9.4.3 Location updating / abnormal cases

34.123-13GPPPart 1: Protocol conformance specificationRelease 15TSUser Equipment (UE) conformance specification

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

9.4.3.1 Void

9.4.3.2 Location updating / abnormal cases / attempt counter less or equal to 4, LAI different

9.4.3.2.1 Definition

9.4.3.2.2 Conformance requirement

1) When a failure such as cases d), f), g) and h) of clause 4.4.4.9 of TS 24.008 has occurred during a normal location updating procedure, if the attempt counter is smaller than 4 and after expiry of T3211, the UE shall resend its LOCATION UPDATING REQUEST message with the Mobile Identity IE set to its IMSI, CKSN IE set to "no key is available" and the Location Updating Type IE set to "normal location updating".

2) When a failure such as cases d), f), g) and h) of clause 4.4.4.9 of TS 24.008 has occurred during a normal location updating procedure the UE shall:

2.1 not answer to paging with the previously allocated TMSI;

2.2 not perform the IMSI detach procedure, when switched off.

3) When a failure such as case e) of clause 4.4.4.9 of TS 24.008 has occurred during a normal location updating procedure and when an emergency call establishment is requested by the user the UE, if it supports emergency speech call, shall send a CM SERVICE REQUEST message with CM Service Type IE set to "emergency call establishment", CKSN IE set to "no key available" and Mobile Identity IE set to its IMSI and after acceptance by the network it shall send an EMERGENCY SETUP message.

4) When a failure such as cases d), f), g) and h) of clause 4.4.4.9 of TS 24.008 has occurred during a normal location updating procedure the UE shall use a request from CM entity other than emergency call as a trigger for a normal location updating procedure and shall send a LOCATION UPDATING REQUEST message with the Mobile Identity IE set to its IMSI, CKSN IE set to "no key is available" and the Location Updating Type IE set to "normal location updating".

5) When a failure such as cases d), f), g) and h) of clause 4.4.4.9 of TS 24.008 has occurred during a normal location updating procedure the UE shall answer to paging with IMSI and shall send a PAGING RESPONSE message with CKSN IE set to "no key available" and Mobile Identity IE set to its IMSI.

6) When a failure such as cases d), f), g) and h) of clause 4.4.4.9 of TS 24.008 has occurred during a normal location updating procedure the UE shall perform a normal location updating procedure as soon as it enters a new cell.

References

TS 24.008 clauses 4.4.4.2, 4.4.4.9.

9.4.3.2.3 Test purpose

To verify that the UE performs normal location updating procedures when its attempt counter is smaller than 4.

To check that the UE does not perform the IMSI detach procedure when "idle not updated".

To verify that when "idle not updated" the UE can perform an emergency call.

To verify that when "idle not updated" the UE uses requests from CM layer other than emergency call as triggering of a normal location updating procedure.

To verify that the UE performs a normal location updating procedure if it enters a new cell while being "idle not updated".

9.4.3.2.4 Method of test

Initial conditions

– System Simulator:

– two cells: A and B of the same PLMN, belonging to different location areas with LAI a and b;

– ATT flag shall be set to IMSI attach/detach allowed.

– User Equipment:

– the UE is "idle updated" on cell A. A valid CKSN value is stored in the USIM and is noted "initial CKSN". A TMSI is allocated.

Related ICS/IXIT statements

USIM removal possible while UE is powered Yes/No.

Switch off on button Yes/No.

Support for emergency speech call Yes/No.

Test Procedure

The UE is made to perform a normal location updating procedure. Five types of failure cases are triggered:

– sending of a Location Updating Reject with cause randomly chosen between all defined cause values except 2, 3, 6, 11, 12 and 13 (which trigger a different action) (case g of TS 24.008 clause 4.4.4.9);

– RRC connection failure (case d);

– sending of a RRC CONNECTION RELEASE message before the normal end of the procedure (case f);

– T3210 time-out (case e);

– RR connection establishment failure (case h).

As there is no stored LAI or the stored LAI is different from the broadcast LAI, and the attempt counter in the UE shall be lower than 4, the UE enters the state MM IDLE and substate ATTEMPTING TO UPDATE and waits for T3211 seconds before trying again a location updating procedure.

Then the behaviour of the UE in the MM IDLE state and ATTEMPTING TO UPDATE substate is checked, that is:

– not answer to paging with TMSI;

– not perform an IMSI detach procedure;

– support request for emergency call;

– use requests from CM layer other than emergency call as triggering of a normal location updating procedure;

– perform normal location updating procedure when a new cell is entered.

Expected sequence

Step	Direction		Message	Comments
Step	UE	SS	Message	Comments
The following messages are sent and shall be received on cell B.
1	SS			Set the cell type of cell B to the "Serving cell". Set the cell type of cell A to the "non-suitable cell". (see note)
2			RRC CONNECTION REQUEST	Establishment cause: Registration. If PS mode: a ROUTING AREA UPDATE REQUEST should be rejected with the same cause as used in the LOCATION UPDATING REJECT.
3			RRC CONNECTION SETUP
4			RRC CONNECTION SETUP COMPLETE
5			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = initial value, LAI = a, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
6			LOCATION UPDATING REJECT	IE Reject cause is set to #X in table 10.5.95 of TS 24.008, causes #2, #3, #6, #11, #12, #13 and #15 being excluded.
7			RRC CONNECTION RELEASE	After the sending of this message, the SS waits for the disconnection of the main signalling link.
8			RRC CONNECTION RELEASE COMPLETE
9	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
8			RRC CONNECTION REQUEST	Establishment cause: Registration.
9			RRC CONNECTION SETUP
12			RRC CONNECTION SETUP COMPLETE
13			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
14	SS			The SS modifies the scrambling code of DL DPCH for generating lower layer failure.
15			(void)
15a			CELL UPDATE	CCCH.
15b			RRC CONNECTION RELEASE	CCCH.
15c	SS			The SS re-modifies the scrambling code of DL DPCH to the original one.
15d	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
16			RRC CONNECTION REQUEST	Establishment cause: Registration.
17			RRC CONNECTION SETUP
18			RRC CONNECTION SETUP COMPLETE
19			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
20			RRC CONNECTION RELEASE	After the sending of this message, the SS waits for the disconnection of the main signalling link.
21			RRC CONNECTION RELEASE COMPLETE
22	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
23			RRC CONNECTION REQUEST	Establishment cause: Registration.
24			RRC CONNECTION SETUP
25			RRC CONNECTION SETUP COMPLETE
26			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
27			AUTHENTICATION REQUEST	CKSN = initial CKSN.
28			AUTHENTICATION RESPONSE
28a			SECURITY MODE COMMAND
28b			SECURITY MODE COMPLETE
29			LOCATION UPDATING ACCEPT	IE mobile Identity = new TMSI.
30			TMSI REALLOCATION COMPLETE
31			RRC CONNECTION RELEASE	After the sending of this message, the SS waits for the disconnection of the main signalling link. UE is now "idle updated" in cell B.
32			RRC CONNECTION RELEASE COMPLETE
The following messages are sent and shall be received on cell A.
33	SS			Set the cell type of cell A to the "Serving cell". Set the cell type of cell B to the "non-suitable cell". (see note)
34			RRC CONNECTION REQUEST	Establishment cause: Registration. If PS mode: a ROUTING AREA UPDATE REQUEST should be rejected with the same cause as used in the LOCATION UPDATING REJECT.
35			RRC CONNECTION SETUP
36			RRC CONNECTION SETUP COMPLETE
37			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = initial value, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
38	SS			performs step 6 with reject cause #100 and step 7.
38a	UE			performs step8.
39			PAGING TYPE 1	UE identity = old TMSI of the UE. This message is sent continuously to the UE during 8 s. Paging Cause: Terminating Conversational Call.
40	SS			The SS checks that there is no answer from the UE during 12 s.
41	SS			If during steps 39 and 40 the UE attempts to perform a location updating procedure the SS will perform step 38 and then continue the procedure.
42	UE			If possible (see ICS) USIM detachment is performed. Otherwise if possible (see ICS) mobile switch off is performed. Otherwise the power is removed. A Detach Request can be received in PS mode.
43	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during 30 s.
44	UE			Depending on what has been performed in step 42 the UE is brought back to operation. The subsequent GMM attach should be rejected if received in the PS mode.
45			RRC CONNECTION REQUEST	Establishment cause: Registration.
46			RRC CONNECTION SETUP
47			RRC CONNECTION SETUP COMPLETE
48			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
49			AUTHENTICATION REQUEST	CKSN = initial CKSN.
50			AUTHENTICATION RESPONSE
50a			SECURITY MODE COMMAND
50b			SECURITY MODE COMPLETE
51			LOCATION UPDATING ACCEPT	IE mobile Identity = new TMSI.
52			TMSI REALLOCATION COMPLETE
53			RRC CONNECTION RELEASE	After the sending of this message, the SS waits for the disconnection of the main signalling link. UE is now "idle updated" in cell A.
54			RRC CONNECTION RELEASE COMPLETE
The following messages are sent and shall be received on cell B.
55	SS			Set the cell type of cell B to the "Serving cell". Set the cell type of cell A to the "non-suitable cell". (see note).
56			RRC CONNECTION REQUEST	Establishment cause: Registration.
57			RRC CONNECTION SETUP
58			RRC CONNECTION SETUP COMPLETE
59			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = initial value, LAI = a, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
60			AUTHENTICATION REQUEST
61			AUTHENTICATION RESPONSE	Steps 60 and 61 are performed N times. N shall be chosen in such a way that T3210 expires.
62	UE			The UE shall cease transmission and then shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the expiry of T3210.
63	UE			If the UE supports emergency speech call it is made to perform an emergency call.
64			RRC CONNECTION REQUEST	Establishment cause: Emergency call.
65			RRC CONNECTION SETUP
66			RRC CONNECTION SETUP COMPLETE
67			CM SERVICE REQUEST	CM service type = Emergency call establishment; CKSN = no key available; Mobile Identity = IMSI.
68			CM SERVICE ACCEPT
69			EMERGENCY SETUP
70			RELEASE COMPLETE	Cause = unassigned number.
71			RRC CONNECTION RELEASE
72			RRC CONNECTION RELEASE COMPLETE
72a	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
73			RRC CONNECTION REQUEST	Establishment cause: Registration.
74			RRC CONNECTION SETUP
75			RRC CONNECTION SETUP COMPLETE
76			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
77			AUTHENTICATION REQUEST	CKSN = initial CKSN.
78			AUTHENTICATION RESPONSE
78a			SECURITY MODE COMMAND
78b			SECURITY MODE COMPLETE
79			LOCATION UPDATING ACCEPT	IE mobile Identity = new TMSI.
80			TMSI REALLOCATION COMPLETE
81			RRC CONNECTION RELEASE	After the sending of this message, the SS waits for the disconnection of the main signalling link. UE is now "idle updated" in cell B.
82			RRC CONNECTION RELEASE COMPLETE
The following messages are sent and shall be received on cell A.
83	SS			Set the cell type of cell A to the "Serving cell". Set the cell type of cell B to the "non-suitable cell". (see note).
84			RRC CONNECTION REQUEST	Establishment cause: Registration.
85			RRC CONNECTION SETUP
86			RRC CONNECTION SETUP COMPLETE
87			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = initial value, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
88	SS			performs step 14.
88a			(void)
88b			CELL UPDATE	CCCH.
88c			RRC CONNECTION RELEASE	CCCH.
88d	SS			performs step 15c.
89	UE			A MO CM connection is attempted before T3211 expiry.
90			RRC CONNECTION REQUEST	Establishment cause: Registration.
91			RRC CONNECTION SETUP
92			RRC CONNECTION SETUP COMPLETE
93			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
94			LOCATION UPDATING ACCEPT	IE mobile Identity = new TMSI. If the location updating type in the LOCATION UPDATING REQUEST contains ‘FOR’, then IE Follow-on Proceed is included in the ACCEPT and steps 96 to 100 will be omitted.
95			TMSI REALLOCATION COMPLETE
96			RRC CONNECTION RELEASE
97			RRC CONNECTION RELEASE COMPLETE
97a	SS
98			RRC CONNECTION REQUEST	Establishment cause: Not checked.
99			RRC CONNECTION SETUP
100			RRC CONNECTION SETUP COMPLETE
101			CM SERVICE REQUEST	CKSN = no key available, Mobile identity = TMSI.
102			RRC CONNECTION RELEASE	After the sending of this message, the SS waits for the disconnection of the main signalling link. UE is now "idle updated" in cell A.
103			RRC CONNECTION RELEASE COMPLETE
The following messages are sent and shall be received on cell B.
104	SS			Set the cell type of cell B to the "Serving cell". Set the cell type of cell A to the "non-suitable cell". (see note).
105			RRC CONNECTION REQUEST	Establishment cause: Registration.
106			RRC CONNECTION SETUP
107			RRC CONNECTION SETUP COMPLETE
108			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available LAI = a, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
109	SS			performs step 14.
109a			(void)
109b			CELL UPDATE	CCCH.
109c			RRC CONNECTION RELEASE	CCCH.
109d	SS			performs step 15c.
The following messages are sent and shall be received on cell A.
110	SS			Set the cell type of cell A to the "Serving cell". Set the cell type of cell B to the "non-suitable cell". (see note).
110a			RRC CONNECTION REQUEST	Establishment cause: Registration.
110b			RRC CONNECTION SETUP
110c			RRC CONNECTION SETUP COMPLETE
110d			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), mobile station classmark 1 as given by the ICS and mobile identity = IMSI.
110e	SS			performs step 14.
110f			CELL UPDATE	CCCH.
110g			RRC CONNECTION RELEASE	CCCH.
110h	SS			performs step 15c.
111			Mobile terminated establishment of Radio Resource Connection	See TS 34.108 clause 7.1.2 "Initial UE identity" = IMSI. Establishment Cause: Terminating Conversation Call.
112			PAGING RESPONSE	"Mobile identity" = IMSI, CKSN = no key available.
113			RRC CONNECTION RELEASE
114			RRC CONNECTION RELEASE COMPLETE
NOTE: The definitions for "Serving cell" and "non-suitable cell" are specified in TS 34.108 clause 6.1 "Reference Radio Conditions for signalling test cases only".

Specific message contents

None.

9.4.3.2.5 Test requirement

1) At step 13 the UE shall send a LOCATION UPDATING REQUEST message with the Mobile Identity IE set to its IMSI, CKSN IE set to "no key available" and the Location Updating Type IE set to "normal location updating".

2.1 At step 40 the UE shall not answer to paging with the previously allocated TMSI.

2.2 At step 43 the UE shall not perform the IMSI detach procedure.

3) At step 67 the UE shall send a CM SERVICE REQUEST message with CM Service Type IE set to "emergency call establishment", CKSN IE set to "no key available" and Mobile Identity IE set to its IMSI.

At step 69 the UE shall send an EMERGENCY SETUP message.

4) At step 93 the UE shall send a LOCATION UPDATING REQUEST message with the Mobile Identity IE set to its IMSI, CKSN IE set to "no key is available" and the Location Updating Type IE set to "normal location updating".

5) At step 112 the UE shall send a PAGING RESPONSE message with CKSN IE set to "no key available" and Mobile Identity IE set to its IMSI.

6) At step 110d the UE shall perform a normal location updating procedure.

9.4.3.3 Location updating / abnormal cases / attempt counter equal to 4

9.4.3.3.1 Definition

9.4.3.3.2 Conformance requirement

1) When four failures such as cases d) to h) of clause 4.4.4.9 of TS 24.008 have occurred during a normal location updating procedure the UE shall:

1.1 For Rel-6 and later, the UE shall:

Optionally enter the MM IDLE sub-state PLMN SEARCH (according to subclause 4.2.1.2).

1.2 Or according to subclause 4.2.2.2 the UE shall

1.2.1 perform location updating after T3212 expiry by sending a LOCATION UPATING REQUEST message with the Mobile Identity IE set to its IMSI, CKSN IE set to "no key is available" and the Location Updating Type set to "normal location updating";

1.2.2 if the T3212 initiated location updating was unsuccessful, then after T3211 expiry the UE shall send a LOCATION UPDATING REQUEST message with the Mobile Identity IE set to its IMSI, CKSN IE set to "no key is available" and the Location Updating Type IE set to "normal location updating".

2) When four failures such as cases d), f), g) and h) of clause 4.4.4.9 of TS 24.008 have occurred during a normal location updating procedure the UE shall not perform the IMSI detach procedure, when switched off.

3) When four failures such as cases d), f), g) and h) of clause 4.4.4.9 of TS 24.008 have occurred during a normal location updating procedure the UE, if it supports emergency speech call, shall be able to perform an emergency call i.e. the UE is able to send a CM SERVICE REQUEST message with the CM Service Type IE set to "emergency call establishment", CKSN IE set to "no key is available" and Mobile Identity IE set to its IMSI and then send an EMERGENCY SETUP message.

4) When four failures such as cases d), f), g) and h) of clause 4.4.4.9 of TS 24.008 have occurred during a normal location updating procedure:

4.1 the UE shall use a request from CM entity for MM connection for a service other than emergency call as a trigger for a normal location updating procedure and shall send a LOCATION UPDATING REQUEST message with the Mobile Identity IE set to its IMSI, CKSN IE set to "no key is available" and the Location Updating Type IE set to "normal location updating";

4.2 after a location updating triggered by a request from the CM layer which was .unsuccessful, after T3211 expiry the UE shall send a LOCATION UPDATING REQUEST message with the Mobile Identity IE set to its IMSI, CKSN IE set to "no key is available" and the Location Updating Type IE set to "normal location updating".

5) When four failures such as cases d), f), g) and h) of clause 4.4.4.9 of TS 24.008 have occurred during a normal location updating procedure:

5.1 the UE shall perform a normal location updating procedure if it enters a new cell;

5.2 if this location updating is unsuccessful, after T3211 expiry the UE shall send a LOCATION UPDATING REQUEST message with the Mobile Identity IE set to its IMSI, CKSN IE set to "no key is available" and the Location Updating type IE set to "normal location updating".

References

TS 24.008 Clause 4.2.1.2, 4.2.2.2, 4.4.4.9.

9.4.3.3.3 Test purpose

To verify that the UE performs normal location updating procedures after T3212 expiry, when its attempt counter has reached value 4 and that the UE reset its attempt counter after a timer T3212 expiry.

To verify that the UE still follows the MM IDLE state and ATTEMPTING TO UPDATE substate requirements after its attempt counter has reached value 4. A Rel-6 or above UE may optionally enter the MM IDLE sub-state PLMN SEARCH (according to subclause 4.2.1.2) in order to perform a PLMN selection.

To verify that the attempt counter is reset in the cases where it has to be done.

9.4.3.3.4 Method of test

Initial conditions

– System Simulator:

– two cells: A and B, belonging to different location areas a and b;

– IMSI attach/detach is allowed in both cells;

– T3212 is set to 6 minutes.

– User Equipment:

– the UE is "Idle updated" on cell B with a valid CKSN and a TMSI.

Related ICS/IXIT statements

USIM removal possible while UE is powered Yes/No.

Switch off on button Yes/No.

Support of emergency speech call Yes/No.

Test Procedure

The UE is made to perform a normal location updating. The SS triggers a failure in this procedure by modifying scrambling code of DL DPCH. After T3211 expiry the UE will try again the location updating procedure. The SS triggers again a failure by modifying it. This is done again 2 times. At this point the attempt counter shall be equal to 4.

It is then checked that T3212 has been started and that at its expiry the UE will try a normal location updating procedure. It is verified that the UE has reset its attempt counter after timer T3212 expiry.

Then it is checked that, when the attempt counter has reached the value of 4, the UE is in the MM IDLE state and ATTEMPTING TO UPDATE substate, that is:

– not perform an IMSI detach procedure;

– support request for emergency call;

– use requests from CM layer other than emergency call as triggering of a normal location updating procedure;

– perform normal location updating procedure when a new cell is entered.

Expected sequence

Step	Direction		Message	Comments
Step	UE	SS	Message	Comments
The following messages are sent and shall be received on cell A.
1	SS			Set the cell type of cell A to the "Serving cell". Set the cell type of cell B to the "non-suitable cell". (see note).
2			RRC CONNECTION REQUEST	Establishment cause: Registration. If PS mode: a ROUTING AREA UPDATE REQUEST should be rejected with the cause “GPRS services not allowed.
3			RRC CONNECTION SETUP
4			RRC CONNECTION SETUP COMPLETE
5			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = initial value, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
6			LOCATION UPDATING REJECT	IE Reject cause is set to #22 in table 10.5.95 of TS 24.008, causes #2, #3, #6, #11, #12, #13 and #15 being excluded.
7			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
8			RRC CONNECTION RELEASE COMPLETE
9	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
10			RRC CONNECTION REQUEST	Establishment cause: Registration.
11			RRC CONNECTION SETUP
12			RRC CONNECTION SETUP COMPLETE
13			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
14	SS			The SS modifies the scrambling code of DL DPCH for generating lower layer failure.
15			(void)
15a			CELL UPDATE	CCCH.
15b			RRC CONNECTION RELEASE	CCCH.
15c	SS			The SS re-modifies the scrambling code of DL DPCH to the original one.
15d	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
16			RRC CONNECTION REQUEST	Establishment cause: Registration.
17			RRC CONNECTION SETUP
18			RRC CONNECTION SETUP COMPLETE
19			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
20			AUTHENTICATION REQUEST
21			AUTHENTICATION RESPONSE	Steps 20 and 21 are performed N times. N shall be chosen in such a way that the Authentication Request is not sent after (T3210 – applicable tolerance) is reached.
21a			SIGNALLING CONNECTION RELEASE INDICATION	The UE shall abort the RR connection. CN domain identity = CS domain
21b			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
21c			RRC CONNECTION RELEASE COMPLETE
22	UE			The UE shall cease transmission and then shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the expiry of T3210.
23			RRC CONNECTION REQUEST	Establishment cause: Registration.
24			RRC CONNECTION SETUP
25			RRC CONNECTION SETUP COMPLETE
26			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
27			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
28			RRC CONNECTION RELEASE COMPLETE
29	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3212 (tolerance ‑15s; 45s) at least after the RRC connection is released. Note: Rel-6 or later UE may optionally send RRC Connection Request immediately
30			RRC CONNECTION REQUEST	Establishment cause: Registration.
31			RRC CONNECTION SETUP
32			RRC CONNECTION SETUP COMPLETE
33			LOCATION UPDATING REQUEST	location updating type: "normal location update" CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE) mobile station classmark 1 as given by the ICS and mobile identity = IMSI.
34			LOCATION UPDATING REJECT	IE Reject cause = #17 "network failure".
35			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
36			RRC CONNECTION RELEASE COMPLETE
37	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
38			RRC CONNECTION REQUEST	Establishment cause: Registration.
39			RRC CONNECTION SETUP
40			RRC CONNECTION SETUP COMPLETE
41			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE) mobile station classmark 1 as given by the ICS and mobile identity = IMSI.
42			AUTHENTICATION REQUEST	CKSN = initial CKSN.
43			AUTHENTICATION RESPONSE
43a			SECURITY MODE COMMAND
43b			SECURITY MODE COMPLETE
44			LOCATION UPDATING ACCEPT	IE mobile Identity = new TMSI.
45			TMSI REALLOCATION COMPLETE
46			RRC CONNECTION RELEASE	After the sending of this message, the SS waits for the disconnection of the main signalling link. UE is now "idle, updated" in cell A.
47			RRC CONNECTION RELEASE COMPLETE
The following messages are sent and shall be received on cell B.
48	SS			Set the cell type of cell B to the "Serving cell". Set the cell type of cell A to the "non-suitable cell". (see note).
49			RRC CONNECTION REQUEST	Establishment cause: Registration.
50			RRC CONNECTION SETUP
51			RRC CONNECTION SETUP COMPLETE
52			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = initial value, LAI = a, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
53			LOCATION UPDATING REJECT	IE Reject cause is set to #38 in table 10.5.95 of TS 24.008, causes #2, #3, #6, #11, #12, #13 and #15 being excluded.
54			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
55			RRC CONNECTION RELEASE COMPLETE
56	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
57			RRC CONNECTION REQUEST	Establishment cause: Registration.
58			RRC CONNECTION SETUP
59			RRC CONNECTION SETUP COMPLETE
60			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
61	SS			The SS modifies the scrambling code of DL DPCH for generating lower layer failure.
61a			(void)
61b			CELL UPDATE	CCCH.
61c			RRC CONNECTION RELEASE	CCCH.
61d	SS			The SS re-modifies the scrambling code of DL DPCH to the original one.
61e	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
62			RRC CONNECTION REQUEST	Establishment cause: Registration.
63			RRC CONNECTION SETUP
64			RRC CONNECTION SETUP COMPLETE
65			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
66			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
67			RRC CONNECTION RELEASE COMPLETE
68	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
69			RRC CONNECTION REQUEST	Establishment cause: Registration.
70			RRC CONNECTION SETUP
71			RRC CONNECTION SETUP COMPLETE
72			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE) mobile station classmark 1 as given by the ICS and mobile identity = IMSI.
73	SS			performs step 53 and 54.
74	UE			performs step 55. If the UE supports emergency speech call, it is made to perform an emergency call.
75			RRC CONNECTION REQUEST	Establishment cause: Emergency call.
76			RRC CONNECTION SETUP
77			RRC CONNECTION SETUP COMPLETE
78			CM SERVICE REQUEST	CM service type = Emergency call establishment; CKSN = no key available; Mobile Identity = IMSI.
79			CM SERVICE ACCEPT
80			EMERGENCY SETUP
81			RELEASE COMPLETE	Cause = unassigned number.
82			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
83			RRC CONNECTION RELEASE COMPLETE
84	UE			If possible (see ICS) USIM detachment is performed. Otherwise if possible (see ICS) switch off is performed. Otherwise the power is removed.
85	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B. This is checked during 30 s.
86	UE			Depending on what has been performed in step 84 the UE is brought back to operation. The subsequent GMM attach should be rejected if received in the PS mode.
87			RRC CONNECTION REQUEST	Establishment cause: Registration.
88			RRC CONNECTION SETUP
89			RRC CONNECTION SETUP COMPLETE
90			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
91			AUTHENTICATION REQUEST	CKSN = initial CKSN.
92			AUTHENTICATION RESPONSE
92a			SECURITY MODE COMMAND
92b			SECURITY MODE COMPLETE
93			LOCATION UPDATING ACCEPT	IE mobile Identity = new TMSI.
94			TMSI REALLOCATION COMPLETE
95			RRC CONNECTION RELEASE	After the sending of this message, the SS waits for the disconnection of the main signalling link. UE is now "idle, updated" in cell B.
96			RRC CONNECTION RELEASE COMPLETE
The following messages are sent and shall be received on cell A.
97	SS			Set the cell type of cell A to the "Serving cell". Set the cell type of cell B to the "non-suitable cell". (see note).
98			RRC CONNECTION REQUEST	Establishment cause: Registration.
99			RRC CONNECTION SETUP
100			RRC CONNECTION SETUP COMPLETE
101			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = initial value, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
102			LOCATION UPDATING REJECT	IE Reject cause is set to #38 in table 10.5.95 of TS 24.008, causes #2, #3, #6, #11, #12, #13 and #15 being excluded.
103			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
104			RRC CONNECTION RELEASE COMPLETE
105	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
106			RRC CONNECTION REQUEST	Establishment cause: Registration.
107			RRC CONNECTION SETUP
108			RRC CONNECTION SETUP COMPLETE
109			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
110	SS			The SS modifies the scrambling code of DL DPCH for generating lower layer failure.
111			(void)
111a			CELL UPDATE	CCCH.
111b			RRC CONNECTION RELEASE	CCCH.
111c	SS			The SS re-modifies the scrambling code of DL DPCH to the original one.
111d	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
112			RRC CONNECTION REQUEST	Establishment cause: Registration.
113			RRC CONNECTION SETUP
114			RRC CONNECTION SETUP COMPLETE
115			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
116			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
117			RRC CONNECTION RELEASE COMPLETE
118	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
119			RRC CONNECTION REQUEST	Establishment cause: Registration.
120			RRC CONNECTION SETUP
121			RRC CONNECTION SETUP COMPLETE
122			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE) mobile station classmark 1 as given by the ICS and mobile identity = IMSI.
123			(void)
123a	SS			performs step 61.
123b			CELL UPDATE	CCCH.
123c			RRC CONNECTION RELEASE	CCCH.
123d	SS			performs step 61d.
124	UE			In case of Rel-6 or later UE go to step 131 A MO CM connection is attempted before T3212 expiry.
125			RRC CONNECTION REQUEST	Establishment cause: Registration.
126			RRC CONNECTION SETUP
127			RRC CONNECTION SETUP COMPLETE
128			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
129			(void)
129a	SS			performs step 61.
129b			CELL UPDATE	CCCH.
129c			RRC CONNECTION RELEASE	CCCH.
129d	SS			performs step 61d.
130	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
131			RRC CONNECTION REQUEST	Establishment cause: Registration. (In case of Rel-6 or later UE, this step may occur after step 123d or after T3212 expiry)
132			RRC CONNECTION SETUP
133			RRC CONNECTION SETUP COMPLETE
134			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
135			AUTHENTICATION REQUEST	CKSN = initial CKSN.
136			AUTHENTICATION RESPONSE
136a			SECURITY MODE COMMAND
136b			SECURITY MODE COMPLETE
137			LOCATION UPDATING ACCEPT	IE mobile Identity = new TMSI. If the location updating type in the LOCATION UPDATING REQUEST contains ‘FOR’, then IE Follow-on Proceed is included in the ACCEPT and steps 139 to 143 will be omitted.
138			TMSI REALLOCATION COMPLETE
139			RRC CONNECTION RELEASE
140			RRC CONNECTION RELEASE COMPLETE	UE is now "idle, updated" in cell A. The UE may or may not have memorised the request for CM connection. The steps 141 to 147 are therefore optional for the MS. The SS waits for 10 seconds to check if the UE attempts to make a CM service request, else it will directly go to step 148.
141			RRC CONNECTION REQUEST
142			RRC CONNECTION SETUP
143			RRC CONNECTION SETUP COMPLETE
144			CM SERVICE REQUEST	CKSN = initial value, Mobile identity = TMSI.
145			CM SERVICE REJECT	cause #17 (network failure).
146			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
147			RRC CONNECTION RELEASE COMPLETE
The following messages are sent and shall be received on cell B.
148	SS			Set the cell type of cell B to the "Serving cell". Set the cell type of cell A to the "non-suitable cell". (see note).
149			RRC CONNECTION REQUEST	Establishment cause: Registration.
150			RRC CONNECTION SETUP
151			RRC CONNECTION SETUP COMPLETE
152			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = initial value, LAI = a, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
153			LOCATION UPDATING REJECT	IE Reject cause is set to #38 in table 10.5.95 of TS 24.008, causes #2, #3, #6, #11, #12, #13 and #15 being excluded.
154			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link
155			RRC CONNECTION RELEASE COMPLETE
156	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
157			RRC CONNECTION REQUEST	Establishment cause: Registration.
158			RRC CONNECTION SETUP
159			RRC CONNECTION SETUP COMPLETE
160			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
161	SS			The SS modifies the scrambling code of DL DPCH for generating lower layer failure.
162			(void)
162a			CELL UPDATE	CCCH.
162b			RRC CONNECTION RELEASE	CCCH.
162c	SS			The SS re-modifies the scrambling code of DL DPCH to the original one.
162d	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
163			RRC CONNECTION REQUEST	Establishment cause: Registration.
164			RRC CONNECTION SETUP
165			RRC CONNECTION SETUP COMPLETE
166			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
167			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
168			RRC CONNECTION RELEASE COMPLETE
169	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
170			RRC CONNECTION REQUEST	Establishment cause: Registration.
171			RRC CONNECTION SETUP
172			RRC CONNECTION SETUP COMPLETE
173			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE) mobile station classmark 1 as given by the ICS and mobile identity = IMSI.
174			LOCATION UPDATING REJECT	IE Reject cause = "retry upon entry into a new cell". Value #48 used.
174a			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
174b			RRC CONNECTION RELEASE COMPLETE
The following messages are sent and shall be received on cell A.
175	SS			Set the cell type of cell A to the "Serving cell". Set the cell type of cell B to the "non-suitable cell". (see note).
176			RRC CONNECTION REQUEST	Establishment cause: Registration.
177			RRC CONNECTION SETUP
178			RRC CONNECTION SETUP COMPLETE
179			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available , LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE) mobile station classmark 1 as given by the ICS and mobile identity = IMSI.
180	SS			performs the step 61.
181			(void)
181a			CELL UPDATE	CCCH.
181b			RRC CONNECTION RELEASE	CCCH.
181c	SS			The SS re-modifies the scrambling code of DL DPCH to the original one.
181d	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
182			RRC CONNECTION REQUEST	Establishment cause: Registration.
183			RRC CONNECTION SETUP
184			RRC CONNECTION SETUP COMPLETE
185			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
186			AUTHENTICATION REQUEST	CKSN = initial CKSN.
187			AUTHENTICATION RESPONSE
187a			SECURITY MODE COMMAND
187b			SECURITY MODE COMPLETE
188			LOCATION UPDATING ACCEPT	IE mobile Identity = new TMSI.
189			TMSI REALLOCATION COMPLETE
190			RRC CONNECTION RELEASE	After the sending of this message, the SS waits for the disconnection of the main signalling link. UE is now "idle, updated" in cell A.
191			RRC CONNECTION RELEASE COMPLETE
NOTE: The definitions for "Serving cell" and "non-suitable cell" are specified in TS 34.108 clause 6.1 "Reference Radio Conditions for signalling test cases only".

Specific message contents

None.

9.4.3.3.5 Test requirement

1) 1.1 At step 33 the UE shall perform location updating procedure.

1.2 At step 41 the UE shall send a LOCATION UPDATING REQUEST message with the Mobile Identity IE set to its IMSI, CKSN IE set to "no key is available" and the Location Updating type IE set to "normal location updating".

2) At step78 the UE shall send a CM SERVICE REQUEST message with the CM Service Type IE set to "emergency call establishment", CKSN IE set to "no key is available" and Mobile Identity IE set to its IMSI.

At step 80 the UE shall send an EMERGENCY SETUP message.

3) At step 85 the UE shall not perform the IMSI detach procedure.

4.1 At step128 the UE shall send a LOCATION UPDATING REQUEST message with the Mobile Identity IE set to its IMSI, CKSN IE set to "no key is available" and the Location Updating type IE set to "normal location updating" (Applicable only for R5 or earlier UE);

4.2 At step 134 the UE shall send a LOCATION UPDATING REQUEST message with the Mobile Identity IE set to its IMSI, CKSN IE set to "no key is available" and the Location Updating type IE set to "normal location updating".

5.1 At step 179 the UE shall perform a normal location updating procedure if it enters a new cell;

5.2 At step 185 the UE shall send a LOCATION UPDATING REQUEST message with the Mobile Identity IE set to its IMSI, CKSN IE set to "no key is available" and the Location Updating type IE set to "normal location updating".

9.4.3.3a Location updating / abnormal cases / attempt counter equal to 4

9.4.3.3a.1 Definition and applicability

9.4.3.3a.2 Conformance requirement

.…

The state PLMN SEARCH is also entered in the following cases:

– in state NO IMSI, a SIM/USIM is inserted;

– in any state except NO IMSI, NO CELL AVAILABLE, NORMAL SERVICE and RECEIVING GROUP CALL (NORMAL SERVICE) after the user has asked for a PLMN selection;

– in any state except NO IMSI and NO CELL AVAILABLE, coverage is lost;

– roaming is denied;

– optionally, when the mobile station is in the ATTEMPTING TO UPDATE state and is in Automatic Network Selection mode and location update attempt counter is greater than or equal to 4.

The service state when the PLMN SEARCH is left depends on the outcome of the search and on the presence of the SIM/USIM as specified in subclause 4.2.1.1.

[…]

…..

When in state MM IDLE and service state ATTEMPTING TO UPDATE the mobile station shall:

– perform location updating procedure at expiry of timer T3211, T3213 or T3246;

– perform normal location updating when the location area identification of the serving cell changes, if timer T3246 is not running;

– if entry into this state was caused by c) or d) or f) (with cause different from "abnormal release, unspecified") or g) (with cause "retry upon entry into a new cell") of subclause 4.4.4.9, then location updating shall be performed when a new cell is entered;

– if entry into this state was caused by e) or f) (with cause "abnormal release, unspecified"), g) (with cause different from "retry upon entry into a new cell"), i) or j) of subclause 4.4.4.9, then location updating shall not be performed because a new cell is entered;

– perform normal location updating at expiry of timer T3212;

– not perform IMSI detach;

– support request for emergency calls;

– use other request from CM layer as triggering of normal location updating procedure (if the location updating procedure is successful, then the request for MM connection is accepted, see subclause 4.5.1), if timer T3246 is not running;

– respond to paging (with IMSI); and

– for an eCall only mobile station (as determined by information configured in USIM), perform the eCall inactivity procedure at expiry of timer T3242 or timer T3243.

In addition, mobile stations supporting VGCS listening or VBS listening shall:

– indicate notifications to the GCC or BCC sublayer for which a channel description has been received in the notification by the RR sublayer;

– reject requests of the GCC or BCC sublayer to respond to notifications for which no channel description has been received in the notification by the RR sublayer;

– request the RR sublayer to receive a voice group or broadcast call if the GCC or BCC sublayer requests the reception of a voice group or broadcast call for which a channel description has been received in the notification by the RR sublayer and then go to the service state RECEIVING GROUP CALL (LIMITED SERVICE).

…..

[…]

…

g) Location updating reject, other causes than those treated in subclause 4.4.4.7, and cases of MM cause #22, if considered as abnormal cases according to subclause 4.4.4.7

Upon reception of the cause codes #22, # 95, # 96, # 97, # 99 and # 111 the MS should set the attempt counter to 4. The MS waits for release of the RR connection as specified in subclause 4.4.4.8, and then proceeds as specified below.

…

In cases d) to i) (except in the case f.1) above, and, for repeated failures as defined in c) above, and for the case of cause code #22 received (as described in subclause 4.4.4.7 and 4.5.1.1) the mobile station proceeds as follows. Timer T3210 is stopped if still running. The RR Connection is aborted in case of timer T3210 timeout. The attempt counter is incremented. The next actions depend on the Location Area Identities (stored and received from the BCCH of the current serving cell) and the value of the attempt counter.

– the update status is UPDATED, and the stored LAI is equal to the one received on the BCCH from the current serving cell and the attempt counter is smaller than 4:

The mobile station shall keep the update status to UPDATED, the MM IDLE sub-state after the RR connection release is NORMAL SERVICE. The mobile station shall memorize the location updating type used in the location updating procedure. It shall start timer T3211 (or, if the conditions for cause code #22 specified in subclause 4.4.4.7 or subclause 4.5.1.1 are met, shall start timer T3246 and not start timer T3211) when the RR connection is released. When timer T3211 or T3246 expires, the location updating procedure is triggered again with the memorized location updating type;

– either the update status is different from UPDATED, or the stored LAI is different from the one received on the BCCH from the current serving cell, or the attempt counter is greater or equal to 4:

When the RR connection is released the mobile station shall delete any LAI, TMSI, ciphering key sequence number stored in the SIM/USIM, and set the update status to NOT UPDATED. A mobile station which is not a GPRS MS shall also delete the list of equivalent PLMNs. The mobile station shall enter the MM IDLE sub-state ATTEMPTING TO UPDATE (see subclause 4.2.2.2 for the subsequent actions) or optionally the MM IDLE sub-state PLMN SEARCH (see subclause 4.2.1.2) in order to perform a PLMN selection according to 3GPP TS 23.122 [14]. If the attempt counter is smaller than 4, the mobile station shall memorize that timer T3211 (or, if the conditions for cause code #22 specified in subclause 4.4.4.7 or subclause 4.5.1.1 are met, shall start timer T3246 and not start timer T3211) is to be started when the RR connection is released, otherwise it shall memorize that timer T3212 (or, if the conditions for cause code #22 specified in subclause 4.4.4.7 or subclause 4.5.1.1 are met, shall start timer T3246 and not start timer T3212) is to be started when the RR connection is released.

[…]

References

TS 24.008 Clauses 4.2.1.2, 4.2.2.2, 4.4.4.7, 4.4.4.9.

9.4.3.3a.3 Test purpose

1. To verify that the UE performs normal location updating procedures after T3212 expiry, when its attempt counter has reached value 4 and that the UE reset its attempt counter after a timer T3212 expiry.

2. To verify that the UE still follows the MM IDLE state and ATTEMPTING TO UPDATE substate requirements after its attempt counter has reached value 4. A Rel-10 or later UE may optionally enter the MM IDLE sub-state PLMN SEARCH (according to subclause 4.2.1.2) in order to perform a PLMN selection.

3. To verify that the attempt counter is reset in the cases where required.

9.4.3.3a.4 Method of test

Initial conditions

– System Simulator:

– two cells: A and B, belonging to different location areas a and b;

– IMSI attach/detach is allowed in both cells;

– T3212 is set to 6 minutes.

– User Equipment:

– the UE is "Idle updated" on cell B with a valid CKSN and a TMSI.

Related ICS/IXIT statements

USIM removal possible while UE is powered Yes/No.
Switch off on button Yes/No.
Support of emergency speech call Yes/No.

Test Procedure

The UE is made to perform a normal location updating. The SS triggers Reject cause #22. At this point the attempt counter shall be set to 4.

Then it is checked that, when the attempt counter has reached the value of 4, the UE is in the MM IDLE state and ATTEMPTING TO UPDATE substate, that is:

– not perform an IMSI detach procedure;

– support request for emergency call;

– use requests from CM layer other than emergency call as triggering of a normal location updating procedure;

– perform normal location updating procedure when a new cell is entered.

Expected sequence

Step	Direction		Message	Comments
Step	UE	SS	Message	Comments
The following messages are sent and shall be received on cell A.
1	SS			Set the cell type of cell A to the "Serving cell". Set the cell type of cell B to the "non-suitable cell". (see note).
2			RRC CONNECTION REQUEST	Establishment cause: Registration. If PS mode: a ROUTING AREA UPDATE REQUEST should be rejected with the cause “GPRS services not allowed.
3			RRC CONNECTION SETUP
4			RRC CONNECTION SETUP COMPLETE
5			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = initial value, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
6			LOCATION UPDATING REJECT	IE Reject cause is set to #22 in table 10.5.95 of TS 24.008, causes #2, #3, #6, #11, #12, #13 and #15 being excluded.
7			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
8			RRC CONNECTION RELEASE COMPLETE
9	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3212 (tolerance ‑15s; 45s) at least after the RRC connection is released.
10			RRC CONNECTION REQUEST	Establishment cause: Registration.
11			RRC CONNECTION SETUP
12			RRC CONNECTION SETUP COMPLETE
13			LOCATION UPDATING REQUEST	location updating type: normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), mobile station classmark 1 as given by the ICS and mobile identity = IMSI.
14			LOCATION UPDATING REJECT	IE Reject cause = #17 "network failure".
15			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
16			RRC CONNECTION RELEASE COMPLETE
17	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
18			RRC CONNECTION REQUEST	Establishment cause: Registration.
19			RRC CONNECTION SETUP
20			RRC CONNECTION SETUP COMPLETE
21			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE) mobile station classmark 1 as given by the ICS and mobile identity = IMSI.
22			AUTHENTICATION REQUEST	CKSN = initial CKSN.
23			AUTHENTICATION RESPONSE
24			SECURITY MODE COMMAND
25			SECURITY MODE COMPLETE
26			LOCATION UPDATING ACCEPT	IE mobile Identity = new TMSI.
27			TMSI REALLOCATION COMPLETE
28			RRC CONNECTION RELEASE	After the sending of this message, the SS waits for the disconnection of the main signalling link. UE is now "idle, updated" in cell A.
29			RRC CONNECTION RELEASE COMPLETE
The following messages are sent and shall be received on cell B.
30	SS			Set the cell type of cell B to the "Serving cell". Set the cell type of cell A to the "non-suitable cell". (see note).
31			RRC CONNECTION REQUEST	Establishment cause: Registration.
32			RRC CONNECTION SETUP
33			RRC CONNECTION SETUP COMPLETE
34			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = initial value, LAI = a, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
35			LOCATION UPDATING REJECT	IE Reject cause is set to #38 in table 10.5.95 of TS 24.008, causes #2, #3, #6, #11, #12, #13 and #15 being excluded.
36			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
37			RRC CONNECTION RELEASE COMPLETE
38	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
39			RRC CONNECTION REQUEST	Establishment cause: Registration.
40			RRC CONNECTION SETUP
41			RRC CONNECTION SETUP COMPLETE
42			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
43	SS			The SS modifies the scrambling code of DL DPCH for generating lower layer failure.
44			CELL UPDATE	CCCH.
45			RRC CONNECTION RELEASE	CCCH.
46	SS			The SS re-modifies the scrambling code of DL DPCH to the original one.
47	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
48			RRC CONNECTION REQUEST	Establishment cause: Registration.
49			RRC CONNECTION SETUP
50			RRC CONNECTION SETUP COMPLETE
51			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
52			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
53			RRC CONNECTION RELEASE COMPLETE
54	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
55			RRC CONNECTION REQUEST	Establishment cause: Registration.
56			RRC CONNECTION SETUP
57			RRC CONNECTION SETUP COMPLETE
58			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE) mobile station classmark 1 as given by the ICS and mobile identity = IMSI.
59	SS			performs step 35 and 36.
60	UE			performs step 37. If the UE supports emergency speech call, it is made to perform an emergency call.
61			RRC CONNECTION REQUEST	Establishment cause: Emergency call.
62			RRC CONNECTION SETUP
63			RRC CONNECTION SETUP COMPLETE
64			CM SERVICE REQUEST	CM service type = Emergency call establishment; CKSN = no key available; Mobile Identity = IMSI.
65			CM SERVICE ACCEPT
66			EMERGENCY SETUP
67			RELEASE COMPLETE	Cause = unassigned number.
68			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
69			RRC CONNECTION RELEASE COMPLETE
70	UE			If possible (see ICS) USIM detachment is performed. Otherwise if possible (see ICS) switch off is performed. Otherwise the power is removed.
71	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B. This is checked during 30 s.
72	UE			Depending on what has been performed in step 70 the UE is brought back to operation. The subsequent GMM attach should be rejected if received in the PS mode.
73			RRC CONNECTION REQUEST	Establishment cause: Registration.
74			RRC CONNECTION SETUP
75			RRC CONNECTION SETUP COMPLETE
76			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
77			AUTHENTICATION REQUEST	CKSN = initial CKSN.
78			AUTHENTICATION RESPONSE
79			SECURITY MODE COMMAND
80			SECURITY MODE COMPLETE
81			LOCATION UPDATING ACCEPT	IE mobile Identity = new TMSI.
82			TMSI REALLOCATION COMPLETE
83			RRC CONNECTION RELEASE	After the sending of this message, the SS waits for the disconnection of the main signalling link. UE is now "idle, updated" in cell B.
84			RRC CONNECTION RELEASE COMPLETE
The following messages are sent and shall be received on cell A.
85	SS			Set the cell type of cell A to the "Serving cell". Set the cell type of cell B to the "non-suitable cell". (see note).
86			RRC CONNECTION REQUEST	Establishment cause: Registration.
87			RRC CONNECTION SETUP
88			RRC CONNECTION SETUP COMPLETE
89			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = initial value, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
90			LOCATION UPDATING REJECT	IE Reject cause is set to #38 in table 10.5.95 of TS 24.008, causes #2, #3, #6, #11, #12, #13 and #15 being excluded.
91			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
92			RRC CONNECTION RELEASE COMPLETE
93	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
94			RRC CONNECTION REQUEST	Establishment cause: Registration.
95			RRC CONNECTION SETUP
96			RRC CONNECTION SETUP COMPLETE
97			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
98	SS			The SS modifies the scrambling code of DL DPCH for generating lower layer failure.
99			CELL UPDATE	CCCH.
100			RRC CONNECTION RELEASE	CCCH.
101	SS			The SS re-modifies the scrambling code of DL DPCH to the original one.
102	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
103			RRC CONNECTION REQUEST	Establishment cause: Registration.
104			RRC CONNECTION SETUP
105			RRC CONNECTION SETUP COMPLETE
106			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
107			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
108			RRC CONNECTION RELEASE COMPLETE
109	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
110			RRC CONNECTION REQUEST	Establishment cause: Registration.
111			RRC CONNECTION SETUP
112			RRC CONNECTION SETUP COMPLETE
113			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE) mobile station classmark 1 as given by the ICS and mobile identity = IMSI.
114	SS			The SS modifies the scrambling code of DL DPCH for generating lower layer failure.
115			CELL UPDATE	CCCH.
116			RRC CONNECTION RELEASE	CCCH.
116a	SS			The SS re-modifies the scrambling code of DL DPCH to the original one.
116b	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
117			RRC CONNECTION REQUEST	Establishment cause: Registration.
118			RRC CONNECTION SETUP
119			RRC CONNECTION SETUP COMPLETE
120			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
121			AUTHENTICATION REQUEST	CKSN = initial CKSN.
122			AUTHENTICATION RESPONSE
123			SECURITY MODE COMMAND
124			SECURITY MODE COMPLETE
125			LOCATION UPDATING ACCEPT	IE mobile Identity = new TMSI. If the location updating type in the LOCATION UPDATING REQUEST contains ‘FOR’, then IE Follow-on Proceed is included in the ACCEPT and steps 127 to 131 will be omitted.
126			TMSI REALLOCATION COMPLETE
127			RRC CONNECTION RELEASE
128			RRC CONNECTION RELEASE COMPLETE	UE is now "idle, updated" in cell A. The UE may or may not have memorised the request for CM connection. The steps 129 to 135 are therefore optional for the MS. The SS waits for 10 seconds to check if the UE attempts to make a CM service request, else it will directly go to step 136.
129			RRC CONNECTION REQUEST
130			RRC CONNECTION SETUP
131			RRC CONNECTION SETUP COMPLETE
132			CM SERVICE REQUEST	CKSN = initial value, Mobile identity = TMSI.
133			CM SERVICE REJECT	cause #17 (network failure).
134			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
135			RRC CONNECTION RELEASE COMPLETE
The following messages are sent and shall be received on cell B.
136	SS			Set the cell type of cell B to the "Serving cell". Set the cell type of cell A to the "non-suitable cell". (see note).
137			RRC CONNECTION REQUEST	Establishment cause: Registration.
138			RRC CONNECTION SETUP
139			RRC CONNECTION SETUP COMPLETE
140			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = initial value, LAI = a, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
141			LOCATION UPDATING REJECT	IE Reject cause is set to #38 in table 10.5.95 of TS 24.008, causes #2, #3, #6, #11, #12, #13 and #15 being excluded.
142			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link
143			RRC CONNECTION RELEASE COMPLETE
144	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
145			RRC CONNECTION REQUEST	Establishment cause: Registration.
146			RRC CONNECTION SETUP
147			RRC CONNECTION SETUP COMPLETE
148			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
149	SS			The SS modifies the scrambling code of DL DPCH for generating lower layer failure.
150			CELL UPDATE	CCCH.
151			RRC CONNECTION RELEASE	CCCH.
152	SS			The SS re-modifies the scrambling code of DL DPCH to the original one.
153	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
154			RRC CONNECTION REQUEST	Establishment cause: Registration.
155			RRC CONNECTION SETUP
156			RRC CONNECTION SETUP COMPLETE
157			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
158			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
159			RRC CONNECTION RELEASE COMPLETE
160	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
161			RRC CONNECTION REQUEST	Establishment cause: Registration.
162			RRC CONNECTION SETUP
163			RRC CONNECTION SETUP COMPLETE
164			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE) mobile station classmark 1 as given by the ICS and mobile identity = IMSI.
165			LOCATION UPDATING REJECT	IE Reject cause = "retry upon entry into a new cell". Value #48 used.
166			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
167			RRC CONNECTION RELEASE COMPLETE
The following messages are sent and shall be received on cell A.
168	SS			Set the cell type of cell A to the "Serving cell". Set the cell type of cell B to the "non-suitable cell". (see note).
169			RRC CONNECTION REQUEST	Establishment cause: Registration.
170			RRC CONNECTION SETUP
171			RRC CONNECTION SETUP COMPLETE
172			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available , LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE) mobile station classmark 1 as given by the ICS and mobile identity = IMSI.
173	SS			performs the step 43.
174			CELL UPDATE	CCCH.
175			RRC CONNECTION RELEASE	CCCH.
176	SS			The SS re-modifies the scrambling code of DL DPCH to the original one.
177	UE			The UE shall not initiate an RRC connection establishment on cell A or on cell B during T3211 seconds at least after the RRC connection is released.
178			RRC CONNECTION REQUEST	Establishment cause: Registration.
179			RRC CONNECTION SETUP
180			RRC CONNECTION SETUP COMPLETE
181			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE), Mobile Identity = IMSI.
182			AUTHENTICATION REQUEST	CKSN = initial CKSN.
183			AUTHENTICATION RESPONSE
184			SECURITY MODE COMMAND
185			SECURITY MODE COMPLETE
186			LOCATION UPDATING ACCEPT	IE mobile Identity = new TMSI.
187			TMSI REALLOCATION COMPLETE
188			RRC CONNECTION RELEASE	After the sending of this message, the SS waits for the disconnection of the main signalling link. UE is now "idle, updated" in cell A.
189			RRC CONNECTION RELEASE COMPLETE
NOTE: The definitions for "Serving cell" and "non-suitable cell" are specified in TS 34.108 clause 6.1 "Reference Radio Conditions for signalling test cases only".

Specific message contents

None.

9.4.3.3a.5 Test requirement

1.1) At step 13 the UE shall perform location updating procedure.

1.2) At step 21 the UE shall send a LOCATION UPDATING REQUEST message with the Mobile Identity IE set to its IMSI, CKSN IE set to "no key is available" and the Location Updating type IE set to "normal location updating".

2) At step 64 the UE shall send a CM SERVICE REQUEST message with the CM Service Type IE set to "emergency call establishment", CKSN IE set to "no key is available" and Mobile Identity IE set to its IMSI.

At step 66 the UE shall send an EMERGENCY SETUP message.

3) At step 71 the UE shall not perform the IMSI detach procedure.

4) At step 120 the UE shall send a LOCATION UPDATING REQUEST message with the Mobile Identity IE set to its IMSI, CKSN IE set to "no key is available" and the Location Updating type IE set to "normal location updating".

5.1) At step 172 the UE shall perform a normal location updating procedure if it enters a new cell;

5.2) At step 181 the UE shall send a LOCATION UPDATING REQUEST message with the Mobile Identity IE set to its IMSI, CKSN IE set to "no key is available" and the Location Updating type IE set to "normal location updating".

9.4.3.4 Location updating / abnormal cases / attempt counter less or equal to 4, stored LAI equal to broadcast LAI

9.4.3.4.1 Definition

9.4.3.4.2 Conformance requirement

1) When a failure such as cases d), f), g) and h) of clause 4.4.4.9 of TS 24.008 has occurred during a periodic location updating procedure (the broadcast LAI is equal to the stored LAI):

1.1 the UE shall be able to establish an MM connection i.e. send a RRC CONNECTION REQUEST message and then a CM SERVICE REQUEST message, CKSN and LAI set to those which have been allocated to the UE, Mobile Identity IE set to the TMSI which has been allocated to the UE;

1.2 then the UE shall not attempt a location updating procedure.

2) When a failure such as cases d), f), g) and h) of clause 4.4.4.9 of TS 24.008 has occurred during an IMSI attach procedure (the broadcast LAI is equal to the stored LAI):

2.1 the UE shall be able to establish an MM connection i.e. send a RRC CONNECTION REQUEST message and then a CM SERVICE REQUEST message, CKSN and LAI set to those which have been allocated to the UE, Mobile Identity IE set to the TMSI which has been allocated to the UE;

2.2 then the UE shall not attempt a location updating procedure.

3) When a failure such as cases d), f), g) and h) of clause 4.4.4.9 of TS 24.008 has occurred during a periodic location updating procedure and the attempt counter is smaller than 4 the UE shall send, after T3211 expiry, a LOCATION UPDATING REQUEST message with the Mobile Identity IE set to the TMSI which has been allocated to the UE, CKSN IE and LAI set to those which have been allocated to the UE and the Location Updating Type IE set to "periodic updating".

3.1 When the UE’s attempt counter reaches the value 4 (four failures such as cases d), f), g) and h) of clause 4.4.4.9 of TS 24.008 have occurred during a periodic location updating procedure) after T3212 expiry it shall send a LOCATION UPDATING REQUEST message with the Mobile Identity IE set to its IMSI, CKSN IE set to "no key is available" and the Location Updating Type IE set to "normal".

4) When the UE’s attempt counter reaches the value 4 (four failures such as cases d), f), g) and h) of clause 4.4.4.9 of TS 24.008 have occurred during a periodic location updating procedure) it shall use a request for a CM connection other than emergency call as a trigger for a location updating procedure.

5) When a failure such as cases d), f), g) and h) of clause 4.4.4.9 of TS 24.008 has occurred during an IMSI attach procedure and the attempt counter is smaller than 4 the UE shall send, after T3211 expiry, a LOCATION UPDATING REQUEST message with the Mobile Identity IE set to the TMSI which has been allocated to the UE, CKSN IE and LAI set to those which have been allocated to the UE and the Location Updating type set to "IMSI attach".

5.1 When the UE’s attempt counter reaches the value 4 (four failures such as cases d), f), g) and h) of clause 4.4.4.9 of TS 24.008 have occurred during an IMSI attach procedure) after T3212 expiry it shall send a LOCATION UPDATING REQUEST message with the Mobile Identity IE set to its IMSI, CKSN IE set to "no key is available" and the Location Updating type set to "normal".

6) When the UE’s attempt counter reaches the value 4 (four failures such as cases d), f), g) and h) of clause 4.4.4.9 of TS 24.008 have occurred during an IMSI attach procedure) it shall use a request for a CM connection other than emergency call as a trigger for a location updating procedure.

References

TS 24.008 clause 4.4.4.9.

9.4.3.4.3 Test purpose

To verify that in the case when the attempt counter is smaller than 4 and the broadcast LAI is equal to the stored LAI, the UE is in the MM IDLE state and NORMAL SERVICE substate. To verify that timer T3211 is stopped after a MM connection establishment.

To verify that the UE uses the T3211 timer. and that it enters the MM IDLE state and NORMAL SERVICE substate when its attempt counter reaches value 4 even in the case where the stored LAI is equal to the broadcast LAI.

9.4.3.4.4 Method of test

Initial conditions

– System Simulator:

– one cell: B, belonging to location area b;

– IMSI attach/detach is allowed;

– T3212 is set to 6 minutes.

– User Equipment:

– the UE is "Idle updated" on cell B with a valid CKSN and a TMSI.

Related ICS/IXIT statements

USIM removal possible while UE is powered Yes/No.

Switch off on button Yes/No.

Test Procedure

A failure during the periodic location updating is triggered: as the broadcast LAI is equal to the stored LAI, the UE is still in the MM IDLE state and NORMAL SERVICE substate and timer T3211 is started. A CM connection other than for emergency call is attempted. It is checked that this is possible and that T3211 is stopped. Same test is performed with a failure during an IMSI attach procedure.

Then failures are triggered during the periodic location updating to let the attempt counter to reach the value of 4. The UE shall enter the MM IDLE state and ATTEMPTING TO UPDATE substate and delete any TMSI, stored LAI, ciphering key sequence number and ciphering key. When the attempt counter reaches the value of 4, timer T3212 shall be started. At timer T3212 expiry a location updating procedure is started. A request for CM connection other for than emergency call shall trigger a location updating procedure.

Same tests are performed when the failures are triggered during an IMSI attach procedure.

Expected sequence

Step	Direction		Message	Comments
Step	UE	SS	Message	Comments
1	SS			The SS shall wait at most T3212 + 45 s.
2			RRC CONNECTION REQUEST	Establishment cause: Registration.
3			RRC CONNECTION SETUP
4			RRC CONNECTION SETUP COMPLETE
5			LOCATION UPDATING REQUEST	location updating type = periodic, CKSN = initial value, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
6	SS			performs step 6, of 9.4.3.2 with cause #17 and step 7 of 9.4.3.2.
6a	UE			performs step 8 of 9.4.3.2.
7	UE			A MO CM connection is attempted before T3211 expiry.
8			RRC CONNECTION REQUEST
9			RRC CONNECTION SETUP
10			RRC CONNECTION SETUP COMPLETE
11			CM SERVICE REQUEST	CKSN = initial CKSN, Mobile Identity = TMSI.
12			CM SERVICE ACCEPT
13			An initial CM message
14			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
15			RRC CONNECTION RELEASE COMPLETE
16	SS			The UE shall not initiate an RRC connection establishment. This is checked during T3211.
17	UE			If possible (see ICS) USIM detachment is performed. Otherwise if possible (see ICS) switch off is performed. Otherwise the power is removed. A Detach Request can be received in PS mode.
Steps 18 to 23 are optional.
18			RRC CONNECTION REQUEST	Establishment Cause: Detach
19			RRC CONNECTION SETUP
20			RRC CONNECTION SETUP COMPLETE
21			IMSI DETACH INDICATION
22			RRC CONNECTION RELEASE
23			RRC CONNECTION RELEASE COMPLETE
24	UE			Depending on what has been performed in step 17 the UE is brought back to operation. The subsequent GMM attach should be rejected if received in the PS mode.
25			RRC CONNECTION REQUEST	Establishment cause: Registration.
26			RRC CONNECTION SETUP
27			RRC CONNECTION SETUP COMPLETE
28			LOCATION UPDATING REQUEST	location updating type = IMSI attach, CKSN = initial value, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
29	SS			performs step 14 of 9.4.3.2.
29a			(void)
29b			CELL UPDATE	CCCH.
29c			RRC CONNECTION RELEASE	CCCH.
29d	SS			performs step 15c of 9.4.3.2.
30	UE			A MO CM connection is attempted before T3211 expiry.
31			RRC CONNECTION REQUEST
32			RRC CONNECTION SETUP
33			RRC CONNECTION SETUP COMPLETE
34			CM SERVICE REQUEST	CKSN = initial CKSN, Mobile Identity = TMSI.
35			SECURITY MODE COMMAND
36			SECURITY MODE COMPLETE
37			An initial CM message
38			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
39			RRC CONNECTION RELEASE COMPLETE
40	SS			The UE shall not initiate an RRC connection establishment. This is checked during T3211 UE is "idle, updated" in cell B.
40/1	UE			If possible (see ICS) USIM detachment is performed. Otherwise if possible (see ICS) switch off is performed. Otherwise the power is removed.
Steps 40/2 to 40/7 are optional.
40/2			RRC CONNECTION REQUEST	Establishment Cause: Detach
40/3			RRC CONNECTION SETUP
40/4			RRC CONNECTION SETUP COMPLETE
40/5			IMSI DETACH INDICATION
40/6			RRC CONNECTION RELEASE
40/7			RRC CONNECTION RELEASE COMPLETE
40/8	UE			Depending on what has been performed in step 40/1, the UE is brought back to operation.
40/9			RRC CONNECTION REQUEST	Establishment cause: Registration.
40/10			RRC CONNECTION SETUP
40/11			RRC CONNECTION SETUP COMPLETE
40/12			LOCATION UPDATING REQUEST	location updating type = IMSI attach, CKSN = initial value, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
40/13			LOCATION UPDATING ACCEPT	without mobile identity
40/14			RRC CONNECTION RELEASE
40/15			RRC CONNECTION RELEASE COMPLETE
41	SS			The SS shall wait at most T3212 + 15 s.
42			RRC CONNECTION REQUEST	Establishment cause: Registration.
43			RRC CONNECTION SETUP
44			RRC CONNECTION SETUP COMPLETE
45			LOCATION UPDATING REQUEST	location updating type = periodic, CKSN = initial value, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
46	SS			performs step 14 of 9.4.3.2.
46a			(void)
46b			CELL UPDATE	CCCH.
46c			RRC CONNECTION RELEASE	CCCH.
46d	SS			performs step 15c of 9.4.3.2.
47	UE			The UE shall not initiate an RRC connection establishment during T3211 at least after the RRC connection is released.
48			RRC CONNECTION REQUEST	Establishment cause: Registration.
49			RRC CONNECTION SETUP
50			RRC CONNECTION SETUP COMPLETE
51			LOCATION UPDATING REQUEST	location updating type = periodic, CKSN = initial value, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
52	SS			performs step 6 of 9.4.3.2 with cause #17 and step 7 of 9.4.3.2.
52a	UE			performs step 8 of 9.4.3.2.
53	UE			The UE shall not initiate an RRC connection establishment during T3211 at least after the RRC connection is released.
54			RRC CONNECTION REQUEST	Establishment cause: Registration.
55			RRC CONNECTION SETUP
56			RRC CONNECTION SETUP COMPLETE
57			LOCATION UPDATING REQUEST	location updating type = periodic, CKSN = initial value, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
58	SS			performs step 14 of 9.4.3.2.
59			(void)
59a			CELL UPDATE	CCCH.
59b			RRC CONNECTION RELEASE	CCCH.
59c	SS			The SS re-modifies the scrambling code of DL DPCH to the original one.
59d	UE			The UE shall not initiate an RRC connection establishment during T3211 at least after the RRC connection is released.
60			RRC CONNECTION REQUEST	Establishment cause: Registration.
61			RRC CONNECTION SETUP
62			RRC CONNECTION SETUP COMPLETE
63			LOCATION UPDATING REQUEST	location updating type = periodic, CKSN = initial value, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
64	SS			performs step 14 of 9.4.3.2.
64a			(void)
64b			CELL UPDATE	CCCH.
64c			RRC CONNECTION RELEASE	CCCH.
64d	SS			performs step 15c of 9.4.3.2.
65	UE			The UE shall not initiate an RRC connection establishment during T3212 seconds at least after the RRC connection is released.
66			RRC CONNECTION REQUEST	Establishment cause: Registration.
67			RRC CONNECTION SETUP
68			RRC CONNECTION SETUP COMPLETE
69			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE) mobile station classmark 1 as given by the ICS and mobile identity = IMSI.
70			AUTHENTICATION REQUEST	CKSN = initial CKSN.
71			AUTHENTICATION RESPONSE
71a			SECURITY MODE COMMAND
71b			SECURITY MODE COMPLETE
72			(void)
72a 72b	 		LOCATION UPDATING ACCEPT TMSI REALLOCATION COMPLETE	IE mobile Identity = TMSI.
73			RRC CONNECTION RELEASE	The SS waits for the disconnection of the main signalling link.
74			RRC CONNECTION RELEASE COMPLETE
75	UE			The UE shall not initiate an RRC connection establishment during than T3212 seconds at least after the RRC connection is released.
76			RRC CONNECTION REQUEST	Establishment cause: Registration.
77			RRC CONNECTION SETUP
78			RRC CONNECTION SETUP COMPLETE
79			LOCATION UPDATING REQUEST	location updating type = periodic, CKSN = initial value, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
80	SS			performs step 6 of 9.4.3.2 with cause #17 and step 7 of 9.4.3.2.
80a	UE			performs step 8 of 9.4.3.2.
81	UE			The UE shall not initiate an RRC connection establishment during T3211 at least after the RRC connection is released.
82			RRC CONNECTION REQUEST	Establishment cause: Registration.
83			RRC CONNECTION SETUP
84			RRC CONNECTION SETUP COMPLETE
85			LOCATION UPDATING REQUEST	location updating type = periodic, CKSN = initial value, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
86	SS			performs step 14 of 9.4.3.2.
87			(void)
87a			CELL UPDATE	CCCH.
87b			RRC CONNECTION RELEASE	CCCH.
87c	SS			The SS re-modifies the scrambling code of DL DPCH to the original one.
87d	UE			The UE shall not initiate an RRC connection establishment during T3211 at least after the RRC connection is released.
88			RRC CONNECTION REQUEST	Establishment cause: Registration.
89			RRC CONNECTION SETUP
90			RRC CONNECTION SETUP COMPLETE
91			LOCATION UPDATING REQUEST	location updating type = periodic, CKSN = initial value, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
92	SS			performs step 14 of 9.4.3.2.
92a			(void)
92b			CELL UPDATE	CCCH.
92c			RRC CONNECTION RELEASE	CCCH.
92d	SS			performs step 15c of 9.4.3.2.
93	UE			The UE shall not initiate an RRC connection establishment during T3211 at least after the RRC connection is released.
94			RRC CONNECTION REQUEST	Establishment cause: Registration.
95			RRC CONNECTION SETUP
96			RRC CONNECTION SETUP COMPLETE
97			LOCATION UPDATING REQUEST	location updating type = periodic, CKSN = initial value, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
98	SS			performs step 6 of 9.4.3.2 with cause #17 and step 7 of 9.4.3.2.
98a	UE			performs step 8 of 9.4.3.2.
99	UE			A MO CM connection is attempted before T3212 expiry.
100			RRC CONNECTION REQUEST	Establishment cause: Registration.
101			RRC CONNECTION SETUP
102			RRC CONNECTION SETUP COMPLETE
103			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE) mobile station classmark 1 as given by the ICS and mobile identity = IMSI.
104			LOCATION UPDATING ACCEPT	IE mobile identity = TMSI. If the location updating type in the LOCATION UPDATING REQUEST contains ‘FOR’, then IE Follow-on Proceed is included in the ACCEPT and steps 106 to 110 will be omitted.
105			TMSI REALLOCATION COMPLETE
106			RRC CONNECTION RELEASE
107			RRC CONNECTION RELEASE COMPLETE
108			RRC CONNECTION REQUEST
109			RRC CONNECTION SETUP
110			RRC CONNECTION SETUP COMPLETE
111			CM SERVICE REQUEST	CKSN = no key available, Mobile identity = TMSI
112			CM SERVICE REJECT	cause #17 (network failure).
113			RRC CONNECTION RELEASE
114			RRC CONNECTION RELEASE COMPLETE
115	UE			If possible (see ICS) USIM detachment is performed. Otherwise if possible (see ICS) switch off is performed. Otherwise the power is removed.
Steps 116 to 121 are optional.
116			RRC CONNECTION REQUEST	Establishment Cause: Detach
117			RRC CONNECTION SETUP
118			RRC CONNECTION SETUP COMPLETE
119			IMSI DETACH INDICATION
120			RRC CONNECTION RELEASE
121			RRC CONNECTION RELEASE COMPLETE
122	UE			Depending on what has been performed in step 115 the UE is brought back to operation.
123			RRC CONNECTION REQUEST	Establishment cause: Registration.
124			RRC CONNECTION SETUP
125			RRC CONNECTION SETUP COMPLETE
126			LOCATION UPDATING REQUEST	location updating type = IMSI attach, CKSN = no key available, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
127	SS			performs step 14 of 9.4.3.2.
128			(void)
128a			CELL UPDATE	CCCH.
128b			RRC CONNECTION RELEASE	CCCH.
128c	SS			The SS re-modifies the scrambling code of DL DPCH to the original one.
128d	UE			The UE shall not initiate an RRC connection establishment during T3211 at least after the RRC connection is released.
129			RRC CONNECTION REQUEST	Establishment cause: Registration.
130			RRC CONNECTION SETUP
131			RRC CONNECTION SETUP COMPLETE
132			LOCATION UPDATING REQUEST	location updating type = IMSI attach, CKSN = no key available, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
133			RRC CONNECTION RELEASE	After the sending of the message the SS waits for the disconnection of the main signalling link.
134			RRC CONNECTION RELEASE COMPLETE
135	UE			The UE shall not initiate an RRC connection establishment during T3211 at least after the RRC connection is released.
136			RRC CONNECTION REQUEST	Establishment cause: Registration.
137			RRC CONNECTION SETUP
138			RRC CONNECTION SETUP COMPLETE
139			LOCATION UPDATING REQUEST	location updating type = IMSI attach, CKSN = no key available, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
140			(void)
140a			LOCATION UPDATING REJECT	IE Reject cause is set to #X in table 10.5.95 of TS 24.008, causes #2, #3, #6, #11, #12, #13 and #15 being excluded.
140b			RRC CONNECTION RELEASE	After the sending of this message, the SS waits for the disconnection of the main signalling link.
141			RRC CONNECTION RELEASE COMPLETE
142	UE			The UE shall not initiate an RRC connection establishment during T3211 at least after the RRC connection is released.
143			RRC CONNECTION REQUEST	Establishment cause: Registration.
144			RRC CONNECTION SETUP
145			RRC CONNECTION SETUP COMPLETE
146			LOCATION UPDATING REQUEST	location updating type = IMSI attach, CKSN = no key available, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
147	SS			performs step 14 of 9.4.3.2.
147a			(void)
147b			CELL UPDATE	CCCH.
147c			RRC CONNECTION RELEASE	CCCH.
147d	SS			performs step 15c of 9.4.3.2.
148	UE			The UE shall not initiate an RRC connection establishment during T3212 seconds at least after the RRC connection is released.
149			RRC CONNECTION REQUEST	Establishment cause: Registration.
150			RRC CONNECTION SETUP
151			RRC CONNECTION SETUP COMPLETE
152			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE) mobile station classmark 1 as given by the ICS and mobile identity = IMSI.
153			AUTHENTICATION REQUEST	CKSN = initial CKSN.
154			AUTHENTICATION RESPONSE
154a			SECURITY MODE COMMAND
154b			SECURITY MODE COMPLETE
155			LOCATION UPDATING ACCEPT	IE mobile Identity = TMSI.
156			TMSI REALLOCATION COMPLETE
157			RRC CONNECTION RELEASE
158			RRC CONNECTION RELEASE COMPLETE
159	UE			If possible (see ICS) USIM detachment is performed. Otherwise if possible (see ICS) switch off is performed. Otherwise the power is removed.
Steps 160 to 165 are optional.
160			RRC CONNECTION REQUEST	Establishment Cause: Detach
161			RRC CONNECTION SETUP
162			RRC CONNECTION SETUP COMPLETE
163			IMSI DETACH INDICATION
164			RRC CONNECTION RELEASE
165			RRC CONNECTION RELEASE COMPLETE
166	UE			Depending on what has been performed in step 159 the UE is brought back to operation.
167			RRC CONNECTION REQUEST	Establishment cause: Registration.
168			RRC CONNECTION SETUP
169			RRC CONNECTION SETUP COMPLETE
170			LOCATION UPDATING REQUEST	location updating type = IMSI attach, CKSN = initial value, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
171	SS			performs step 14 of 9.4.3.2.
171a			(void)
171b			CELL UPDATE	CCCH.
171c			RRC CONNECTION RELEASE	CCCH.
171d	SS			performs step 15c of 9.4.3.2.
172	UE			The UE shall not initiate an RRC connection establishment during T3211 at least after the RRC connection is released.

173			RRC CONNECTION REQUEST	Establishment cause: Registration.
174			RRC CONNECTION SETUP
175			RRC CONNECTION SETUP COMPLETE
176			LOCATION UPDATING REQUEST	location updating type = IMSI attach, CKSN = initial value, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
177	SS			performs step 6 of 9.4.3.2 with cause #17 and step 7 of 9.4.3.2.
177a	UE			performs step 8 of 9.4.3.2.
178	UE			The UE shall not initiate an RRC connection establishment during T3211 at least after the RRC connection is released.
179			RRC CONNECTION REQUEST	Establishment cause: Registration.
180			RRC CONNECTION SETUP
181			RRC CONNECTION SETUP COMPLETE
182			LOCATION UPDATING REQUEST	location updating type = IMSI attach, CKSN = initial value, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
183	SS			performs step 14 of 9.4.3.2.
184			(void)
184a			CELL UPDATE	CCCH.
184b			RRC CONNECTION RELEASE	CCCH.
184c	SS			The SS re-modifies the scrambling code of DL DPCH to the original one.
184d	UE			The UE shall not initiate an RRC connection establishment during T3211 at least after the RRC connection is released.
185			RRC CONNECTION REQUEST	Establishment cause: Registration.
186			RRC CONNECTION SETUP
187			RRC CONNECTION SETUP COMPLETE
188			LOCATION UPDATING REQUEST	location updating type = IMSI attach, CKSN = initial value, LAI = b, mobile station classmark 1 as given by the ICS and mobile identity = TMSI.
189	SS			performs step 14 of 9.4.3.2.
189a			(void)
189b			CELL UPDATE	CCCH.
189c			RRC CONNECTION RELEASE	CCCH.
189d	SS			performs step 15c of 9.4.3.2.
190	UE			A MO CM connection id attempted before T3212 expiry
191			RRC CONNECTION REQUEST	Establishment cause: Registration.
192			RRC CONNECTION SETUP
193			RRC CONNECTION SETUP COMPLETE
194			LOCATION UPDATING REQUEST	location updating type = normal, CKSN = no key available, LAI = deleted LAI (the MCC and MNC hold the previous values, the LAC is coded FFFE) mobile station classmark 1 as given by the ICS and mobile identity = IMSI.
195			AUTHENTICATION REQUEST	CKSN = initial CKSN.
196			AUTHENTICATION RESPONSE
196a			SECURITY MODE COMMAND
196b			SECURITY MODE COMPLETE
197			LOCATION UPDATING ACCEPT	IE mobile Identity = TMSI. If the location updating type in the LOCATION UPDATING REQUEST contains ‘FOR’, then IE Follow-on Proceed is included in the ACCEPT and steps 199 to 204 will be omitted.
198			TMSI REALLOCATION COMPLETE
199			RRC CONNECTION RELEASE
200			RRC CONNECTION RELEASE COMPLETE
201			(void)
202			RRC CONNECTION REQUEST
203			RRC CONNECTION SETUP
204			RRC CONNECTION SETUP COMPLETE
205			CM SERVICE REQUEST	CKSN = initial value, Mobile identity = TMSI.
206			CM SERVICE REJECT	cause #17 (network failure).
207			RRC CONNECTION RELEASE
208			RRC CONNECTION RELEASE COMPLETE

Specific message contents

None.

9.4.3.4.5 Test requirement

1.1 At step 8 the UE shall send a RRC CONNECTION REQUEST message and at step 11 the UE shall send a CM SERVICE REQUEST message, CKSN and LAI set to those which have been allocated to the UE, Mobile Identity IE set to the TMSI which has been allocated to the UE;

1.2 At step 11 the UE shall not attempt a location updating procedure.

2.1 At step 31 the UE shall send a RRC CONNECTION REQUEST message and at step 34 the UE shall send a CM SERVICE REQUEST message, CKSN and LAI set to those which have been allocated to the UE, Mobile Identity IE set to the TMSI which has been allocated to the UE;

2.2 At step 39 the UE shall not attempt a location updating procedure.

3) At step 51 the UE shall send a LOCATION UPDATING REQUEST message with the Mobile Identity IE set to the TMSI which has been allocated to the UE, CKSN IE and LAI set to those which have been allocated to the UE and the Location Updating Type IE set to "periodic updating".

3.1 At step 69 the UE shall send a LOCATION UPDATING REQUEST message with the Mobile Identity IE set to its IMSI, CKSN IE set to "no key is available" and the Location Updating Type IE set to "normal".

4) At step 103 the UE shall send a LOCATION UPDATING REQUEST message.

5) At step 132 the UE shall send a LOCATION UPDATING REQUEST message with the Mobile Identity IE set to the TMSI which has been allocated to the UE, CKSN IE and LAI set to those which have been allocated to the UE and the Location Updating Type IE set to "IMSI attach".

5.1 At step 152 the UE shall send a LOCATION UPDATING REQUEST message with the Mobile Identity IE set to its IMSI, CKSN IE set to "no key is available" and the Location Updating Type IE set to "normal".

6) At step 194 the UE shall send a LOCATION UPDATING REQUEST message.

9.4.3.5 Location updating / abnormal cases / Failure due to non-integrity protection

9.4.3.5.1 Definition

9.4.3.5.2 Conformance requirement

Except the messages listed below, no layer 3 signalling messages shall be processed by the receiving MM and GMM entities or forwarded to the CM entities, unless the security mode control procedure is activated for that domain.

– MM messages:

– AUTHENTICATION REQUEST

– AUTHENTICATION REJECT

– IDENTITY REQUEST

– LOCATION UPDATING ACCEPT (at periodic location update with no change of location area or temporary identity)

– LOCATION UPDATING REJECT

– CM SERVICE ACCEPT, if the following two conditions apply:

– no other MM connection is established; and

– the CM SERVICE ACCEPT is the response to a CM SERVICE REQUEST with CM SERVICE TYPE IE set to ’emergency call establishment’

– CM SERVICE REJECT

– ABORT

References

TS 24.008 clauses 4.1.1.1.1

9.4.3.5.3 Test purpose

To verify that the UE ignores NAS signalling messages when the security mode procedure is not activated.

9.4.3.5.4 Method of test

Initial conditions

– System Simulator:

– two cells: A and B, belonging to different location areas a and b, both cells are on the same PLMN.

– User Equipment:

– the UE has a valid TMSI. It is "idle updated" on cell A.

Related ICS/IXIT statements

None.

Test Procedure

The location updating procedure is started. Upon reception of LOCATION UPDATING REQUEST message from the UE, the SS responds to LOCATION UPDATING ACCEPT message without the integrity protection. The UE shall ignore this message and restart the location updating procedure at expiry of timer T3211. This time the SS starts the authentication procedure and initiates the integrity protection. After receiving LOCATION UPDATING ACCEPT message, the UE shall respond to TMSI REALLOCATION COMPLETE message.

Expected sequence

Step	Direction		Message	Comments
Step	UE	SS	Message	Comments
1	SS			Set the cell type of cell B to the "Serving cell". Set the cell type of cell A to the "non-suitable cell". (see note)
2	SS			The SS verifies that the IE "Establishment cause" in the received RRC CONNECTION REQUEST message is set to "Registration". If PS mode: a routing area updating procedure should be rejected with cause “GPRS services not allowed”.
3			LOCATION UPDATING REQUEST
4			AUTHENTICATION REQUEST
5			AUTHENTICATION RESPONSE
6	SS			The SS does not initiate the security mode procedure.
7			LOCATION UPDATING ACCEPT
8	UE			The UE ignores LOCATION UPDATING ACCEPT message.
8a			SIGNALLING CONNECTION RELEASE INDICATION	UE may also release PS domain CN domain identity = PS domain
9	SS			The SS waits T3210 expiry.
10	UE			The UE aborts the RR connection.
11	SS			The SS releases the RRC connection.
12	SS			The SS waits T3211 expiry.
13	SS			The SS verifies that the IE "Establishment cause" in the received RRC CONNECTION REQUEST message is set to "Registration".
14			LOCATION UPDATING REQUEST
15			AUTHENTICATION REQUEST
16			AUTHENTICATION RESPONSE
17	SS			The SS starts the security mode procedure with the integrity protection.
18			LOCATION UPDATING ACCEPT
19			TMSI REALLOCATION COMPLETE
20	SS			The SS releases the RRC connection.
NOTE: The definitions for "Serving cell" and "non-suitable cell" are specified in TS 34.108 clause 6.1 "Reference Radio Conditions for signalling test cases only".

Specific message contents

None.

9.4.3.5.5 Test requirement

At step 8 the UE shall ignore the first LOCATION UPDATING ACCEPT message.

At step 14 the UE shall send LOCATION UPDATING REQUEST message after expiry of timer T3211.

At step 16 the UE shall respond to TMSI REALLOCATION COMPLITE message after the UE receives the second LOCATION UPDATING ACCEPT message.

9.4.3.6 Location updating /abnormal cases / CS domain is changed from barred to unbarred because of domain specific access control

9.4.3.6.1 Definition

This test is applicable for Rel-5 UEs supporting DSAC and Rel-6 or later UEs.

9.4.3.6.2 Conformance requirement

TS 24.008 clause 4.1.1.2.2

If the PS or CS domain is barred because of domain specific access control, a GPRS MS operating in mode A or B in a network that operates in mode II or III shall use the MM specific procedures or GMM specific procedures, respectively, in the domain which is unbarred. If the MS detects that a domain changes from barred to unbarred, it shall behave as specified in subclauses 4.4.4.9, 4.5.1.2, 4.7.3.1.5, 4.7.5.1.5, and 4.7.13.5.

TS 24.008 clause 4.4.4.9

a) Access barred because of common access class control or CS domain specific access control

The location updating procedure is not started. The mobile station stays in the current serving cell and applies normal cell reselection process. The procedure is started as soon as possible and if still necessary (when the barred state is ended or because of a cell change).

Reference

3GPP TS 24.008 clause 4.1.1.2.2; 4.4.4.9

9.4.3.6.3 Test purpose

To test the behaviour of the UE if the CS domain is barred and if it is then changed from barred to unbarred because of domain specific access control in a network that operates mode II.

9.4.3.6.4 Method of test

Initial condition

An access class x (0-15) is arbitrarily chosen. The USIM is programmed with this access class x. The UE is informed that the CS domain specific access class x is barred in cell B.

System Simulator:

– two cells, A and B, belonging to different location areas with location area identification a and b of the same PLMN and operating in network operation mode II;

– IMSI attach/detach is allowed in both cells;

– the T3212 time-out value is 1/10 hour in both cells.

User Equipment:

The UE has a valid TMSI (=TMSI1) and CKSN (=CKSN1). It is "idle updated" on cell A.

Related ICS/IXIT statements

Support of DSAC Yes/No.

Test procedure

1) The UE is made to select cell B. The CS domain specific access class x is barred: the UE shall not initiate a location updating procedure in the CS domain.

2) The SS informs the UE by paging that the CS domain specific access class x is not barred: The UE shall initiate a location updating procedure. The SS checks, by paging, that the UE has stored the newly allocated TMSI. The RRC CONNECTION is released.

Expected sequence

Step	Direction		Message	Comments
Step	UE	SS	Message	Comments
1	SS			Set the cell type of cell B to the "Serving cell". Set the cell type of cell A to the "non-suitable cell". (see note)
2	UE			The UE shall not initiate a location updating procedure as CS domain specific access class x is barred . If PS mode: a routing area updating procedure should be performed.
3	SS			The SS informs the UE by paging that the CS domain specific access class x is not barred anymore.
4	UE			The UE shall initiate a location updating procedure.
5	SS			The SS verifies that the IE "Establishment cause" in the received RRC CONNECTION REQUEST message is set to: Registration.
6			LOCATION UPDATING REQUEST	"location updating type" = normal, "CKSN" = CKSN1, "location area identification" = a, "mobile station classmark 1" as given by the ICS and "mobile identity" = TMSI1. The MM message is included in the RRC message INITIAL DIRECT TRANSFER with the CN domain identity set to CS domain.
7	SS			The SS starts integrity protection.
8			LOCATION UPDATING ACCEPT	"Mobile identity" = new TMSI (=TMSI2), LAI = b.
9			TMSI REALLOCATION COMPLETE
9a				The SS releases the RRC Connection.
10	SS			SS waits 5 seconds to guarantee that the UE is in service.
11			Mobile terminated establishment of RRC Connection	See TS 34.108 clause 7.1.2 "Initial UE identity" IE contains the new TMSI (= TMSI2) and the new LAI (=b). Establishment Cause: Terminating Conversational Call, or Supplementary Service Terminating High Priority Signalling, or SMS Terminating Low Priority Signalling.
12			PAGING RESPONSE	"Mobile identity" IE contains the new TMSI (= TMSI2).
13	SS			The SS releases the RRC Connection.
NOTE: The definitions for "Serving cell" and "non-suitable cell" are specified in TS 34.108 clause 6.1 "Reference Radio Conditions for signalling test cases only". Only one operation is applicable at step 11 based on the type of CS call that is being made.

Specific message contents

None.

9.4.3.6.5 Test requirements

At step 2, cell B is serving cell, the CS domain specific access class x is barred:

– the UE shall not use the specific MM location updating procedure.

At step 6, cell B is serving cell, the CS domain specific access class x is not barred anymore:

– the UE shall initiate a location updating procedure.

9.4.3.7 Location updating / abnormal cases / Network reject with Extended Wait Timer

9.4.3.7.1 Definition

9.4.3.7.2 Conformance requirement

The different abnormal cases that can be identified are the following:

a) Access barred because of access class control

b) The answer to random access is an IMMEDIATE ASSIGNMENT REJECT message (A/Gb mode only).

The location updating is not started. The mobile station stays in the chosen cell and applies normal cell selection process. The waiting timer T3122 is reset when a cell change occurs. The procedure is started as soon as possible after T3122 timeout if still necessary.

c) Random access failure (A/Gb mode only).

Timer T3213 is started. When it expires the procedure is attempted again if still necessary.

NOTE 1: As specified in 3GPP TS 45.008 [34], a cell reselection then takes place, with return to the cell inhibited for 5 seconds if there is at least one other suitable cell. Typically the selection process will take the mobile station back to the cell where the random access failed after 5 seconds.

If at the expiry of timer T3213 a new cell has not been selected due to the lack of valid information (see 3GPP TS 45.008 [34]), the mobile station may as an option delay the repeated attempt for up to 8 seconds to allow cell re-selection to take place. In this case the procedure is attempted as soon as a new cell has been selected or the mobile station has concluded that no other cell can be selected.

If random access failure occurs for two successive random access attempts for location updating the mobile station proceeds as specified below.

d) RR connection failure

The procedure is aborted and the mobile station proceeds as specified below.

e) T3210 timeout

The procedure is aborted, the RR connection is aborted and the MS proceeds as specified below.

f) RR release without "Extended wait time" received from lower layers before the normal end of procedure.

The procedure is aborted and the mobile station proceeds as specified below, except in the following implementation option case f.1.

f.1) RR release in Iu mode (i.e. RRC connection release) with, for example, cause "Normal", "User inactivity" or "Directed signalling connection re-establishment" (see 3GPP TS 25.331 [32c] and 3GPP TS 44.118 [111])

The location updating procedure shall be initiated again, if the following conditions apply:

i) The original location updating procedure was initiated over an existing RRC connection; and

ii) No SECURITY MODE COMMAND message and no Non-Access Stratum (NAS) messages relating to the CS signalling connection (e.g. CS authentication procedures, see subclause 4.3.2), were received after the LOCATION UPDATING REQUEST message was transmitted.

NOTE 2: The RRC connection release cause that triggers the re-initiation of the location updating procedure is implementation specific.

g) Location updating reject, other causes than those treated in subclause 4.4.4.7, and cases of MM cause #22, if considered as abnormal cases according to subclause 4.4.4.7

h) RR connection establishment failure without "Extended wait time" received from lower layers (Iu mode only).

The procedure is aborted and the mobile station proceeds as specified below.

NOTE 3: Case h) covers all cases when the signalling connection cannot be established, including random access failure and access reject. As the RRC protocol has error specific retransmission mechanisms (see 3GPP TS 25.331 [23c]), there is no need to distinguish between the different error cases within MM.

i) "Extended wait time" for CS domain from the lower layers.

The MS shall abort the MM connection establishment and stop timer T3230 if still running.

If the LOCATION UPDATING REQUEST message contained the NAS signalling low priority indication set to "MS is configured for NAS signalling low priority", the MS shall start timer T3246 with the "Extended wait time" value.

In other cases the MS shall ignore the "Extended wait time".

The MM connection establishment is started, if still necessary, when timer T3246 expires or is stopped.

References

TS 24.368

TS 24.008 clauses 1.8, 4.4.4.9, L.1

9.4.3.7.3 Test purpose

1) To verify that the LAP indicator can be set in the UE.

2) To verify that the Delay Tolerant indicator is sent by the UE.

3) To verify that the UE uses the back-off timer if the network reject a request with the Extended Wait timer.

9.4.3.7.4 Method of test

Initial conditions

– System Simulator:

– two cells: A and B, belonging to different location areas a and b.

– User Equipment:

– the UE has a valid TMSI. It is "idle updated" on cell A.

– The UE is equipped with a USIM containing default values except for those listed below.

USIM field	Value
EF_UST	Service 96 is supported.
EF_NASCONFIG	“NAS_SignallingPriority is set to “NAS signalling low priority” as defined in TS 24.368, clause 5.3.
EF_NASCONFIG	“ExtendedAccessBarring is set to extended access barring is applied for the UE” as defined in TS 24.368, clause 5.8

Related ICS/IXIT statements

None.

Test Procedure

The location updating procedure is started. Upon reception of LOCATION UPDATING REQUEST message from the UE, the SS verifies that the UE is configured for NAS signalling low priority. The SS responds by sending an RRC Disconnect including the “Extended Wait Time” IE, indicating that the UE shall use the extended back-off timer. The SS verifies that the UE does not initiate any signalling for the duration of timer T3246.

Expected sequence

Step	Direction		Message	Comments
	UE	SS
1	SS			Set the cell type of cell B to the "Serving cell". Set the cell type of cell A to the "non-suitable cell". (see note)
2			RRC CONNECTION REQUEST	The SS verifies that the IE "Establishment cause" is set to "Delay Tolerant Access". If PS mode: a routing area updating procedure should be performed.
3			RRC CONNECTION SETUP
4			RRC CONNECTION SETUP COMPLETE
5			LOCATION UPDATING REQUEST	The SS verifies that the IE “Device properties” is set to “MS is configured for NAS signalling low priority”
6			RRC CONNECTION RELEASE	The SS includes the IE “Extended Wait Time” in the RRC CONNECTION RELEASE message. MS starts timer T3246 with the value of 5 seconds.
7			RRC CONNECTION RELEASE COMPLETE
8	SS			The SS verifies that the UE does not initiate any communication before the T3246 timer has expired
9			RRC CONNECTION REQUEST	The SS verifies that the IE "Establishment cause" is set to "Delay Tolerant Access".
10			RRC CONNECTION SETUP
11			RRC CONNECTION SETUP COMPLETE
12			LOCATION UPDATING REQUEST
13			LOCATION UPDATING ACCEPT
14			TMSI REALLOCATION COMPLETE
NOTE: The definitions for "Serving cell" and "non-suitable cell" are specified in TS 34.108 clause 6.1 "Reference Radio Conditions for signalling test cases only".

Specific message contents

None.

9.4.3.7.5 Test requirement

1) At step 5 the UE shall include the IE “Device properties", set to “MS is configured for NAS signalling low priority”, in the LOCATION UPDATING REQUEST.

2) At step 8 the UE shall not initiate any communication attempts.

3) At step 2 and 9 the UE shall send RRC CONNECTION REQUEST message with "Establishment cause": delayTolerantAccess.