5.6 5GMM connection management procedures

24.5013GPPNon-Access-Stratum (NAS) protocol for 5G System (5GS)Release 18Stage 3TS

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

5.6.1 Service request procedure

5.6.1.1 General

The purpose of the service request procedure is to change the 5GMM mode from 5GMM-IDLE to 5GMM-CONNECTED mode. If the UE is not using 5GS services with control plane CIoT 5GS optimization, this procedure is used to request the establishment of user-plane resources for PDU sessions which are established without user-plane resources. In latter case, the 5GMM mode can be the 5GMM-IDLE mode or the 5GMM-CONNECTED mode if the UE requires to establish user-plane resources for PDU sessions. If the UE is using 5GS services with control plane CIoT 5GS optimization, this procedure can be used for UE initiated transfer of user data via the control plane from 5GMM-IDLE mode.

NOTE 1: The lower layer indicates when the user-plane resources for PDU sessions are successfully established or released.

This procedure is used when:

– the network has downlink signalling pending over 3GPP access and the UE is in 5GMM-IDLE mode over 3GPP access;

– the network has downlink signalling pending over non-3GPP access, the UE is in 5GMM-IDLE mode over non-3GPP access and in 5GMM-IDLE or 5GMM-CONNECTED mode over 3GPP access;

– the UE has uplink signalling pending over 3GPP access and the UE is in 5GMM-IDLE mode over 3GPP access;

– the network has downlink user data pending over 3GPP access and the UE is in 5GMM-IDLE mode over 3GPP access;

– the network has downlink user data pending over non-3GPP access, the UE is in 5GMM-IDLE mode over non-3GPP access and in 5GMM-IDLE or 5GMM-CONNECTED mode over 3GPP access;

– the UE has user data pending over 3GPP access and the UE is in 5GMM-IDLE or 5GMM-CONNECTED mode over 3GPP access;

– the UE has user data pending over non-3GPP access and the UE is in 5GMM-CONNECTED mode over non-3GPP access;

– the UE in 5GMM-IDLE mode over non-3GPP access, receives an indication from the lower layers of non-3GPP access, that the access stratum connection is established between the UE and the network, if T3346 is not running;

– the UE in 5GMM-IDLE or 5GMM-CONNECTED mode over 3GPP access receives a request from the upper layers to perform emergency services fallback and performs emergency services fallback as specified in subclause 4.13.4.2 of 3GPP TS 23.502 [9];

– the UE has to request resources for V2X communication over PC5;

– the UE has to request resources for 5G ProSe direct discovery over PC5 or 5G ProSe direct communication over PC5;

– the MUSIM UE in 5GMM-IDLE mode requests the network to remove the paging restriction; or

– the MUSIM UE requests the release of the NAS signalling connection or rejects the paging request from the network.

This procedure shall not be used for:

a) initiating user data transfer; or

b) PDU session management related signalling other than for performing UE-requested PDU session release procedure related to a PDU session for LADN or for performing the UE-requested PDU session modification procedure to indicate a change of 3GPP PS data off UE status;

when the UE is located outside the LADN service area.

In NB-N1 mode, this procedure shall not be used to request the establishment of user-plane resources:

a) for a number of PDU sessions that exceeds the UE’ s maximum number of supported user-plane resources if there is currently:

1) no user-plane resources established for the UE;

2) user-plane resources established for:

i) one PDU session and the Multiple user-plane resources support bit was set to "Multiple user-plane resources not supported" in the 5GMM capability IE; or

ii) two PDU sessions and the Multiple user-plane resources support bit was set to "Multiple user-plane resources supported" in the 5GMM capability IE; or

b) for additional PDU sessions, if the number of PDU sessions for which user-plane resources are currently established is equal to the UE’s maximum number of supported user-plane resources.

The service request procedure is initiated by the UE, however, it can be triggered by the network by means of:

– the paging procedure (see subclause 5.6.2) for the transfer of downlink signalling or user data pending over 3GPP access to a UE in 5GMM-IDLE mode over 3GPP access;

– the paging procedure (see subclause 5.6.2) for the transfer of downlink signalling or user data pending over non-3GPP access to a UE in 5GMM-IDLE mode over 3GPP access and in 5GMM-IDLE mode over non-3GPP access;

– the notification procedure (see subclause 5.6.3) for the transfer of downlink signalling or user data pending over non-3GPP access to a UE in 5GMM-CONNECTED mode over 3GPP access and in 5GMM-IDLE mode over non-3GPP access; or

– the notification procedure (see subclause 5.6.3) for the transfer of downlink signalling or user data pending over 3GPP access to a UE in 5GMM-IDLE mode over 3GPP access and in 5GMM-CONNECTED mode over non-3GPP access.

NOTE 2: In case the UE is in 5GMM-IDLE mode over 3GPP access and in 5GMM-CONNECTED mode over non-3GPP access and downlink signalling or user data pending over 3GPP access needs to be transferred, the AMF can trigger either the notification procedure or the paging procedure based on implementation.

The UE shall invoke the service request procedure when:

a) the UE, in 5GMM-IDLE mode over 3GPP access, receives a paging request from the network;

NOTE 3: As an implementation option, the MUSIM UE is allowed to not invoke service request to respond to paging based on the information available in the paging message, e.g. voice service indication.

b) the UE, in 5GMM-CONNECTED mode over 3GPP access, receives a notification from the network with access type indicating non-3GPP access;

c) the UE, in 5GMM-IDLE mode over 3GPP access, has uplink signalling pending (except in case i);

d) the UE, in 5GMM-IDLE mode over 3GPP access, has uplink user data pending (except in case j);

e) the UE, in 5GMM-CONNECTED mode or in 5GMM-CONNECTED mode with RRC inactive indication, has user data pending due to no user-plane resources established for PDU session(s) used for user data transport;

f) the UE in 5GMM-IDLE mode over non-3GPP access, with T3346 not active or upon expiry of T3346, receives or has already received an indication from the lower layers of non-3GPP access, that the access stratum connection is established between the UE and the network;

g) the UE, in 5GMM-IDLE mode over 3GPP access, receives a notification from the network with access type indicating 3GPP access when the UE is in 5GMM-CONNECTED mode over non-3GPP access;

h) the UE, in 5GMM-IDLE, 5GMM-CONNECTED mode over 3GPP access, or 5GMM-CONNECTED mode with RRC inactive indication, receives a request from the upper layers to perform emergency services fallback and performs emergency services fallback as specified in subclause 4.13.4.2 of 3GPP TS 23.502 [9];

i) the UE, in 5GMM-CONNECTED mode over 3GPP access or in 5GMM-CONNECTED mode with RRC inactive indication, receives a fallback indication from the lower layers (see subclauses 5.3.1.2 and 5.3.1.4) and the UE has a pending NAS procedure other than a registration, service request, or de-registration procedure;

j) the UE, in 5GMM-CONNECTED mode over 3GPP access or in 5GMM-CONNECTED mode with RRC inactive indication, receives a fallback indication from the lower layers (see subclauses 5.3.1.2 and 5.3.1.4) and the UE has pending uplink user data for PDU session(s) with user-plane resources already established but no pending NAS procedure;

k) the UE, in 5GMM-CONNECTED mode and has a NAS signalling connection only, is using 5GS services with control plane CIoT 5GS optimization and has pending user data to be sent via user-plane resources;

l) the UE in 5GMM-IDLE mode over 3GPP access has to request resources for V2X communication over PC5 (see 3GPP TS 23.287 [6C]);

m) the network supports the paging restriction, and the MUSIM UE in 5GMM-IDLE mode is requesting the network to remove the paging restriction;

n) the UE in 5GMM-IDLE mode over 3GPP access

– has to request resources for 5G ProSe direct discovery over PC5 or 5G ProSe direct communication over PC5 (see 3GPP TS 23.304 [6E]); or

– acts as a 5G ProSe layer-2 UE-to-network relay UE and receives a trigger from lower layers to establish the NAS signalling connection (see 3GPP TS 23.304 [6E]);

o) the network supports the N1 NAS signalling connection release, the MUSIM UE,

– is in 5GMM-CONNECTED mode, requests the network to release the NAS signalling connection and, if the network supports the paging restriction, optionally includes paging restriction;

– is in 5GMM-CONNECTED mode with RRC inactive indication, requests the network to release the NAS signalling connection and, if the network supports the paging restriction, optionally includes paging restriction; or

– is in 5GMM-CONNECTED mode with RRC inactive indication, rejects the RAN paging, requests the network to release the NAS signalling connection and, if the network supports the paging restriction, optionally includes paging restriction; or

p) the network supports the reject paging request, the MUSIM UE in 5GMM-IDLE mode when responding to paging rejects the paging request from the network, requests the network to release the NAS signalling connection and, if the network supports the paging restriction, optionally includes paging restriction.

If one of the above criteria to invoke the service request procedure is fulfilled, then the service request procedure shall only be initiated by the UE when the following conditions are fulfilled:

– its 5GS update status is 5U1 UPDATED, and the TAI of the current serving cell is included in the TAI list; and

– no 5GMM specific procedure is ongoing.

The UE shall not invoke the service request procedure when the UE is in the state 5GMM-SERVICE-REQUEST-INITIATED.

The MUSIM UE shall not initiate service request procedure for requesting the network to release the N1 NAS signalling connection if the UE is registered for emergency services or if the UE has an emergency PDU session established. To enable the emergency call back, the UE shall not initiate service request procedure for requesting the network to release the NAS signalling connection for a UE implementation-specific duration of time after the completion of the emergency services.

Figure 5.6.1.1.1: Service Request procedure (Part 1)

Figure 5.6.1.1.2: Service Request procedure (Part 2)

A service request attempt counter is used to limit the number of service request attempts and no response from the network. The service request attempt counter shall be incremented as specified in subclause 5.6.1.7.

The service request attempt counter shall be reset when:

– a registration procedure for mobility and periodic registration update is successfully completed;

– a service request procedure is successfully completed;

– a service request procedure is rejected as specified in subclause 5.6.1.5 or subclause 5.3.20; or

– the UE moves to 5GMM-DEREGISTERED state.

5.6.1.2 Service request procedure initiation

5.6.1.2.1 UE is not using 5GS services with control plane CIoT 5GS optimization

The UE initiates the service request procedure by sending a SERVICE REQUEST message to the AMF. The UE shall start timer T3517 and enter the state 5GMM-SERVICE-REQUEST-INITIATED.

If the UE is sending the SERVICE REQUEST message from 5GMM-IDLE mode and the UE needs to send non-cleartext IEs, the UE shall send the SERVICE REQUEST message including the NAS message container IE as described in subclause 4.4.6.

For cases a), b), and g) in subclause 5.6.1.1, the service type IE in the SERVICE REQUEST message shall be set to "mobile terminated services".

For cases c), d), e), f), i), j), l) m) and n) in subclause 5.6.1.1, if the UE is a UE configured for high priority access in selected PLMN or SNPN, the service type IE in the SERVICE REQUEST message shall be set to "high priority access".

For case a) in subclause 5.6.1.1:

a) if the paging request includes an indication for non-3GPP access type, the Allowed PDU session status IE shall be included in the SERVICE REQUEST message. If the UE has established the PDU session(s) over the non-3GPP access for which the associated S-NSSAI(s) are included in the allowed NSSAI for 3GPP access, the UE shall indicate the PDU session(s) for which the UE allows the user-plane resources to be re-established over 3GPP access in the Allowed PDU session status IE. Otherwise, the UE shall not indicate any PDU session(s) in the Allowed PDU session status IE; and

b) if the UE has uplink user data pending to be sent over 3GPP access, the Uplink data status IE shall be included in the SERVICE REQUEST message to indicate the PDU session(s) for which the UE has pending user data to be sent. Otherwise, the Uplink data status IE shall not be included in the SERVICE REQUEST message.

For case b) in subclause 5.6.1.1:

a) the Allowed PDU session status IE shall be included in the SERVICE REQUEST message. If the UE has the PDU session(s) over the non-3GPP access for which the associated S-NSSAI(s) are included in the allowed NSSAI for 3GPP access, the UE shall indicate the PDU session(s) for which the UE allows the user-plane resources to be re-established over 3GPP access in the Allowed PDU session status IE. Otherwise, the UE shall not indicate any PDU session(s) in the Allowed PDU session status IE; and

When the Allowed PDU session status IE is included in the SERVICE REQUEST message, the UE shall indicate that a PDU session is not allowed to be transferred to the 3GPP access if the 3GPP PS data off UE status is "activated" for the corresponding PDU session and the UE is not using the PDU session to send uplink IP packets for any of the 3GPP PS data off exempt services (see subclause 6.2.10).

For case c) in subclause 5.6.1.1, the Uplink data status IE shall not be included in the SERVICE REQUEST message except if the UE has one or more active always-on PDU sessions associated with the access type over which the SERVICE REQUEST message is sent. If the UE is not a UE configured for high priority access in selected PLMN or SNPN and:

a) if the SERVICE REQUEST message is triggered by a request for emergency services from the upper layer, the UE shall set the service type IE in the SERVICE REQUEST message to "emergency services"; or

b) otherwise, the UE shall set the service type IE to "signalling".

When the UE is in a non-allowed area or is not in an allowed area as specified in subclause 5.3.5 and:

a) if the uplink signalling pending is to indicate a change of 3GPP PS data off UE status for a PDU session, the UE shall set the service type IE in the SERVICE REQUEST message to "elevated signalling", and shall not include the Uplink data status IE in the SERVICE REQUEST message even if the UE has one or more active always-on PDU sessions associated with the access type over which the SERVICE REQUEST message is sent; or

b) otherwise, the UE shall not initiate service request procedure except for emergency services, high priority access or responding to paging or notification.

For cases d) and e) in subclause 5.6.1.1, the Uplink data status IE shall be included in the SERVICE REQUEST message to indicate the PDU session(s) the UE has pending user data to be sent. If the UE is not a UE configured for high priority access in selected PLMN or SNPN:

a) if there exists an emergency PDU session which is indicated in the Uplink data status IE the service type IE in the SERVICE REQUEST message shall be set to "emergency services"; or

b) otherwise, the service type IE in the SERVICE REQUEST message shall be set to "data".

NOTE 1: For a UE in NB-N1 mode, the Uplink data status IE cannot be used to request the establishment of user-plane resources such that there will be user-plane resources established for a number of PDU sessions that exceeds the UE’s maximum number of supported user-plane resources.

For case f) in subclause 5.6.1.1:

a) if the UE has uplink user data pending to be sent, the Uplink data status IE shall be included in the SERVICE REQUEST message to indicate the PDU session(s) the UE has pending user data to be sent. If the UE is not a UE configured for high priority access in selected PLMN or SNPN, the service type IE in the SERVICE REQUEST message shall be set to "data";

b) otherwise, if the UE is not a UE configured for high priority access in selected PLMN or SNPN, the service type IE in the SERVICE REQUEST message shall be set to "signalling".

For case g) in subclause 5.6.1.1, if the UE has uplink user data pending to be sent, the Uplink data status IE shall be included in the SERVICE REQUEST message to indicate the PDU session(s) the UE has pending user data to be sent.

For case h) in subclause 5.6.1.1, the UE shall send a SERVICE REQUEST message with service type set to "emergency services fallback" and without an Uplink data status IE.

For case i) in subclause 5.6.1.1, if the UE is not configured for high priority access in selected PLMN or SNPN, the UE shall set the Service type IE in the SERVICE REQUEST message as follows:

a) if the pending message is an UL NAS TRANSPORT message with the Request type IE set to "initial emergency request" or "existing emergency PDU session", the UE shall set the Service type IE in the SERVICE REQUEST message to "emergency services"; or

b) otherwise, the UE shall set the Service type IE in the SERVICE REQUEST message to "signalling".

For case j) in subclause 5.6.1.1:

a) the UE shall include the Uplink data status IE in the SERVICE REQUEST message indicating the PDU session(s) for which user-plane resources were active prior to receiving the fallback indication, if any; and

b) if the UE is not a UE configured for high priority access in selected PLMN or SNPN, the UE shall set the Service type IE in the SERVICE REQUEST message as follows:

1) if there is an emergency PDU session which is indicated in the Uplink data status IE, the UE shall set the Service type IE in the SERVICE REQUEST message to "emergency services"; or

2) if there is no emergency PDU session which is indicated in the Uplink data status IE, the UE shall set the Service type IE in the SERVICE REQUEST message to "data".

For case l) and n) in subclause 5.6.1.1, if the UE is not a UE configured for high priority access in selected PLMN or SNPN:

a) if there exists an emergency PDU session which is indicated in the Uplink data status IE the service type IE in the SERVICE REQUEST message shall be set to "emergency services"; or

b) otherwise, the service type IE in the SERVICE REQUEST message shall be set to "signalling".

For case m) in subclause 5.6.1.1, the UE shall not include the Paging restriction IE in the SERVICE REQUEST message and set Service type to "signalling". The UE may include the UE request type IE and set Request type to "NAS signalling connection release" to remove the paging restriction and request the release of the NAS signalling connection at the same time. If the UE requests the release of the NAS signalling connection, the UE shall not include the Uplink data status IE in the SERVICE REQUEST message.

For cases o and p in subclause 5.6.1.1, the UE shall not include the Uplink data status IE and the Allowed PDU session status IE in the SERVICE REQUEST message. Further,

– for case o in subclause 5.6.1.1, the UE shall set Request type to "NAS signalling connection release" in the UE request type IE and Service type to "signalling";

– for case p in subclause 5.6.1.1, the UE shall set Request type to "Rejection of paging" in the UE request type IE and Service type to "mobile terminated services"; and

may include its paging restriction preference in the Paging restriction IE in the SERVICE REQUEST message.

The UE shall include a valid 5G-S-TMSI in the 5G-S-TMSI IE of the SERVICE REQUEST message.

For all cases except cases o) and p) in subclause 5.6.1.1, if the UE has one or more active always-on PDU sessions associated with the access type over which the SERVICE REQUEST message is sent and the user-plane resources for these PDU sessions are not established, the UE shall include the Uplink data status IE in the SERVICE REQUEST message and indicate that the UE has pending user data to be sent for those PDU sessions.

If the UE has one or more active PDU sessions which are not accepted by the network as always-on PDU sessions and no uplink user data pending to be sent for those PDU sessions, the UE shall not include those PDU sessions in the Uplink data status IE in the SERVICE REQUEST message.

The Uplink data status IE may be included in the SERVICE REQUEST message to indicate which PDU session(s) associated with the access type the SERVICE REQUEST message is sent over have pending user data to be sent.

The PDU session status information element may be included in the SERVICE REQUEST message to indicate:

– the single access PDU session(s) not in 5GSM state PDU SESSION INACTIVE in the UE associated with the access type the SERVICE REQUEST message is sent over; and

– the MA PDU session(s) not in 5GSM state PDU SESSION INACTIVE and having the corresponding user plane resources being established or established in the UE on the access the SERVICE REQUEST message is sent over.

If the SERVICE REQUEST message includes a NAS message container IE, the AMF shall process the SERVICE REQUEST message that is obtained from the NAS message container IE as described in subclause 4.4.6.

If the UE has an emergency PDU session over the non-current access, it shall not initiate the SERVICE REQUEST message with the service type IE set to "emergency services" over the current access, unless the SERVICE REQUEST message has to be initiated to perform handover of an existing emergency PDU session from the non-current access to the current access.

NOTE 2: Transfer of an existing emergency PDU session between 3GPP access and non-3GPP access is needed e.g. if the UE determines that the current access is no longer available.

5.6.1.2.2 UE is using 5GS services with control plane CIoT 5GS optimization

The UE shall send a CONTROL PLANE SERVICE REQUEST message, start T3517 and enter the state 5GMM-SERVICE-REQUEST-INITIATED.

For case a), and case b) in subclause 5.6.1.1, the Control plane service type of the CONTROL PLANE SERVICE REQUEST message shall indicate "mobile terminating request". If:

a) the UE only has uplink CIoT user data or SMS to be sent, the UE shall:

1) if the data size is not more than 254 octets and there is no other optional IE to be included in the message:

i) for sending CIoT user data, set the Data type field to "control plane user data", include the PDU session ID, data, and Downlink data expected (DDX) (if available), in the CIoT small data container IE; and

ii) for sending SMS, set the Data type field to "SMS", include SMS in the CIoT small data container IE; and

2) otherwise if the data size is more than 254 octets or there are other optional IEs to be included in the message:

i) for sending CIoT user data, set the Payload container type IE to "CIoT user data container", include the PDU session ID in the PDU session ID IE and include data in the Payload container IE as described in subclause 5.4.5.2.2; and

ii) for sending SMS, set the Payload container type IE to "SMS" and include data in the Payload container IE as described in subclause 5.4.5.2.2; and

b) the paging request or the notification includes an indication for non-3GPP access type, the UE has at least one PDU session that is not associated with control plane only indication, the Allowed PDU session status IE shall be included in the CONTROL PLANE SERVICE REQUEST message.

NOTE 1: The term DDX used in the present document corresponds to the term NAS RAI used in 3GPP TS 23.502 [9].

For case c), and case d) if the UE has pending CIoT user data that is to be sent via the control plane in subclause 5.6.1.1, the UE shall set the Control plane service type of the CONTROL PLANE SERVICE REQUEST message to "mobile originating request". If the UE has only uplink CIoT user data, SMS or location services message to be sent, the UE shall:

a) if the data size is not more than 254 octets, there is no other optional IE to be included in the CONTROL PLANE SERVICE REQUEST message, and the data being sent is:

1) CIoT user data, set the Data type field to "control plane user data", include the PDU session ID, data, and Downlink data expected (DDX) (if available), in the CIoT small data container IE;

2) location services message, set the Data type field to "Location services message container" and Downlink data expected (DDX), if available, in the CIoT small data container IE, and:

i) if routing information is provided by upper layers:

A) set the length of additional information field in the CIoT small data container IE to the length of routing information provided by upper layer location services application (see subclause 9.11.3.67), and set the additional information field in the CIoT small data container IE to the routing information provided by upper layer location services application (see subclause 9.11.3.67); or

B) otherwise set the length of additional information field in the CIoT small data container IE to zero. In this case the Additional information field of the CIoT small data container IE shall not be included; and

ii) set the Data contents field of the CIoT small data container IE to the location services message payload; or

3) SMS, set the Data type field to "SMS", include SMS in the CIoT small data container IE; or

b) otherwise if the data size is more than 254 octets or there are other optional IEs to be included in the CONTROL PLANE SERVICE REQUEST message, and the data being sent is:

1) CIoT user data, set the Payload container type IE to "CIoT user data container", include the PDU session ID in the PDU session ID IE and include data in the Payload container IE as described in subclause 5.4.5.2.2;

2) location services message, set the Payload container type IE to "Location services message container", include data in the Payload container IE as described in subclause 5.4.5.2.2. If the upper layer location services application provides the routing information set the Additional information IE to the routing information as described in subclause 5.4.5.2.2; or

3) SMS, set the Payload container type IE to "SMS" and include data in the Payload container IE as described in subclause 5.4.5.2.2.

For case a), and case b) in subclause 5.6.1.1, if the UE has pending user data that is to be sent via the user plane, the UE shall set the Control plane service type of the CONTROL PLANE SERVICE REQUEST message to "mobile terminating request". The UE shall include the Uplink data status IE in the CONTROL PLANE SERVICE REQUEST message to indicate which PDU session(s) have pending user data to be sent via user-plane resources.

For case c) in subclause 5.6.1.1, if the UE is in WB-N1 mode and the CONTROL PLANE SERVICE REQUEST message is triggered by a request for emergency services from the upper layer, the UE shall set the Control plane service type of the CONTROL PLANE SERVICE REQUEST message to "emergency services".

For cases d) and k), if the UE has pending user data that is to be sent via the user plane in subclause 5.6.1.1:

a) and if there exists an emergency PDU session which is indicated in the Uplink data status IE, the UE shall set the Control plane service type of the CONTROL PLANE SERVICE REQUEST message to "emergency services"; or

b) otherwise, the UE shall set the Control plane service type to "mobile originating request".

The UE shall include the Uplink data status IE in the CONTROL PLANE SERVICE REQUEST message to indicate which PDU session(s) have pending user data to be sent via user-plane resources.

NOTE 2: For a UE in NB-N1 mode, the Uplink data status IE cannot be used to request the establishment of user-plane resources such that there will be user-plane resources established for a number of PDU sessions that exceeds the UE’s maximum number of supported user-plane resources.

For case h) in subclause 5.6.1.1, if the UE is in WB-N1 mode and the UE does not have any PDU session that is associated with control plane only indication, the UE shall send a CONTROL PLANE SERVICE REQUEST message with the Control plane service type set to "emergency services fallback" and without an Uplink data status IE.

For case i) in subclause 5.6.1.1, the Control plane service type of the CONTROL PLANE SERVICE REQUEST message shall indicate "mobile originating request". If the pending message is an UL NAS TRANSPORT message with the Payload container type IE set to:

a) "SMS", "Location services message container", or "CIoT user data container", the UE shall send the CONTROL PLANE SERVICE REQUEST and include the SMS, location services message, or CIoT user data as described in this subclause; or

b) otherwise, the UE shall send the CONTROL PLANE SERVICE REQUEST:

1) without including the CIoT small data container IE and without including the NAS message container IE if the UE has no other optional IE to be sent; or

2) with the NAS message container IE if the UE has an optional IE to be sent as described in this subclause.

For case j) in subclause 5.6.1.1, the Control plane service type of the CONTROL PLANE SERVICE REQUEST message shall indicate "mobile originating request". The UE shall include the Uplink data status IE in the CONTROL PLANE SERVICE REQUEST message indicating the PDU session(s) for which user-plane resources were active prior to receiving the fallback indication, if any.

For cases o) and p) in subclause 5.6.1.1, the UE shall not include the Uplink data status IE and the Allowed PDU session status IE in the CONTROL PLANE SERVICE REQUEST message. Further,

– for case o) in subclause 5.6.1.1, the UE shall set Request type to "NAS signalling connection release" in the UE request type IE and Control plane service type to "mobile originating request";

– for case p) in subclause 5.6.1.1, the UE shall set Request type to "Rejection of paging" in the UE request type IE and Control plane service type to "mobile terminating request"; and

may include its paging restriction preferences in the Paging restriction IE in the CONTROL PLANE SERVICE REQUEST message.

For case m) in clause 5.6.1.1, the Control plane service type of the CONTROL PLANE SERVICE REQUEST message shall indicate "mobile originating request". The UE shall not include the Paging restriction IE in the CONTROL PLANE SERVICE REQUEST message. The UE may include the UE request type IE and set Request type to "NAS signalling connection release" to remove the paging restriction and request the release of the NAS signalling connection at the same time. If the UE requests the release of the NAS signalling connection, the UE shall not include the Uplink data status IE in the SERVICE REQUEST message.

The UE may include the PDU session status IE in the CONTROL PLANE SERVICE REQUEST message to indicate which PDU session(s) associated with the access type the CONTROL PLANE SERVICE REQUEST message is sent over are active in the UE.

5.6.1.3 Common procedure initiation

Upon receipt of the SERVICE REQUEST or CONTROL PLANE SERVICE REQUEST message, the AMF may initiate the common procedures e.g. the 5G AKA based primary authentication and key agreement procedure or the EAP based primary authentication and key agreement procedure.

5.6.1.4 Service request procedure accepted by the network

5.6.1.4.1 UE is not using 5GS services with control plane CIoT 5GS optimization

For cases other than h) in subclause 5.6.1.1, the UE shall treat the reception of the SERVICE ACCEPT message as successful completion of the procedure. The UE shall reset the service request attempt counter, stop timer T3517 and enter the state 5GMM-REGISTERED.

For case h) in subclause 5.6.1.1,

a) the UE shall treat the indication from the lower layers when the UE has changed to S1 mode or E-UTRA connected to 5GCN (see 3GPP TS 23.502 [9]) as successful completion of the procedure and stop timer T3517;

b) if a UE operating in single-registration mode has changed to S1 mode, it shall disable the N1 mode capability for 3GPP access (see subclause 4.9.2); and

c) the AMF shall not check for CAG restrictions.

If the PDU session status information element is included in the SERVICE REQUEST message, then:

a) for single access PDU sessions, the AMF shall:

1) perform a local release of all those PDU sessions which are not in 5GSM state PDU SESSION INACTIVE on the AMF side associated with the access type the SERVICE REQUEST message is sent over, but are indicated by the UE as being in 5GSM state PDU SESSION INACTIVE; and

2) request the SMF to perform a local release of all those PDU sessions. If any of those PDU sessions is associated with one or more multicast MBS sessions, the SMF shall consider the UE as removed from the associated multicast MBS sessions; and

b) for MA PDU sessions, the AMF shall:

1) for MA PDU sessions having user plane resources established in the AMF only on the access the SERVICE REQUEST message is sent over, but are indicated by the UE as no user plane resources established:

i) for all those MA PDU sessions without a PDN connection established as a user-plane resource, perform a local release of all those MA PDU sessions and request the SMF to perform a local release of all those MA PDU sessions. If the MA PDU session is associated with one or more multicast MBS sessions, the SMF shall consider the UE as removed from the associated multicast MBS sessions; and

ii) for all those MA PDU sessions with a PDN connection established as a user-plane resource, perform a local release of user plane resources of all those PDU sessions on the access the SERVICE REQUEST message is sent over and request the SMF to perform a local release of user plane resources of all those PDU sessions on the access type the SERVICE REQUEST message is sent over; and

2) for MA PDU sessions having user plane resources established on both accesses in the AMF, but are indicated by the UE as no user plane resources established:

i) perform a local release of user plane resources of all those PDU sessions on the access the SERVICE REQUEST message is sent over; and

ii) request the SMF to perform a local release of user plane resources of all those PDU sessions on the access type the SERVICE REQUEST message is sent over. If the SERVICE REQUEST message is sent over 3GPP access and the MA PDU session is associated with one or more multicast MBS sessions, the SMF shall consider the UE as removed from the associated multicast MBS sessions.

If the AMF needs to initiate PDU session status synchronization or a PDU session status IE was included in the SERVICE REQUEST message, the AMF shall include a PDU session status IE in the SERVICE ACCEPT message to indicate:

– which single access PDU sessions associated with the access type the SERVICE ACCEPT message is sent over are not in 5GSM state PDU SESSION INACTIVE in the AMF; and

– which MA PDU sessions are not in 5GSM state PDU SESSION INACTIVE and having user plane resources established in the AMF on the access the SERVICE ACCEPT message is sent over.

If the PDU session status information element is included in the SERVICE ACCEPT message, then:

a) for single access PDU sessions, the UE shall perform a local release of all those PDU sessions which are not in 5GSM state PDU SESSION INACTIVE or PDU SESSION ACTIVE PENDING on the UE side associated with the access type the SERVICE ACCEPT message is sent over, but are indicated by the AMF as in 5GSM state PDU SESSION INACTIVE. If a locally released PDU session is associated with one or more multicast MBS sessions, the UE shall locally leave the associated multicast MBS sessions; and

b) for MA PDU sessions, for all those PDU sessions which are not in 5GSM state PDU SESSION INACTIVE or PDU SESSION ACTIVE PENDING and have user plane resources established on the UE side associated with the access the SERVICE ACCEPT message is sent over, but are indicated by the AMF as no user plane resources established:

1) for MA PDU sessions having user plane resources established only on the access type the SERVICE ACCEPT message is sent over, the UE shall perform a local release of those MA PDU sessions. If a locally released MA PDU session is associated with one or more multicast MBS sessions, the UE shall locally leave the associated multicast MBS sessions; and

2) for MA PDU sessions having user plane resources established on both accesses, the UE shall perform a local release on the user plane resources on the access type the SERVICE ACCEPT message is sent over. If the user plane resources over 3GPP access are released and the MA PDU session is associated with one or more multicast MBS sessions, the UE shall locally leave the associated multicast MBS sessions.

If the Uplink data status IE is included in the SERVICE REQUEST message and the UE is:

a) not in NB-N1 mode; or

b) in NB-N1 mode and the UE does not indicate a request to have user-plane resources established for a number of PDU sessions that exceeds the UE’s maximum number of supported user-plane resources;

the AMF shall:

a) indicate the SMF to re-establish the user-plane resources for the corresponding PDU sessions;

b) include the PDU session reactivation result IE in the SERVICE ACCEPT message to indicate the user-plane resources re-establishment result of the PDU sessions for which the UE requested to re-establish the user-plane resources; and

c) determine the UE presence in LADN service area and forward the UE presence in LADN service area towards the SMF, if the corresponding PDU session is a PDU session for LADN.

If the Allowed PDU session status IE is included in the SERVICE REQUEST message, the AMF shall:

a) for a 5GSM message from each SMF that has indicated pending downlink signalling only, forward the received 5GSM message via 3GPP access to the UE after the SERVICE ACCEPT message is sent;

b) for each SMF that has indicated pending downlink data only:

1) notify the SMF that reactivation of the user-plane resources for the corresponding PDU session(s) associated with non-3GPP access cannot be performed if the corresponding PDU session ID(s) are not indicated in the Allowed PDU session status IE; and

2) notify the SMF that reactivation of the user-plane resources for the corresponding PDU session(s) associated with non-3GPP access can be performed if:

i) for a UE not in NB-N1 mode, the corresponding PDU session ID(s) are indicated in the Allowed PDU session status IE; or

ii) for a UE in NB-N1 mode, the corresponding PDU session ID(s) are indicated in the Allowed PDU session status IE, and the resulting number of PDU sessions with established user-plane resources does not exceed the UE’s maximum number of supported user-plane resources;

c) for each SMF that have indicated pending downlink signalling and data:

2) notify the SMF that reactivation of the user-plane resources for the corresponding PDU session(s) associated with non-3GPP access can be performed if:

i) for a UE not in NB-N1 mode, the corresponding PDU session ID(s) are indicated in the Allowed PDU session status IE; or

3) discard the received 5GSM message for PDU session(s) associated with non-3GPP access; and

d) include the PDU session reactivation result IE in the SERVICE ACCEPT message to indicate the successfully re-established user-plane resources for the corresponding PDU sessions, if any.

If due to regional subscription restrictions or access restrictions the UE is not allowed to access the TA or due to CAG restrictions the UE is not allowed to access the cell, but the UE has an emergency PDU session established, the AMF may accept the SERVICE REQUEST message and indicate to the SMF to perform a local release of all non-emergency PDU sessions (associated with 3GPP access if it is due to CAG restrictions) and informs the UE via the PDU session status IE in the SERVICE ACCEPT message. The AMF shall not indicate to the SMF to release the emergency PDU session. If the AMF indicated to the SMF to perform a local release of all non-emergency PDU sessions (associated with 3GPP access if it is due to CAG restrictions), the network shall behave as if the UE is registered for emergency services.

If the PDU session reactivation result IE is included in the SERVICE ACCEPT message indicating that the user-plane resources have been successfully reactivated for a PDU session that was requested by the UE in the Allowed PDU session status IE, the UE considers the corresponding PDU session to be associated with the 3GPP access. If the user-plane resources of a PDU session have been successfully reactivated over the 3GPP access, the AMF and SMF update the associated access type of the corresponding PDU session.

If the user-plane resources cannot be established for a PDU session, the AMF shall include the PDU session reactivation result IE in the SERVICE ACCEPT message indicating that user-plane resources for the corresponding PDU session cannot be re-established, and:

a) if the user-plane resources cannot be established because the SMF indicated to the AMF that the UE is located out of the LADN service area (see 3GPP TS 29.502 [20A]), the AMF shall include the PDU session reactivation result error cause IE with the 5GMM cause set to #43 "LADN not available";

b) if the user-plane resources cannot be established because the SMF indicated to the AMF that only prioritized services are allowed (see 3GPP TS 29.502 [20A]), the AMF shall include the PDU session reactivation result error cause IE with the 5GMM cause set to #28 "restricted service area";

c) if the user-plane resources cannot be established because the SMF indicated to the AMF that the resource is not available in the UPF (see 3GPP TS 29.502 [20A]), the AMF shall include the PDU session reactivation result error cause IE with the 5GMM cause set to #92 "insufficient user-plane resources for the PDU session";

e) if the user-plane resources cannot be established because the SMF indicated to the AMF that the S-NSSAI associated with the PDU session is unavailable due to NSAC (see 3GPP TS 29.502 [20A]), the AMF shall include the PDU session reactivation result error cause IE with the 5GMM cause set to #69 "insufficient resources for specific slice"; or

d) otherwise, the AMF may include the PDU session reactivation result error cause IE to indicate the cause of failure to re-establish the user-plane resources.

NOTE 1: It is up to UE implementation when to re-send a request for user-plane re-establishment for the associated PDU session after receiving a PDU session reactivation result error cause IE with a 5GMM cause set to #92 "insufficient user-plane resources for the PDU session".

NOTE 2: The UE can locally start a back-off timer after receiving a PDU session reactivation result error cause IE with a 5GMM cause set to #69 "insufficient resources for specific slice". The value of the back-off timer is up to UE implementation. Upon expiry of the back-off timer, the UE can re-send a request for user-plane re-establishment for the associated PDU session.

If the PDU session reactivation result IE is included in the SERVICE ACCEPT message indicating that the user-plane resources cannot be established for a PDU session that was requested by the UE in the Allowed PDU session status IE, the UE considers the corresponding PDU session to be associated with the non-3GPP access.

If the MUSIM UE does not include the Paging restriction IE in the SERVICE REQUEST message, the AMF shall delete any stored paging restriction for the UE and stop restricting paging.

For case m in subclause 5.6.1.1 when the MUSIM UE sets the Request type to "NAS signalling connection release" in the SERVICE REQUEST message, the AMF shall initiate the release of the N1 NAS signalling connection after the completion of the service request procedure.

For cases o and p in subclause 5.6.1.1 when the MUSIM UE sets the Request type to "NAS signalling connection release" or to "Rejection of paging" in the UE request type IE in the SERVICE REQUEST message and if the UE requests restriction of paging by including the Paging restriction IE, the AMF:

– if accepts the paging restriction, shall include the 5GS additional request result IE in the SERVICE ACCEPT message and set the Paging restriction decision to "paging restriction is accepted". The AMF shall store the paging restriction of the UE and enforce these restrictions in the paging procedure as described in clause 5.6.2; or

– if rejects the paging restriction, shall include the 5GS additional request result IE in the SERVICE ACCEPT message and set the Paging restriction decision to "paging restriction is rejected", and shall discard the received paging restriction. The AMF shall delete any stored paging restriction for the UE and stop restricting paging; and

the AMF shall initiate the release of the N1 NAS signalling connection as follows:

– for case o in subclause 5.6.1.1, after the completion of the service request procedure;

– for case p in subclause 5.6.1.1, after the completion of the generic UE configuration update procedure that is triggered after the completion of the service request procedure.

If the SERVICE REQUEST message is for emergency services fallback, the AMF triggers the emergency services fallback procedure as specified in subclause 4.13.4.2 of 3GPP TS 23.502 [9].

If the UE having an emergency PDU session sent the SERVICE REQUEST message via:

a) a CAG cell and none of the CAG-IDs of the CAG cell are included in the "Allowed CAG list" for the current PLMN in the UE’s subscription; or

b) a non-CAG cell in a PLMN for which the UE’s subscription contains an "indication that the UE is only allowed to access 5GS via CAG cells";

the network shall accept the SERVICE REQUEST message and release all non-emergency PDU sessions locally. The emergency PDU session shall not be released.

If the AMF received the list of TAIs from the satellite NG-RAN as described in 3GPP TS 23.501 [8], and determines that, by UE subscription and operator’s preferences, any but not all TAIs in the received list of TAIs is forbidden for roaming or for regional provision of service, the AMF shall include the TAI(s) in:

a) the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for roaming" IE; or

b) the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for regional provision of service" IE; or

c) both;

in the SERVICE ACCEPT message.

NOTE 9: Void.

If the UE receives the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for roaming" IE in the SERVICE ACCEPT message and the TAI(s) included in the IE is not part of the list of "5GS forbidden tracking areas for roaming", the UE shall store the TAI(s) included in the IE into the list of "5GS forbidden tracking areas for roaming" and remove the TAI(s) from the stored TAI list if present.

If the UE receives the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for regional provision of service" IE in the SERVICE ACCEPT message and the TAI(s) included in the IE is not part of the list of "5GS forbidden tracking areas for regional provision of service", the UE shall store the TAI(s) included in the IE into the list of "5GS forbidden tracking areas for regional provision of service" and remove the TAI(s) from the stored TAI list if present.

5.6.1.4.2 UE is using 5GS services with control plane CIoT 5GS optimization

For case a in subclause 5.6.1.1, upon receipt of the CONTROL PLANE SERVICE REQUEST message with Control plane service type indicating "mobile terminating request", after completion of the 5GMM common procedures (if initiated) according to subclause 5.6.1.3, the AMF shall send a SERVICE ACCEPT message.

For cases c, d and m in subclause 5.6.1.1, upon receipt of the CONTROL PLANE SERVICE REQUEST message with Control plane service type indicating "mobile originating request", after completion of the 5GMM common procedures (if initiated) according to subclause 5.6.1.3, the AMF shall send a SERVICE ACCEPT message, except for case d when the DDX field of the Release assistance indication IE or the DDX field of the CIoT small data container IE indicates "No further uplink and no further downlink data transmission subsequent to the uplink data transmission is expected".

For case a, c and d:

a) if the CIoT small data container IE is included in the message, the AMF shall decipher the value part of the CIoT small data container IE and:

1) if the Data type field indicates "control plane user data", extract the PDU session ID and data content from the CIoT small data container IE, look up a PDU session routing context for the UE and the PDU session ID, and forward the content of the CIoT small data container IE to the SMF associated with the UE;

2) if the Data type field indicates "SMS", forward the content of the CIoT small data container IE to the SMSF associated with the UE; or

3) if the Data type field indicates "Location services message container", and if

i) length of additional information field in the CIoT small data container IE is zero, forward the value of Data type field and the content of the CIoT small data container IE to the to the location services application; or

ii) otherwise forward the value of Data type field and the content of the CIoT small data container IE to the LMF associated with the routing information that is included in the additional information field of the CIoT small data container IE; or

NOTE 1: If the AMF determines there is no pending data or signalling for the UE, the AMF provides an indication of control plane CIoT 5GS Optimisation to the LMF as specified in 3GPP TS 29.518 [20B].

b) otherwise, the AMF shall decipher the value part of NAS message container IE and:

1) if the Payload container IE is included in the CONTROL PLANE SERVICE REQUEST message and if the Payload container type IE is set to "CIoT user data container", the AMF shall look up a PDU session routing context for the UE and the PDU session ID, and forward the content of the Payload container IE to the SMF associated with the UE;

2) if the Payload container IE is included in the CONTROL PLANE SERVICE REQUEST message and if the Payload container type IE is set to "SMS", the AMF shall forward the content of the Payload container IE to the SMSF associated with the UE;

3) if the PDU session status IE is included in the CONTROL PLANE SERVICE REQUEST message or the AMF needs to perform a PDU session status synchronization, the AMF shall include a PDU session status IE in the SERVICE ACCEPT message to indicate which PDU sessions associated with the access type the SERVICE ACCEPT message is sent over are active in the AMF;

4) if the Uplink data status IE is included in the CONTROL PLANE SERVICE REQUEST message and the UE is:

i) not in NB-N1 mode; or

ii) in NB-N1 mode and the UE does not indicate a request to have user-plane resources established for a number of PDU sessions that exceeds the UE’s maximum number of supported user-plane resources;

the AMF shall:

i) indicate the SMF to re-establish the user-plane resources for the corresponding PDU sessions; and

ii) include the PDU session reactivation result IE in the SERVICE ACCEPT message to indicate the user-plane resources re-establishment result of the PDU sessions for which the UE requested to re-establish the user-plane resources;

5) if the Uplink data status IE is included in the CONTROL PLANE SERVICE REQUEST, the UE is in NB-N1 mode, and the UE indicates a request to have user-plane resources established for a number of PDU sessions that exceeds the UE’s maximum number of supported user-plane resources, the AMF shall not indicate to the SMF to re-establish the user-plane resources for the corresponding PDU sessions; or

6) otherwise, if the Payload container IE is included in the message and if the Payload container type IE is set to "Location services message container", the AMF shall forward the Payload container type and the content of the Payload container IE to the LMF associated with the routing information included in the Additional information IE of the CONTROL PLANE SERVICE REQUEST message.

NOTE 2: If the AMF determines there is no pending data or signalling for the UE, the AMF provides an indication of control plane CIoT 5GS Optimisation to the LMF as specified in 3GPP TS 29.518 [20B].

For case k) in subclause 5.6.1.1, if the Uplink data status IE is included in the CONTROL PLANE SERVICE REQUEST message and the UE is:

a) not in NB-N1 mode; or

b) in NB-N1 mode and the UE does not indicate a request to have user-plane resources established for a number of PDU sessions that exceeds the UE’s maximum number of supported user-plane resources,

the AMF shall:

a) indicate the SMF to re-establish the user-plane resources for the corresponding PDU sessions; and

If the Allowed PDU session status IE is included in the CONTROL PLANE SERVICE REQUEST message, the AMF shall:

a) for a 5GSM message from each SMF that has indicated pending downlink signalling only, forward the received 5GSM message via 3GPP access to the UE after the SERVICE ACCEPT message is sent;

b) for each SMF that has indicated pending downlink data only:

2) notify the SMF that reactivation of the user-plane resources for the corresponding PDU session(s) associated with non-3GPP access can be performed if:

i) for a UE not in NB-N1 mode, the corresponding PDU session ID(s) are indicated in the Allowed PDU session status IE; or

ii) for a UE in NB-N1 mode, the corresponding PDU session ID(s) are indicated in the Allowed PDU session status IE and the resulting number of PDU sessions with established user-plane resources does not exceed the UE’s maximum number of supported user-plane resources;

c) for each SMF that have indicated pending downlink signalling and data:

2) notify the SMF that reactivation of the user-plane resources for the corresponding PDU session(s) associated with non-3GPP access can be performed if:

i) for a UE not in NB-N1 mode, the corresponding PDU session ID(s) are indicated in the Allowed PDU session status IE; or

3) discard the received 5GSM message for PDU session(s) associated with non-3GPP access; and

d) include the PDU session reactivation result IE in the SERVICE ACCEPT message to indicate the successfully re-established user-plane resources for the corresponding PDU sessions, if any.

If the DDX field in the CIoT small data container IE or the DDX field of the Release assistance indication IE indicates:

1) "No further uplink and no further downlink data transmission subsequent to the uplink data transmission is expected" and if there is no downlink signalling or downlink data for the UE; or

2) "Only a single downlink data transmission and no further uplink data transmission subsequent to the uplink data transmission is expected" and upon subsequent delivery of the next received downlink data transmission to the UE and if there is no additional downlink signalling or downlink data for the UE,

the AMF initiates the release of the N1 NAS signalling connection (see 3GPP TS 23.502 [9]).

If the MUSIM UE does not include the Paging restriction IE in the CONTROL PLANE SERVICE REQUEST message, the AMF shall delete any stored paging restriction for the UE and stop restricting paging.

For case m in subclause 5.6.1.1 when the MUSIM UE sets the Request type to "NAS signalling connection release" in the CONTROL PLANE SERVICE REQUEST message, the AMF shall initiate the release of the N1 NAS signalling connection after the completion of the service request procedure.

For cases o and p in subclause 5.6.1.1 when the MUSIM UE sets the Request type to "NAS signalling connection release" or to "Rejection of paging" in the UE request type IE in the CONTROL PLANE SERVICE REQUEST message and if the UE requests restriction of paging by including the Paging restriction IE, the AMF:

the AMF shall send the SERVICE ACCEPT message and initiate the release of the N1 NAS signalling connection as follows:

– for case o in subclause 5.6.1.1, after the completion of the service request procedure;

– for case p in subclause 5.6.1.1, after the completion of the generic UE configuration update procedure that is triggered after the completion of the service request procedure.

Upon successful completion of the procedure, the UE shall reset the service request attempt counter, stop the timer T3517 and enter the state 5GMM-REGISTERED.

If the PDU session status information element is included in the CONTROL PLANE SERVICE REQUEST message, then the AMF:

a) shall perform a local release of all those PDU sessions which are not in 5GSM state PDU SESSION INACTIVE on the AMF side associated with the access type the CONTROL PLANE SERVICE REQUEST message is sent over, but are indicated by the UE as being inactive, and

b) request the SMF to perform a local release of all those PDU sessions. If any of those PDU sessions is associated with one or more multicast MBS sessions, the SMF shall consider the UE as removed from the associated multicast MBS sessions.

If the PDU session status information element is included in the SERVICE ACCEPT message, then the UE shall perform a local release of all those PDU sessions which are not in 5GSM state PDU SESSION INACTIVE or PDU SESSION ACTIVE PENDING on the UE side associated with the 3GPP access but are indicated by the AMF as being inactive. If a locally released PDU session:

a) is associated with one or more multicast MBS sessions, the UE shall locally leave the associated multicast MBS sessions; or

b) has the same PDU session identity value as that used by the UE in the CONTROL PLANE SERVICE REQUEST message, and the message contained CIoT user data, then the UE determines that the CIoT user data was not successfully sent.

c) if the user-plane resources cannot be established because:

1) the SMF indicated to the AMF that the resource is not available in the UPF (see 3GPP TS 29.502 [20A]); or

2) the UE is in NB-N1 mode and the result will lead to user-plane resources established for more than two PDU sessions (see 3GPP TS 23.502 [9])

the AMF shall include the PDU session reactivation result error cause IE with the 5GMM cause set to #92 "insufficient user-plane resources for the PDU session":

NOTE 3: For a UE that is not in NB-N1 mode, it is up to UE implementation when to re-send a request for user-plane re-establishment for the associated PDU session after receiving a PDU session reactivation result error cause IE with a 5GMM cause set to #92 "insufficient user-plane resources for the PDU session".

For case d) in subclause 5.6.1.1, the UE shall also treat the indication from the lower layers that the RRC connection has been released as successful completion of the procedure. The UE shall reset the service request attempt counter, stop the timer T3517 and enter the state 5GMM-REGISTERED.

Upon receipt of the CONTROL PLANE SERVICE REQUEST message with uplink data:

– if the DDX field of the Release assistance indication IE or the DDX field of the CIoT small data container IE is set to "No further uplink and no further downlink data transmission subsequent to the uplink data transmission is expected" in the message;

– if the AMF decides to forward the uplink data piggybacked in the CONTROL PLANE SERVICE REQUEST message; and

– if the AMF decides to activate the congestion control for transport of user data via the control plane,

then the AMF shall send SERVICE ACCEPT message with the T3448 value IE included.

If the AMF decides to deactivate the congestion control for transport of user data via the control plane, then the AMF shall delete the stored control plane data back-off time for the UE and the AMF shall not include timer T3448 value IE in the SERVICE ACCEPT message.

If the T3448 value IE is present in the received SERVICE ACCEPT message and the value indicates that this timer is neither zero nor deactivated, the UE shall:

a) stop timer T3448 if it is running;

b) consider the transport of user data via the control plane as successful; and

c) start timer T3448 with the value provided in the T3448 value IE.

If the UE is using 5GS services with control plane CIoT 5GS optimization, the T3448 value IE is present in the SERVICE ACCEPT message and the value indicates that this timer is either zero or deactivated, the UE shall ignore the T3448 value IE and proceed as if the T3448 value IE was not present.

If the UE in 5GMM-IDLE mode initiated the service request procedure by sending a CONTROL PLANE SERVICE REQUEST message and the SERVICE ACCEPT message does not include the T3448 value IE and if timer T3448 is running, then the UE shall stop timer T3448.

For case h) in subclause 5.6.1.1,

a) the UE shall treat the indication from the lower layers when the UE has changed to S1 mode as successful completion of the procedure and stop timer T3517;

b) if a UE operating in single-registration mode has changed to S1 mode, it shall disable the N1 mode capability for 3GPP access (see subclause 4.9.2); and

c) the AMF shall not check for CAG restrictions.

If the CONTROL PLANE SERVICE REQUEST message is for emergency services fallback, the AMF triggers the emergency services fallback procedure as specified in subclause 4.13.4.2 of 3GPP TS 23.502 [9].

5.6.1.5 Service request procedure not accepted by the network

If the service request cannot be accepted, the network shall return a SERVICE REJECT message to the UE including an appropriate 5GMM cause value.

If the SERVICE REJECT message with 5GMM cause #76 or #78 was received without integrity protection, then the UE shall discard the message.

If the AMF needs to initiate PDU session status synchronisation or a PDU session status IE was included in the SERVICE REQUEST message, the AMF shall include a PDU session status IE in the SERVICE REJECT message to indicate which PDU sessions associated with the access type the SERVICE REJECT message is sent over are active in the AMF. If the PDU session status IE is included in the SERVICE REJECT message and if the message is integrity protected, then:

a) for single access PDU sessions, the UE shall perform a local release of all those PDU sessions which are not in 5GSM state PDU SESSION INACTIVE or PDU SESSION ACTIVE PENDING on the UE side associated with the access type the SERVICE REJECT message is sent over, but are indicated by the AMF as being in 5GSM state PDU SESSION INACTIVE. If a locally released PDU session is associated with one or more MBS sessions, the UE shall locally leave the associated MBS multicast sessions; and

b) for MA PDU sessions, for all those PDU sessions which are not in 5GSM state PDU SESSION INACTIVE or PDU SESSION ACTIVE PENDING and have user plane resources established on the UE side associated with the access the SERVICE REJECT message is sent over, but are indicated by the AMF as no user plane resources established:

1) for MA PDU sessions having user plane resources established only on the access type the SERVICE REJECT message is sent over, the UE shall perform a local release of those MA PDU sessions. If a locally released PDU session is associated with one or more MBS sessions, the UE shall locally leave the associated MBS multicast sessions; and

2) for MA PDU sessions having user plane resources established on both accesses, the UE shall perform a local release on the user plane resources on the access type the SERVICE REJECT message is sent over. If a locally released PDU session is associated with one or more MBS sessions, the UE shall locally leave the associated MBS multicast sessions.

If the service request for mobile originated services is rejected due to general NAS level mobility management congestion control, the network shall set the 5GMM cause value to #22 "congestion" and assign a value for back-off timer T3346.

In NB-N1 mode, if the service request for mobile originated services is rejected due to operator determined barring (see 3GPP TS 29.503 [20AB]), the network shall set the 5GMM cause value to #22 "congestion" and assign a value for back-off timer T3346.

If the service request from a UE supporting CAG is rejected due to CAG restrictions, the network shall set the 5GMM cause value to #76 "Not authorized for this CAG or authorized for CAG cells only" and should include the "CAG information list" in the CAG information list IE or the Extended CAG information list IE in the SERVICE REJECT message.

NOTE 1: The network cannot be certain that "CAG information list" stored in the UE is updated as result of sending of the SERVICE REJECT message with the CAG information list IE or the Extended CAG information list IE, as the SERVICE REJECT message is not necessarily delivered to the UE (e.g., due to abnormal radio conditions).

NOTE 2: The "CAG information list" can be provided by the AMF and include no entry if no "CAG information list" exists in the subscription.

NOTE 2A: If the UE supports extended CAG information list, the CAG information list can be included either in the CAG information list IE or Extended CAG information list IE.

If the UE does not support extended CAG information list, the CAG information list shall not be included in the Extended CAG information list IE.

If the service request from a UE not supporting CAG is rejected due to CAG restrictions, the network shall operate as described in bullet h) of subclause 5.6.1.8.

Upon receipt of the CONTROL PLANE SERVICE REQUEST message with uplink data:

– if the AMF decides to not forward the uplink data piggybacked in the CONTROL PLANE SERVICE REQUEST message; and

– if the AMF decides to activate the congestion control for transport of user data via the control plane,

then the AMF shall send a SERVICE REJECT message and set the 5GMM cause value to #22 "congestion" and assign a value for control plane data back-off timer T3448.

If the AMF determines that the UE is in a non-allowed area or is not in an allowed area as specified in subclause 5.3.5, then:

a) if the service type IE in the SERVICE REQUEST message is set to "signalling" or "data", the AMF shall send a SERVICE REJECT message with the 5GMM cause value set to #28 "Restricted service area";

b) otherwise, if the service type IE in the SERVICE REQUEST message is set to "mobile terminated services", "emergency services", "emergency services fallback", "high priority access" or "elevated signalling", the AMF shall continue the process as specified in subclause 5.6.1.4 unless for other reasons the service request cannot be accepted.

If the service request for mobile originated services is rejected due to service gap control as specified in subclause 5.3.17, i.e. the T3447 timer is running in AMF, the network shall set the 5GMM cause value to #22 "Congestion" and may include T3346 value IE in the SERVICE REJECT message set to the remaining time of the running T3447 timer.

Based on operator policy, if the service request procedure is rejected due to core network redirection for CIoT optimizations, the network shall set the 5GMM cause value to #31 "Redirection to EPC required".

NOTE 3: The network can take into account the UE’s S1 mode capability, the EPS CIoT network behaviour supported by the UE or the EPS CIoT network behaviour supported by the EPC to determine the rejection with the 5GMM cause value #31 "Redirection to EPC required".

If the service request is via a satellite NG-RAN cell, and the network determines that the UE is in a location where the network is not allowed to operate, see 3GPP TS 23.502 [9], the network shall set the 5GMM cause value in the SERVICE REJECT message to #78 "PLMN not allowed to operate at the present UE location".

If the service request from a UE supporting MINT is rejected due to a disaster condition no longer being applicable in the current location of the UE, the network shall set the 5GMM cause value to #11 "PLMN not allowed" or #13 "Roaming not allowed in this tracking area" and may include a disaster return wait range in the Disaster return wait range IE in the SERVICE REJECT message.

On receipt of the SERVICE REJECT message, if the UE is in state 5GMM-SERVICE-REQUEST-INITIATED, the UE shall reset the service request attempt counter and stop timer T3517 if running.

If the AMF received multiple TAIs from the satellite NG-RAN as described in 3GPP TS 23.501 [8], and determines that, by UE subscription and operator’s preferences, all of the received TAIs are forbidden, for roaming or for regional provision of service, the AMF shall include the TAI(s) in:

a) the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for roaming" IE; or

b) the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for regional provision of service" IE; or

c) both;

in the SERVICE REJECT message.

Regardless of the 5GMM cause value received in the SERVICE REJECT message via satellite NG-RAN,

– if the UE receives the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for roaming" IE in the SERVICE REJECT message and if the TAI(s) included in the IE is not part of the list of "5GS forbidden tracking areas for roaming", the UE shall store the TAI(s) included in the IE, if not already stored, into the list of "5GS forbidden tracking areas for roaming"; and

– if the UE receives the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for regional provision of service" IE in the SERVICE REJECT message and if the TAI(s) included in the IE is not part of the list of "5GS forbidden tracking areas for regional provision of service", the UE shall store the TAI(s) included in the IE, if not already stored, into the list of "5GS forbidden tracking areas for regional provision of service".

Furthermore, the UE shall take the following actions depending on the 5GMM cause value received in the SERVICE REJECT message.

#3 (Illegal UE);

#6 (Illegal ME);

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI.

In case of PLMN, the UE shall consider the USIM as invalid for 5GS services until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.19a.1;

In case of SNPN, if the UE is not registered for onboarding services in SNPN and the UE does not support access to an SNPN using credentials from a credentials holder, the UE shall consider the entry of the "list of subscriber data" with the SNPN identity of the current SNPN as invalid until the UE is switched off, the entry is updated or the timer T3245 expires as described in clause 5.3.19a.2. In case of SNPN, if the UE is not registered for onboarding services in SNPN and the UE supports access to an SNPN using credentials from a credentials holder, the UE shall consider the selected entry of the "list of subscriber data" as invalid for 3GPP access until the UE is switched off, the entry is updated or the timer T3245 expires as described in clause 5.3.19a.2. Additionally, if EAP based primary authentication and key agreement procedure using EAP-AKA’ or 5G AKA based primary authentication and key agreement procedure was performed in the current SNPN, the UE shall consider the USIM as invalid for the current SNPN until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.19a.2.

If the UE is not registered for onboarding services in SNPN, the UE shall delete the list of equivalent PLMNs (if any) and shall enter the state 5GMM-DEREGISTERED.NO-SUPI. If the message has been successfully integrity checked by the NAS, then the UE shall:

1) set the counter for "SIM/USIM considered invalid for GPRS services" events and the counter for "USIM considered invalid for 5GS services over non-3GPP access" events to UE implementation-specific maximum value in case of PLMN if the UE maintains these counters;

2) set the counter for "the entry for the current SNPN considered invalid for 3GPP access" events and the counter for "the entry for the current SNPN considered invalid for non-3GPP access" events to UE implementation-specific maximum value in case of SNPN if the UE maintains these counters; and

If the message was received via 3GPP access and the UE is operating in the single-registration mode, the UE shall handle the EMM parameters EMM state, EPS update status, 4G-GUTI, last visited registered TAI, TAI list and eKSI as specified in 3GPP TS 24.301 [15] for the case when the service request procedure is rejected with the EMM cause with the same value. The USIM shall be considered as invalid also for non-EPS services until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.7a in 3GPP TS 24.301 [15]. If the message has been successfully integrity checked by the NAS and the UE maintains a counter for "SIM/USIM considered invalid for non-GPRS services", then the UE shall set this counter to UE implementation-specific maximum value.

If the UE is registered for onboarding services in SNPN, the UE shall store the SNPN identity in the "permanently forbidden SNPNs" list for onboarding services, enter state 5GMM-DEREGISTERED.PLMN-SEARCH, and perform an SNPN selection or an SNPN selection for onboarding services according to 3GPP TS 23.122 [5]. If the message has been successfully integrity checked by the NAS, the UE shall set the SNPN-specific attempt counter to the UE implementation-specific maximum value.

If the message has been successfully integrity checked by the NAS and the UE also supports the registration procedure over the other access, the UE shall in addition handle 5GMM parameters and 5GMM state for this access, as described for this 5GMM cause value.

#7 (5GS services not allowed).

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI.

In case of PLMN, the UE shall consider the USIM as invalid for 5GS services until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.19a.1;

In case of SNPN, if the UE is not registered for onboarding services in SNPN and the UE does not support access to an SNPN using credentials from a credentials holder, the UE shall consider the entry of the "list of subscriber data" with the SNPN identity of the current SNPN as invalid for 5GS services until the UE is switched off, the entry is updated or the timer T3245 expires as described in clause 5.3.19a.2. In case of SNPN, if the UE is not registered for onboarding services in SNPN and the UE supports access to an SNPN using credentials from a credentials holder, the UE shall consider the selected entry of the "list of subscriber data" as invalid for 3GPP access until the UE is switched off, the entry is updated or the timer T3245 expires as described in clause 5.3.19a.2. Additionally, if EAP based primary authentication and key agreement procedure using EAP-AKA’ or 5G AKA based primary authentication and key agreement procedure was performed in the current SNPN, the UE shall consider the USIM as invalid for the current SNPN until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.19a.2.

If the UE is not registered for onboarding services in SNPN, the UE shall enter the state 5GMM-DEREGISTERED.NO-SUPI. If the message has been successfully integrity checked by the NAS, then the UE shall:

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall handle the EMM parameters EMM state, EPS update status, 4G-GUTI, last visited registered TAI, TAI list and eKSI as specified in 3GPP TS 24.301 [15] for the case when the service request procedure is rejected with the EMM cause with the same value.

NOTE 4: The possibility to configure a UE so that the radio transceiver for a specific radio access technology is not active, although it is implemented in the UE, is outside the scope of the present document.

#9 (UE identity cannot be derived by the network).

The UE shall set the 5GS update status to 5U2 NOT UPDATED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. The UE shall enter the state 5GMM-DEREGISTERED.

If the service request was initiated for emergency services fallback, the UE shall attempt to select an E-UTRA cell connected to EPC or 5GCN according to the domain priority and selection rules specified in 3GPP TS 23.167 [6]. If the UE finds a suitable E-UTRA cell, it then proceeds with the appropriate EMM or 5GMM procedures. If the UE operating in single-registration mode has changed to S1 mode, it shall disable the N1 mode capability for 3GPP access.

If the service request was initiated for any reason other than emergency services fallback or initiating an emergency PDU session, the UE shall perform a new initial registration procedure.

NOTE 5: User interaction is necessary in some cases when the UE cannot re-establish the PDU session(s) automatically.

#10 (Implicitly de-registered).

The UE shall enter the state 5GMM-DEREGISTERED.NORMAL-SERVICE. The UE shall delete any mapped 5G NAS security context or partial native 5G NAS security context.

If the rejected request was neither for initiating an emergency PDU session nor for emergency services fallback, the UE shall perform a new initial registration procedure.

NOTE 6: User interaction is necessary in some cases when the UE cannot re-establish the PDU session(s) automatically.

If the message was received via 3GPP access and the UE is operating in the single-registration mode, the UE shall handle the EMM state as specified in 3GPP TS 24.301 [15] for the case when the service request procedure is rejected with the EMM cause with the same value.

#11 (PLMN not allowed).

This cause value received from a cell belonging to an SNPN is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.6.1.7.

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. The UE shall delete the list of equivalent PLMNs and store the PLMN identity in the forbidden PLMN list as specified in subclause 5.3.13A and if the UE is configured to use timer T3245 then the UE shall start timer T3245 and proceed as described in clause 5.3.19a.1. For 3GPP access, the UE shall enter the state 5GMM-DEREGISTERED.PLMN-SEARCH and perform a PLMN selection according to 3GPP TS 23.122 [5], and for non-3GPP access the UE shall enter state 5GMM-DEREGISTERED.LIMITED-SERVICE and perform network selection as defined in 3GPP TS 24.502 [18]. If the message has been successfully integrity checked by the NAS and the UE mantains the PLMN-specific attempt counter and the PLMN-specific attempt counter for non-3GPP access for that PLMN, the UE shall set the PLMN-specific attempt counter and the PLMN-specific attempt counter for non-3GPP access for that PLMN to the UE implementation-specific maximum value.

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition handle the EMM parameters EMM state, EPS update status, 4G-GUTI, last visited registered TAI, TAI list and eKSI as specified in 3GPP TS 24.301 [15] for the case when the service request procedure is rejected with the EMM cause with the same value.

If the message has been successfully integrity checked by the NAS and the UE also supports the registration procedure over the other access to the same PLMN, the UE shall in addition handle 5GMM parameters and 5GMM state for this access, as described for this 5GMM cause value.

If the UE receives the Disaster return wait range IE in the SERVICE REJECT message and the UE supports MINT, the UE shall delete the disaster return wait range stored in the ME, if any, and store the disaster return wait range included in the Disaster return wait range IE in the ME.

#12 (Tracking area not allowed).

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete 5G-GUTI, last visited registered TAI, TAI list and ngKSI.

If:

1) the UE is not operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for regional provision of service" and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE. If the SERVICE REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for regional provision of service" for non-integrity protected NAS reject message; or

2) the UE is operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for regional provision of service" for the current SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, the selected entry of the "list of subscriber data" or the selected PLMN subscription, and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE. If the SERVICE REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for regional provision of service" for the current SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, the selected entry of the "list of subscriber data" or the selected PLMN subscription, for non-integrity protected NAS reject message.

#13 (Roaming not allowed in this tracking area).

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2). For 3GPP access the UE shall enter the state 5GMM-REGISTERED.PLMN-SEARCH, and for non-3GPP access the UE shall enter the state 5GMM-REGISTERED.LIMITED-SERVICE.

If:

1) the UE is not operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" and remove the current TAI from the stored TAI list if present. If the SERVICE REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for non-integrity protected NAS reject message; or

2) the UE is operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, the selected entry of the "list of subscriber data" or the selected PLMN subscription, and remove the current TAI from the stored TAI list if present. If the SERVICE REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, the selected entry of the "list of subscriber data" or the selected PLMN subscription, for non-integrity protected NAS reject message.

For 3GPP access the UE shall perform a PLMN selection or SNPN selection according to 3GPP TS 23.122 [5], and for non-3GPP access the UE shall perform network selection as defined in 3GPP TS 24.502 [18].

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall handle the EMM parameters EMM state and EPS update status as specified in 3GPP TS 24.301 [15] for the case when the service request procedure is rejected with the EMM cause with the same value.

#15 (No suitable cells in tracking area).

The UE shall enter the state 5GMM-REGISTERED.LIMITED-SERVICE.

If:

If the UE initiated service request for emergency services fallback, the UE shall attempt to select an E-UTRA cell connected to EPC or 5GC according to the emergency services support indicator (see 3GPP TS 36.331 [25A]). If the UE finds a suitable E-UTRA cell, it then proceeds with the appropriate EMM or 5GMM procedures. If the UE operating in single-registration mode has changed to S1 mode, it shall disable the N1 mode capability for 3GPP access.

If the service request was not initiated for emergency services fallback, the UE shall search for a suitable cell in another tracking area according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C].

If the message was received via 3GPP access and the UE is operating in the single-registration mode, the UE shall handle the EMM parameters EMM state and EPS update status as specified in 3GPP TS 24.301 [15] for the case when the service request procedure is rejected with the EMM cause with the same value.

If received over non-3GPP access the cause shall be considered as an abnormal case and the behaviour of the UE for this case is specified in subclause 5.6.1.7.

#22 (Congestion).

If the T3346 value IE is present in the SERVICE REJECT message and the value indicates that this timer is neither zero nor deactivated, the UE shall proceed as described below, otherwise it shall be considered as an abnormal case and the behaviour of the UE for this case is specified in subclause 5.6.1.7.

If the rejected request was not for initiating an emergency PDU session, the UE shall abort the service request procedure and enter state 5GMM-REGISTERED and stop timer T3517 if still running.

The UE shall stop timer T3346 if it is running.

If the SERVICE REJECT message is integrity protected, the UE shall start timer T3346 with the value provided in the T3346 value IE.

If the SERVICE REJECT message is not integrity protected, the UE shall start timer T3346 with a random value from the default range specified in 3GPP TS 24.008 [12].

For all other cases the UE stays in the current serving cell and applies normal cell reselection process. The service request procedure is started, if still necessary, when timer T3346 expires or is stopped.

If the service request procedure was initiated for an MO MMTEL voice call (i.e. access category 4), or for an MO MMTEL video call (i.e. access category 5) or for an MO IMS registration related signalling (i.e. access category 9), a notification that the service request was not accepted due to congestion shall be provided to the upper layers.

If the UE is using 5GS services with control plane CIoT 5GS optimization and if the T3448 value IE is present in the SERVICE REJECT message and the value indicates that this timer is neither zero nor deactivated, the UE shall:

a) stop timer T3448 if it is running;

b) consider the transport of user data via the control plane as unsuccessful; and

c) start timer T3448:

1) with the value provided in the T3448 value IE if the SERVICE REJECT message is integrity protected; or

2) with a random value from the default range specified in 3GPP TS 24.301 [15] table 10.2.1 if the SERVICE REJECT message is not integrity protected.

If the UE is using 5GS services with control plane CIoT 5GS optimization, the T3448 value IE is present in the SERVICE REJECT message and the value indicates that this timer is either zero or deactivated, the UE shall ignore the T3448 value IE and:

a) stop timer T3448 if it is running; and

b) consider the transport of user data via the control plane as unsuccessful.

If the UE is using 5GS services with control plane CIoT 5GS optimization and if the T3448 value IE is not present in the SERVICE REJECT message, it shall be considered as an abnormal case and the behaviour of UE for this case is specified in subclause 5.6.1.7.

#27 (N1 mode not allowed).

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall enter the state 5GMM-REGISTERED.LIMITED-SERVICE. If the message has been successfully integrity checked by the NAS, the UE shall set:

1) the PLMN-specific N1 mode attempt counter for 3GPP access and the PLMN-specific N1 mode attempt counter for non-3GPP access for that PLMN in case of PLMN; or

2) the SNPN-specific attempt counter for 3GPP access for the current SNPN and the SNPN-specific attempt counter for non-3GPP access for the current SNPN in case of SNPN

to the UE implementation-specific maximum value.

The UE shall disable the N1 mode capability for the specific access type for which the message was received (see subclause 4.9).

If the message has been successfully integrity checked by the NAS, the UE shall disable the N1 mode capability also for the other access type (see subclause 4.9).

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition set the EPS update status to EU3 ROAMING NOT ALLOWED and enter the state EMM-REGISTERED.

#28 (Restricted service area).

The UE shall enter the state 5GMM-REGISTERED.NON-ALLOWED-SERVICE, wait for the release of the N1 NAS signalling connection and perform the registration procedure for mobility and periodic registration update if the service type IE in the SERVICE REQUEST message was not set to "elevated signalling" and the SERVICE REJECT message is received over 3GPP access (see subclause 5.3.5 and 5.5.1.3).

If the service type IE in the SERVICE REQUEST message was set to "elevated signalling", the UE shall not re-initiate service request procedure until the UE enters an allowed area or leaves a non-allowed area, except for emergency services, high priority access or responding to paging or notification.

#31 (Redirection to EPC required).

5GMM cause #31 received by a UE that has not indicated support for CIoT optimizations or received by a UE over non-3GPP access is considered an abnormal case and the behaviour of the UE is specified in subclause 5.6.1.7.

This cause value received from a cell belonging to an SNPN is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.6.1.7.

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2). The UE shall reset the service request attempt counter and enter the state 5GMM-REGISTERED.LIMITED-SERVICE.

The UE shall enable the E-UTRA capability if it was disabled and disable the N1 mode capability for 3GPP access (see subclause 4.9.2).

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall handle the EMM parameters, EMM state, and EPS update status as specified in 3GPP TS 24.301 [15] for the case when the service request procedure is rejected with the EMM cause with the same value.

#72 (Non-3GPP access to 5GCN not allowed).

If the UE initiated the service request procedure over non-3GPP access, the UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete 5G-GUTI, last visited registered TAI, TAI list and ngKSI for non-3GPP access. Additionally, the UE shall enter the state 5GMM-DEREGISTERED for non-3GPP access. If the message has been successfully integrity checked by the NAS, the UE shall set:

1) the PLMN-specific N1 mode attempt counter for non-3GPP access for that PLMN in case of PLMN; or

2) the SNPN-specific attempt counter for non-3GPP access for that SNPN in case of SNPN;

to the UE implementation-specific maximum value.

NOTE 7: The 5GMM sublayer states, the 5GMM parameters and the registration status are managed per access type independently, i.e. 3GPP access or non-3GPP access (see subclauses 4.7.2 and 5.1.3).

The UE shall disable the N1 mode capability for non-3GPP access (see subclause 4.9.3).

As an implementation option, if the UE is not currently registered over 3GPP access, the UE may enter the state 5GMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection according to 3GPP TS 23.122 [5].

If received over 3GPP access the cause shall be considered as an abnormal case and the behaviour of the UE for this case is specified in subclause 5.6.1.7.

#73 (Serving network not authorized).

This cause value received from a cell belonging to an SNPN is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.6.1.7.

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. The UE shall delete the list of equivalent PLMNs, store the PLMN identity in the forbidden PLMN list as specified in subclause 5.3.13A. For 3GPP access the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection according to 3GPP TS 23.122 [5], and for non-3GPP access the UE shall enter state 5GMM-DEREGISTERED.LIMITED-SERVICE in order to perform network selection as defined in 3GPP TS 24.502 [18]. If the message has been successfully integrity checked by the NAS, the UE shall set the PLMN-specific attempt counter and the PLMN-specific attempt counter for non-3GPP access for that PLMN to the UE implementation-specific maximum value.

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition set the EPS update status to EU3 ROAMING NOT ALLOWED, enter the state EMM-DEREGISTERED and shall delete any 4G-GUTI, last visited registered TAI, TAI list and eKSI.

#74 (Temporarily not authorized for this SNPN).

5GMM cause #74 is only applicable when received from a cell belonging to an SNPN. 5GMM cause #74 received from a cell not belonging to an SNPN is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.6.1.7.

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. The UE shall store the SNPN identity in the "temporarily forbidden SNPNs" list for the specific access type for which the message was received and, if the UE supports access to an SNPN using credentials from a credentials holder, the selected entry of the "list of subscriber data" or the selected PLMN subscription. If the UE is not registered for onboarding services in SNPN, the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection according to 3GPP TS 23.122 [5]. If the UE is registered for onboarding services in SNPN, the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection or an SNPN selection for onboarding services according to 3GPP TS 23.122 [5]. If the message has been successfully integrity checked by the NAS, the UE shall set the SNPN-specific attempt counter for 3GPP access and the SNPN-specific attempt counter for non-3GPP access for the current SNPN to the UE implementation-specific maximum value.

If the message has been successfully integrity checked by the NAS and the UE also supports the registration procedure over the other access to the same SNPN, the UE shall in addition handle 5GMM parameters and 5GMM state for this access, as described for this 5GMM cause value.

NOTE 8: When 5GMM cause #74 is received over 3GPP access, the term "other access" in "the UE also supports the registration procedure over the other access to the same SNPN" is used to express access to SNPN services via a PLMN.

NOTE 9: The term "non-3GPP access" in an SNPN refers to the case where the UE is accessing SNPN services via a PLMN.

#75 (Permanently not authorized for this SNPN).

5GMM cause #75 is only applicable when received from a cell belonging to an SNPN with a globally-unique SNPN identity. 5GMM cause #75 received from a cell not belonging to an SNPN or a cell belonging to an SNPN with a non-globally-unique SNPN identity is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.6.1.7.

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. The UE shall store the SNPN identity in the "permanently forbidden SNPNs" list for the specific access type for which the message was received and, if the UE supports access to an SNPN using credentials from a credentials holder, the selected entry of the "list of subscriber data" or the selected PLMN subscription. If the UE is not registered for onboarding services in SNPN, the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection according to 3GPP TS 23.122 [5]. If the UE is registered for onboarding services in SNPN, the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection or an SNPN selection for onboarding services according to 3GPP TS 23.122 [5]. If the message has been successfully integrity checked by the NAS, the UE shall set the SNPN-specific attempt counter for 3GPP access and the SNPN-specific attempt counter for non-3GPP access for the current SNPN to the UE implementation-specific maximum value.

NOTE 10: When 5GMM cause #75 is received over 3GPP access, the term "other access" in "the UE also supports the registration procedure over the other access to the same SNPN" is used to express access to SNPN services via a PLMN.

NOTE 11: The term "non-3GPP access" in an SNPN refers to the case where the UE is accessing SNPN services via a PLMN.

#76 (Not authorized for this CAG or authorized for CAG cells only).

This cause value received via non-3GPP access or from a cell belonging to an SNPN is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.6.1.7.

The UE shall set the 5GS update status to 5U3.ROAMING NOT ALLOWED, store the 5GS update status according to clause 5.1.3.2.2.

If 5GMM cause #76 is received from:

1) a CAG cell, and if the UE receives a "CAG information list" in the CAG information list IE or the Extended CAG information list IE included in the SERVICE REJECT message, the UE shall:

i) replace the "CAG information list" stored in the UE with the received "CAG information list" when received in the HPLMN or EHPLMN;

ii) replace the serving VPLMN’s entry of the "CAG information list" stored in the UE with the serving VPLMN’s entry of the received CAG information list IE or the Extended CAG information list IE when the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN; or

NOTE 12: When the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN, entries of a PLMN other than the serving VPLMN, if any, in the received CAG information list IE or the Extended CAG information list IE are ignored.

iii) remove the serving VPLMN’s entry of the "CAG information list" stored in the UE when the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN and the CAG information list IE or the Extended CAG information list IE does not contain the serving VPLMN’s entry.

Otherwise, the UE shall delete the CAG-ID from the "allowed CAG list" for the current PLMN. In the case the "allowed CAG list" for the current PLMN only contains a range of CAG-IDs, how the UE deletes the CAG-ID(s) of the cell from the "allowed CAG list" for the current PLMN is up to UE implementation. In addition:

i) if the entry in the "CAG information list" for the current PLMN does not include an "indication that the UE is only allowed to access 5GS via CAG cells" or if the entry in the "CAG information list" for the current PLMN includes an "indication that the UE is only allowed to access 5GS via CAG cells" and the updated "allowed CAG list" for the current PLMN includes one or more CAG-IDs, then the UE shall enter the state 5GMM-REGISTERED.LIMITED-SERVICE and shall search for a suitable cell according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C] with the updated "CAG information list";

ii) if the entry in the "CAG information list" for the current PLMN includes an "indication that the UE is only allowed to access 5GS via CAG cells" and the updated "allowed CAG list" for the current PLMN does not include any CAG-ID, then the UE shall enter the state 5GMM-REGISTERED.PLMN-SEARCH and shall apply the PLMN selection process defined in 3GPP TS 23.122 [5] with the updated "CAG information list"; or

iii) if the "CAG information list" does not include an entry for the current PLMN, then the UE shall enter the state 5GMM-REGISTERED.LIMITED-SERVICE and shall search for a suitable cell according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C] with the updated "CAG information list".

2) a non-CAG cell, and if the UE receives a "CAG information list" in the CAG information list IE or the Extended CAG information list IE included in the SERVICE REJECT message, the UE shall:

i) replace the "CAG information list" stored in the UE with the received "CAG information list" when received in the HPLMN or EHPLMN;

NOTE 13: When the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN, entries of a PLMN other than the serving VPLMN, if any, in the received CAG information list IE or the Extended CAG information list IE are ignored.

Otherwise, the UE shall store an "indication that the UE is only allowed to access 5GS via CAG cells" in the entry of the "CAG information list" for the current PLMN, if any. If the "CAG information list" stored in the UE does not include the current PLMN’s entry, the UE shall add an entry for the current PLMN to the "CAG information list" and store an "indication that the UE is only allowed to access 5GS via CAG cells" in the entry of the "CAG information list" for the current PLMN. If the UE does not have a stored "CAG information list", the UE shall create a new "CAG information list" and add an entry with an "indication that the UE is only allowed to access 5GS via CAG cells" for the current PLMN.

In addition:

i) if the "allowed CAG list" for the current PLMN includes one or more CAG-IDs, then the UE shall enter the state 5GMM-REGISTERED.LIMITED-SERVICE and shall search for a suitable cell according to 3GPP TS 38.304 [28] with the updated CAG information; or

ii) if the "allowed CAG list" for the current PLMN does not include any CAG-ID, then the UE shall enter the state 5GMM-REGISTERED.PLMN-SEARCH and shall apply the PLMN selection process defined in 3GPP TS 23.122 [5] with the updated "CAG information list".

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition set the EPS update status to EU3 ROAMING NOT ALLOWED, reset the service request attempt counter and enter the state EMM-REGISTERED.

#77 (Wireline access area not allowed).

5GMM cause #77 is only applicable when received from a wireline access network by the 5G-RG or the W-AGF acting on behalf of the FN-CRG (or on behalf of the N5GC device). 5GMM cause #77 received from a 5G access network other than a wireline access network and 5GMM cause #77 received by the W-AGF acting on behalf of the FN-BRG are considered as abnormal cases and the behaviour of the UE is specified in subclause 5.6.1.7.

When received over wireline access network, the 5G-RG and the W-AGF acting on behalf of the FN-CRG (or on behalf of the N5GC device) shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2), shall delete 5G-GUTI, last visited registered TAI, TAI list and ngKSI, shall enter the state 5GMM-DEREGISTERED and shall act as specified in subclause 5.3.23.

NOTE 14: The 5GMM sublayer states, the 5GMM parameters and the registration status are managed per access type independently, i.e. 3GPP access or non-3GPP access (see subclauses 4.7.2 and 5.1.3).

#78 (PLMN not allowed to operate at the present UE location).

This cause value received from a non-satellite NG-RAN cell is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.6.1.7.

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.2.2) and shall delete 5G-GUTI, last visited registered TAI, TAI list and ngKSI. Additionally, the UE shall reset the registration attempt counter. The UE shall store the PLMN identity and, if it is known, the current geographical location in the list of "PLMNs not allowed to operate at the present UE location" and shall start a corresponding timer instance (see subclause 4.23.2). The UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform a PLMN selection according to 3GPP TS 23.122 [5].

5.6.1.6 Service request procedure for initiating an emergency PDU session not accepted by the network

If the service request for initiating an emergency PDU session cannot be accepted by the network, the UE shall perform the procedures as described in subclause 5.6.1.5. Then if the UE is in the same selected PLMN where the last service request was attempted, the UE shall:

a) inform the upper layers of the failure of the procedure; or

NOTE 1: This can result in the upper layers requesting another emergency call attempt using domain selection as specified in 3GPP TS 23.167 [6].

b) de-register locally, if not de-registered already, attempt initial registration for emergency services.

If the service request for initiating an emergency PDU session fails due to abnormal cases a) in subclause 5.6.1.7, the UE shall perform the procedures as described in subclause 5.6.1.7. Then if the UE is in the same selected PLMN where the last SERVICE REQUEST message was attempted, the UE shall:

a) inform the upper layers of the failure of the procedure; or

NOTE 2: This can result in the upper layers requesting another emergency call attempt using domain selection as specified in 3GPP TS 23.167 [6] and 3GPP TS 24.229 [14].

b) de-register locally, if not de-registered already, attempt initial registration for emergency services.

5.6.1.6A Service request procedure for an emergency services fallback not accepted by the network

If the service request for initiating an emergency services fallback cannot be accepted by the network, the UE shall perform the procedures as described in subclause 5.6.1.5 and if the UE does not attempt to select an E-UTRA cell connected to EPC or 5GCN as described in subclause 5.6.1.5 and is camped on NR or E-UTRA cell connected to 5GCN in the same PLMN where the last service request was attempted, the UE shall inform the upper layers of the failure of the procedure.

NOTE 1: This can result in the upper layers requesting another emergency call attempt using domain selection as specified in 3GPP TS 23.167 [6].

If the service request for initiating an emergency services fallback fails due to abnormal cases a) in subclause 5.6.1.7, the UE shall inform the upper layers of the failure of the emergency services fallback.

NOTE 2: This can result in the upper layers requesting another emergency call attempt using domain selection as specified in 3GPP TS 23.167 [6].

If the service request procedure for initiating an emergency services fallback fails due to abnormal cases other than a) in subclause 5.6.1.7, the UE may abort the service request procedure, if not aborted already and attempt to select an E-UTRA cell connected to EPC or 5GCN according to the domain priority and selection rules specified in 3GPP TS 23.167 [6]. If the UE finds a suitable E-UTRA cell, it then proceeds with the appropriate EMM or 5GMM procedures. If the UE operating in single-registration mode has changed to S1 mode, it shall disable the N1 mode capability for 3GPP access.

5.6.1.7 Abnormal cases in the UE

The following abnormal cases can be identified:

a) T3517 expired.

The UE shall enter the state 5GMM-REGISTERED.

If the UE triggered the service request procedure in 5GMM-IDLE mode sending a:

1) SERVICE REQUEST message and the service type of the SERVICE REQUEST message was not set to "emergency services fallback"; or

2) CONTROL PLANE SERVICE REQUEST message and the control plane service type of the CONTROL PLANE SERVICE REQUEST message was not set to "emergency services fallback";

then the 5GMM sublayer shall increment the service request attempt counter, abort the procedure and release locally any resources allocated for the service request procedure. The service request attempt counter shall not be incremented, if:

1) the service request procedure is initiated to establish an emergency PDU session;

2) the UE has an emergency PDU session established;

3) the UE is a UE configured for high priority access in selected PLMN or SNPN;

4) the service request procedure is initiated in response to paging or notification from the network; or

5) the UE in NB-N1 mode is requested by the upper layer to transmit user data related to an exceptional event and the UE is allowed to use exception data reporting (see the ExceptionDataReportingAllowed leaf of the NAS configuration MO in 3GPP TS 24.368 [17] or the USIM file EF_NASCONFIG in 3GPP TS 31.102 [22]).

If the service request attempt counter is greater than or equal to 5, the UE shall start timer T3525. Additionally, if the service request procedure was initiated for an MO MMTEL voice call or for an MO MMTEL video call or for an MO IMS registration related signalling, a notification that the service request was not initiated due to the UE having started timer T3525 shall be provided to the upper layers.

NOTE 1: This can result in the upper layers requesting implementation specific mechanisms, e.g. the MMTEL voice call being attempted to another IP-CAN, or establishment of a CS voice call (if supported and not already attempted in the CS domain).

The UE shall not attempt service request until expiry of timer T3525 unless:

1) the service request procedure is initiated in response to paging or notification from the network;

2) the UE is a UE configured for high priority access in selected PLMN or SNPN;

3) the service request procedure is initiated to establish an emergency PDU session;

4) the UE has an emergency PDU session established;

5) the service request procedure is initiated for emergency services fallback;

6) the UE is registered in a new PLMN; or

NOTE 2: According to Table 10.2.1, when "UE camped on a new PLMN other than the PLMN on which timer started", timer T3525 is stopped, hence this check may be skipped.

7) the UE in NB-N1 mode is requested by the upper layer to transmit user data related to an exceptional event and the UE is allowed to use exception data reporting (see the ExceptionDataReportingAllowed leaf of the NAS configuration MO in 3GPP TS 24.368 [17] or the USIM file EF_NASCONFIG in 3GPP TS 31.102 [22]).

NOTE 3: The NAS signalling connection can also be released if the UE deems that the network has failed the authentication check as specified in subclause 5.4.1.3.7.

If the UE triggered the service request procedure in 5GMM-CONNECTED mode sending a:

1) SERVICE REQUEST message and the service type of the SERVICE REQUEST message was not set to "emergency services fallback"; or

2) CONTROL PLANE SERVICE REQUEST message and the control plane service type of the CONTROL PLANE SERVICE REQUEST message was not set to "emergency services fallback",

the 5GMM sublayer shall abort the procedure, and stay in 5GMM-CONNECTED mode.

If the service type of the SERVICE REQUEST message was set to "emergency services fallback" or the control plane service type of the CONTROL PLANE SERVICE REQUEST message was set to "emergency services fallback" and:

1) the service request procedure was triggered in 5GMM-IDLE mode, the 5GMM sublayer shall abort the procedure, release locally any resources allocated for the service request procedure; or

2) the service request procedure was triggered in 5GMM-CONNECTED mode, the 5GMM sublayer shall abort the procedure, stay in 5GMM-CONNECTED mode.

b) The lower layers indicate that the access attempt is barred.

The UE shall not start the service request procedure. The UE stays in the current serving cell and applies the normal cell reselection process. Receipt of the access barred indication shall not trigger the selection of a different core network type (EPC or 5GCN).

The service request procedure is started, if still needed, when the lower layers indicate that the barring is alleviated for the access category with which the access attempt was associated.

ba) The lower layers indicate that:

1) access barring is applicable for all access categories except categories 0 and 2 and the access category with which the access attempt was associated is other than 0 and 2; or

2) access barring is applicable for all access categories except category 0 and the access category with which the access attempt was associated is other than 0.

If the SERVICE REQUEST message or CONTROL PLANE SERVICE REQUEST has not been sent, the UE shall proceed as specified for case b.

If the SERVICE REQUEST message or CONTROL PLANE SERVICE REQUEST has been sent:

1) the UE shall abort the service request procedure and stop timer T3517. The UE stays in the current serving cell and applies the normal cell reselection process; and

2) the service request procedure is started, if still needed, when the lower layers indicate that the barring is alleviated for the access category with which the access attempt was associated.

For additional UE requirements for both cases see subclause 4.5.5.

c) Timer T3346 is running.

The UE shall not start the service request procedure unless:

1) the UE receives a paging;

2) the UE receives a NOTIFICATION message over non-3GPP access when the UE is in 5GMM-CONNECTED mode over non-3GPP access and in 5GMM-IDLE mode over 3GPP access;

3) the UE receives a NOTIFICATION message over 3GPP access when the UE is in 5GMM-CONNECTED mode over 3GPP access and in 5GMM-IDLE mode over non-3GPP access;

4) the UE is a UE configured for high priority access in selected PLMN or SNPN;

5) the UE has an emergency PDU session established or is establishing an emergency PDU session;

6) the service request procedure is initiated for emergency services fallback;

7) the service request procedure is initiated for elevated signalling;

8) the UE in NB-N1 mode is requested by the upper layer to transmit user data related to an exceptional event and:

– the UE is allowed to use exception data reporting (see the ExceptionDataReportingAllowed leaf of the NAS configuration MO in 3GPP TS 24.368 [17] or the USIM file EF_NASCONFIG in 3GPP TS 31.102 [22]); and

– timer T3346 was not started when N1 NAS signalling connection was established with RRC establishment cause set to "mo-ExceptionData"; or

9) the MUSIM UE is in 5GMM-CONNECTED mode and requests the network to release the NAS signalling connection (see case o in subclause 5.6.1.1).

If the UE is in 5GMM-IDLE mode, the UE stays in the current serving cell and applies normal cell reselection process. The service request procedure is started, if still necessary, when timer T3346 expires or is stopped.

If the service request procedure was triggered for an MO MMTEL voice call (i.e. access category 4), or for an MO MMTEL video call (i.e. access category 5) or for an MO IMS registration related signalling (i.e. access category 9), a notification that the service request procedure was not initiated due to congestion shall be provided to the upper layers.

If the UE receives a paging with access type set to "Non-3GPP access" and the non-3GPP access is available and UE is in 5GMM-REGISTERED.NORMAL SERVICE over non-3GPP access, the UE shall stop timer T3346 and send the SERVICE REQUEST message over non-3GPP access.

d) Registration procedure for mobility and periodic registration update is triggered.

The UE shall abort the service request procedure, stop timer T3517, if running and perform the registration procedure for mobility and periodic registration update. The Follow-on request indicator in the REGISTRATION REQUEST message shall be handled as specified in clause 5.5.1.3.2.

e) Switch off.

If the UE is in state 5GMM-SERVICE-REQUEST-INITIATED at switch off, the de-registration procedure shall be performed.

f) De-registration procedure collision.

If the UE receives a DEREGISTRATION REQUEST message from the network in state 5GMM-SERVICE-REQUEST-INITIATED, the UE shall progress the DEREGISTRATION REQUEST message and the service request procedure shall be aborted.

NOTE 4: The above collision case is valid if the DEREGISTRATION REQUEST message indicates the access type over which the service request procedure is attempted otherwise both the procedures are progressed.

g) Transmission failure of SERVICE REQUEST or CONTROL PLANE SERVICE REQUEST message indication with change in the current TAI.

If the current TAI is not in the TAI list, UE shall abort the service request procedure to perform the registration procedure for mobility and periodic registration update as specified in subclause 5.5.1.3.2.

If the current TAI is part of the TAI list, the UE shall restart the service request procedure unless the service request procedure is initiated for case o) or p) in subclause 5.6.1.1. For case o) and p) in subclause 5.6.1.1 the UE shall abort the service request procedure, enters state 5GMM-REGISTERED, locally release the N1 NAS signalling connection, stop timer T3517 and locally release any resources allocated for the service request procedure.

h) Transmission failure of SERVICE REQUEST or CONTROL PLANE SERVICE REQUEST message indication without change in the current TAI.

The UE shall restart the service request procedure unless the service request procedure is initiated for case o) or p) in subclause 5.6.1.1. For case o) and p) in subclause 5.6.1.1 the UE shall abort the service request procedure, enters state 5GMM-REGISTERED, locally release the N1 NAS signalling connection, stop timer T3517 and locally release any resources allocated for the service request procedure.

i) SERVICE REJECT message received with other 5GMM cause values than those treated in subclause 5.6.1.5, and cases of 5GMM cause values #11, #15, #22, #31, #72, #73, #74, #75, #76, #77 and #78 that are considered as abnormal cases according to subclause 5.6.1.5.

The UE shall enter state 5GMM-REGISTERED.

The UE shall abort the service request procedure, stop timer T3517 and locally release any resources allocated for the service request procedure.

j) The UE in 5GMM-CONNECTED mode with RRC inactive indication over the 3GPP access, and in 5GMM-CONNECTED mode over non-3GPP access, receives a NOTIFICATION message over the non-3GPP access with access type indicating 3GPP access.

The UE shall transition from 5GMM-CONNECTED mode with RRC inactive indication to 5GMM-IDLE mode over 3GPP access and initiate the service request procedure over the 3GPP access.

k) Timer T3447 is running

The UE shall not start any service request procedure unless:

1) the UE in 5GMM-IDLE receives a paging request;

2) the UE is a UE configured for high priority access;

3) the UE has a PDU session for emergency services established or is establishing a PDU session for emergency services;

4) the service request procedure is initiated for emergency services fallback;

5) the UE in 5GMM-CONNECTED mode receives mobile terminated signalling or downlink data over the user-plane;

6) the service request procedure is initiated for elevated signalling; or

7) the MUSIM UE requests the network to release the NAS signalling connection (see case o in subclause 5.6.1.1).

The UE stays in the current serving cell and applies the normal cell reselection process. The service request procedure is started, if still necessary, when timer T3447 expires or timer T3447 is stopped.

l) Lower layer failure, release of the N1 signalling connection received from lower layers or the lower layers indicate that the RRC connection has been suspended before the service request procedure is completed or SERVICE REJECT message is received.

The UE shall abort the service request procedure, stop timer T3517, locally release any resources allocated for the service request procedure and enters state 5GMM-REGISTERED. For case m) in subclause 5.6.1.1 the UE may retry the service request procedure a certain number of times (maximum re-attempts 5).

m) Timer T3448 is running

The UE in 5GMM-IDLE mode shall not initiate the service request procedure for transport of user data via the control plane unless:

1) the UE is a UE configured for high priority access in selected PLMN;

2) the UE which is only using 5GS services with control plane CIoT 5GS optimization received a paging request;

3) the UE in NB-N1 mode is requested by the upper layer to transmit user data related to an exceptional event and the UE is allowed to use exception data reporting (see the ExceptionDataReportingAllowed leaf of the NAS configuration MO in 3GPP TS 24.368 [17] or the USIM file EF_NASCONFIG in 3GPP TS 31.102 [22]); or

4) the UE is initiating the service request procedure to request emergency services or emergency services fallback.

The UE stays in the current serving cell and applies the normal cell reselection process. The service request procedure is started, if still necessary, when timer T3448 expires.

5.6.1.8 Abnormal cases on the network side

The following abnormal cases can be identified:

a) Lower layer failure.

If a lower layer failure occurs before a SERVICE REJECT message has been sent to the UE or the service request procedure has been completed by the AMF, the AMF enters/stays in 5GMM-IDLE.

b) Protocol error.

If the SERVICE REQUEST message or the CONTROL PLANE SERVICE REQUEST message is received with a protocol error, the AMF shall return a SERVICE REJECT message with one of the following 5GMM cause values:

#96 invalid mandatory information;

#99 information element non-existent or not implemented;

#100 conditional IE error; or

#111 protocol error, unspecified.

The AMF stays in the current 5GMM mode.

c) More than one SERVICE REQUEST message or CONTROL PLANE SERVICE REQUEST message received before the procedure has been completed (i.e., before SERVICE REJECT message has been sent or service request procedure has been completed).

– If one or more of the information elements in the SERVICE REQUEST message or CONTROL PLANE SERVICE REQUEST message differs from the ones received within the previous SERVICE REQUEST message or CONTROL PLANE SERVICE REQUEST message, the previously initiated service request procedure shall be aborted, and the new service request procedure shall be progressed;

– If the information elements do not differ, then the AMF shall continue with the previous service request procedure and shall not treat any further this SERVICE REQUEST message or this CONTROL PLANE SERVICE REQUEST message.

d) REGISTRATION REQUEST message received with "initial registration" or "emergency registration" in the 5GS registration type IE before a SERVICE REJECT message has been sent or the service request procedure has been completed.

If a REGISTRATION REQUEST message with "initial registration" or "emergency registration" in the 5GS registration type IE is received and the service request procedure has not been completed or a SERVICE REJECT message has not been sent, the AMF may initiate the 5GMM common procedures, e.g. the primary authentication and key agreement procedure. The AMF may e.g. after a successful primary authentication and key agreement procedure execution, abort the service request procedure, delete the 5GMM context, indicate towards the SMF that the 5GMM context has been deleted and progress the new REGISTRATION REQUEST message.

e) REGISTRATION REQUEST message received with "mobility registration updating" or "periodic registration updating" in the 5GS registration type IE received before the service request procedure has been completed or a SERVICE REJECT message has been sent.

If a REGISTRATION REQUEST message with "mobility registration updating" or "periodic registration updating" in the 5GS registration type IE is received and the service request procedure has not been completed or a SERVICE REJECT message has not been sent, the AMF may initiate the 5GMM common procedures, e.g. the primary authentication and key agreement procedure. The AMF may e.g. after a successful primary authentication and key agreement procedure execution, abort the service request procedure and progress the new REGISTRATION REQUEST message.

f) If a CONTROL PLANE SERVICE REQUEST message with Control plane service type indicating "mobile originating request" is received after the AMF initiated a paging procedure, the AMF shall treat this CONTROL PLANE SERVICE REQUEST as a paging response and handle the message according to subclauses 5.6.1.4 and 5.6.1.5.

g) CONTROL PLANE SERVICE REQUEST message received with the Data type field indicates "control plane user data" in the CIoT small data container IE or received with Payload container type IE set to "CIoT user data container" and:

1) the AMF does not have a PDU session routing context for the PDU session ID and the UE; or

2) the AMF unsuccessfully attempted to forward the user data container and the PDU session ID,

then the AMF may send back to the UE the CIoT user data container or control plane user data which was not forwarded as specified in subclause 5.4.5.3.1 case l1) or case l2).

h) Based on operator policy, if the service request from a UE not supporting CAG is rejected due to CAG restrictions, the network shall reject the service request with a 5GMM cause value other than the 5GMM cause #76 (Not authorized for this CAG or authorized for CAG cells only).

i) CIoT user data received for a PDU session ID which is inactive in the network.

If a CONTROL PLANE SERVICE REQUEST message is received with CIoT user data for a PDU session that is inactive in the network, the AMF shall discard the CIoT user data. The AMF shall send the SERVICE ACCEPT message and indicate that this PDU session ID is inactive using the PDU session status IE.

NOTE: 5GMM cause #7 (5GS services not allowed), 5GMM cause #11 (PLMN not allowed), 5GMM cause #27 (N1 mode not allowed), 5GMM cause #73 (Serving network not authorized) can be used depending on the subscription of the UE and whether the UE roams or not.

5.6.2 Paging procedure

5.6.2.1 General

The paging procedure is performed only in 3GPP access and used by the network to request the establishment of a NAS signalling connection to the UE. The paging procedure is also used by the network to request the UE to re-establish the user-plane resources of PDU sessions for downlink user data transport. Another purpose of the paging procedure is to request the UE to re-establish the user-plane resources of PDU session(s) associated with non-3GPP access over 3GPP access.

Additionally, the network can use the paging procedure to initiate the mobile terminating SMS.

For the UE using eDRX, the network initiates the paging procedure when NAS signalling messages or user data is pending to be sent to the UE within the paging time window and requests the lower layers to include the eDRX cycle length and paging time window length in the paging message. If NAS signalling messages or user data is pending to be sent to the UE outside the paging time window and the eDRX value that the network provides to the UE in the Negotiated extended DRX parameters IE during the last registration procedure indicates:

a) the eDRX cycle length duration of the E-UTRA cell connected to 5GCN, is higher than 5.12 seconds; or

b) the eDRX cycle length duration of the NR cell connected to 5GCN, is higher than 10.24 seconds,

the network initiates the paging procedure at T time ahead of the beginning of the next paging time window.

NOTE: T time is a short time period based on implementation. The operator can take possible imperfections in the synchronization between the 5GCN and the UE into account when choosing T time.

If the network detects that the pending user data to be sent to the UE is related to the voice service as specified in 3GPP TS 23.502 [9] and the network decides to initiate the paging procedure based on the stored paging restriction information, if any, the AMF should request the lower layer to include the Voice Service Indication in the paging message when the UE and the network support the paging indication for voice services.

5.6.2.2 Paging for 5GS services

5.6.2.2.1 General

The network shall initiate the paging procedure for 5GS services when NAS signalling messages or user data is pending to be sent to the UE in 5GMM-IDLE mode over 3GPP access (see example in figure 5.6.2.2.1.1) and there is no paging restriction applied in the network for that paging.

Figure 5.6.2.2.1.1: Paging procedure

To initiate the procedure the 5GMM entity in the AMF requests the lower layer to start paging and shall start timer T3513.

If downlink signalling or user data is pending to be sent over non-3GPP access, the 5GMM entity in the AMF shall indicate to the lower layer that the paging is associated to non-3GPP access.

The network shall not page the UE to re-establish user-plane resources of PDU session(s) associated with non-3GPP access over 3GPP access if all the PDU sessions of the UE that are established over the 3GPP access are associated with control plane only indication.

If the network has downlink user data pending for a UE, the AMF has stored paging restriction of the UE and the Paging restriction type in the stored paging restriction is set to:

a) "All paging is restricted", the network should not page the UE;

b) "All paging is restricted except for voice service", the network should page the UE only when:

1) the pending downlink user data for the UE is considered as voice service related by the network;

c) "All paging is restricted except for specified PDU session(s)", the network should page the UE only when:

1) for PDU session(s) that paging is not restricted based on the stored paging restriction, the network has downlink user data pending; or

d) "All paging is restricted except for voice service and specified PDU session(s)", the network should page the UE only when:

1) the pending downlink user data for the UE is considered as voice service related by the network; or

2) for PDU session(s) that paging is not restricted based on the stored paging restriction, the network has downlink user data pending.

If the network has downlink signalling pending for a UE and the AMF has stored paging restriction of the UE and the Paging restriction type in the stored paging restriction is set to:

a) "All paging is restricted", the network should not page the UE;

b) "All paging is restricted except for voice service", the network should page the UE only when:

1) the pending downlink signalling for the UE is 5GMM signalling or 5GSM signalling of the PDU session of voice service;

c) "All paging is restricted except for specified PDU session(s)", the network should page the UE only when:

1) the pending downlink signalling for the UE is 5GMM signalling; or

2) for PDU session(s) that paging is not restricted based on the stored paging restriction, the network has downlink 5GSM signalling pending; or

d) "All paging is restricted except for voice service and specified PDU session(s)", the network should page the UE only when:

1) the pending downlink signalling for the UE is 5GMM signalling or 5GSM signalling of the PDU session of voice service; or

2) for PDU session(s) that paging is not restricted based on the stored paging restriction, the network has downlink 5GSM signalling pending.

NOTE 1: If the network pages the UE due to downlink signalling pending, the network initiates the release of the N1 NAS signalling connection after network-requested procedure is completed.

The 5GMM entity in the AMF may provide the lower layer with the "allowed CAG list" and an "indication that the UE is only allowed to access 5GS via CAG cells" for the current PLMN, if available, and with the "allowed CAG list" and an "indication that the UE is only allowed to access 5GS via CAG cells" per equivalent PLMN, if available. If there is an active emergency PDU session, the 5GMM entity in the AMF shall not provide the lower layer with the "allowed CAG list" and an "indication that the UE is only allowed to access 5GS via CAG cells" for the current PLMN, even if available, or with the "allowed CAG list" and an "indication that the UE is only allowed to access 5GS via CAG cells" per equivalent PLMN, even if available.

Upon reception of a paging indication, the UE shall stop the timer T3346, if running, and:

a) if control plane CIoT 5GS optimization is not used by the UE, the UE shall:

1) initiate a service request procedure over 3GPP access to respond to the paging as specified in subclauses 5.6.1.2.1 if the UE is in 5GMM-REGISTERED.NORMAL-SERVICE or 5GMM-REGISTERED.NON-ALLOWED-SERVICE (as described in subclause 5.3.5.2) state and the UE is in the 5GMM-IDLE mode without suspend indication;

2) initiate a service request procedure over non-3GPP access to respond to the paging as specified in subclauses 5.6.1;

3) initiate a registration procedure for mobility and periodic registration update over 3GPP access to respond to the paging as specified in subclauses 5.5.1.3.2; or

4) proceed as specified in subclause 5.3.1.5 if the UE is in the 5GMM-IDLE mode with suspend indication; or

b) if control plane CIoT 5GS optimization is used by the UE, the UE shall:

1) initiate a service request procedure as specified in subclause 5.6.1.2.2 if the UE is in the 5GMM-IDLE mode without suspend indication;

2) initiate a registration procedure for mobility and periodic registration update over 3GPP access as specified in subclauses 5.5.1.3.2; or

3) proceed as specified in subclause 5.3.1.5 if the UE is in the 5GMM-IDLE mode with suspend indication.

NOTE 2: If the UE is in the 5GMM-IDLE mode without suspend indication and has an uplink user data to be sent to the network using control plane CIoT 5GS optimization when receiving the paging indication, the UE can piggyback the uplink user data during the service request procedure initiated to respond to the paging, as specified in subclause 5.6.1.2.2.

The MUSIM UE based on implementation may use the paging cause indicated by lower layers (see 3GPP TS 38.331 [30]), if any, to accept the paging, reject the paging or ignore the paging indication.

Upon reception of a paging indication, if the network supports the rejection of paging request and if a MUSIM UE decides not to accept the paging, the UE may initiate a service request procedure to reject the paging as specified in clause 5.6.1.1.

NOTE 3: As an implementation option, MUSIM UE is allowed to not respond to paging based on the information available in the paging message, e.g. voice service indication.

If TMGI is used as paging identity and the TMGI matches with multicast MBS session which the has UE joined, the UE shall respond to the paging. Otherwise, the UE shall not respond to the paging.

The network shall stop timer T3513 for the paging procedure when an integrity-protected response is received from the UE and successfully integrity checked by the network or when the 5GMM entity in the AMF receives an indication from the lower layer that it has received the NGAP UE context resume request message as specified in 3GPP TS 38.413 [31]. If the response received is not integrity protected, or the integrity check is unsuccessful, timer T3513 for the paging procedure shall be kept running unless:

a) the UE is registered for emergency services;

b) the UE has an emergency PDU session; or

c) the response received is a REGISTRATION REQUEST message for mobility and periodic registration update and the security mode control procedure or authentication procedure performed during mobility and periodic registration update has completed successfully.

Upon expiry of timer T3513, the network may reinitiate paging.

If the network, while waiting for a response to the paging sent without paging priority, receives downlink signalling or downlink data associated with priority user-plane resources for PDU sessions, the network shall stop timer T3513, and then initiate the paging procedure with paging priority.

5.6.2.2.2 Abnormal cases on the network side

The following abnormal case can be identified:

a) Void.

5.6.2.2.3 Abnormal cases in the UE

The following abnormal cases can be identified:

a) Paging message received with access type set to non-3GPP access while the UE is in 5GMM-CONNECTED mode over non-3GPP access.

The UE shall not respond to paging message.

b) Paging message received with access type set to 3GPP access when UE-initiated 5GMM specific procedure or service request procedure is ongoing.

The UE shall proceed with 5GMM specific procedure or service request procedure. If for these procedures lower layers indicate that the access attempt is barred, then the UE shall handle the pending paging message as specified in subclause 5.6.2.2.1. Otherwise, the UE shall ignore the paging once lower layers confirm the establishment of the signalling connection.

5.6.3 Notification procedure

5.6.3.1 General

The notification procedure is used by the network:

a) to request the UE, by sending the NOTIFICATION message over 3GPP access, to re-establish the user-plane resources of PDU session(s) associated with non-3GPP access over 3GPP access or to deliver 5GSM downlink signalling messages associated with non-3GPP access over 3GPP access when the UE is in 5GMM-IDLE mode over non-3GPP access and in 5GMM-CONNECTED mode over 3GPP access; or

b) to request the UE, by sending the NOTIFICATION message over non-3GPP access, to re-establish user-plane resources of the PDU session(s) or to deliver downlink signalling associated with 3GPP access over 3GPP access when the UE is in 5GMM-CONNECTED mode over non-3GPP access and:

1) in 5GMM-IDLE mode over 3GPP access when the UE is not in MICO mode; or

2) in 5GMM-IDLE mode with suspend indication over 3GPP access when the UE is not in MICO mode.

The network shall not use the NOTIFICATION message to re-establish user-plane resources of PDU session(s) associated with non-3GPP access over 3GPP access if all the PDU sessions of the UE that are established over the 3GPP access are associated with control plane only indication. .

The network shall not use the NOTIFICATION message over non-3GPP access, if:

a) the MUSIM UE supports the paging indication for voice services;

b) the network has indicated "paging indication for voice services supported" to the UE; and

c) the AMF detects that the downlink data is related to voice service (see 3GPP TS 23.501 [8]).

5.6.3.2 Notification procedure initiation

The network shall initiate the notification procedure by sending the NOTIFICATION message to the UE and start timer T3565 (see example in figure 5.6.3.2.1).

For case a) in subclause 5.6.3.1, the NOTIFICATION message is sent from the network to the UE via 3GPP access with access type indicating non-3GPP access.

For case b) in subclause 5.6.3.1, the NOTIFICATION message is sent from the network to the UE via non-3GPP access with access type indicating 3GPP access when the UE is not in MICO mode.

Figure 5.6.3.2.1: Notification procedure

For case b) in subclause 5.6.3.1, if the network has downlink user data pending for a UE and the AMF has stored paging restriction of the UE and the Paging restriction type in the stored paging restriction is set to:

a) "All paging is restricted", the network should not send the NOTIFICATION message to the UE;

b) "All paging is restricted except for voice service", the network should send the NOTIFICATION message to the UE only when the pending downlink user data for the UE is considered as voice service related by the network and the MUSIM UE does not support the paging indication for voice services or the network has not indicated "paging indication for voice services supported" to the UE;

c) "All paging is restricted except for specified PDU session(s)", the network should send the NOTIFICATION message to the UE only when:

1) for PDU session(s) that paging is not restricted based on the stored paging restriction, the network has downlink user data pending;

d) "All paging is restricted except for voice service and specified PDU session(s)" the network should send the NOTIFICATION message to the UE only:

1) when the pending downlink user data for the UE is considered as voice service related by the network and the MUSIM UE does not support the paging indication for voice services, or the network has not indicated "paging indication for voice services supported" to the UE; or

2) for PDU session(s) that paging is not restricted based on the stored paging restriction, the network has downlink user data pending.

For case b) in subclause 5.6.3.1, if the network has downlink signalling pending for a UE and the AMF has stored paging restriction of the UE and the Paging restriction type in the stored paging restriction is set to:

a) "All paging is restricted", the network should not send the NOTIFICATION message to the UE;

b) "All paging is restricted except for voice service", then the network should send the NOTIFICATION message to the UE only when:

1) the pending downlink signalling for the UE is 5GMM signalling or 5GSM signalling of the PDU session of voice service;

c) "All paging is restricted except for specified PDU session(s)", the network should send the NOTIFICATION message to the UE only when:

1) the pending downlink signalling for the UE is 5GMM signalling; or

2) for PDU session(s) that paging is not restricted based on the stored paging restriction, the network has downlink 5GSM signalling pending; or

d) "All paging is restricted except for voice service and specified PDU session(s)" then the network should send the NOTIFICATION message to the UE only when:

1) the pending downlink signalling for the UE is 5GMM signalling or 5GSM signalling pending of the PDU session of voice service; or

2) for PDU session(s) that paging is not restricted based on the stored paging restriction, the network has downlink 5GSM signalling pending.

NOTE 1: If the network sends NOTIFICATION message to the UE due to downlink signalling pending, the network initiates the release of the N1 NAS signalling connection over 3GPP access after network-requested procedure is completed.

Upon reception of a NOTIFICATION message, the UE shall stop the timer T3346, if running.

For case a) in subclause 5.6.3.1, upon reception of NOTIFICATION message, the UE shall initiate a service request procedure over 3GPP access as specified in subclauses 5.6.1.

NOTE 2: For a UE in NB-NI mode, if there is DL user data pending for a PDU session associated with non-3GPP access then the AMF notifies the SMF that reactivation of user plane resources cannot be performed if the number of PDU sessions that currently has user-plane resources established equals to the UE’s maximum number of supported user-plane resources.

For case b) in subclause 5.6.3.1, upon reception of NOTIFICATION message:

a) if control plane CIoT 5GS optimization is not used by the UE, the UE shall:

1) initiate a service request procedure over 3GPP access as specified in subclause 5.6.1.2.1, if the UE is in 5GMM-REGISTERED.NORMAL-SERVICE or 5GMM-REGISTERED.NON-ALLOWED-SERVICE (as described in subclause 5.3.5.2) state over 3GPP access or 5GMM-REGISTERED.NON-ALLOWED-SERVICE state (see subclause 5.3.5.2), and the UE is in the 5GMM-IDLE mode without suspend indication;

2) initiate a registration procedure for mobility and periodic registration update over 3GPP access as specified in subclause 5.5.1.3.2, if the UE is in 5GMM-REGISTERED.ATTEMPTING-REGISTRATION-UPDATE state over 3GPP access; or

3) proceed as specified in subclause 5.3.1.5 if the UE is in the 5GMM-IDLE mode with suspend indication;

b) if control plane CIoT 5GS optimization is used by the UE, the UE shall:

1) initiate a service request procedure over 3GPP access as specified in subclause 5.6.1.2.2, if the UE is in 5GMM-REGISTERED.NORMAL-SERVICE or 5GMM-REGISTERED.NON-ALLOWED-SERVICE (as described in subclause 5.3.5.2) state and the UE is in the 5GMM-IDLE mode without suspend indication;

3) proceed as specified in subclause 5.3.1.5 if the UE is in the 5GMM-IDLE mode with suspend indication; or

c) if:

1) the UE is in 5GMM-REGISTERED.NO-CELL-AVAILABLE state, 5GMM-REGISTERED.PLMN-SEARCH state, 5GMM-REGISTERED.LIMITED-SERVICE state or 5GMM-REGISTERED.UPDATE-NEEDED state over 3GPP access; or

2) the MUSIM UE is not able to respond the NOTIFICATION message as specified in case a) and b) above, e.g., due to UE implementation constraints;

the UE shall respond with NOTIFICATION RESPONSE message over non-3GPP access indicating inability of the UE to initiate a service request procedure or a registration procedure over 3GPP access and may include the PDU session status information element to indicate:

1) the single access PDU session(s) not in 5GSM state PDU SESSION INACTIVE in the UE associated with the 3GPP access type; and

2) the MA PDU session(s) not in 5GSM state PDU SESSION INACTIVE in the UE and having user plane resources established associated with the 3GPP access type.

Upon reception of NOTIFICATION message:

For case b) in subclause 5.6.3.1, if the UE is in 5GMM-REGISTERED.NO-CELL-AVAILABLE state or 5GMM-REGISTERED.PLMN-SEARCH state and a local release was performed in the UE for the single access PDU sessions associated with the 3GPP access or for user plane resources on the 3GPP access of MA PDU sessions;

then the UE shall respond with NOTIFICATION RESPONSE message over non-3GPP access indicating with the PDU session status information element that:

– the local release of its single access PDU sessions associated with the 3GPP access was performed; and

– the local release of its 3GPP access user plane resources of MA PDU sessions was performed.

5.6.3.3 Notification procedure completion

Upon reception of SERVICE REQUEST message, CONTROL PLANE SERVICE REQUEST message or REGISTRATION REQUEST message, the AMF shall stop timer T3565 and proceed service request procedure as specified in subclauses 5.6.3.1 or registration procedure for mobility and periodic registration update as specified in subclauses 5.5.1.3. If no user-plane resources of PDU session(s) need to be re-established, the AMF should notify the SMF that the UE was reachable but did not accept to re-establish the user-plane resources of PDU session(s).

When the 5GMM entity in the AMF receives an indication from the lower layer that it has received the NGAP UE context resume request message as specified in 3GPP TS 38.413 [31], the AMF shall stop timer T3565.

Upon reception of NOTIFICATION RESPONSE message over non-3GPP access, the AMF shall stop timer T3565 and should notify the SMF that the UE is unreachable.

If the NOTIFICATION RESPONSE message includes the PDU session status information element, then:

a) for single access PDU sessions, the AMF shall:

1) perform a local release of all those PDU sessions which are not in 5GSM state PDU SESSION INACTIVE on the AMF side associated with 3GPP access, but are indicated by the UE in the PDU session status information element in the NOTIFICATION RESPONSE message as being in 5GSM state PDU SESSION INACTIVE; and

2) shall request the SMF to perform a local release of all those PDU sessions associated with 3GPP access. If any of those PDU sessions is associated with one or more multicast MBS sessions, the SMF shall consider the UE as removed from the associated multicast MBS sessions; and

b) For MA PDU sessions, the AMF shall:

1) for MA PDU sessions having user plane resources established only on the 3GPP access in the AMF side, but are indicated by the UE in the PDU session status information element in the NOTIFICATION RESPONSE message as no user plane resources established on the 3GPP access:

i) perform a local release of all those MA PDU sessions; and

ii) request the SMF to perform a local release of all those MA PDU sessions. If the MA PDU session is associated with one or more multicast MBS sessions, the SMF shall consider the UE as removed from the associated multicast MBS sessions; and

2) for MA PDU sessions having user plane resources established on both accesses in the AMF side, but are indicated by the UE in the PDU session status information element in the NOTIFICATION RESPONSE message as no user plane resources established on the 3GPP access:

i) perform a local release of 3GPP access user plane resources of all those MA PDU sessions; and

ii) request the SMF to perform a local release of 3GPP access user plane resources of all those MA PDU sessions. If the MA PDU session is associated with one or more MBS sessions, the SMF shall consider the UE as removed from the associated MBS sessions.

5.6.3.4 Abnormal cases on the network side

The following abnormal cases can be identified:

a) Expiry of timer T3565.

The network shall, on the first expiry of the timer T3565, retransmit the NOTIFICATION message and shall reset and start timer T3565. This retransmission is repeated four times, i.e. on the fifth expiry of timer T3565, the procedure shall be aborted. In addition, upon the fifth expiry of timer T3565:

For case a) in subclause 5.6.3.1, the AMF should notify the SMF that the UE is unreachable. The AMF may enter 5GMM-IDLE mode over 3GPP access.

For case b) in subclause 5.6.3.1, the AMF may either:

1) perform the paging procedure over the 3GPP access; or

2) notify the SMF that the UE is unreachable.

NOTE: Whether the AMF performs the paging procedure or notifies the SMF is up to operator’s policies.

b) De-registration procedure collision

If the network receives a DEREGISTRATION REQUEST message before it receives a SERVICE REQUEST message or REGISTRATION REQUEST message, the AMF shall stop timer T3565 and proceed de-registration procedure as specified in subclause 5.5.2.

5.6.3.5 Abnormal cases on the UE side

The following abnormal cases can be identified:

a) NOTIFICATION message received via non-3GPP access with access type indicating 3GPP access when UE-initiated 5GMM specific procedure or service request procedure over 3GPP access is ongoing.

The UE shall proceed with 5GMM specific procedure or service request procedure. If for these procedures lower layers indicate that the access attempt is barred, then the UE shall handle the pending NOTIFICATION message as specified in subclause 5.6.3.2. Otherwise, the UE shall ignore the NOTIFICATION message once lower layers confirms the establishment of the signalling connection.