UE shall replace the stored list on each receipt of the ATTACH ACCEPT message. If the ATTACH ACCEPT message does not contain a list, then the UE shall delete the stored list.

If the MME received the list of TAIs from the satellite E-UTRAN as described in 3GPP TS 23.401 [10], and determines that any but not all TAIs in the received list of TAIs is forbidden for roaming or for regional provision of service as per operator’s choice, the MME shall include the TAI(s) in:

a) the Forbidden TAI(s) for the list of "Forbidden tracking areas for roaming" IE;

b) the Forbidden TAI(s) for the list of "Forbidden tracking areas for regional provision of service" IE; or

c) both;

in the ATTACH ACCEPT message.

NOTE 8: "Forbidden tracking areas for roaming" corresponds to cause values #13 and #15, and "Forbidden tracking areas for regional provision of service" corresponds to cause value #12.

If the attach procedure is neither for emergency bearer services nor for access to RLOS, and if the PLMN identity of the registered PLMN is a member of the list of "forbidden PLMNs" or the list of "forbidden PLMNs for GPRS service", any such PLMN identity shall be deleted from the corresponding list(s).

The network informs the UE about the support of specific features, such as IMS voice over PS session, location services (EPC-LCS, CS-LCS), emergency bearer services, or CIoT EPS optimizations, in the EPS network feature support information element. In a UE with IMS voice over PS capability, the IMS voice over PS session indicator and the emergency bearer services indicator shall be provided to the upper layers. The upper layers take the IMS voice over PS session indicator into account as specified in 3GPP TS 23.221 [8A], clause 7.2a and clause 7.2b, when selecting the access domain for voice sessions or calls. When initiating an emergency call, the upper layers also take both the IMS voice over PS session indicator and the emergency bearer services indicator into account for the access domain selection. In a UE with LCS capability, location services indicators (EPC-LCS, CS-LCS) shall be provided to the upper layers. When MO-LR procedure is triggered by the UE’s application, those indicators are taken into account as specified in 3GPP TS 24.171 [13C].

If the RestrictDCNR bit is set to "Use of dual connectivity with NR is restricted" in the EPS network feature support IE of the ATTACH ACCEPT message, the UE shall provide the indication that dual connectivity with NR is restricted to the upper layers.

The UE supporting N1 mode shall operate in the mode for inter-system interworking with 5GS as follows:

– if the IWK N26 bit in the EPS network feature support IE is set to "interworking without N26 interface not supported", the UE shall operate in single-registration mode;

– if the IWK N26 bit in the EPS network feature support IE is set to "interworking without N26 interface supported" and the UE supports dual-registration mode, the UE may operate in dual-registration mode; or

NOTE 9: The registration mode used by the UE is implementation dependent.

– if the IWK N26 bit in the EPS network feature support IE is set to "interworking without N26 interface supported" and the UE only supports single-registration mode, the UE shall operate in single-registration mode.

The UE shall treat the interworking without N26 interface indicator as valid in the entire PLMN and equivalent PLMNs. The interworking procedures required for coordination between 5GMM and EMM without N26 interface are specified in 3GPP TS 24.501 [54].

If the redir-policy bit is set to "Unsecured redirection to GERAN not allowed" in the Network policy IE of the ATTACH ACCEPT message, the UE shall set the network policy on unsecured redirection to GERAN for the current PLMN to "Unsecured redirection to GERAN not allowed" and indicate to the lower layers that unsecured redirection to a GERAN cell is not allowed. If the redir-policy bit is set to "Unsecured redirection to GERAN allowed" or if the Network policy IE is not included in the ATTACH ACCEPT message, the UE shall set the network policy for the current PLMN to "Unsecured redirection to GERAN allowed" and indicate to the lower layers that unsecured redirection to a GERAN cell is allowed. The UE shall set the network policy on unsecured redirection to GERAN to "Unsecured redirection to GERAN not allowed" and indicate this to the lower layers when any of the following events occurs:

– the UE initiates an EPS attach or tracking area updating procedure in a PLMN different from the PLMN where the UE performed the last successful EPS attach or tracking area updating procedure;

– the UE is switched on; or

– the UICC containing the USIM is removed.

If the UE has initiated the attach procedure due to manual CSG selection and receives an ATTACH ACCEPT message; and the UE sent the ATTACH REQUEST message in a CSG cell, the UE shall check if the CSG ID and associated PLMN identity of the cell are contained in the Allowed CSG list. If not, the UE shall add that CSG ID and associated PLMN identity to the Allowed CSG list and the UE may add the HNB Name (if provided by lower layers) to the Allowed CSG list if the HNB Name is present in neither the Operator CSG list nor the Allowed CSG list.

When the UE receives the ATTACH ACCEPT message combined with the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message, and if the UE has requested PDN connectivity the UE shall forward the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message to the ESM sublayer. Upon receipt of an indication from the ESM sublayer that the default EPS bearer context has been activated, the UE shall send an ATTACH COMPLETE message together with an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message contained in the ESM message container information element to the network.

Additionally, the UE shall reset the attach attempt counter, enter state EMM-REGISTERED, and set the EPS update status to EU1 UPDATED.

If EMM-REGISTERED without PDN connection is supported by the UE and the MME, and the UE receives the ATTACH ACCEPT message combined with an ESM DUMMY MESSAGE, the UE shall send an ATTACH COMPLETE message together with an ESM DUMMY MESSAGE contained in the ESM message container information element to the network.

If the UE receives the ATTACH ACCEPT message from a PLMN for which a PLMN-specific attempt counter or PLMN-specific PS-attempt counter is maintained (see clause 5.3.7b), then the UE shall reset these counters. If the UE maintains a counter for "SIM/USIM considered invalid for GPRS services", then the UE shall reset this counter.

When the UE receives any ACTIVATE DEDICATED EPS BEARER CONTEXT REQUEST messages during the attach procedure, and if the UE has requested PDN connectivity the UE shall forward the ACTIVATE DEDICATED EPS BEARER CONTEXT REQUEST message(s) to the ESM sublayer. The UE shall send a response to the ACTIVATE DEDICATED EPS BEARER CONTEXT REQUEST message(s) after successful completion of the attach procedure.

If the attach procedure was initiated in S101 mode, the lower layers are informed about the successful completion of the procedure.

Upon receiving an ATTACH COMPLETE message, the MME shall stop timer T3450, enter state EMM-REGISTERED and consider the GUTI sent in the ATTACH ACCEPT message as valid.

If the T3448 value IE is present in the received ATTACH ACCEPT message, the UE shall:

– stop timer T3448 if it is running; and

– start timer T3448 with the value provided in the T3448 value IE.

If the UE is using EPS services with control plane CIoT EPS optimization, the T3448 value IE is present in the ATTACH ACCEPT message and the value indicates that this timer is either zero or deactivated, the UE shall consider this case as an abnormal case and proceed as if the T3448 value IE is not present.

If the UE has indicated "service gap control supported" in the ATTACH REQUEST message and:

– the ATTACH ACCEPT message contains the T3447 value IE, then the UE shall store the new T3447 value, erase any previous stored T3447 value if exists and use the new T3447 value with the T3447 timer next time it is started; or

– the ATTACH ACCEPT message does not contain the T3447 value IE, then the UE shall erase any previous stored T3447 value if exists and stop the T3447 timer if running.

In WB-S1 mode, if the UE has set the RACS bit to "RACS supported" in the UE network capability IE of the ATTACH REQUEST message, the MME may include a UE radio capability ID IE or a UE radio capability ID deletion indication IE in the ATTACH ACCEPT message.

In WB-S1 mode, if the UE has set the RACS bit to "RACS supported" in the UE network capability IE of the ATTACH REQUEST message and the ATTACH ACCEPT message includes:

– a UE radio capability ID deletion indication IE set to "Network-assigned UE radio capability IDs deletion requested", the UE shall delete any network-assigned UE radio capability IDs associated with the registered PLMN stored at the UE, then the UE shall, after the completion of the ongoing attach procedure, initiate a tracking area updating procedure as specified in clause 5.5.3 over the existing NAS signalling connection; or

– a UE radio capability ID IE, the UE shall store the UE radio capability ID as specified in annex C.

If the UE receives the Forbidden TAI(s) for the list of "forbidden tracking areas for roaming" IE in the ATTACH ACCEPT message and the TAI(s) included in the IE is not part of the list of "forbidden tracking areas for roaming", the UE shall store the TAI(s) included in the IE into the list of "forbidden tracking areas for roaming".

If the UE receives the Forbidden TAI(s) for the list of "forbidden tracking areas for regional provision of service" IE in the ATTACH ACCEPT message and the TAI(s) included in the IE is not part of the list of "forbidden tracking areas for regional provision of service", the UE shall store the TAI(s) included in the IE into the list of "forbidden tracking areas for regional provision of service".

5.5.1.2.4A Attach successful for EPS services and not accepted for SMS services

Apart from the actions on the tracking area updating attempt counter, the description for attach for EPS services as specified in clause 5.5.1.2.4 shall be followed. In addition, the following description for attach for SMS services applies.

In NB-S1 mode, if the UE requested "SMS only" in the Additional update type IE and supports NB-S1 mode only, the MME decides to accept the attach request for EPS services only and:

– the location update for non-EPS services is not accepted by the VLR as specified in 3GPP TS 29.118 [16A]; or

– the MME decides to not accept the attach request for "SMS only",

the MME shall set the EPS attach result IE to "EPS only", shall not indicate "SMS only" in the Additional update result IE in the ATTACH ACCEPT message and shall include an appropriate SMS services status value.

The UE receiving the ATTACH ACCEPT message takes one of the following actions depending on the value included in the SMS services status IE:

"SMS services not available"

The UE shall stop timer T3410 if still running, shall reset the tracking area updating attempt counter, shall set the EPS update status to EU1 UPDATED and shall enter state EMM-REGISTERED.NORMAL-SERVICE. The USIM shall be considered as invalid for SMS services until switching off or the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.7a.

"SMS services not available in this PLMN"

The UE may provide a notification to the user or the upper layers that the SMS services are not available.

The UE shall not attempt normal attach or tracking area updating procedures indicating "SMS only" with current PLMN until switching off the UE or the UICC containing the USIM is removed. Additionally, the UE may perform a PLMN selection according to 3GPP TS 23.122 [6].

"Network failure"

The UE shall stop timer T3410 if still running. The tracking area updating attempt counter shall be incremented, unless it was already set to 5.

If the tracking area updating attempt counter is less than 5:

– the UE shall start timer T3411, shall set the EPS update status to EU1 UPDATED and shall enter state EMM-REGISTERED.NORMAL-SERVICE. When timer T3411 expires the normal tracking area updating procedure for EPS services and "SMS only" or the combined tracking area updating procedure for EPS services and "SMS only" is triggered.

If the tracking area updating attempt counter is equal to 5:

– the UE shall start timer T3402, shall set the EPS update status to EU1 UPDATED and shall enter state EMM-REGISTERED.NORMAL-SERVICE. When timer T3402 expires the normal tracking area updating procedure for EPS services and "SMS only" or the combined tracking area updating procedure for EPS services and "SMS only" is triggered.

"Congestion"

The UE shall stop the timer T3410 if still running. The tracking area updating attempt counter shall be set to 5. The UE shall start the timer T3402, shall set the EPS update status to EU1 UPDATED, and shall enter state EMM-REGISTERED.NORMAL-SERVICE. When timer T3402 expires the normal tracking area updating procedure for EPS services and "SMS only" or the combined tracking area updating procedure for EPS services and "SMS only" is triggered.

Other values are considered as abnormal cases. The attach procedure shall be considered as failed for SMS services. The behaviour of the UE in those cases is specified in clause 5.5.1.2.6A.

5.5.1.2.5 Attach not accepted by the network

If the attach request cannot be accepted by the network, the MME shall send an ATTACH REJECT message to the UE including an appropriate EMM cause value.

If EMM-REGISTERED without PDN connection is not supported by the UE or the MME, the attach request included a PDN CONNECTIVITY REQUEST message, the attach procedure fails due to:

– a default EPS bearer setup failure;

– an ESM procedure failure; or

– operator determined barring is applied on default EPS bearer context activation during attach procedure,

the MME shall:

– combine the ATTACH REJECT message with a PDN CONNECTIVITY REJECT message contained in the ESM message container information element. In this case the EMM cause value in the ATTACH REJECT message shall be set to #19 "ESM failure"; or

– send the ATTACH REJECT message with the EMM cause set to #15 "No suitable cells in tracking area", if the PDN connectivity reject is due to ESM cause #29 subject to operator policies (see 3GPP TS 29.274 [16D] for further details). In this case, the network may additionally include the Extended EMM cause IE with value "E-UTRAN not allowed".

If the attach request is rejected due to NAS level mobility management congestion control, the network shall set the EMM cause value to #22 "congestion" and assign a value for back-off timer T3346.

In NB-S1 mode, if the attach request is rejected due to operator determined barring (see 3GPP TS 29.272 [16C]), the network shall set the EMM cause value to #22 "congestion" and assign a value for back-off timer T3346.

If the attach request is rejected due to service gap control as specified in clause 5.3.17 i.e. the T3447 timer is running, the network shall set the EMM cause value to #22 "congestion" and may assign a back-off timer T3346 with the remaining time of the running T3447 timer.

If the attach request is rejected due to incompatibility between the CIoT EPS optimizations supported by the UE and what the network supports and the network sets the EMM cause value to #15 "no suitable cells in tracking area", the network may additionally include the Extended EMM cause IE with value "requested EPS optimization not supported".

NOTE 1: How the UE uses the Extended EMM cause IE with value "requested EPS optimization not supported" is implementation specific. The UE still behaves according to the EMM cause value #15.

Based on operator policy, if the attach request is rejected due to core network redirection for CIoT optimizations, the network shall set the EMM cause value to #31 "Redirection to 5GCN required".

NOTE 2: The network can take into account the UE’s N1 mode capability, the 5GS CIoT network behaviour supported by the UE or the 5GS CIoT network behaviour supported by the 5GCN to determine the rejection with the EMM cause value #31 "Redirection to 5GCN required".

In NB-S1 mode or WB-S1 mode via satellite E-UTRAN access, if the attach request is from a UE via a satellite E-UTRA cell and the network using the User Location Information provided by the eNodeB (see 3GPP TS 36.413 [23]), is able to determine that the UE is in a location where the network is not allowed to operate, the network shall set the EMM cause value in the ATTACH REJECT message to #78 "PLMN not allowed to operate at the present UE location".

Upon receiving the ATTACH REJECT message, if the message is integrity protected or contains a reject cause other than EMM cause value #25, the UE shall stop timer T3410.

If the ATTACH REJECT message with EMM cause #25 was received without integrity protection, then the UE shall discard the message.

Regardless of the EMM cause value received in the ATTACH REJECT message,

– if the UE receives the Forbidden TAI(s) for the list of "forbidden tracking areas for roaming" IE in the ATTACH REJECT message, the UE shall store the TAI(s) included in the IE, if not already stored, into the list of "forbidden tracking areas for roaming" and remove the TAI(s) from the stored TAI list if present; and

– if the UE receives the Forbidden TAI(s) for the list of "forbidden tracking areas for regional provision of service" IE in the ATTACH REJECT message, the UE shall store the TAI(s) included in the IE, if not already stored, into the list of "forbidden tracking areas for regional provision of service" and remove the TAI(s) from the stored TAI list if present.

Furthermore, the UE shall take the following actions depending on the EMM cause value received in the ATTACH REJECT message.

#3 (Illegal UE);

#6 (Illegal ME); or

#8 (EPS services and non-EPS services not allowed);

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI. The UE shall consider the USIM as invalid for EPS services and non-EPS services until switching off or the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.7a. Additionally, the UE shall delete the list of equivalent PLMNs and enter state EMM-DEREGISTERED.NO-IMSI. If the message has been successfully integrity checked by the NAS and the UE maintains a counter for "SIM/USIM considered invalid for GPRS services", then the UE shall set this counter to UE implementation-specific maximum value. If the message has been successfully integrity checked by the NAS and the UE maintains a counter for "SIM/USIM considered invalid for non-GPRS services", then the UE shall set this counter to UE implementation-specific maximum value.

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the MM parameters update status, TMSI, LAI and ciphering key sequence number, and the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number as specified in 3GPP TS 24.008 [13] for the case when the normal attach procedure is rejected with the GMM cause with the same value.

For the EMM cause value #3 or #6, if the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, 5G-GUTI, last visited registered TAI, TAI list and ngKSI as specified in 3GPP TS 24.501 [54] for the case when the initial registration procedure performed over 3GPP access is rejected with the 5GMM cause with the same value.

For the EMM cause value #8, if the UE is operating in single-registration mode, the UE shall in addition set the 5GMM state to 5GMM-DEREGISTERED, 5GS update status to 5U3 ROAMING NOT ALLOWED, and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI.

NOTE 3: The possibility to configure a UE so that the radio transceiver for a specific RAT is not active, although it is implemented in the UE, is out of scope of the present specification.

#7 (EPS services not allowed);

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number as specified in 3GPP TS 24.008 [13] for the case when the normal attach procedure is rejected with the GMM cause with the same value.

If the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, 5G-GUTI, last visited registered TAI, TAI list and ngKSI as specified in 3GPP TS 24.501 [54] for the case when the initial registration procedure performed over 3GPP access is rejected with the 5GMM cause with the same value.

#11 (PLMN not allowed); or

#35 (Requested service option not authorized in this PLMN);

In S1 mode, the UE shall store the PLMN identity in the "forbidden PLMN list" and enter state EMM-DEREGISTERED.PLMN-SEARCH and if the UE is configured to use timer T3245 (see 3GPP TS 24.368 [15] or 3GPP TS 31.102 [17]) then the UE shall start timer T3245 and proceed as described in clause 5.3.7a. The UE shall perform a PLMN selection according to 3GPP TS 23.122 [6]. If the message has been successfully integrity checked by the NAS and the UE maintains a PLMN-specific attempt counter for that PLMN, then the UE shall set this counter to the UE implementation-specific maximum value.

In S101 mode, the UE shall store the PLMN identity provided with the indication from the lower layers to prepare for an S101 mode to S1 mode handover in the list of "forbidden PLMNs for attach in S101 mode" and enter the state EMM-DEREGISTERED.NO-CELL-AVAILABLE and if the UE is configured to use timer T3245 (see 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17]) then the UE shall start timer T3245 and proceed as described in clause 5.3.7a.

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the MM parameters update status, TMSI, LAI, ciphering key sequence number and location update attempt counter, and the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and GPRS attach attempt counter as specified in 3GPP TS 24.008 [13] for the case when the normal attach procedure is rejected with the GMM cause value #11and no RR connection exists.

For the EMM cause value #11, if the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, 5G-GUTI, last visited registered TAI, TAI list, ngKSI and registration attempt counter as specified in 3GPP TS 24.501 [54] for the case when the initial registration procedure performed over 3GPP access is rejected with the 5GMM cause with the same value.

For the EMM cause value #35, if the UE is operating in single-registration mode, the UE shall in addition set the 5GMM state to 5GMM-DEREGISTERED, 5GS update status to 5U3 ROAMING NOT ALLOWED, and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. Additionally, the UE shall reset the registration attempt counter.

#12 (Tracking area not allowed);

In S1 mode, the UE shall store the current TAI in the list of "forbidden tracking areas for regional provision of service" and enter the state EMM-DEREGISTERED.LIMITED-SERVICE. If the ATTACH REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "forbidden tracking areas for regional provision of service" for non-integrity protected NAS reject message.

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and GPRS attach attempt counter as specified in 3GPP TS 24.008 [13] for the case when the normal attach procedure is rejected with the GMM cause with the same value.

If the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, 5G-GUTI, last visited registered TAI, TAI list, ngKSI and registration attempt counter as specified in 3GPP TS 24.501 [54] for the case when the initial registration procedure performed over 3GPP access is rejected with the 5GMM cause with the same value.

#13 (Roaming not allowed in this tracking area);

In S1 mode, the UE shall store the current TAI in the list of "forbidden tracking areas for roaming". If the ATTACH REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "forbidden tracking areas for roaming" for non-integrity protected NAS reject message. Additionally, the UE shall enter the state EMM-DEREGISTERED.LIMITED-SERVICE or optionally EMM-DEREGISTERED.PLMN-SEARCH. If the UE is registered in N1 mode and operating in dual-registration mode, the PLMN that the UE chooses to register in is specified in 3GPP TS 24.501 [54] clause 4.8.3. Otherwise the UE shall perform a PLMN selection according to 3GPP TS 23.122 [6].

If the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, 5G-GUTI, last visited registered TAI, TAI list, ngKSI and registration attempt counter as specified in 3GPP TS 24.501 [54] for the case when the initial registration procedure performed over 3GPP access is rejected with the 5GMM cause with the same value.

#14 (EPS services not allowed in this PLMN);

In S1 mode, the UE shall store the PLMN identity in the "forbidden PLMNs for GPRS service" list. Additionally, the UE shall enter state EMM-DEREGISTERED.PLMN-SEARCH and if the UE is configured to use timer T3245 (see 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17]) then the UE shall start timer T3245 and proceed as described in clause 5.3.7a. The UE shall perform a PLMN selection according to 3GPP TS 23.122 [6]. If the message has been successfully integrity checked by the NAS and the UE maintains a PLMN-specific PS-attempt counter for that PLMN, then the UE shall set this counter to the UE implementation-specific maximum value.

If the UE is operating in single-registration mode, the UE shall in addition set the 5GMM state to 5GMM-DEREGISTERED, 5GS update status to 5U3 ROAMING NOT ALLOWED, and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. Additionally, the UE shall reset the registration attempt counter.

#15 (No suitable cells in tracking area);

The UE shall store the current TAI in the list of "forbidden tracking areas for roaming". If the ATTACH REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "forbidden tracking areas for roaming" for non-integrity protected NAS reject message. Additionally, the UE shall enter the state EMM-DEREGISTERED.LIMITED-SERVICE and:

– if the UE is in WB-S1 mode and the Extended EMM cause IE with value "E-UTRAN not allowed" is included in the ATTACH REJECT message, the UE supports "E-UTRA Disabling for EMM cause #15", and the "E-UTRA Disabling Allowed for EMM cause #15" parameter as specified in 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17] is present and set to enabled; then the UE shall disable the E-UTRA capability as specified in clause 4.5 and search for a suitable cell in GERAN, UTRAN or NG-RAN radio access technology;

– if the UE is in NB-S1 mode and the Extended EMM cause IE with value "NB-IoT not allowed" is included in the ATTACH REJECT message, then the UE may disable the NB-IoT capability as specified in clause 4.9 and search for a suitable cell in E-UTRAN radio access technology;

– otherwise, the UE shall search for a suitable cell in another tracking area or in another location area according to 3GPP TS 36.304 [21].

If the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, 5G-GUTI, last visited registered TAI, TAI list, ngKSI and registration attempt counter as specified in 3GPP TS 24.501 [54] for the case when the initial registration procedure performed over 3GPP access is rejected with the 5GMM cause with the same value.

#22 (Congestion);

If the T3346 value IE is present in the ATTACH REJECT message and the value indicates that this timer is neither zero nor deactivated, the UE shall proceed as described below; otherwise it shall be considered as an abnormal case and the behaviour of the UE for this case is specified in clause 5.5.1.2.6.

The UE shall abort the attach procedure, reset the attach attempt counter, set the EPS update status to EU2 NOT UPDATED and enter state EMM-DEREGISTERED.ATTEMPTING-TO-ATTACH.

The UE shall stop timer T3346 if it is running.

If the ATTACH REJECT message is integrity protected, the UE shall start timer T3346 with the value provided in the T3346 value IE.

If the ATTACH REJECT message is not integrity protected, the UE shall start timer T3346 with a random value from the default range specified in 3GPP TS 24.008 [13].

The UE stays in the current serving cell and applies the normal cell reselection process. The attach procedure is started if still needed when timer T3346 expires or is stopped.

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the GMM parameters GMM state, GPRS update status and GPRS attach attempt counter as specified in 3GPP TS 24.008 [13] for the case when the normal attach procedure is rejected with the GMM cause with the same value.

If the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status and registration attempt counter as specified in 3GPP TS 24.501 [54] for the case when the initial registration procedure performed over 3GPP access is rejected with the 5GMM cause with the same value.

#25 (Not authorized for this CSG);

EMM cause #25 is only applicable when received from a CSG cell. EMM cause #25 received from a non-CSG cell is considered as an abnormal case and the behaviour of the UE is specified in clause 5.5.1.2.6.

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and store it according to clause 5.1.3.3). Additionally, the UE shall reset the attach attempt counter and shall enter the state EMM-DEREGISTERED.LIMITED-SERVICE.

If the CSG ID and associated PLMN identity of the cell where the UE has sent the ATTACH REQUEST message are contained in the Allowed CSG list, the UE shall remove the entry corresponding to this CSG ID and associated PLMN identity from the Allowed CSG list.

If the CSG ID and associated PLMN identity of the cell where the UE has sent the ATTACH REQUEST message are contained in the Operator CSG list, the UE shall apply the procedures defined in 3GPP TS 23.122 [6] clause 3.1A.

The UE shall search for a suitable cell according to 3GPP TS 36.304 [21].

If the UE is operating in single-registration mode, the UE shall in addition set the 5GMM state to 5GMM-DEREGISTERED and set the 5GS update status to 5U3 ROAMING NOT ALLOWED and reset the registration attempt counter.

#31 (Redirection to 5GCN required);

EMM cause #31 received by a UE that has not indicated support for CIoT optimizations or not indicated support for N1 mode is considered as an abnormal case and the behaviour of the UE is specified in clause 5.5.1.2.6.

The UE shall enable N1 mode capability for 3GPP access if it was disabled and disable the E-UTRA capability (see clause 4.5) and enter state EMM-DEREGISTERED.NO-CELL-AVAILABLE.

If the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, 5G-GUTI, last visited registered TAI, TAI list, ngKSI and registration attempt counter as specified in 3GPP TS 24.501 [54] for the case when the initial registration procedure performed over 3GPP access is rejected with the 5GMM cause with the same value.

#42 (Severe network failure);

The UE shall set the EPS update status to EU2 NOT UPDATED, and shall delete any GUTI, last visited registered TAI, TAI list, eKSI, and list of equivalent PLMNs, and set the attach attempt counter to 5. The UE shall start an implementation specific timer setting its value to 2 times the value of T as defined in 3GPP TS 23.122 [6]. While this timer is running, the UE shall not consider the PLMN + RAT combination that provided this reject cause a candidate for PLMN selection. The UE then enters state EMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection according to 3GPP TS 23.122 [6].

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition set the GMM state to GMM-DEREGISTERED, GPRS update status to GU2 NOT UPDATED, and shall delete the P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number.

If the UE is operating in single-registration mode, the UE shall in addition set the 5GMM state to 5GMM-DEREGISTERED, 5GS update status to 5U2 NOT UPDATED, and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI.

#78 (PLMN not allowed to operate at the present UE location).

This cause value received from a non-satellite E-UTRA cell is considered as an abnormal case and the behaviour of the UE is specified in clause 5.5.1.2.6.

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI. Additionally, the UE shall reset the registration attempt counter. The UE shall store the PLMN identity and, if it is known, the current geographical location in the list of "PLMNs not allowed to operate at the present UE location", start a corresponding timer instance (see clause 4.11.2), enter state EMM-DEREGISTERED.PLMN-SEARCH and perform a PLMN selection according to 3GPP TS 23.122 [6].

Other values are considered as abnormal cases. The behaviour of the UE in those cases is specified in clause 5.5.1.2.6.

5.5.1.2.5A Attach for emergency bearer services not accepted by the network

If the attach request for emergency bearer services cannot be accepted by the network, the MME shall send an ATTACH REJECT message to the UE including EMM cause #5 "IMEI not accepted" or one of the EMM cause values as described in clause 5.5.1.2.5.

NOTE 1: If EMM cause #11 is sent to a UE of a roaming subscriber attaching for emergency bearer services and the UE is in automatic network selection mode, it cannot obtain normal service provided by this PLMN.

Upon receiving the ATTACH REJECT message including EMM cause #5, the UE shall enter the state EMM-DEREGISTERED.NO-IMSI.

Upon receiving the ATTACH REJECT message including one of the other EMM cause values, the UE shall perform the actions as described in clause 5.5.1.2.5 with the following addition: the UE shall inform the upper layers of the failure of the procedure.

NOTE 2: This can result in the upper layers requesting establishment of a CS emergency call (if not already attempted in the CS domain), or other implementation specific mechanisms, e.g. procedures specified in 3GPP TS 24.229 [13D] can result in the emergency call being attempted to another IP-CAN.

If the attach request for emergency bearer services fails due to abnormal case a) in clause 5.5.1.2.6, the UE shall perform the actions as described in clause 5.5.1.2.6 and inform the upper layers of the failure to access the network.

NOTE 3: This can result in the upper layers requesting establishment of a CS emergency call (if not already attempted in the CS domain), or other implementation specific mechanisms, e.g. procedures specified in 3GPP TS 24.229 [13D] can result in the emergency call being attempted to another IP-CAN.

If the attach request for emergency bearer services fails due to abnormal cases b), c) or d) in clause 5.5.1.2.6, the UE shall perform the actions as described in clause 5.5.1.2.6 with the following addition: the UE shall inform the upper layers of the failure of the procedure.

NOTE 4: This can result in the upper layers requesting establishment of a CS emergency call (if not already attempted in the CS domain), or other implementation specific mechanisms, e.g. procedures specified in 3GPP TS 24.229 [13D] can result in the emergency call being attempted to another IP-CAN.

In a shared network, upon receiving the ATTACH REJECT message, the UE shall perform the actions as described in clause 5.5.1.2.5, and shall:

a) inform the upper layers of the failure of the procedure; or

NOTE 5: This can result in the upper layers requesting establishment of a CS emergency call (if not already attempted in the CS domain), or other implementation specific mechanisms, e.g. procedures specified in 3GPP TS 24.229 [13D] can result in the emergency call being attempted to another IP-CAN .

b) attempt to perform a PLMN selection in the shared network and, if an attach for emergency bearer services was not already attempted with the selected PLMN and the ATTACH REQUEST message:

– did not include a PDN CONNECTIVITY REQUEST message with request type set to "handover of emergency bearer services", initiate an attach for emergency bearer services to the selected PLMN; or

– did include a PDN CONNECTIVITY REQUEST message with request type set to "handover of emergency bearer services" and:

i) the selected PLMN is an equivalent PLMN, initiate an attach for emergency bearer services to the selected PLMN; and

ii) the selected PLMN is not an equivalent PLMN, perform a PLMN selection and initiate an attach for emergency bearer services to the selected PLMN if an attach for emergency bearer services was not already attempted with the selected PLMN.

In a shared network, if the attach request for emergency bearer services fails due to abnormal case a) in clause 5.5.1.2.6, the UE shall perform the actions as described in clause 5.5.1.2.6 and shall:

a) inform the upper layers of the failure to access the network; or

NOTE 6: This can result in the upper layers requesting establishment of a CS emergency call (if not already attempted in the CS domain), or other implementation specific mechanisms, e.g. procedures specified in 3GPP TS 24.229 [13D] can result in the emergency call being attempted to another IP-CAN .

b) attempt to perform a PLMN selection in the shared network and, if an attach for emergency bearer services was not already attempted with the selected PLMN and the ATTACH REQUEST message:

– did not include a PDN CONNECTIVITY REQUEST message with request type set to "handover of emergency bearer services", initiate an attach for emergency bearer services to the selected PLMN; or

– did include a PDN CONNECTIVITY REQUEST message with request type set to "handover of emergency bearer services" and:

i) the selected PLMN is an equivalent PLMN, initiate an attach for emergency bearer services to the selected PLMN; and

In a shared network, if the attach request for emergency bearer services fails due to abnormal cases b), c) or d) in clause 5.5.1.2.6, the UE shall perform the actions as described in clause 5.5.1.2.6, and shall:

a) inform the upper layers of the failure of the procedure; or

NOTE 7: This can result in the upper layers requesting establishment of a CS emergency call (if not already attempted in the CS domain), or other implementation specific mechanisms, e.g. procedures specified in 3GPP TS 24.229 [13D] can result in the emergency call being attempted to another IP-CAN .

b) attempt to perform a PLMN selection in the shared network and, if an attach for emergency bearer services was not already attempted with the selected PLMN and the ATTACH REQUEST message

– did not include a PDN CONNECTIVITY REQUEST message with request type set to "handover of emergency bearer services", initiate an attach for emergency bearer services to the selected PLMN; or

– did include a PDN CONNECTIVITY REQUEST message with request type set to "handover of emergency bearer services" and:

i) the selected PLMN is an equivalent PLMN, initiate an attach for emergency bearer services to the selected PLMN; and

5.5.1.2.5B Attach for initiating a PDN connection for emergency bearer services not accepted by the network

If the network cannot accept an attach request with attach type not set to "EPS emergency attach" and including a PDN CONNECTIVITY REQUEST message with request type set to "emergency", the UE shall perform the procedures as described in clause 5.5.1.2.5. Then if the UE is in the same selected PLMN where the last attach request was attempted, the UE shall:

a) inform the upper layers of the failure of the procedure; or

NOTE 1: This can result in the upper layers requesting establishment of a CS emergency call (if not already attempted in the CS domain) or other implementation specific mechanisms, e.g. procedures specified in 3GPP TS 24.229 [13D] can result in the emergency call being attempted to another IP-CAN.

b) attempt EPS attach for emergency bearer services including the PDN CONNECTIVITY REQUEST message.

If the network cannot accept an attach request with attach type not set to "EPS emergency attach" and including a PDN CONNECTIVITY REQUEST message with request type set to "handover of emergency bearer services", the UE shall perform the procedures as described in clause 5.5.1.2.5. Then if the UE is in the same selected PLMN or equivalent PLMN where the last attach request was attempted, the UE shall attempt EPS attach for emergency bearer services including the PDN CONNECTIVITY REQUEST message.

If the attach request with attach type not set to "EPS emergency attach" for initiating a PDN connection for emergency bearer services fails due to abnormal case a) in clause 5.5.1.2.6, the UE shall perform the actions as described in clause 5.5.1.2.6 and inform the upper layers of the failure to access the network.

NOTE 2: This can result in the upper layers requesting establishment of a CS emergency call (if not already attempted in the CS domain) or other implementation specific mechanisms, e.g. procedures specified in 3GPP TS 24.229 [13D] can result in the emergency call being attempted to another IP-CAN.

If the attach request with attach type not set to "EPS emergency attach" and including a PDN CONNECTIVITY REQUEST message with request type set to "emergency" fails due to abnormal cases b), c) or d) as well as l) when the "Extended wait time" is ignored, and la) when the "Extended wait time CP data" is ignored in clause 5.5.1.2.6, the UE shall perform the procedures as described in clause 5.5.1.2.6. Then if the UE is in the same selected PLMN where the last attach request was attempted, the UE shall:

a) inform the upper layers of the failure of the procedure; or

NOTE 3: This can result in the upper layers requesting establishment of a CS emergency call (if not already attempted in the CS domain) or other implementation specific mechanisms, e.g. procedures specified in 3GPP TS 24.229 [13D] can result in the emergency call being attempted to another IP-CAN.

b) attempt EPS attach for emergency bearer services including the PDN CONNECTIVITY REQUEST message.

If the attach request with attach type not set to "EPS emergency attach" and including a PDN CONNECTIVITY REQUEST message with request type set to "handover of emergency bearer services" fails due to abnormal cases b), c), d) or o) in clause 5.5.1.2.6, the UE shall perform the procedures as described in clause 5.5.1.2.6. Then if the UE is in the same selected PLMN or equivalent PLMN where the last attach request was attempted, the UE shall attempt EPS attach for emergency bearer services including the PDN CONNECTIVITY REQUEST message.

5.5.1.2.5B1 Attach by a UE transferring an emergency PDU session using a standalone PDN CONNECTIVITY REQUEST message

If the network cannot accept attach request including a PDN CONNECTIVITY REQUEST message with request type set to "handover" and the UE also intends to transfer an emergency PDU session, the UE shall attempt EPS attach for emergency bearer services including a PDN CONNECTIVITY REQUEST message with request type set to "handover of emergency bearer services" for the emergency PDU session.

If the attach request, including a PDN CONNECTIVITY REQUEST message with request type set "handover", fails due to abnormal case a) in clause 5.5.1.2.6 and the UE intends to transfer an emergency PDU session, the UE shall attempt EPS attach including a PDN CONNECTIVITY REQUEST message with request type set to "handover of emergency bearer services" for the emergency PDU session.

If the attach request including a PDN CONNECTIVITY REQUEST message with request type set "handover" fails due to abnormal cases b), c), d) or o) in clause 5.5.1.2.6, the UE intends to transfer an emergency PDU session:

– if an EMM cause set to #19 "ESM failure" is received, the UE shall attempt EPS attach; and

– otherwise, the UE shall attempt EPS attach for emergency bearer services,

with the ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message with request type set to "handover of emergency bearer services" for the emergency PDU session.

5.5.1.2.5C Attach for access to RLOS not accepted by the network

If the attach request for access to RLOS is received by the network and the UE requesting attach is not in limited service state, the MME shall reject the UE’s attach request.

If the attach request for access to RLOS cannot be accepted by the network, the MME shall send an ATTACH REJECT message to the UE including EMM cause #35 "Requested service option not authorized in this PLMN" or one of the EMM cause values as described in clause 5.5.1.2.5.

Upon receiving the ATTACH REJECT message including EMM cause #35, the UE shall enter the state EMM-DEREGISTERED.PLMN-SEARCH and perform a PLMN selection according to 3GPP TS 23.122 [6] to attempt EPS attach for access to RLOS via another PLMN.

Upon receiving the ATTACH REJECT message including one of the other EMM cause values, the UE shall perform the actions as described in clause 5.5.1.2.5. along with the following conditions:

a) if the action for the reject involves searching for a suitable cell in E-UTRAN radio access technology, the UE shall proceed with the action and shall attempt to attach for access to RLOS in the new tracking area, if found; and

b) if the action for the reject involves attempting to select GERAN or UTRAN radio access technology or disabling the E-UTRA capability, the UE shall skip the action for as long as access to RLOS is still needed.

NOTE: How long the UE attempts to access RLOS is up to UE implementation.

Then if the UE is in the same selected PLMN where the last attach procedure was attempted and rejected and if timer T3346 is not running, perform a PLMN selection according to 3GPP TS 23.122 [6] to attempt EPS attach for access to RLOS via another PLMN.

If the attach request for access to RLOS fails due to abnormal cases b), c) or d) in clause 5.5.1.2.6, the UE shall perform the procedures as described in clause 5.5.1.2.6 with the exception that the UE shall skip actions that involve attempting to select GERAN or UTRAN radio access technology and actions that involve disabling the E-UTRA capability, for as long as access to RLOS is still needed.

5.5.1.2.6 Abnormal cases in the UE

The following abnormal cases can be identified:

a) Access barred because of access class barring, EAB, ACDC or NAS signalling connection establishment rejected by the network without "Extended wait time" received from lower layers

In WB-S1 mode, if access is barred for "originating signalling" (see 3GPP TS 36.331 [22]), the attach procedure shall not be started. The UE stays in the current serving cell and applies the normal cell reselection process. The attach procedure is started as soon as possible, i.e. when access for "originating signalling" is granted on the current cell or when the UE moves to a cell where access for "originating signalling" is granted.

In NB-S1 mode, if access is barred for "originating signalling" (see 3GPP TS 36.331 [22]), the attach procedure shall not be started. The UE stays in the current serving cell and applies the normal cell reselection process. Further UE behaviour is implementation specific, e.g. the attach procedure is started again after an implementation dependent time.

In NB-S1 mode, if access is barred for "originating signalling" (see 3GPP TS 36.331 [22]), a request for an exceptional event is received from the upper layers, then the attach procedure shall be started.

NOTE 1: In NB-S1 mode, the EMM layer cannot receive the access barring alleviation indication from the lower layers (see 3GPP TS 36.331 [22]).

If access is barred because of access class barring for "originating signalling" (see 3GPP TS 36.331 [22]), ACDC is applicable to the request from the upper layers and the UE supports ACDC, then the attach procedure shall be started.

If access is barred for a certain ACDC category (see 3GPP TS 36.331 [22]), a request with a higher ACDC category is received from the upper layers and the UE supports ACDC, then the attach procedure shall be started.

If an access request for an uncategorized application is barred due to ACDC (see 3GPP TS 36.331 [22]), a request with a certain ACDC category is received from the upper layers and the UE supports ACDC, then the attach procedure shall be started.

aa) Lower layer failure to establish the RRC connection and:

– the UE is in its HPLMN or in an EHPLMN (if the EHPLMN list is present);

– the attach request is neither for emergency bearer services nor for initiating a PDN connection for emergency bearer services with attach type not set to "EPS emergency attach";

– the UE supports being configured with CustomLLFailureRetry as specified in 3GPP TS 24.368 [15A]); and

– CustomLLFailureRetry leaf is present as specified in 3GPP TS 24.368 [15A]);

The UE shall abort the attach procedure and wait for a UE implementation specific timer which shall be set to MinRetryTimer or MaxRetryTimer as specified in 3GPP TS 24.368 [15A]. The UE shall not set the UE implementation specific timer to MinRetryTimer for more than MaxMinRetry consecutive attempts as specified in 3GPP TS 24.368 [15A]. After the expiration of the UE implementation specific timer, the UE shall restart the attach procedure, if still needed.

b) Lower layer failure not covered in case aa) or release of the NAS signalling connection without "Extended wait time" and without "Extended wait time CP data" received from lower layers before the ATTACH ACCEPT or ATTACH REJECT message is received

The attach procedure shall be aborted, and the UE shall proceed as described below.

c) T3410 timeout

The UE shall abort the attach procedure. The NAS signalling connection, if any, shall be released locally.

NOTE 2: The NAS signalling connection can also be released if the UE deems that the network has failed the authentication check as specified in clause 5.4.2.7.

The UE shall proceed as described below.

d) ATTACH REJECT, other EMM cause values than those treated in clause 5.5.1.2.5, and cases of EMM cause values #22, #25, #31 and #78, if considered as abnormal cases according to clause 5.5.1.2.5

Upon reception of the EMM cause #19 "ESM failure", if the UE is not configured for NAS signalling low priority and the ESM cause value received in the PDN CONNECTIVITY REJECT message is not #54 "PDN connection does not exist", the UE may set the attach attempt counter to 5. Subsequently, if the UE needs to retransmit the ATTACH REQUEST message to request PDN connectivity towards a different APN, the UE may stop T3411 or T3402, if running, and send the ATTACH REQUEST message. If the UE needs to attempt EPS attach to request transfer of a PDN connection for emergency bearer services by including a PDN CONNECTIVITY REQUEST message with request type set to "handover of emergency bearer services", the UE shall stop T3411 or T3402, if running, and send the ATTACH REQUEST message.

NOTE 3: When receiving EMM cause #19 "ESM failure", coordination is required between the EMM and ESM sublayers in the UE to determine whether to set the attach attempt counter to 5.

If the attach request is neither for emergency bearer services nor for initiating a PDN connection for emergency bearer services with attach type not set to "EPS emergency attach", upon reception of the EMM causes #95, #96, #97, #99 and #111 the UE should set the attach attempt counter to 5.

The UE shall proceed as described below.

e) Change of cell into a new tracking area

If a cell change into a new tracking area occurs before the attach procedure is completed, the attach procedure shall be aborted and re-initiated immediately. If a tracking area border is crossed when the ATTACH ACCEPT message has been received but before an ATTACH COMPLETE message is sent, the attach procedure shall be re-initiated. If a GUTI was allocated during the attach procedure, this GUTI shall be used in the attach procedure.

f) Mobile originated detach required

The attach procedure shall be aborted, and the UE initiated detach procedure shall be performed.

g) Detach procedure collision

If the UE receives a DETACH REQUEST message from the network in state EMM-REGISTERED-INITIATED and the detach type indicates "re-attach not required" and no EMM cause IE, or "re-attach not required" and the EMM cause value is not #2 "IMSI unknown in HSS", the detach procedure shall be progressed and the attach procedure shall be aborted. If the UE receives a DETACH REQUEST message from the network in state EMM-REGISTERED-INITIATED and the detach type indicates "re-attach required", the detach procedure shall be progressed and the UE shall locally release the NAS signalling connection, before re-initiating the attach procedure. Otherwise the attach procedure shall be progressed and the DETACH REQUEST message shall be ignored.

h) Transmission failure of ATTACH REQUEST message indication from lower layers

The UE shall restart the attach procedure immediately.

i) Transmission failure of ATTACH COMPLETE message indication from lower layers

If the current TAI is not in the TAI list, the UE shall restart the attach procedure.

If the current TAI is still in the TAI list, it is up to the UE implementation how to re-run the ongoing procedure. The EMM sublayer notifies the ESM sublayer that the ESM message in the ESM message container IE of the ATTACH COMPLETE has failed to be transmitted.

j) If EMM-REGISTERED without PDN connection is not supported by the UE or the MME, and the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message combined with the ATTACH ACCEPT is not accepted by the UE due to failure in the UE ESM sublayer, then the UE shall initiate the detach procedure by sending a DETACH REQUEST message to the network. Further UE behaviour is implementation specific.

If EMM-REGISTERED without PDN connection is supported by the UE and the MME, and the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message combined with the ATTACH ACCEPT is not accepted by the UE due to failure in the UE ESM sublayer, then the UE shall either send an ATTACH COMPLETE message together with an ACTIVATE DEFAULT EPS BEARER CONTEXT REJECT contained in the ESM message container information element to the network or initiate the detach procedure by sending a DETACH REQUEST message. Further UE behaviour is implementation specific.

k) Indication from the lower layers that an S101 mode to S1 mode handover has been cancelled (S101 mode only)

The UE shall abort the attach procedure and enter state EMM-DEREGISTERED.NO-CELL-AVAILABLE.

l) "Extended wait time" from the lower layers

If the ATTACH REQUEST message contained the low priority indicator set to "MS is configured for NAS signalling low priority", the UE shall start timer T3346 with the "Extended wait time" value and reset the attach attempt counter.

If the ATTACH REQUEST message did not contain the low priority indicator set to "MS is configured for NAS signalling low priority", the UE is operating in NB-S1 mode and the UE is not a UE configured to use AC11 – 15 in selected PLMN, then the UE shall start timer T3346 with the "Extended wait time" value and reset the attach attempt counter.

In other cases the UE shall ignore the "Extended wait time".

The UE shall abort the attach procedure, stay in the current serving cell, change the state to EMM-DEREGISTERED.ATTEMPTING-TO-ATTACH and apply the normal cell reselection process.

The UE shall proceed as described below.

la) "Extended wait time CP data" from the lower layers

If the UE is operating in NB-S1 mode, the UE shall start the timer T3346 with the "Extended wait time CP data" value and reset the attach attempt counter.

In other cases the UE shall ignore the "Extended wait time CP data".

The UE shall abort the attach procedure, stay in the current serving cell, change the state to EMM-DEREGISTERED.ATTEMPTING-TO-ATTACH and apply the normal cell reselection process.

The UE shall proceed as described below.

m) Timer T3346 is running

The UE shall not start the attach procedure unless:

– the UE is a UE configured to use AC11 – 15 in selected PLMN;

– the UE needs to attach for emergency bearer services;

– the UE in NB-S1 mode is requested by the upper layer to transmit user data related to an exceptional event and

i) the UE is allowed to use exception data reporting (see the ExceptionDataReportingAllowed leaf of the NAS configuration MO in 3GPP TS 24.368 [15A] or the USIM file EF_NASCONFIG in 3GPP TS 31.102 [17]); and

ii) timer T3346 was not started when NAS signalling connection was established with RRC establishment cause set to "MO exception data"; or

– the UE needs to attach without the NAS signalling low priority indication and if the timer T3346 was started due to rejection of a NAS request message (e.g. ATTACH REQUEST, TRACKING AREA UPDATE REQUEST or EXTENDED SERVICE REQUEST) which contained the low priority indicator set to "MS is configured for NAS signalling low priority".

The UE stays in the current serving cell and applies the normal cell reselection process.

NOTE 4: It is considered an abnormal case if the UE needs to initiate an attach procedure while timer T3346 is running independent on whether timer T3346 was started due to an abnormal case or a non successful case.

The UE shall proceed as described below.

n) If EMM-REGISTERED without PDN connection is supported by the UE and the MME, an ESM DUMMY MESSAGE is included in the ESM message container information element of the ATTACH REQUEST message and the UE receives the ATTACH ACCEPT message combined with a PDN CONNECTIVITY REJECT message, the UE shall send an ATTACH COMPLETE message together with an ESM DUMMY MESSAGE contained in the ESM message container information element to the network. Further UE behaviour is implementation specific.

o) Timer T3447 is running

The UE shall not start the attach procedure unless:

– the UE is a UE configured to use AC11 – 15 in selected PLMN;

– the UE attempts to attach for emergency bearer services; or

– the UE attempts to attach without PDN connection request.

The UE stays in the current serving cell and applies the normal cell reselection process. The attach request procedure is started, if still necessary, when timer T3447 expires.

For the cases b, c, d, l, la and m:

– Timer T3410 shall be stopped if still running.

– For the cases b, c, d, l when the "Extended wait time" is ignored, and la when the "Extended wait time CP data" is ignored, if the attach request is neither for emergency bearer services nor for initiating a PDN connection for emergency bearer services with attach type not set to "EPS emergency attach", the attach attempt counter shall be incremented, unless it was already set to 5.

– If the attach attempt counter is less than 5:

– for the cases l, la and m, the attach procedure is started, if still necessary, when timer T3346 expires or is stopped;

– for the cases b, c, d, l when the "Extended wait time" is ignored, and la when the "Extended wait time CP data" is ignore, if the attach request is neither for emergency bearer services nor for initiating a PDN connection for emergency bearer services with attach type not set to "EPS emergency attach", timer T3411 is started and the state is changed to EMM-DEREGISTERED.ATTEMPTING-TO-ATTACH. When timer T3411 expires the attach procedure shall be restarted, if still required by ESM sublayer.

– If the attach attempt counter is equal to 5:

– the UE shall delete any GUTI, TAI list, last visited registered TAI, list of equivalent PLMNs and KSI, shall set the update status to EU2 NOT UPDATED, and shall start timer T3402 if he value of the timer as indicated by the network is not zero. The state is changed to EMM-DEREGISTERED.ATTEMPTING-TO-ATTACH or optionally to EMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection according to 3GPP TS 23.122 [6]; and

– if A/Gb mode, Iu mode or N1 mode is supported by the UE:

– if A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number as specified in 3GPP TS 24.008 [13] for the abnormal case when a normal attach procedure fails and the attach attempt counter is equal to 5;

– if the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, 5G-GUTI, last visited registered TAI, TAI list and ngKSI as specified in 3GPP TS 24.501 [54] for the abnormal case when an initial registration procedure performed over 3GPP access fails and the registration attempt counter is equal to 5; and

– the UE shall attempt to select GERAN, UTRAN or NG-RAN radio access technology and proceed with appropriate GMM or 5GMM specific procedures. Additionally, if the UE selects GERAN or UTRAN radio access technology, the UE may disable the E-UTRA capability as specified in clause 4.5. If No E-UTRA Disabling In 5GS is enabled at the UE (see 3GPP TS 24.368 [50] or 3GPP TS 31.102 [17]) and the UE selects NG-RAN radio access technology, it shall not disable the E-UTRA capability; otherwise, the UE may disable the E-UTRA capability as specified in clause 4.5.

– if the value of T3402 as indicated by the network is zero, the UE shall perform the actions defined for the expiry of the timer T3402.

NOTE 5: Whether the UE requests RRC to treat the active E-UTRA cell as barred (see 3GPP TS 36.304 [21]) is left to the UE implementation.

5.5.1.2.6A Abnormal cases in the UE, SMS services not accepted

The UE shall proceed as follows:

1) if the attach was successful for EPS services only and the ATTACH ACCEPT message contained a value included in the SMS services status IE not treated in clause 5.5.1.2.4A, the UE shall proceed as follows:

a) The UE shall stop timer T3410 if still running. The tracking area updating attempt counter shall be incremented, unless it was already set to 5;

b) If the tracking area updating attempt counter is less than 5:

c) If the tracking area updating attempt counter is equal to 5:

2) otherwise, the abnormal cases specified in clause 5.5.1.2.6 apply.

5.5.1.2.7 Abnormal cases on the network side

The following abnormal cases can be identified:

a) Lower layer failure

If a lower layer failure occurs before the message ATTACH COMPLETE has been received from the UE, the network shall locally abort the attach procedure, enter state EMM-DEREGISTERED and shall not resend the message ATTACH ACCEPT. If a new GUTI was assigned to the UE in the attach procedure, the MME shall consider both the old and the new GUTI as valid until the old GUTI can be considered as invalid by the network or the EMM context which has been marked as detached in the network is released.

If the old GUTI was allocated by an MME other than the current MME, the current MME does not need to retain the old GUTI. If the old GUTI is used by the UE in a subsequent attach message, the network may use the identification procedure to request the UE’s IMSI.

b) Protocol error

If the ATTACH REQUEST message is received with a protocol error, the network shall return an ATTACH REJECT message with one of the following EMM cause values:

#96: invalid mandatory information;

#99: information element non-existent or not implemented;

#100: conditional IE error; or

#111: protocol error, unspecified.

c) T3450 time-out

On the first expiry of the timer, the network shall retransmit the ATTACH ACCEPT message and shall reset and restart timer T3450.

This retransmission is repeated four times, i.e. on the fifth expiry of timer T3450, the attach procedure shall be aborted and the MME enters state EMM-DEREGISTERED. If a new GUTI was allocated in the ATTACH ACCEPT message, the network shall consider both the old and the new GUTI as valid until the old GUTI can be considered as invalid by the network or the EMM context which has been marked as detached in the network is released. If the old GUTI was allocated by an MME other than the current MME, the current MME does not need to retain the old GUTI.

If the old GUTI is used by the UE in a subsequent attach message, the network acts as specified for case a above.

d) ATTACH REQUEST received after the ATTACH ACCEPT message has been sent and before the ATTACH COMPLETE message is received

– If one or more of the information elements in the ATTACH REQUEST message differ from the ones received within the previous ATTACH REQUEST message, the previously initiated attach procedure shall be aborted if the ATTACH COMPLETE message has not been received and the new attach procedure shall be progressed; or

– if the information elements do not differ, then the ATTACH ACCEPT message shall be resent and the timer T3450 shall be restarted if an ATTACH COMPLETE message is expected. In that case, the retransmission counter related to T3450 is not incremented.

e) More than one ATTACH REQUEST received and no ATTACH ACCEPT or ATTACH REJECT message has been sent

– If one or more of the information elements in the ATTACH REQUEST message differs from the ones received within the previous ATTACH REQUEST message, the previously initiated attach procedure shall be aborted and the new attach procedure shall be executed;

– if the information elements do not differ, then the network shall continue with the previous attach procedure and shall ignore the second ATTACH REQUEST message.

f) ATTACH REQUEST received in state EMM-REGISTERED

If an ATTACH REQUEST message is received in state EMM-REGISTERED the network may initiate the EMM common procedures; if it turned out that the ATTACH REQUEST message was sent by a genuine UE that has already been attached, the EMM context, EPS bearer contexts, if any, are deleted and the new ATTACH REQUEST is progressed, otherwise if network considers ATTACH REQUEST message was not sent by a genuine UE based on authentication procedure the network shall maintain the EMM-context, if any, unchanged.

NOTE 1: The network can determine that the UE is genuine by executing the authentication procedure as described in clause 5.4.2.

g) TRACKING AREA UPDATE REQUEST message received before ATTACH COMPLETE message.

Timer T3450 shall be stopped. The allocated GUTI in the attach procedure shall be considered as valid and the tracking area updating procedure shall be rejected with the EMM cause #10 "implicitly detached" as described in clause 5.5.3.2.5.

h) DETACH REQUEST message received before ATTACH COMPLETE message.

The network shall abort the attach procedure and shall progress the detach procedure as described in clause 5.5.2.2.

i) If EMM-REGISTERED without PDN connection is supported by the UE and the MME, the MME receives an ATTACH REQUEST message with an ESM message included in the ESM message container information element, and the ESM sublayer in the MME detects a message error according to clause 7, the MME may decide to proceed with the attach procedure or to reject it. When sending the ATTACH ACCEPT or ATTACH REJECT message to the UE, the MME shall include the ESM message provide by the ESM layer in the ESM message container information element.

j) UE security capabilities invalid or unacceptable

If the ATTACH REQUEST message is received with invalid or unacceptable UE security capabilities (e.g. no EPS encryption algorithms (all bits zero), no EPS integrity algorithms (all bits zero), mandatory EPS encryption algorithms not supported or mandatory EPS integrity algorithms not supported, etc.), the MME shall return an ATTACH REJECT message.

NOTE 2: EMM cause value to be used in ATTACH REJECT message is up to the network implementation.

5.5.1.3 Combined attach procedure for EPS services and non-EPS services (S1 mode only)

5.5.1.3.1 General

The combined attach procedure is used by a UE in CS/PS mode 1 or CS/PS mode 2 of operation to attach for both EPS and non-EPS services, or both EPS services and "SMS only".

The combined attach procedure is also used by a UE in CS/PS mode 1 or CS/PS mode 2 of operation to attach for EPS services if it is already IMSI attached for non-EPS services.

When the UE initiates a combined attach procedure, the UE shall indicate "combined EPS/IMSI attach" in the EPS attach type IE.

The combined attach procedure follows the attach procedure for EPS described in clause 5.5.1.2 with exception of clause 5.5.1.2.4A and clause 5.5.1.2.6A.

5.5.1.3.2 Combined attach procedure initiation

If the UE is in EMM state EMM-DEREGISTERED, the UE initiates the combined attach procedure by sending an ATTACH REQUEST message to the network, starting timer T3410 and entering state EMM-REGISTERED-INITIATED (see example in figure 5.5.1.2.2.1).

The UE shall include the TMSI status IE if no valid TMSI is available. Furthermore, if the UE has stored a valid location area identification, the UE shall include it in the Old location area identification IE in the ATTACH REQUEST message.

If the UE has stored a valid TMSI, the UE shall include the TMSI based NRI container IE in the ATTACH REQUEST message.

If the UE initiates a combined attach procedure for EPS services and "SMS only", the UE shall indicate "SMS only" in the Additional update type IE.

5.5.1.3.3 EMM common procedure initiation

The network may initiate EMM common procedures, e.g. the identification, authentication and security mode control procedures, depending on the received information such as IMSI, GUTI and KSI.

5.5.1.3.4 Combined attach accepted by the network

5.5.1.3.4.1 General

Depending on the value of the EPS attach result IE received in the ATTACH ACCEPT message, the following different cases can be distinguished:

1) The EPS attach result IE value indicates "combined EPS/IMSI attach": attach for EPS and non-EPS services, or for EPS services and "SMS only" have been successful.

2) The EPS attach result IE value indicates "EPS only": attach for EPS services has been successful but attach for non-EPS services or "SMS only" has failed.

5.5.1.3.4.2 Combined attach successful

The description for attach for EPS services as specified in clause 5.5.1.2.4 shall be followed. In addition, the following description for attach for non-EPS services or "SMS only" applies.

The TMSI reallocation may be part of the combined attach procedure. The TMSI allocated is then included in the ATTACH ACCEPT message, together with the location area identification (LAI). In this case the MME shall start timer T3450 as described in clause 5.4.1.4, and enter state EMM-COMMON-PROCEDURE-INITIATED. If the MME does not indicate "SMS only" in the ATTACH ACCEPT message, subject to operator policies the MME should allocate a TAI list that does not span more than one location area.

For a shared network in CS domain, the MME indicates the selected PLMN for CS domain in the LAI to the UE as specified in 3GPP TS 23.272 [9].

The UE, receiving an ATTACH ACCEPT message, stores the received location area identification, stops timer T3410, resets the location update attempt counter and sets the update status to U1 UPDATED. If the message contains an IMSI, the UE is not allocated any TMSI, and shall delete any TMSI accordingly. If the message contains a TMSI, the UE shall use this TMSI as the new temporary identity. The UE shall delete its old TMSI and shall store the new TMSI. If neither a TMSI nor an IMSI has been included by the network in the ATTACH ACCEPT message, the old TMSI, if any available, shall be kept.

If the UE maintains a counter for "SIM/USIM considered invalid for non-GPRS services" events (see clause 5.3.7b), then the UE shall reset this counter.

If the UE requested "SMS only" in the Additional update type IE, or if the UE requested a combined attach for EPS and non-EPS services, but the network decides to accept the attach request for EPS services and "SMS only", the network shall indicate "SMS only" in the Additional update result IE. In addition, if the SMS services are provided via SMS in MME, the network shall provide a non-broadcast LAI in the ATTACH ACCEPT message. If a TMSI has to be allocated, then the network shall also provide a TMSI value which cannot cause any ambiguity with assigned TMSI values.

If the ATTACH ACCEPT message includes the Additional update result IE with value "SMS only", a UE operating in CS/PS mode 2 and a UE operating in CS/PS mode 1 with "IMS voice available" shall not attempt to use CS fallback for mobile originating services.

As an implementation option, if the ATTACH ACCEPT message does not include the Additional update result IE with value "SMS only" and the UE is not configured for NAS signalling low priority then the UE may stop timer T3246 if running.

If the ATTACH ACCEPT message includes the Additional update result IE with value "CS Fallback not preferred", this indicates to a UE operating in CS/PS mode 2 and a UE operating in CS/PS mode 1 with "IMS voice available" that it is attached for EPS and non-EPS services and that it can use CS fallback.

If the LAI contained in the ATTACH ACCEPT message is a member of the list of "forbidden location areas for regional provision of service" or the list of "forbidden location areas for roaming" then such entry shall be deleted.

If the PLMN identity for the CS domain which is provided as part of the LAI contained in the ATTACH ACCEPT message differs from the PLMN identity provided as part of the GUTI, the MME shall include the PLMN identity for the CS domain in the list of equivalent PLMNs in the ATTACH ACCEPT message.

The UE, when having requested PDN connectivity as contained in the ATTACH REQUEST and on receiving the ATTACH ACCEPT message combined with the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message, shall send an ATTACH COMPLETE message combined with an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message to the network.

Upon transmission of the ATTACH COMPLETE message the UE shall enter state EMM-REGISTERED and MM state MM-IDLE and set the EPS update status to EU1 UPDATED.

If the ATTACH ACCEPT message includes the Additional update result IE with value "SMS only" or "CS Fallback not preferred", a UE operating in CS/PS mode 1 with "IMS voice not available" shall attempt to select GERAN or UTRAN radio access technology and disable the E-UTRA capability (see clause 4.5).

Upon receiving an ATTACH COMPLETE message, the MME shall stop timer T3450, enter state EMM-REGISTERED.

NOTE: Upon receiving an ATTACH COMPLETE message, the MME sends an SGsAP-TMSI-REALLOCATION-COMPLETE message as specified in 3GPP TS 29.118 [16A].

After the UE performs intersystem change from N1 mode to S1 mode, if:

– the network supports SRVCC for IMS emergency sessions (see 3GPP TS 23.216 [8]);

– the UE has an emergency PDN connection;

– the UE has set the SRVCC to GERAN/UTRAN capability bit in the MS network capability IE to "SRVCC from UTRAN HSPA or E-UTRAN to GERAN/UTRAN supported; and

– the MME has neither an IMEI nor an IMEISV for the UE;

then the MME shall initiate the identification procedure (see clause 5.4.4) or the security mode control procedure (see clause 5.4.3) with the UE.

5.5.1.3.4.3 Combined attach successful for EPS services only

If, due to emergency services fallback (see 3GPP TS 23.502 [59], clause 4.13.4), there is

a request for emergency services pending and the emergency bearer services indicator in the EPS network feature support IE indicates "emergency bearer services in S1 mode not supported",

then the UE shall skip the requirements defined below in the present clause for the receipt of an ATTACH ACCEPT message including an EMM cause value, attempt to select GERAN or UTRAN radio access technology, select a setup message as defined in clause 5.3.7, proceed with appropriate MM specific procedures, and send the setup message.

The UE receiving the ATTACH ACCEPT message takes one of the following actions depending on the EMM cause value:

#2 (IMSI unknown in HSS)

The UE shall stop T3410 if still running and shall reset the tracking area updating attempt counter. The UE shall set the update status to U3 ROAMING NOT ALLOWED and shall delete any TMSI, LAI and ciphering key sequence number. The UE shall enter state EMM-REGISTERED.NORMAL-SERVICE. The new MM state is MM IDLE. The USIM shall be considered as invalid for non-EPS services until the UE is switched off, the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.7a. If the UE maintains a counter for "SIM/USIM considered invalid for non-GPRS services", then the UE shall set this counter to UE implementation-specific maximum value.

If, due to emergency services fallback (see 3GPP TS 23.502 [59]), there is a request for CS fallback call pending (see clause 5.3.7), the UE shall attempt to select GERAN or UTRAN radio access technology and attempt emergency call setup.

A UE operating in CS/PS mode 1 of operation with "IMS voice not available" shall disable the E-UTRA capability (see clause 4.5).

#16 (MSC temporarily not reachable); or

#17 (Network failure)

The UE shall stop timer T3410 if still running, and shall enter state MM IDLE. The tracking area updating attempt counter shall be incremented, unless it was already set to 5.

If the tracking area updating attempt counter is less than 5:

– the UE shall start timer T3411, shall set the EPS update status to EU1 UPDATED and shall enter state EMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM. When timer T3411 expires the combined tracking area updating procedure indicating "combined TA/LA updating with IMSI attach" is triggered.

If the tracking area updating attempt counter is equal to 5:

– a UE operating in CS/PS mode 2 of operation and a UE operating in CS/PS mode 1 of operation with "IMS voice available" shall start timer T3402, shall set the EPS update status to EU1 UPDATED and shall enter state EMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM. When timer T3402 expires the combined tracking area updating procedure indicating "combined TA/LA updating with IMSI attach" is triggered;

– a UE operating in CS/PS mode 1 of operation with "IMS voice not available" shall attempt to select GERAN or UTRAN radio access technology and proceed with appropriate MM or GMM specific procedures and disable the E-UTRA capability (see clause 4.5).

#18 (CS domain not available)

The UE shall enter state MM IDLE and shall set the update status to U2 NOT UPDATED.

A UE in CS/PS mode 1 of operation with "IMS voice not available" shall attempt to select GERAN or UTRAN radio access technology and disable the E-UTRA capability (see clause 4.5).

A UE in CS/PS mode 2 of operation and a UE operating in CS/PS mode 1 of operation with "IMS voice available" may provide a notification to the user or the upper layers that the CS domain is not available.

The UE shall not attempt combined attach or combined tracking area updating procedures with current PLMN until switching off the UE or the UICC containing the USIM is removed.

#22 (Congestion)

Other EMM cause values and the case that no EMM cause IE was received are considered as abnormal cases. The combined attach procedure shall be considered as failed for non-EPS services. The behaviour of the UE in those cases is specified in clause 5.5.1.3.6.

5.5.1.3.5 Combined attach not accepted by the network

If the attach request can neither be accepted by the network for EPS nor for non-EPS services, the MME shall send an ATTACH REJECT message to the UE including an appropriate EMM cause value. If EMM-REGISTERED without PDN connection is not supported by the UE or the MME, the attach request included a PDN CONNECTIVITY REQUEST message, and the attach procedure fails due to a default EPS bearer setup failure, an ESM procedure failure or operator determined barring, the MME shall:

If the attach request is rejected due to NAS level mobility management congestion control, the network shall set the EMM cause value to #22 "congestion" and assign a back-off timer T3346.

Based on operator policy, if the attach request is rejected due to core network redirection for CIoT optimizations, the network shall set the EMM cause value to #31 "Redirection to 5GCN required".

NOTE 1: The network can take into account the UE’s N1 mode capability, the 5GS CIoT network behaviour supported by the UE or the 5GS CIoT network behaviour supported by the 5GCN to determine the rejection with the EMM cause value #31 "Redirection to 5GCN required".

Upon receiving the ATTACH REJECT message, if the message is integrity protected or contains a reject cause other than EMM cause value #25, the UE shall stop timer T3410 and enter MM state MM IDLE.

If the ATTACH REJECT message with EMM cause #25 was received without integrity protection, then the UE shall discard the message.

The UE shall take the following actions depending on the EMM cause value received in the ATTACH REJECT message.

#3 (Illegal UE);

#6 (Illegal ME); or

#8 (EPS services and non-EPS services not allowed);

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to clause5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI.

The UE shall consider the USIM as invalid for EPS and non-EPS services until switching off or the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.7a. Additionally, the UE shall delete the list of equivalent PLMNs and shall enter the state EMM-DEREGISTERED.NO-IMSI. If the message has been successfully integrity checked by the NAS and the UE maintains a counter for "SIM/USIM considered invalid for GPRS services", then the UE shall set this counter to UE implementation-specific maximum value. If the message has been successfully integrity checked by the NAS and the UE maintains a counter for "SIM/USIM considered invalid for non-GPRS services", then the UE shall set this counter to UE implementation-specific maximum value.

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the MM parameters update status, TMSI, LAI and ciphering key sequence number, and the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number as specified in 3GPP TS 24.008 [13] for the case when the combined attach procedure is rejected with the GMM cause with the same value.

#7 (EPS services not allowed);

A UE which is already IMSI attached for non-EPS services is still IMSI attached for non-EPS services and shall set the update status to U2 NOT UPDATED.

The UE shall attempt to select GERAN or UTRAN radio access technology and shall proceed with the appropriate MM specific procedure according to the MM service state. The UE shall not reselect E-UTRAN radio access technology until switching off or the UICC containing the USIM is removed.

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number as specified in 3GPP TS 24.008 [13] for the case when the combined attach procedure is rejected with the GMM cause with the same value.

#11 (PLMN not allowed); or

#35 (Requested service option not authorized in this PLMN);

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI, and reset the attach attempt counter. The UE shall delete the list of equivalent PLMNs and enter the state EMM-DEREGISTERED.PLMN-SEARCH.

The UE shall store the PLMN identity in the "forbidden PLMN list" and if the UE is configured to use timer T3245 (see 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17]) then the UE shall start timer T3245 and proceed as described in clause 5.3.7a. If the message has been successfully integrity checked by the NAS and the UE maintains a PLMN-specific attempt counter for that PLMN, then the UE shall set this counter to the UE implementation-specific maximum value.

The UE shall perform a PLMN selection according to 3GPP TS 23.122 [6].

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the MM parameters update status, TMSI, LAI, ciphering key sequence number and location update attempt counter, and the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and GPRS attach attempt counter as specified in 3GPP TS 24.008 [13] for the case when the combined attach procedure is rejected with the GMM cause value #11 and no RR connection exists.

#12 (Tracking area not allowed);

The UE shall store the current TAI in the list of "forbidden tracking areas for regional provision of service". If the ATTACH REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "forbidden tracking areas for regional provision of service" for non-integrity protected NAS reject message.

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the MM parameters update status, TMSI, LAI, ciphering key sequence number and location update attempt counter, and the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and GPRS attach attempt counter as specified in 3GPP TS 24.008 [13] for the case when the combined attach procedure is rejected with the GMM cause with the same value.

If the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, 5G-GUTI, last visited registered TAI, TAI list, ngKSI and registration attempt counter as specified in 3GPP TS 24.501 [54] for the case when the initial registration procedure performed over 3GPP access is rejected with the 5GMM cause with the same value.

#13 (Roaming not allowed in this tracking area);

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI. The UE shall delete the list of equivalent PLMNs and reset the attach attempt counter. Additionally the UE enter the state EMM-DEREGISTERED.LIMITED-SERVICE or optionally EMM-DEREGISTERED.PLMN-SEARCH.

If the UE is registered in N1 mode and operating in dual-registration mode, the PLMN that the UE chooses to register in is specified in 3GPP TS 24.501 [54] clause 4.8.3. Otherwise the UE shall perform a PLMN selection according to 3GPP TS 23.122 [6].

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the MM parameters update status, TMSI, LAI, ciphering key sequence number and location update attempt counter, and the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and GPRS attach attempt counter as specified in 3GPP TS 24.008 [13] for the case when the combined attach procedure is rejected with the GMM cause with the same value.

If the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, 5G-GUTI, last visited registered TAI, TAI list, ngKSI and registration attempt counter as specified in 3GPP TS 24.501 [54] for the case when the initial registration procedure performed over 3GPP access is rejected with the 5GMM cause with the same value.

#14 (EPS services not allowed in this PLMN);

The UE shall store the PLMN identity in the "forbidden PLMNs for GPRS service" list and if the UE is configured to use timer T3245 (see 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17]) then the UE shall start timer T3245 and proceed as described in clause 5.3.7a. If the message has been successfully integrity checked by the NAS and the UE maintains a PLMN-specific PS-attempt counter for that PLMN, then the UE shall set this counter to the UE implementation-specific maximum value.

A UE operating in CS/PS mode 1 or CS/PS mode 2 of operation which is already IMSI attached for non-EPS services is still IMSI attached for non-EPS services and shall set the update status to U2 NOT UPDATED.

A UE operating in CS/PS mode 1 of operation and supporting A/Gb or Iu mode may select GERAN or UTRAN radio access technology and proceed with the appropriate MM specific procedure according to the MM service state. In this case, the UE shall disable the E-UTRA capability (see clause 4.5).

A UE operating in CS/PS mode 1 of operation and supporting A/Gb or Iu mode may perform a PLMN selection according to 3GPP TS 23.122 [6].

A UE operating in CS/PS mode 1 of operation and supporting S1 mode only, or operating in CS/PS mode 2 of operation shall delete the list of equivalent PLMNs and shall perform a PLMN selection according to 3GPP TS 23.122 [6].

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and GPRS attach attempt counter as specified in 3GPP TS 24.008 [13] for the case when the combined attach procedure is rejected with the GMM cause with the same value.

#15 (No suitable cells in tracking area);

– if the UE is in WB-S1 mode and the Extended EMM cause IE with value "E-UTRAN not allowed" is included in the ATTACH REJECT message, the UE supports "E-UTRA Disabling for EMM cause #15", and the "E-UTRA Disabling Allowed for EMM cause #15" parameter as specified in 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17] is present and set to enabled, then the UE shall disable the E-UTRA capability as specified in clause 4.5 and search for a suitable cell in another location area or 5GS tracking area;

– otherwise, the UE shall search for a suitable cell in another tracking area or in another location area according to 3GPP TS 36.304 [21].

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the MM parameters update status, TMSI, LAI, ciphering key sequence number and location update attempt counter, and the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and GPRS attach attempt counter as specified in 3GPP TS 24.008 [13] for the case when the combined attach procedure is rejected with the GMM cause with the same value.

If the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, 5G-GUTI, last visited registered TAI, TAI list, ngKSI and registration attempt counter as specified in 3GPP TS 24.501 [54] for the case when the initial registration procedure performed over 3GPP access is rejected with the 5GMM cause with the same value.

#22 (Congestion);

The UE shall abort the attach procedure, reset the attach attempt counter, set the EPS update status to EU2 NOT UPDATED and enter state EMM-DEREGISTERED.ATTEMPTING-TO-ATTACH.

The UE shall stop timer T3346 if it is running.

If the ATTACH REJECT message is integrity protected, the UE shall start timer T3346 with the value provided in the T3346 value IE.

If the ATTACH REJECT message is not integrity protected, the UE shall start timer T3346 with a random value from the default range specified in 3GPP TS 24.008 [13].

The UE stays in the current serving cell and applies the normal cell reselection process. The attach procedure is started if still needed when timer T3346 expires or is stopped.

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the GMM parameters GMM state, GPRS update status and GPRS attach attempt counter as specified in 3GPP TS 24.008 [13] for the case when the combined attach procedure is rejected with the GMM cause with the same value.

#25 (Not authorized for this CSG);

The UE shall search for a suitable cell according to 3GPP TS 36.304 [21].

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the MM parameters update status and location update attempt counter, and GMM parameters GMM state, GPRS update status and GPRS attach attempt counter as specified in 3GPP TS 24.008 [13] for the case when the combined attach procedure is rejected with the GMM cause with the same value.

#31 (Redirection to 5GCN required);

The UE shall enable N1 mode capability for 3GPP access if it was disabled and disable the E-UTRA capability (see clause 4.5) and enter state EMM-DEREGISTERED.NO-CELL-AVAILABLE.

If the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, 5G-GUTI, last visited registered TAI, TAI list, ngKSI and registration attempt counter as specified in 3GPP TS 24.501 [54] for the case when the initial registration procedure performed over 3GPP access is rejected with the 5GMM cause with the same value.

#42 (Severe network failure);

The UE shall set the EPS update status to EU2 NOT UPDATED, and shall delete any GUTI, last visited registered TAI, TAI list, eKSI, and list of equivalent PLMNs, and set the attach attempt counter to 5. The UE shall start an implementation specific timer, setting its value to 2 times the value of T as defined in 3GPP TS 23.122 [6]. While this timer is running, the UE shall not consider the PLMN + RAT combination that provided this reject cause as a candidate for PLMN selection. The UE then enters state EMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection according to 3GPP TS 23.122 [6].

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition set the GMM state to GMM-DEREGISTERED, GPRS update status to GU2 NOT UPDATED signature, RAI and GPRS ciphering key sequence number TMSI and ciphering key sequence number.

Other values are considered as abnormal cases. The behaviour of the UE in those cases is specified in clause 5.5.1.3.6.

5.5.1.3.6 Abnormal cases in the UE

The UE shall proceed as follows:

1) if the UE requested the combined attach for EPS services and "SMS only" and the ATTACH ACCEPT message indicates a combined attach successful for EPS and non-EPS services, the UE shall behave as if the combined attach was successful for EPS services and "SMS only";

NOTE: In this case the UE can ignore the CS SERVICE NOTIFICATION message or the Paging with CN domain indicator set to "CS", as specified in clause 5.6.2.3.2.

2) if the combined attach was successful for EPS services only and the ATTACH ACCEPT message contained an EMM cause value not treated in clause 5.5.1.3.4.3 or the EMM cause IE is not included in the message, the UE shall proceed as follows:

a) The UE shall stop timer T3410 if still running, and shall enter state MM IDLE. The tracking area updating attempt counter shall be incremented, unless it was already set to 5;

b) If the tracking area updating attempt counter is less than 5:

c) If the tracking area updating attempt counter is equal to 5:

– a UE operating in CS/PS mode 2 of operation and a UE operating in CS/PS mode 1 of operation with "IMS voice available" shall start timer T3402 if the value of the timer as indicated by the network is not zero, shall set the EPS update status to EU1 UPDATED and shall enter state EMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM.

– If the value of T3402 as indicated by the network is zero, the UE shall perform the actions defined for the expiry of the timer T3402.

– When timer T3402 expires the combined tracking area updating procedure indicating "combined TA/LA updating with IMSI attach" is triggered; and

– a UE operating in CS/PS mode 1 of operation with "IMS voice not available" shall attempt to select GERAN, UTRAN or NG-RAN radio access technology and proceed with appropriate MM, GMM or 5GMM specific procedures. If the UE selects GERAN or UTRAN radio access technology, the UE may disable the E-UTRA capability (see clause 4.5). If No E-UTRA Disabling In 5GS is enabled at the UE (see 3GPP TS 24.368 [50] or 3GPP TS 31.102 [17]) and the UE selects NG-RAN radio access technology, it shall not disable the E-UTRA capability; otherwise, the UE may disable the E-UTRA capability as specified in clause 4.5; and

NOTE 2: Whether the UE requests RRC to treat the active E-UTRA cell as barred (see 3GPP TS 36.304 [21]) is left to the UE implementation.

d) If there is a CS fallback emergency call pending or CS fallback call pending, the UE shall attempt to select GERAN or UTRAN radio access technology. If the UE finds a suitable GERAN or UTRAN cell, it then proceeds with the appropriate MM and CC specific procedures; otherwise the EMM sublayer shall indicate the abort of the EMM procedure to the MM sublayer; and

3) otherwise, the abnormal cases specified in clause 5.5.1.2.6 apply with the following modification.

If the attach attempt counter is incremented according to clause 5.5.1.2.6 the next actions depend on the value of the attach attempt counter:

– if the attach attempt counter is less than 5, the UE shall set the update status to U2 NOT UPDATED but shall not delete any LAI, TMSI, ciphering key sequence number and list of equivalent PLMNs; or

– if the attach attempt counter is equal to 5, then the UE shall delete any LAI, TMSI, ciphering key sequence number and list of equivalent PLMNs and set the update status to U2 NOT UPDATED.

– The UE shall attempt to select GERAN, UTRAN or NG-RAN radio access technology and proceed with appropriate MM, GMM or 5GMM specific procedures. Additionally, if the UE selects GERAN or UTRAN radio access technology, the UE may disable the E-UTRA capability as specified in clause 4.5. If No E-UTRA Disabling In 5GS is enabled at the UE (see 3GPP TS 24.368 [50] or 3GPP TS 31.102 [17]) and the UE selects NG-RAN radio access technology, it shall not disable the E-UTRA capability; otherwise, the UE may disable the E-UTRA capability as specified in clause 4.5.

NOTE 3: Whether the UE requests RRC to treat the active E-UTRA cell as barred (see 3GPP TS 36.304 [21]) is left to the UE implementation.

If there is a CS fallback emergency call pending or CS fallback call pending, the UE shall attempt to select GERAN or UTRAN radio access technology. If the UE finds a suitable GERAN or UTRAN cell, it then proceeds with the appropriate MM and CC specific procedures; otherwise the EMM sublayer shall indicate the abort of the EMM procedure to the MM sublayer.

5.5.1.3.7 Abnormal cases on the network side

The abnormal cases specified in clause 5.5.1.2.7 apply.