7.1 FPLMN handling

31.1213GPPRelease 16TSUICC-terminal interfaceUniversal Subscriber Identity Module (USIM) application test specification

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

7.1.1 Adding FPLMN to the Forbidden PLMN list

7.1.1.1 Definition and applicability

A list of forbidden PLMNs stored in the USIM and providing storage for at least 4 entries is managed by the UE. In automatic PLMN selection mode the UE controls registration attempts to appropriate networks with respect to this list of forbidden PLMNs. As a result of a registration reject with the cause "PLMN not allowed" the UE stores the PLMN which rejected the update request in the USIM.

The registration attempts initiated by the 3G UE depends on UEs capabilities and can be one of the following:

I. registration procedures for UEs supporting CS or

II. registration procedures for UEs supporting PS or

III. registration procedures for UEs supporting CS/PS

7.1.1.2 Conformance requirement

In case of a 2G terminal:

1) In automatic PLMN selection mode the UE shall only attempt a LOCATION UPDATE if it receives a BCCH containing a LAI that is not indicated in the EF_FPLMN in the USIM.

Reference:

– TS 22.011 [6], clause 2.3;

– TS 31.102 [4], clauses 5.1.1 and 5.2.7.

2) After receipt of a LOCATION UPDATING REJECT message with the cause "PLMN not allowed" the Terminal shall update the EF_FPLMN in the USIM.

Reference:

– TS 22.011 [6], clause 2.3;

– TS 31.102 [4], clauses 5.1.1 and 5.2.7.

3) After call termination the USIM shall contain the correct Ciphering Key Sequence Number.

Reference:

– TS 31.102 [4], clauses 5.1.2, 5.2.5 and 5.2.6;

– TS 21.111 [19], clause 10.1.

4) After call termination the USIM shall contain the correct TMSI and location information received by the UE.

Reference:

– TS 31.102 [4], clauses 5.1.2, 5.2.5 and 5.2.6;

– TS 21.111 [19], clause 10.1.

In case of a 3G terminal:

1) Depending on which domain the UE is going to be registered on, one of the following requirements should be fulfilled:

I. In automatic PLMN selection mode the UE shall only attempt a LOCATION UPDATING REQUEST during registration on CS if it receives a BCCH containing a PLMN(MCC,MNC) that is not indicated in the EF_FPLMN in the USIM or

II. in automatic PLMN selection mode the UE shall only attempt a ATTACH REQUEST during registration on PS if it receives a BCCH containing a PLMN(MCC,MNC) that is not indicated in the EF_FPLMN in the USIM or

III. in automatic PLMN selection mode the UE shall only attempt a LOCATION UPDATING REQUEST and/or ATTACH REQUEST during registration on CS/PS if it receives a BCCH containing a PLMN(MCC,MNC) that is not indicated in the EF_FPLMN in the USIM.

Reference:

– TS 22.011 [6], clause 2.3;

– TS 31.102 [4], clauses 5.1.1 and 5.2.7.

2) Depending on which domain the UE is going to be on, one of the following requirements should be fulfilled:

I. After receipt of a LOCATION UPDATING REJECT message during registration on CS with the cause "PLMN not allowed" the Terminal shall update the EF_FPLMN in the USIM or.

II. after receipt of a ATTACH REJECT message during registration on PS with the cause "PLMN not allowed" the Terminal shall update the EF_FPLMN in the USIM or

III. after receipt of a LOCATION UPDATING REJECT and/or ATTACH REJECT message during registration on CS/PS with the cause "PLMN not allowed" the Terminal shall update the EF_FPLMN in the USIM.

Reference:

– TS 22.011 [6], clause 3.2.2 2.3;

– TS 31.102 [4], clauses 5.1.1 and 5.2.7.

3) After call termination the USIM shall contain the correct Key Set Identifier.

4) Depending on which domain the UE is going to be registered on, one of the following requirements should be fulfilled:

I. after registration on CS the USIM shall contain the correct TMSI and location information received by the UE or

II. after registration on PS the USIM shall contain the correct P-TMSI and routing information received by the UE or

III. after registration on CS/PS the USIM shall contain the correct TMSI, P-TMSI, location information and routing information received by the UE.

Reference:

– TS 31.102 [4], clauses 5.1.2, 5.2.5 and 5.2.6;

– TS 21.111 [6], clause 10.1.

5) After call termination the USIM shall contain the correct TMSI and location information received by the UE.

Reference:

– TS 31.102 [4], clauses 5.1.2, 5.2.5 and 5.2.6;

– TS 21.111 [6], clause 10.1.

7.1.1.3 Test purpose

In case of a 2G terminal:

1) To verify that in automatic PLMN selection mode the UE does not attempt to access PLMNs stored in EF_FPLMN on the USIM.

2) To verify that the EF_FPLMN is correctly updated by the Terminal after receipt of a LOCATION UPDATING REJECT message with cause "PLMN not allowed".

3) To verify that the EF_LOCI has been correctly updated by the Terminal.

In case of a 3G terminal:

1) To verify that in automatic PLMN selection mode the UE does not attempt to access PLMNs stored in EF_FPLMN on the USIM.

2) To verify that after receipt of a

I. LOCATION UPDATING REJECT message with cause "PLMN not allowed" during registration on CS
the Terminal correctly updates EF_FPLMN and EF_Keys, or

II. ATTACH REJECT message with cause "PLMN not allowed" during registration on PS
the Terminal correctly updates EF_FPLMN and EF_KeysPS, or

III. LOCATION UPDATING REJECT and/or ATTACH REJECT message with cause "PLMN not allowed" during registration on CS/PS the Terminal correctly updates EF_FPLMN, EF_Keys and EF_KeysPS.

3) To verify that

I. the EF_LOCI has been correctly updated by the Terminal during registration on CS or.

II. the EF_PSLOCI has been correctly updated by the Terminal during registration on PS or.

III. the EF_LOCIand EF_PSLOCI have been correctly updated by the Terminal during registration on CS/PS.

4) (void)

7.1.1.4 Method of test

7.1.1.4.1 Initial conditions

The USS (in case of a Terminal accessing UTRAN)/ SS (in case of a Terminal accessing a GERAN) transmits on the BCCH, with the following network parameters:

– Attach/detach: disabled.

– LAI (MCC/MNC/LAC): 234/002/0001.

– RAI (MCC/MNC/LAC/RAC): 234/002/0001/05. (only for UTRAN cell)

– Access control: unrestricted.

NOTE: In case of a GERAN no packet system information is transmitted

The default UICC is used with the following exception:

EF_IMSI (IMSI)

Logically: 246081111111111

Coding:	B1	B2	B3	B4	B5	B6	B7	B8	B9
Hex	08	29	64	80	11	11	11	11	11

EF_LOCI (Location Information)

Logically: LAI-MCC: 234

LAI-MNC: 007

LAI-LAC: 0000

TMSI: "32547698"

Coding:	B1	B2	B3	B4	B5	B6	B7	B8	B9	B10	B11
Hex	32	54	76	98	32	74	00	00	00	FF	00

EF_PSLOCI (Packet Switched location Information)

Logically: RAI-MCC: 234

RAI-MNC: 007

RAI-LAC: 0000

RAI-RAC: 05

P-TMSI: "32547698"

P-TMSI signature value: "112233"

Coding:	B1	B2	B3	B4	B5	B6	B7	B8	B9	B10	B11
Hex	32	54	76	98	11	22	33	32	74	00	00

	B12	B13	B14
	00	05	00

The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode.

EF_Keys (Ciphering and Integrity Keys)

Logically: Key Set Identifier KSI: 02

Ciphering Keys CK: undefined

Integrity Keys IK: undefined

Coding:	B1	B2	B3	…	B16	B17	B18	…	B31	B32	B33
Hex	02	xx	xx	…	xx	xx	xx	…	xx	xx	xx

EF_KeysPS (Ciphering and Integrity Keys for Packet Switched domain)

Logically: Key Set Identifier KSI: 02

Ciphering Keys CK: undefined

Integrity Keys IK: undefined

Coding:	B1	B2	B3	…	B16	B17	B18	…	B31	B32	B33
Hex	02	xx	xx	…	xx	xx	xx	…	xx	xx	xx

In case of a Terminal accessing UTRAN "Expected Sequence A" shall be performed and in case of a Terminal accessing a GERAN "Expected Sequence B" shall be performed.

7.1.1.4.2 Procedure

Expected Sequence A:

a) The UE is powered on.

b) The USS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the UE. The BCCH is changed to contain:

PLMN (MCC/MNC): 234/003

The USS then resumes RF output on the BCCH.

c) The USS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the UE. The BCCH is changed to contain:

PLMN (MCC/MNC): 234/004

The USS then resumes RF output on the BCCH.

d) The USS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the UE. The BCCH is changed to contain:

PLMN (MCC/MNC): 234/005

The USS then resumes RF output on the BCCH.

e) The USS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the UE. The BCCH is changed to contain:

LAI (MCC/MNC/LAC): 234/007/0001

RAI (MCC/MNC/LAC/RAC): 234/007/0001/05

The USS then resumes RF output on the BCCH.

f) After receipt of a RRC CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS.

g) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed through:

I. During registration on CS and after receipt of a LOCATION UPDATING REQUEST from the UE, the USS performs authentication and starts integrity protection, sends LOCATION UPDATING REJECT to the UE with cause "PLMN Not Allowed", followed by RRC CONNECTION RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS.

II. During registration on PS and after receipt of a ATTACH REQUEST from the UE, the USS performs authentication and starts integrity protection, sends ATTACH REJECT to the UE with cause "PLMN Not Allowed", followed by RRC CONNECTION RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS or

III.During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or ATTACH REQUEST from the UE, the USS performs authentication and starts integrity protection, sends LOCATION UPDATING REJECT and/or ATTACH REJECT to the UE with cause "PLMN Not Allowed", followed by RRC CONNECTION RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS.

The USS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the UE. The BCCH is changed to contain:

LAI (MCC/MNC/LAC): 234/008/0001

RAI (MCC/MNC/LAC/RAC): 234/008/0001/05

The USS then resumes RF output on the BCCH.

h) After receipt of a RRC CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS.

i) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed through:

I. During registration on CS and after receipt of a LOCATION UPDATING REQUEST from the UE, the USS initiates authentication, starts integrity by using the security procedure and sends LOCATION UPDATING ACCEPT with:

LAI (MCC/MNC/LAC): 234/008/0001

TMSI: "43658709"

II. During registration on PS and after receipt of a ATTACH REQUEST from the UE, the USS initiates authentication, starts integrity by using the security procedure and sends ATTACH ACCEPT to the UE with:

RAI (MCC/MNC/LAC/RAC): 234/008/0001/05

P-TMSI: "43658709"

P-TMSI signature value "443322"

III. During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or ATTACH REQUEST from the UE, the USS initiates authentication, starts integrity by using the security procedure and sends LOCATION UPDATING ACCEPT and/or ATTACH ACCEPT with some of the following values to the UE with:

LAI (MCC/MNC/LAC): 234/008/0001

TMSI: "43658709"

RAI (MCC/MNC/LAC/RAC): 234/008/0001/05

P-TMSI: "43658709"

P-TMSI signature value "443322"

j) After passing through the authentication procedure and after receipt of

I. TMSI REALLOCATION COMPLETE during registration on CS from the UE the USS sends RRC CONNECTION RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS or.

II. ATTACH COMPLETE during registration on PS from the UE, the USS sends RRC CONNECTION RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS or.

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE during registration on CS/PS from the UE, the USS sends RRC CONNECTION RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS.

k) The UE is soft powered down.

Expected Sequence B:

a) The UE is powered on.

b) The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the UE. The BCCH is changed to contain:

PLMN (MCC/MNC): 234/003

The SS then resumes RF output on the BCCH.

c) The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the UE. The BCCH is changed to contain:

PLMN (MCC/MNC): 234/004

The SS then resumes RF output on the BCCH.

d) The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the UE. The BCCH is changed to contain:

PLMN (MCC/MNC): 234/005

The SS then resumes RF output on the BCCH.

e) The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the UE. The BCCH is changed to contain:

LAI (MCC/MNC/LAC): 234/007/0001

The SS then resumes RF output on the BCCH.

f) After receipt of a CHANNEL REQUEST from the UE, the SS sends IMMEDIATE ASSIGNMENT to the UE.

g) After receipt of a LOCATION UPDATING REQUEST from the UE, the SS sends LOCATION UPDATING REJECT to the UE with cause "PLMN Not Allowed", followed by CHANNEL RELEASE.

The SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the UE. The BCCH is changed to contain:

LAI (MCC/MNC/LAC): 234/008/0001

The SS then resumes RF output on the BCCH.

h) After receipt of a CHANNEL REQUEST from the UE, the SS sends IMMEDIATE ASSIGNMENT to the UE.

i) After receipt of a LOCATION UPDATING REQUEST from the UE, the SS sends LOCATION UPDATING ACCEPT with:

LAI (MCC/MNC/LAC): 234/008/0001

TMSI: "43658709"

to the UE.

j) After receipt of a TMSI REALLOCATION COMPLETE from the UE, the SS sends CHANNEL RELEASE to the UE.

k) The UE is soft powered down.

7.1.1.5 Acceptance criteria

1) After each of the steps a) to d) the UE shall not attempt a LOCATION UPDATING and not a ATTACH procedure.

2) After step f) the 2G UE shall send LOCATION UPDATING REQUEST to the SS and a 3G terminal shall send

I. LOCATION UPDATING REQUEST to the USS during registration on CS or

II. ATTACH REQUEST during registration on PS or

III. LOCATION UPDATING REQUEST and/or ATTACH REQUEST to the USS during registration on CS/PS.

2a) After step g) a terminal accessing UTRAN shall update

I. during the rejected registration attempt on CS or

EF_Keys (Ciphering and Integrity Keys)

Logically: Key Set Identifier KSI: 07 (no key available)

Ciphering Keys CK: xx

Integrity Keys IK: xx

Coding:	B1	B2	B3	…	B16	B17	B18	…	B31	B32	B33
Hex	07	xx	xx	…	xx	xx	xx	…	xx	xx	Xx

II. during the rejected registration attempt on PS or

EF_KeysPS (Ciphering and Integrity Keys for Packet Switched domain)

Logically: Key Set Identifier KSIPS: 07 (no key available)

Ciphering Keys CKPS: xx

Integrity Keys IKPS: xx

Coding:	B1	B2	B3	…	B16	B17	B18	…	B31	B32	B33
Hex	07	xx	xx	…	xx	xx	xx	…	xx	xx	Xx

III. during the rejected registration attempt on CS/PS.

EF_Keys (Ciphering and Integrity Keys)

Logically: Key Set Identifier KSI: 07 (no key available)

Ciphering Keys CK: xx

Integrity Keys IK: xx

Coding:	B1	B2	B3	…	B16	B17	B18	…	B31	B32	B33
Hex	07	xx	xx	…	xx	xx	xx	…	xx	xx	Xx

EF_KeysPS (Ciphering and Integrity Keys for Packet Switched domain)

Logically: Key Set Identifier KSIPS: 07 (no key available)

Ciphering Keys CKPS: xx

Integrity Keys IKPS: xx

Coding:	B1	B2	B3	…	B16	B17	B18	…	B31	B32	B33
Hex	07	xx	xx	…	xx	xx	xx	…	xx	xx	Xx

3) After step h) the 2G UE shall send LOCATION UPDATING REQUEST to the SS and a 3G terminal shall send

I. LOCATION UPDATING REQUEST to the USS during registration on CS or

II. ATTACH REQUEST during registration on PS or

III. LOCATION UPDATING REQUEST and/or ATTACH REQUEST to the USS during registration on CS/PS.

4) After step i) the 2G UE shall respond with TMSI REALLOCATION COMPLETE to the SS and a 3G terminal shall respond with

I. TMSI REALLOCATION COMPLETE to the USS during registration on CS or

II. ATTACH COMPLETE during registration on PS or

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE to the USS during registration on CS/PS.

5) After step k) the USIM shall contain the following values:

EF_FPLMN (Forbidden PLMNs)

Logically: PLMN1: 234 002 (MCC MNC)

PLMN2: 234 003

PLMN3: 234 004

PLMN4: 234 005

PLMN5: 234 006

PLMN6: 234 007

Coding:	B1	B2	B3	B4	B5	B6	B7	B8	B9	B10	B11	B12
Hex	32	24	00	32	34	00	32	44	00	32	54	00

	B13	B14	B15	B16	B17	B18
	32	64	00	32	74	00

For 2G terminals and 3G terminals supporting (CS and PS) or (CS only):

EF_LOCI (Location Information)

Logically: LAI-MCC: 234

LAI-MNC: 008

TMSI: "43658709"

Coding:	B1	B2	B3	B4	B5	B6	B7	B8	B9	B10	B11
Hex	43	65	87	09	32	84	00	xx	xx	xx	00

For 3G terminals supporting (CS and PS) or (PS only):

EF_PSLOCI (Location Information)

Logically: RAI-MCC: 234

RAI-MNC: 008

P-TMSI: "43658709"

Coding:	B1	B2	B3	B4	B5	B6	B7	B8	B9	B10	B11
Hex	43	65	87	09	xx	xx	xx	32	84	00	xx

Coding:	B12	B13	B14
Hex	xx	xx	00

In case of a Terminal accessing GERAN:

EF_Keys (Ciphering and Integrity Keys)

Logically: Key Set Identifier KSI: 07 (not available)

Ciphering Keys CK: xx

Integrity Keys IK: xx

Coding:	B1	B2	B3	…	B16	B17	B18	…	B31	B32	B33
Hex	07	xx	xx	…	xx	xx	xx	…	xx	xx	Xx

7.1.2 UE updating forbidden PLMNs

7.1.2.1 Definition and applicability

A list of forbidden PLMNs stored in the USIM provides storage for at least 4 entries, and is managed by the UE. In automatic PLMN selection mode the UE controls registration attempts to appropriate networks with respect to this list of forbidden PLMNs. As a result of a registration reject with the cause "PLMN not allowed" the UE stores the PLMN which rejected the update request in the USIM.

The registration attempts initiated by the 3G UE depends on UEs capabilities and can be one of the following:

I. registration procedures for UEs supporting CS or

II. registration procedures for UEs supporting PS or

III. registration procedures for UEs supporting CS/PS

7.1.2.2 Conformance requirement

In case of a 2G terminal:

After the receipt of a LOCATION UPDATING REJECT message with the cause "PLMN not allowed" the UE shall update the EF_FPLMN in the USIM.

Reference:

– TS 22.011 [6], clause 3.2.2.4.

– TS 31.102 [4], clauses 5.1.1 and 5.2.7.

In case of a 3G terminal:

Depending on which domain the UE will be registered on, one of the following requirements should be fulfilled:

I. After the receipt of a LOCATION UPDATING REJECT message during registration on CS with the cause "PLMN not allowed" the UE shall update the EF_FPLMN in the USIM or

II. after receipt of a ATTACH REJECT message during registration on PS with the cause "PLMN not allowed" the Terminal shall update the EF_FPLMN in the USIM or

III. after receipt of a LOCATION UPDATING REJECT and/or ATTACH REJECT message during registration on CS/PS with the cause "PLMN not allowed" the Terminal shall update the EF_FPLMN in the USIM.

Reference:

– TS 22.011 [6], clause 3.2.2.4.

– TS 31.102 [4], clauses 5.1.1 and 5.2.7.

7.1.2.3 Test purpose

To verify that the UE correctly updates the EF_FPLMN, i.e. fill up existing gaps in the elementary file before overwriting any existing entries.

7.1.2.4 Method of test

7.1.2.4.1 Initial conditions

The USS (in case of a Terminal accessing UTRAN)/ SS (in case of a Terminal accessing a GERAN) transmits on the BCCH, with the following network parameters:

– Attach/detach: disabled.

– LAI (MCC/MNC/LAC): 234/002/0001.

– RAI (MCC/MNC/LAC/RAC): 234/002/0001/05 (only for UTRAN cell)

– Access control: unrestricted.

NOTE: In case of a GERAN no packet system information is transmitted

The default UICC is used with the following exception:

EF_FPLMN (Forbidden PLMNs)

Logically: PLMN1: 234 001 (MCC MNC)

PLMN2: empty

PLMN3: 234 003

PLMN4: 234 004

PLMN5: 234 005

PLMN6: 234 006

Coding:

B10

B11

B12

Hex

B13

B14

B15

B16

B17

B18

The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode.

In case of a Terminal accessing UTRAN "Expected Sequence A" and in case of a Terminal accessing a GERAN "Expected Sequence B" shall be performed.

7.1.2.4.2 Procedure

Expected Sequence A:

a) The UE is powered on.

b) After receipt of a RRC CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS.

c) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed through:

I. During registration on CS and after receipt of a LOCATION UPDATING REQUEST from the UE, the USS performs authentication and starts integrity protection, sends LOCATION UPDATING REJECT to the UE with the cause "PLMN not allowed", followed by RRC CONNECTION RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS or

III. During registration on CS/PS and after receipt of a LOCATION UPDATING REQUEST and/or ATTACH REQUEST from the UE, the USS performs authentication and starts integrity protection, sends LOCATION UPDATING REJECT and/or ATTACH REJECT to the UE with cause "PLMN Not Allowed", followed by RRC CONNECTION RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS.

d) The UE is soft powered down.

Expected Sequence B:

a) The UE is powered on.

b) After receipt of a CHANNEL REQUEST from the UE, the SS sends IMMEDIATE ASSIGNMENT to the UE.

c) After receipt of a LOCATION UPDATING REQUEST from the UE, the SS sends LOCATION UPDATING REJECT to the UE with cause "PLMN Not Allowed", followed by CHANNEL RELEASE.

d) The UE is soft powered down.

7.1.2.5 Acceptance criteria

1) After step b) the 2G UE shall send LOCATION UPDATING REQUEST to the SS and the 3G terminal shall send

I. LOCATION UPDATING REQUEST to the USS during registration on CS or

II. ATTACH REQUEST during registration on PS or

III. LOCATION UPDATING REQUEST and/or ATTACH REQUEST to the USS during registration on CS/PS.

2) After step d) the USIM shall contain:

EF_FPLMN (Forbidden PLMNs)

Logically: PLMN1: 234 001 (MCC MNC)

PLMN2: 234 002

PLMN3: 234 003

PLMN4: 234 004

PLMN5: 234 005

PLMN6: 234 006

Coding:	B1	B2	B3	B4	B5	B6	B7	B8	B9	B10	B11	B12
Hex	32	14	00	32	24	00	32	34	00	32	44	00

	B13	B14	B15	B16	B17	B18
	32	54	00	32	64	00

EF_FPLMN (Forbidden PLMNs)

Logically: PLMN1: 234 001 (MCC MNC)

PLMN2: 234 003

PLMN3: 234 004

PLMN4: 234 005

PLMN5: 234 006

PLMN6: 234 002

Coding:	B1	B2	B3	B4	B5	B6	B7	B8	B9	B10	B11	B12
Hex	32	14	00	32	34	00	32	44	00	32	54	00

	B13	B14	B15	B16	B17	B18
	32	64	00	32	24	00

7.1.3 UE deleting forbidden PLMNs

7.1.3.1 Definition and applicability

In manual PLMN selection mode the UE allows registration attempts to all available PLMNs, including forbidden PLMNs (as indicated by the forbidden PLMN list on the USIM). As a result of a successful registration procedure onto a PLMN which is in the forbidden PLMN list, the forbidden PLMN list is automatically updated by the UE.

The registration attempts initiated by the 3G UE depends on Ues capabilities and can be one of the following:

I. registration procedures for Ues supporting CS or

II. registration procedures for Ues supporting PS or

III. registration procedures for Ues supporting CS/PS

7.1.3.2 Conformance requirement

In case of a 2G terminal:

1) In manual PLMN selection mode the UE shall be able to perform a LOCATION UPDATING attempt to a PLMN which is in the forbidden PLMN list.

– TS 22.011 [6], clause 3.2.2.2.

2) After receipt of LOCATION UPDATING ACCEPT the UE shall delete the forbidden PLMN from the forbidden PLMN list.

– TS 22.011 [6], clause 3.2.2.4.

In case of a 3G terminal:

1) Depending on which domain the UE will be registered on, one of the following requirements should be fulfilled:

I. In manual PLMN selection mode the UE shall be able to perform a LOCATION UPDATING attempt during registration on CS to a PLMN which is in the forbidden PLMN list or

II. In manual PLMN selection mode the UE shall be able to perform a ATTACH attempt during registration on PS to a PLMN which is in the forbidden PLMN list or

III. In manual PLMN selection mode the UE shall be able to perform a LOCATION UPDATING and/or ATTACH attempt during registration on CS/PS to a PLMN which is in the forbidden PLMN list.

– TS 22.011 [6], clause 3.2.2.2.

– TS 31.102 [4], clauses 5.1.1 and 5.2.7.

2) Depending on which domain the UE is going to be registered on, one of the following requirements should be fulfilled:

I. After receipt of LOCATION UPDATING ACCEPT message during registration on CS the UE shall delete the forbidden PLMN from the forbidden PLMN list OR

II. After receipt of ATTACH ACCEPT message during registration on PS the UE shall delete the forbidden PLMN from the forbidden PLMN list or

III. After receipt of LOCATION UPDATING ACCEPT and/or ATTCH ACCEPT message during registration on CS/PS the UE shall delete the forbidden PLMN from the forbidden PLMN list.

– TS 22.011 [6], clause 3.2.2.4.

7.1.3.3 Test purpose

1) To verify that the 2G UE is able to perform a LOCATION UPDATING on a forbidden PLMN in manual PLMN selection mode or to verify that the 3G UE is able to perform

I. a LOCATION UPDATING REQUEST during registration on CS on a forbidden PLMN in manual PLMN selection mode or

II. a ATTACH REQUEST during registration on PS on a forbidden PLMN in manual PLMN selection mode or

III. a LOCATION UPDATING REQUEST and/or ATTACH REQUEST during registration on CS/PS on a forbidden PLMN in manual PLMN selection mode.

2) To verify that the UE after a successful registration attempt deletes the PLMN in the EF_FPLMN on the USIM.

7.1.3.4 Method of test

7.1.3.4.1 Initial conditions

The USS (in case of a Terminal accessing UTRAN)/ SS (in case of Terminal accessing a GERAN) transmits on the BCCH, with the following network parameters:

– Attach/detach: disabled.

– LAI (MCC/MNC/LAC): 234/005/0001.

– RAI (MCC/MNC/LAC/RAC): 234/005/0001/05 (only for UTRAN cell).

– Access control: unrestricted.

NOTE: In case of a GERAN no packet system information is transmitted

The default UICC is used with the following exception:

EF_FPLMN (Forbidden PLMNs)

Logically: PLMN1: empty

PLMN2: empty

PLMN3: empty

PLMN4: empty

PLMN5: 234 005 (MCC MNC)

PLMN6: empty

Coding:

B10

B11

B12

Hex

B13

B14

B15

B16

B17

B18

The UICC is installed into the Terminal and the UE is set to manual PLMN selection mode.

In case of a Terminal accessing UTRAN "Expected Sequence A" and in case of a Terminal accessing a GERAN "Expected Sequence B" shall be performed.

7.1.3.4.2 Procedure

Expected Sequence A:

a) The UE is powered on.

b) PLMN with MCC/MNC of 234/005 is manually selected.

c) After receipt of a RRC CONNECTION REQUEST from the UE, the USS sends RRC CONNECTION SETUP to the UE, followed by RRC CONNECTION SETUP COMPLETE sent by the UE to the USS.

d) Depending on which domain the UE is going to be registered on, one of the following sequences will be passed through:

LAI (MCC/MNC/LAC): 234/005/0001

TMSI: "12345678"

RAI (MCC/MNC/LAC/RAC): 234/005/0001/05

P-TMSI: "12345678"

P-TMSI signature value "AB1234"

LAI (MCC/MNC/LAC): 234/005/0001

TMSI: "12345678"

RAI (MCC/MNC/LAC/RAC): 234/005/0001/05

P-TMSI: "12345678"

P-TMSI signature value "AB1234"

e) After passing through the authentication procedure and after receipt of

I. TMSI REALLOCATION COMPLETE during registration on CS from the UE, the USS sends RRC CONNECTION RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS or

II. ATTACH COMPLETE during registration on PS from the UE, the USS sends RRC CONNECTION RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS or.

f) The UE is soft powered down.

Expected Sequence B:

a) The UE is powered on.

b) PLMN with MCC/MNC of 234/005 is manually selected.

c) After receipt of a CHANNEL REQUEST from the UE, the SS sends IMMEDIATE ASSIGNMENT to the UE.

d) After receipt of a LOCATION UPDATING REQUEST from the UE, the SS sends LOCATION UPDATING ACCEPT with:

LAI (MCC/MNC/LAC): 234/005/0001

TMSI: "12345678"

to the UE.

e) After receipt of TMSI REALLOCATION COMPLETE from the UE, the SS sends CHANNEL RELEASE.

f) The UE is soft powered down.

7.1.3.5 Acceptance criteria

1) After step c) the 2G UE shall send LOCATION UPDATING REQUEST to the SS and the 3G terminal shall send

I. LOCATION UPDATING REQUEST to the USS during registration on CS or

II. ATTACH REQUEST during registration on PS or

III. LOCATION UPDATING REQUEST and/or ATTACH REQUEST to the USS during registration on CS/PS.

2) After step d) the 2G UE shall respond with TMSI REALLOCATION COMPLETE and the 3G terminal shall respond with

I. TMSI REALLOCATION COMPLETE to the USS during registration on CS or

II. ATTACH COMPLETE during registration on PS or

III. TMSI REALLOCATION COMPLETE and/or ATTACH COMPLETE to the USS during registration on CS/PS.

3) After step f) the USIM shall contain the following values:

EF_FPLMN (Forbidden PLMNs)

Logically: PLMN1: empty

PLMN2: empty

PLMN3: empty

PLMN4: empty

PLMN5: empty

PLMN6: empty

Coding:

B10

B11

B12

Hex

B13

B14

B15

B16

B17

B18

For 2G terminals and 3G terminals supporting CS only or CS/PS:

EF_LOCI (Location Information)

Logically: LAI-MCC: 234

LAI-MNC: 005

TMSI: "12345678"

Coding:	B1	B2	B3	B4	B5	B6	B7	B8	B9	B10	B11
Hex	12	34	56	78	32	54	00	xx	xx	xx	00

For UEs supporting PS only or CS/PS :

EF_PSLOCI (Location Information)

Logically: RAI-MCC: 234

RAI-MNC: 005

P-TMSI: "12345678"

Coding:	B1	B2	B3	B4	B5	B6	B7	B8	B9	B10	B11
Hex	12	34	56	78	xx	xx	xx	32	54	00	xx

Coding:	B12	B13	B14
Hex	xx	xx	00

7.1.4 Adding FPLMN to the forbidden PLMN list when accessing E-UTRAN

7.1.4.1 Definition and applicability

7.1.4.2 Conformance requirement

1) In automatic PLMN selection mode the UE shall only attempt a AttachRequest during registration on E-UTRAN/EPS if it receives a BCCH containing a PLMN (MCC,MNC) that is not indicated in the EF_FPLMN in the USIM

Reference:

– TS 22.011 [6], clause 2.3;

– TS 31.102 [4], clauses 5.1.1 and 5.2.7.

2) After receipt of an AttachReject message during registration on E-UTRAN/EPS with the EMM cause "PLMN not allowed" the Terminal shall update the EF_FPLMN in the USIM.

Reference:

– TS 22.011 [6], clause 3.2.2 2;

– TS 31.102 [4], clauses 5.1.1 and 5.2.7

3) After receipt of an AttachReject message during registration on E-UTRAN/EPS with the EMM cause "PLMN not allowed" the Terminal shall update the EF_EPSLOCI in the USIM.

Reference:

– TS 24.301 [26], clause 5.5.1.2.5;

– TS 31.102 [4], clauses 5.1.1 and 4.2.9.1.

3) After registration on E-UTRAN/EPS the USIM shall contain the correct GUTI and TAI received by the UE.

Reference:

– TS 31.102 [4], clauses 5.1.2 and 4.2.9.1;

– TS 21.111 [6], clause 10.1.

7.1.4.3 Test purpose

1) To verify that in automatic PLMN selection mode the UE does not attempt to access PLMNs stored in EF_FPLMN on the USIM.

2) To verify that the EF_FPLMN is correctly updated by the Terminal after receipt of a AttachReject message with cause "PLMN not allowed" during registration.

3) To verify that the EF_EPSLOCI has been correctly updated by the Terminal during registration.

7.1.4.4 Method of test

7.1.4.4.1 Initial conditions

The E-USS transmits on the BCCH, with the following network parameters:

– TAI (MCC/MNC/TAC): 234/002/0001.

– Access control: unrestricted.

The NB-SS transmits on the BCCH, with the following network parameters:

– TAI (MCC/MNC/TAC): 234/002/0001.

– Access control: unrestricted.

The default E-UTRAN UICC is used.

The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode.

7.1.4.4.2 Procedure

a) The UE is powered on.

b) The E-USS/NB-SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the UE. The BCCH is changed to contain:

PLMN (MCC/MNC): 234/003

The E-USS/NB-SS then resumes RF output on the BCCH.

c) The E-USS/NB-SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the UE. The BCCH is changed to contain:

PLMN (MCC/MNC): 234/004

The E-USS/NB-SS then resumes RF output on the BCCH.

d) The E-USS/NB-SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the UE. The BCCH is changed to contain:

PLMN (MCC/MNC): 234/005

The E-USS/NB-SS then resumes RF output on the BCCH.

e) The E-USS/NB-SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the UE. The BCCH is changed to contain:

TAI (MCC/MNC/TAC): 234/007/0001

The E-USS/NB-SS then resumes RF output on the BCCH.

f) After receipt of an RRCConnectionRequest/RRCConnectionRequest-NB from the UE, the E-USS/NB-SS sends RRCConnectionSetup/RRCConnectionSetup-NB to the UE, followed by RRCConnectionSetupComplete/RRCConnectionSetupComplete-NB sent by the UE to the E-USS/NB-SS.

g) During registration and after receipt of an AttachRequest from the UE, the E-USS/NB-SS performs authentication and starts NAS integrity protection, sends AttachReject to the UE with cause "PLMN Not Allowed", followed by RRCConnectionRelease/RRCConnectionRelease-NB.

h) The E-USS/NB-SS stops all RF output on the BCCH for a long enough period of time to cause a cell reselection procedure in the UE. The BCCH is changed to contain:

TAI (MCC/MNC/TAC): 234/008/0001

The E-USS/NB-SS then resumes RF output on the BCCH.

i) After receipt of an RRCConnectionRequest/RRCConnectionRequest-NB from the UE, the E-USS/NB-SS sends RRCConnectionSetup/RRCConnectionSetup-NB to the UE, followed by RRCConnectionSetupComplete/RRCConnectionSetupComplete-NB sent by the UE to the E-USS/NB-SS.

j) During registration and after receipt of an AttachRequest from the UE, the E-USS/NB-SS initiates authentication, starts integrity by using the security procedure and sends AttachAccept to the UE with:

TAI (MCC/MNC/TAC): 234/008/ 0001

GUTI: "23400800010266436587"

k) After receipt of AttachComplete during registration from the UE, the E-USS/NB-SS sends RRCConnectionRelease/RRCConnectionRelease-NB.

l) The UE is soft powered down.

7.1.4.5 Acceptance criteria

1) After each of the steps a) to d) the terminal shall not attempt an Attach procedure.

2) After step f) the terminal shall send AttachRequest during registration.

3) After step h) the terminal shall send AttachRequest during registration.

4) After step i) the terminal shall respond with AttachComplete during registration.

5) After step k) the USIM shall contain the following values:

EF_FPLMN (Forbidden PLMNs)

Logically: PLMN1: 234 002 (MCC MNC)

PLMN2: 234 003

PLMN3: 234 004

PLMN4: 234 005

PLMN5: 234 006

PLMN6: 234 007

Coding:	B1	B2	B3	B4	B5	B6	B7	B8	B9	B10	B11	B12
Hex	32	24	00	32	34	00	32	44	00	32	54	00

	B13	B14	B15	B16	B17	B18
	32	64	00	32	74	00

EF_EPSLOCI (EPS Information)

Logically: GUTI: 23400800010266436587

Last visited registered TAI: 234/008/0001

EPS update status: updated

Coding:	B1	B2	B3	B4	B5	B6	B7	B8	B9	B10	B11
Hex	0B	F6	32	84	00	00	01	02	66	43	65

	B12	B13	B14	B15	B16	B17	B18
	87	32	84	00	00	01	00

7.1.5 UE updating forbidden PLMNs when accessing E-UTRAN

7.1.5.1 Definition and applicability

7.1.5.2 Conformance requirement

After receipt of a AttachReject message during registration with the cause "PLMN not allowed" the Terminal shall update the EF_FPLMN in the USIM.

Reference:

– TS 22.011 [6], clause 3.2.2.4.

– TS 31.102 [4], clauses 5.1.1 and 5.2.7.

7.1.5.3 Test purpose

To verify that the UE correctly updates the EF_FPLMN, i.e. fill up existing gaps in the elementary file before overwriting any existing entries.

7.1.5.4 Method of test

7.1.5.4.1 Initial conditions

The E-USS transmits on the BCCH, with the following network parameters:

– TAI (MCC/MNC/TAC): 234/002/0001.

– Access control: unrestricted.

The NB-SS transmits on the BCCH, with the following network parameters:

– TAI (MCC/MNC/TAC): 234/002/0001.

– Access control: unrestricted.

The default E-UTRAN UICC is used with the following exception:

EF_FPLMN (Forbidden PLMNs)

Logically: PLMN1: 234 001 (MCC MNC)

PLMN2: empty

PLMN3: 234 003

PLMN4: 234 004

PLMN5: 234 005

PLMN6: 234 006

Coding:

B10

B11

B12

Hex

B13

B14

B15

B16

B17

B18

The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode.

7.1.5.4.2 Procedure

a) The UE is powered on.

b) After receipt of a RRCConnectionRequest/RRCConnectionRequest-NB from the UE, the E-USS/NB-SS sends RRCConnectionSetup/RRCConnectionSetup-NB to the UE, followed by RRCConnectionSetupComplete/RRCConnectionSetupComplete-NB sent by the UE to the E-USS/NB-SS.

c) During registration and after receipt of a AttachRequest from the UE, the E-USS/NB-SS performs authentication and starts NAS integrity protection, sends AttachReject to the UE with cause "PLMN Not Allowed", followed by RRCConnectionRelease/RRCConnectionRelease-NB.

d) The UE is soft powered down.

7.1.5.5 Acceptance criteria

1) After step b) the terminal shall send AttachRequest during registration.

2) After step d) the USIM shall contain:

EF_FPLMN (Forbidden PLMNs)

Logically: PLMN1: 234 001 (MCC MNC)

PLMN2: 234 002

PLMN3: 234 003

PLMN4: 234 004

PLMN5: 234 005

PLMN6: 234 006

Coding:	B1	B2	B3	B4	B5	B6	B7	B8	B9	B10	B11	B12
Hex	32	14	00	32	24	00	32	34	00	32	44	00

	B13	B14	B15	B16	B17	B18
	32	54	00	32	64	00

EF_FPLMN (Forbidden PLMNs)

Logically: PLMN1: 234 001 (MCC MNC)

PLMN2: 234 003

PLMN3: 234 004

PLMN4: 234 005

PLMN5: 234 006

PLMN6: 234 002

Coding:	B1	B2	B3	B4	B5	B6	B7	B8	B9	B10	B11	B12
Hex	32	14	00	32	34	00	32	44	00	32	54	00

	B13	B14	B15	B16	B17	B18
	32	64	00	32	24	00

7.1.6 UE deleting forbidden PLMNs when accessing E-UTRAN

7.1.6.1 Definition and applicability

7.1.6.2 Conformance requirement

a) In manual PLMN selection mode the UE shall be able to perform a ATTACH attempt during registration to a PLMN which is in the forbidden PLMN list or

– TS 22.011 [6], clause 3.2.2.2.

– TS 31.102 [4], clauses 5.1.1 and 5.2.7.

b) After receipt of AttachAccept message during registration the UE shall delete the forbidden PLMN from the forbidden PLMN list or

– TS 22.011 [6], clause 3.2.2.4.

7.1.6.3 Test purpose

1) To verify that the terminal is able to perform an AttachRequest during registration on a forbidden PLMN in manual PLMN selection mode.

2) To verify that the UE after a successful registration attempt deletes the PLMN in the EF_FPLMN on the USIM.

7.1.6.4 Method of test

7.1.6.4.1 Initial conditions

The E-USS transmits on the BCCH, with the following network parameters:

– TAI (MCC/MNC/TAC): 234/005/0001.

– Access control: unrestricted.

The NB-SS transmits on the BCCH, with the following network parameters:

– TAI (MCC/MNC/TAC): 234/005/0001.

– Access control: unrestricted.

The default E-UTRAN UICC is used with the following exception:

EF_FPLMN (Forbidden PLMNs)

Logically: PLMN1: empty

PLMN2: empty

PLMN3: empty

PLMN4: empty

PLMN5: 234 005 (MCC MNC)

PLMN6: empty

Coding:

B10

B11

B12

Hex

B13

B14

B15

B16

B17

B18

The UICC is installed into the Terminal and the UE is set to manual PLMN selection mode.

7.1.6.4.2 Procedure

a) The UE is powered on.

b) PLMN with MCC/MNC of 234/005 is manually selected.

c) After receipt of a RRCConnectRequest/RRCConnectionRequest-NB from the UE, the E-USS/NB-SS sends RRCConnectionSetup/RRCConnectionSetup-NB to the UE, followed by RRCConnectionSetupComplete/RRCConnectionSetupComplete-NB sent by the UE to the E-USS/NB-SS.

d) During registration and after receipt of a AttachRequest from the UE, the E-USS/NB-SS initiates authentication, starts integrity by using the security procedure and sends AttachAccept with to the UE:

TAI (MCC/MNC/TAC): 234/005/ 0001

GUTI: "23400500010266436587"

e) After receipt of the AttachComplete during registration from the UE, the E-USS/NB-SS sends RRCConnectionRelease/RRCConnectionRelease-NB.

f) The UE is soft powered down.

7.1.6.5 Acceptance criteria

1) After step c) the terminal shall send AttachRequest during registration

2) After step d) the terminal shall respond with AttachComplete during registration

3) After step f) the USIM shall contain the following values:

EF_FPLMN (Forbidden PLMNs)

Logically: PLMN1: empty

PLMN2: empty

PLMN3: empty

PLMN4: empty

PLMN5: empty

PLMN6: empty

Coding:

B10

B11

B12

Hex

B13

B14

B15

B16

B17

B18

EF_EPSLOCI (EPS Information)

Logically: GUTI: 23400500010266436587

Last visited registered TAI: 234/005/0001

EPS update status: updated

Coding:	B1	B2	B3	B4	B5	B6	B7	B8	B9	B10	B11
Hex	0B	F6	32	54	00	00	01	02	66	43	65

	B12	B13	B14	B15	B16	B17	B18
	87	32	54	00	00	01	00

7.1.7 Updating the Forbidden PLMN list after receiving non-integrity protected reject message – UTRAN

7.1.7.1 Definition and applicability

7.1.7.2 Conformance requirement

After receipt of a not integrity-protected LOCATION UPDATING REJECT and/or ATTACH REJECT message during registration on CS/PS with the cause "PLMN not allowed" the Terminal shall update the EF_FPLMN in the USIM thereafter that VPLMN will not be accessed by the MS in automatic mode:

– if the MS is not configured to use timer T3245, and the MS maintains a list of PLMN-specific attempt counters and the value of the PLMN-specific attempt counter for that VPLMN is equal to the MS implementation specific maximum value or;

– if the MS is not configured to use timer T3245, and the MS is not maintain a list of PLMN-specific attempt counters

Reference:

– TS 23.122 [31], clause 3.1.

– TS 22.011 [6], clause 3.2.2 2.3;

– TS 31.102 [4], clauses 5.1.1 and 5.2.7.

7.1.7.3 Test purpose

To verify in automatic PLMN selection mode and after receipt of a LOCATION UPDATING REJECT and/or ATTACH REJECT message with cause "PLMN not allowed" during registration that the UE correctly updates EF_FPLMN, in the following cases:

– if the UE maintains a list of PLMN-specific attempt counters, and the value of the PLMN-specific attempt counter for that VPLMN is equal to the MS implementation specific maximum value.

– if the UE does not maintain a list of PLMN-specific attempt counters.

To verify that the UE correctly updates the EF_FPLMN, i.e. fill up existing gaps in the elementary file before overwriting any existing entries.

7.1.7.4 Method of test

7.1.7.4.1 Initial conditions

The USS transmits on the BCCH, with the following network parameters:

– Attach/detach: disabled.

– LAI (MCC/MNC/LAC): 234/002/0001.

– RAI (MCC/MNC/LAC/RAC): 234/002/0001/05.

– Access control: unrestricted.

The default UICC is used with the following exception:

EF_FPLMN (Forbidden PLMNs)

Logically: PLMN1: 234 001 (MCC MNC)

PLMN2: empty

PLMN3: 234 003

PLMN4: 234 004

PLMN5: 234 005

PLMN6: 234 006

Coding:

B10

B11

B12

Hex

B13

B14

B15

B16

B17

B18

7.1.7.4.2 Procedure

a) The UE is powered on.

b) Depending on which domain the UE is going to be registered on, the UE attempts to perform CS, PS or CS/PS registration to the USS.

c) During registration and after receipt of a LOCATION UPDATING REQUEST and/or ATTACH REQUEST from the UE, the USS sends a not integrity-protected LOCATION UPDATING REJECT and/or ATTACH REJECT to the UE with cause "PLMN Not Allowed", followed by RRC CONNECTION RELEASE, followed by RRC CONNECTION RELEASE COMPLETE sent by the UE to the USS.

d) ) if the UE supports A.1/38, perform step e) after the expiry of timer T3247, otherwise perform step f).

e) Using the settings declared in table B.1/AER006, repeat step c) – d) until the PLMN-specific attempt counters has reached the maximum value for that VPLMN.

f) The UE is powered down

7.1.7.5 Acceptance criteria

1) After step b) the terminal shall send a LOCATION UPDATING REQUEST and/or AttachRequest during registration.

2) After steps c) the UE shall start the timer T3247 before the next registration attempt.

3) Depending on the support of A.1/38, either after step d) or step e), the EF_FPLMN in the USIM shall be updated as specified below.

EF_FPLMN (Forbidden PLMNs)

Logically: PLMN1: 234 001 (MCC MNC)

PLMN2: 234 002

PLMN3: 234 003

PLMN4: 234 004

PLMN5: 234 005

PLMN6: 234 006

Coding:	B1	B2	B3	B4	B5	B6	B7	B8	B9	B10	B11	B12
Hex	32	14	00	32	24	00	32	34	00	32	44	00

	B13	B14	B15	B16	B17	B18
	32	54	00	32	64	00

EF_FPLMN (Forbidden PLMNs)

Logically: PLMN1: 234 001 (MCC MNC)

PLMN2: 234 003

PLMN3: 234 004

PLMN4: 234 005

PLMN5: 234 006

PLMN6: 234 002

Coding:	B1	B2	B3	B4	B5	B6	B7	B8	B9	B10	B11	B12
Hex	32	14	00	32	34	00	32	44	00	32	54	00

	B13	B14	B15	B16	B17	B18
	32	64	00	32	24	00

7.1.8 Updating the Forbidden PLMN list after receiving non-integrity protected reject message – E-UTRAN

7.1.8.1 Definition and applicability

7.1.8.2 Conformance requirement

After receipt of a not integrity-protected ATTACH REJECT message during registration with the cause "PLMN not allowed" the Terminal shall update the EF_FPLMN in the USIM thereafter that VPLMN will not be accessed by the MS in automatic mode:

– if the MS is not configured to use timer T3245, and the MS is not maintain a list of PLMN-specific attempt counters

Reference:

– TS 23.122 [31], clause 3.1.

– TS 22.011 [6], clause 3.2.2 2.3;

– TS 31.102 [4], clauses 5.1.1 and 5.2.7.

7.1.8.3 Test purpose

To verify in automatic PLMN selection mode and after receipt of ATTACH REJECT message with cause "PLMN not allowed" during registration that the UE correctly updates EF_FPLMN, for the following cases:

– if the UE maintains a list of PLMN-specific attempt counters, and the value of the PLMN-specific attempt counter for that VPLMN is equal to the MS implementation specific maximum value.

– if the UE does not maintain a list of PLMN-specific attempt counters.

To verify that the UE correctly updates the EF_FPLMN, i.e. fill up existing gaps in the elementary file before overwriting any existing entries.

7.1.8.4 Method of test

7.1.8.4.1 Initial conditions

The E-USS transmits on the BCCH, with the following network parameters:

– TAI (MCC/MNC/TAC): 234/002/0001.

– Access control: unrestricted.

The NB-SS transmits on the BCCH, with the following network parameters:

– TAI (MCC/MNC/TAC): 234/002/0001.

– Access control: unrestricted.

The default E-UTRAN UICC is used with the following exception:

EF_FPLMN (Forbidden PLMNs)

Logically: PLMN1: 234 001 (MCC MNC)

PLMN2: empty

PLMN3: 234 003

PLMN4: 234 004

PLMN5: 234 005

PLMN6: 234 006

Coding:

B10

B11

B12

Hex

B13

B14

B15

B16

B17

B18

The UICC is installed into the Terminal and the UE is set to automatic PLMN selection mode.

7.1.8.4.2 Procedure

a) The UE is powered on.

c) During registration and after receipt of a AttachRequest from the UE, the E-USS/NB-SS sends non-integrity protected AttachReject message to the UE with cause "PLMN Not Allowed", followed by RRCConnectionRelease/RRCConnectionRelease-NB.

d) ) if the UE supports A.1/38, perform step e) after the expiry of timer T3247, otherwise perform step f).

e) Using the settings declared in table B.1/AER006, repeat step c) – d) until the PLMN-specific attempt counters has reached the maximum value for that VPLMN.

f) The UE is powered down.

7.1.8.5 Acceptance criteria

1) After step b) the terminal shall send AttachRequest during registration.

2) After steps c) the UE shall start the timer T3247 before the next registration attempt.

3) Depending on the support of A.1/38, either after step d) or step e), the EF_FPLMN in the USIM shall be updated as specified below.

EF_FPLMN (Forbidden PLMNs)

Logically: PLMN1: 234 001 (MCC MNC)

PLMN2: 234 002

PLMN3: 234 003

PLMN4: 234 004

PLMN5: 234 005

PLMN6: 234 006

Coding:	B1	B2	B3	B4	B5	B6	B7	B8	B9	B10	B11	B12
Hex	32	14	00	32	24	00	32	34	00	32	44	00

	B13	B14	B15	B16	B17	B18
	32	54	00	32	64	00

EF_FPLMN (Forbidden PLMNs)

Logically: PLMN1: 234 001 (MCC MNC)

PLMN2: 234 003

PLMN3: 234 004

PLMN4: 234 005

PLMN5: 234 006

PLMN6: 234 002

Coding:	B1	B2	B3	B4	B5	B6	B7	B8	B9	B10	B11	B12
Hex	32	14	00	32	34	00	32	44	00	32	54	00

	B13	B14	B15	B16	B17	B18
	32	64	00	32	24	00