22.1 General

36.523-13GPPEvolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Packet Core (EPC)Part 1: Protocol conformance specificationRelease 17TSUser Equipment (UE) conformance specification

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

22.1.1 NB-IoT / Control Plane CIoT EPS optimisation for EPS services

22.1.1.0 Test Scope

The following features relevant to Control Plane CIoT EPS optimisation for EPS are verified in the present TC:

Module 1 (M1): Attach for Control Plane CIoT EPS optimisation for EPS services with/without SMS-only

sT01 Attach for Control Plane CIoT EPS optimisation for EPS services with/without SMS-only

sT02 UE identification (IMSI)

sT03 UE authentication

sT04 Security mode control procedure

– PDN handling during attach

sT05 EMM-REGISTERED without PDN connection

sT06 EMM-REGISTERED with PDN connection

– IP and none-IP PDN

– Header compression configuration negotiation (if requested by the UE for IP data)

– RB establishment (SRB only)

– RRC

sT07 RRC Connection establishment

sT08 Void

sT09 UE Connection release

Module 2 (M2): UE and Network transmission of user data via the control plane (non-SMS service)

sT10 UE transmission of user data via the control plane in EMM-IDLE and EMM-CONNECTED

sT11 UE reception of Network transmission of user data via the control plane in EMM-IDLE and EMM-CONNECTED

sT12 PDN handling in the case of EMM-REGISTERED without PDN connection

– IP and none-IP PDN

– Header compression configuration negotiation (if requested by the UE for IP data)

– RB establishment (SRB only)

– PDN release

sT13- Serving PLMN rate control

sT14 APN rate control

sT22 EPS bearer context modification

– RRC

sT16 Paging

sT17 RRC Connection establishment

Module 3 (M3): UE and Network transmission of SMS via the control plane

sT18 UE transmission of SMS via the control plane in EMM-IDLE and EMM-CONNECTED

sT19 UE reception of Network transmission of SMS via the control plane in EMM-IDLE and EMM-CONNECTED

– RRC

sT20 Paging

sT17 RRC Connection establishment

sT21, sT23, sT24 Void

Figure 22.1.1.0-1: TC structure

22.1.1.1 Test Purpose (TP)

(1) sT01, sT05, sT06, sT07, sT09

with { the UE in EMM-DEREGISTERED/RRC-IDLE }

ensure that {

when { UE finds a cell which provides access by NB-IoT RAT and supports attach without PDN }

then { the UE establishes RRC connection, and, successfully performs an attach procedure for Control Plane CIoT EPS optimisation (with or without PDN establishment depending on the UE support of Attach without PDN), and, releases the RRC connection when requested by the Network }

}

(2) sT02, sT03, sT04

with { the UE in EMM-DEREGISTERED/RRC-CONNECTED }

ensure that {

when { the UE is performing an attach procedure (Control Plane CIoT EPS optimisation only) }

then { the UE performs successfully an Identity request procedure initiated by the network requesting the UE’s IMSI and provides the requested identity }

then { the UE performs successfully an Authentication procedure initiated by the network and establishes correct EPS security context }

then { the UE performs successfully a Security mode control procedure }

}

(3) sT12

with { the UE in RRC-CONNECTED, and, the UE needs to establish one or more PDNs (Control Plane CIoT EPS optimisation) }

ensure that {

when { the UE supports PDN type non-IP }

then { the UE performs successfully an UE requested PDN connectivity procedure with PDN type non-IP }

when { the UE supports PDN type IP }

then { the UE performs successfully an UE requested PDN connectivity procedure with PDN type IP, including Header compression configuration negotiation (if supported) }

}

(4) sT12

with { the UE supporting attach without PDN, and, in EMM-REGISTERED/RRC-CONNECTED, and, the UE having established one or more PDNs for the purposes of user data transmission as part of Control Plane CIoT EPS optimisation }

ensure that {

when { there is no need for transmission of user data }

then { the UE successfully performs a UE requested PDN disconnect procedure, or, accepts a Network requested PDN disconnect procedure otherwise, and, releases all EPS bearer contexts established towards all active PDNs }

}

(5) sT11, sT12, sT17, sT22

with { the UE in RRC-IDLE after attaching with Control Plane CIoT EPS optimisation for EPS services }

ensure that {

when { UE has user data to send via the control plane }

then { the UE initiates a Service request procedure for EPS services with Control Plane CIoT EPS optimization by sending a CONTROL PLANE SERVICE REQUEST message (rules for ciphering of the initial NAS message apply )

when { UE has already a PDN established }

then { the UE incorporates ESM DATA TRANSPORT message carrying the user data in the CONTROL PLANE SERVICE REQUEST message (rules for ciphering of the initial NAS message apply) }

when { UE does not have a PDN established }

then { the UE performs successfully one or more (if supported) UE requested PDN connectivity procedure(s) with PDN type non-IP/IP before submitting ESM DATA TRANSPORT message }

when { UE, while in RRC-CONNECTED, has user data to send via the control plane }

then { the UE sends one or more ESM DATA TRANSPORT message(s) including the user data to be sent in the User data container IE }

when { UE performs Control Plane data transfer whenever this is needed }

then { the UE obeys the local serving PLMN rate control }

}

(6) sT13, sT14, sT22

with { the UE in RRC-IDLE after attaching with Control Plane CIoT EPS optimisation for EPS services }

ensure that {

when { UE performs Control Plane data transfer whenever this is needed }

then { the UE obeys the local serving PLMN rate control, and, when supported the APN rate control provided through EPS bearer context modification }

}

(7) sT10, sT12, sT16, sT17

with { the UE in RRC-IDLE after attaching with Control Plane CIoT EPS optimisation for EPS services }

ensure that {

when { the Network has user data to send via the control plane, and, has executed a Paging for EPS services procedure }

then { the UE successfully completes RRC connection establishment together with Service request procedure for EPS services with Control Plane CIoT EPS optimization }

when { UE does not have a PDN established }

then { the UE performs successfully one or more (if supported) UE requested PDN connectivity procedure(s) with PDN type non-IP/IP }

when { UE has a PDN established }

then { is able to receive user data sent via ESM DATA TRANSPORT message }

}

(8) sT18, sT17

with { the UE RRC-IDLE after attaching with Control Plane CIoT EPS optimisation for EPS services, "SMS-only" included }

ensure that {

when { UE has SMS messages to send }

then { the UE initiates a Service request procedure for EPS services with Control Plane CIoT EPS optimization by sending a CONTROL PLANE SERVICE REQUEST message and including the first SMS message encapsulated it the NAS message container IE, and, every subsequent SMS message included in a UPLINK NAS TRANSPORT message sent as part of a UE initiated transport of NAS messages procedure }

when { UE, while in RRC-CONNECTED, has SMS messages to send }

then { the UE sends one or more UPLINK NAS TRANSPORT message(s) including the SMS }

}

(9) sT19, sT20, sT17

with { the UE in RRC-IDLE after attaching with Control Plane CIoT EPS optimisation for EPS services, "SMS-only" included }

ensure that {

when { the Network has SMS messages to send, and, has executed a Paging for SMS procedure }

then { the UE successfully completes RRC connection establishment together with Service request procedure for EPS services with Control Plane CIoT EPS optimization, and, is able to receive the SMSs sent via a number of DOWNLINK NAS TRANSPORT messages }

}

(10) Void

22.1.1.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 36.331, clauses 5.3.1.4, 5.3.3.3, 5.3.3.4, 5.6.3.3; TS 24.301, clauses 5.3.15, 5.5.1.1, 5.5.1.2.2, 5.6.1.1, 5.6.1.2.2, 5.6.2.2.1.1, 5.6.3.1, 5.6.3.2, 5.6.3.3, 6.2A, 6.3.8, 6.3.9, 6.4.1.3, 6.4.3.3, 6.5.1.2, 6.5.2.1, 6.6.4.2. Unless otherwise stated these are Rel-13 requirements.

[TS 36.331, clause 5.3.1.4]

In NB-IoT, during the RRC connection establishment procedure, SRB1bis is established implicitly with SRB1. SRB1bis uses the logical channel identity defined in 9.1.2a, with the same configuration as SRB1 but no PDCP entity. SRB1bis is used until security is activated. The RRC messages to activate security (command and successful response) are sent over SRB1 being integrity protected and ciphering is started after completion of the procedure. Once security is activated, new RRC messages shall be transmitted using SRB1. A NB-IoT UE that only supports the Control Plane CIoT EPS optimisation (see TS 24.301 [35]) only establishes SRB1bis.

A NB-IoT UE only supports 0, 1 or 2 DRBs, depending on its capability. A NB-IoT UE that only supports the Control Plane CIoT EPS optimisation ([24.301]) does not need to support any DRBs and associated procedures.

[TS 36.331, clause 5.3.3.3]

The UE shall set the contents of RRCConnectionRequest message as follows:

1> set the ue-Identity as follows:

2> if upper layers provide an S-TMSI:

3> set the ue-Identity to the value received from upper layers;

2> else:

3> draw a random value in the range 0 .. 2⁴⁰-1 and set the ue-Identity to this value;

NOTE 1: Upper layers provide the S-TMSI if the UE is registered in the TA of the current cell.

1> if the UE supports mo-VoiceCall establishment cause and UE is establishing the RRC connection for mobile originating MMTEL voice and SystemInformationBlockType2 includes voiceServiceCauseIndication:

2> set the establishmentCause to mo-VoiceCall;

1> else:

2> set the establishmentCause in accordance with the information received from upper layers;

1> if the UE is a NB-IoT UE:

2> if the UE supports multi-tone transmission, include multiToneSupport;

2> if the UE supports multi-carrier operation, include multiCarrierSupport;

The UE shall submit the RRCConnectionRequest message to lower layers for transmission.

[TS 36.331, clause 5.3.3.4]

1> set the content of RRCConnectionSetupComplete message as follows:

…

2> set the selectedPLMN-Identity to the PLMN selected by upper layers (see TS 23.122 [11], TS 24.301 [35]) from the PLMN(s) included in the plmn-IdentityList in SystemInformationBlockType1 (or SystemInformationBlockType1-NB in NB-IoT);

…

2> if the UE supports CIoT EPS optimisation(s):

3> if the UE is establishing the RRC connection for mobile originating signalling:

4> include pc_AttachWithoutPDN-Connectivity if received from upper layers;

4> for NB-IoT, include up-CIoT-EPS-Optimisation if received from upper layers;

…

2> set the dedicatedInfoNAS to include the information received from upper layers;

…

2> submit the RRCConnectionSetupComplete message to lower layers for transmission, upon which the procedure ends;

[TS 36.331, clause 5.6.3.3]

The UE shall:

1> for NB-IoT, set the contents of UECapabilityInformation message as follows:

2> include the UE Radio Access Capability Parameters within the ue-Capability-Container;

2> include ue-RadioPagingInfo;

2> submit the UECapabilityInformation message to lower layers for transmission, upon which the procedure ends;

[TS 24.301, clause 5.3.15]

CIoT EPS optimizations provide improved support of small data and SMS transfer. A UE supporting CIoT EPS optimizations can request the use of CIoT EPS optimizations during an attach or tracking area updating procedure to indicate the CIoT network behaviour the UE can support and prefer to use (see 3GPP TS 23.401 [10]). The UE may indicate the support for control plane CIoT EPS optimization, user plane CIoT EPS optimization, EMM-REGISTERED without PDN connection, S1-U data transfer and header compression (see subclause 9.9.3.34). The UE may also request to use SMS transfer without combined attach procedure during the attach procedure. Furthermore, the UE may, separately from the indication of support, indicate preference for control plane CIoT EPS optimization or user plane CIoT EPS optimization (see subclause 9.9.3.0B). The indication of preference is also considered as the request to use.

The UE can be in NB-S1 mode or WB-S1 mode when requesting the use of CIoT EPS optimizations during an attach or tracking area updating procedure. A UE in NB-S1 mode always indicates support for control plane CIoT EPS optimization. A UE in NB-S1 mode can also request SMS transfer without combined procedure by using the normal attach or tracking area updating procedure (see subclause 5.5.1 and 5.5.3).

In NB-S1 mode, the UE, when requesting the use of CIoT EPS optimization, does not:

– request an attach for emergency bearer services procedure;

– request an attach procedure for initiating a PDN connection for emergency bearer services with attach type not set to "EPS emergency attach"; or

– indicate voice domain preference and UE’s usage setting.

The network does not indicate to the UE support of emergency bearer services when the UE is in NB-S1 mode (see subclause 5.5.1.2.4 and 5.5.3.2.4).

The control plane CIoT EPS optimization enables support of efficient transport of user data (IP, non-IP) or SMS messages over control plane via the MME without triggering data radio bearer establishment. The support of control plane CIoT EPS optimization is mandatory for the network in NB-S1 mode and optional in WB-S1 mode. Optional header compression of IP data can be applied to IP PDN type PDN connections that are configured to support header compression.

The user plane CIoT EPS optimization enables support for change from EMM-IDLE mode to EMM-CONNECTED mode without the need for using the service request procedure (see subclause 5.3.1.3).

If the UE indicates support of EMM-REGISTERED without PDN connection in the attach request, the UE may include an ESM DUMMY MESSAGE instead of a PDN CONNECTIVITY REQUEST message as part of the attach procedure. If the EMM-REGISTERED without PDN connection is supported by the network, the UE and the network can at any time release all the PDN connections and the UE still remains EPS attached.

NOTE: For both the UE and the network, the term "EMM-REGISTERED without PDN connection" is equivalent to the term "EPS attach without PDN connectivity" as specified in 3GPP TS 23.401 [10].

In NB-S1 mode, if the UE indicates "SMS only" during a normal attach or tracking area updating procedure, the MME supporting CIoT EPS optimisations provides SMS so that the UE is not required to perform a combined attach or tracking area updating procedure.

If the UE supports user plane CIoT EPS optimization, it shall also support S1-U data transfer.

If the UE indicates support for one or more CIoT EPS optimizations and the network supports one or more CIoT EPS optimizations and decides to accept the attach or tracking area update request, the network indicates the supported CIoT EPS optimizations to the UE per TAI list when accepting the UE request. Network indication of support is interpreted by the UE as the acceptance to use the respective feature. After completion of the attach or tracking area updating procedure, the UE and the network can then use the accepted CIoT EPS optimizations for the transfer of user data (IP, non-IP and SMS).

…

Broadcast system information may provide information about support of CIoT EPS optimizations (see 3GPP TS 36.331 [22]). At reception of new broadcast system information, the lower layers deliver it to the EMM layer in the UE. The information provided by lower layers is per PLMN and used by the UE to determine whether certain CIoT EPS optimizations are supported in the cell.

The UE shall not request CIoT EPS optimizations which are indicated as not supported.

If the UE only supports EMM-REGISTERED without PDN connection, i.e. the UE cannot request PDN connectivity during the attach procedure, this CIoT EPS optimization is not indicated as supported for the PLMN in the broadcast system information, and the UE has to perform an attach or tracking area updating procedure, the UE shall perform a PLMN selection procedure according to 3GPP TS 23.122 [6].

In NB-S1 mode, when the UE requests the lower layer to establish a RRC connection and the UE requests the use of EMM-REGISTERED without PDN connection or user plane CIoT EPS optimization, the UE shall pass an indication of the requested CIoT EPS optimizations to the lower layers.

In WB-S1 mode, when the UE requests the lower layer to establish a RRC connection and the UE requests the use of EMM-REGISTERED without PDN connection, control plane CIoT EPS optimization or user plane CIoT EPS optimization, the UE shall pass an indication of the requested CIoT EPS optimizations to the lower layers.

[TS 24.301, clause 5.5.1.1]

The attach procedure is used for three purposes:

– by a UE in PS mode of operation to attach for EPS services only;

…

– by a UE supporting NB-S1 mode only in PS mode of operation to attach for EPS services and "SMS only"; or

…

With a successful attach procedure in NB-S1 mode, a context is established for the UE in the MME. If the attach request included information to request PDN connectivity, a default bearer is also established between the UE and the PDN.

If EMM-REGISTERED without PDN connection is supported by the UE and the MME, a default bearer need not be requested by the UE during the attach procedure. If EMM-REGISTERED without PDN connection is not supported by the UE or the MME, then the UE shall request establishment of a default bearer.

During the attach procedure with default bearer establishment, the UE may also obtain the home agent IPv4 or IPv6 address or both.

[TS 24.301, clause 5.5.1.2.2]

In state EMM-DEREGISTERED, the UE initiates the attach procedure by sending an ATTACH REQUEST message to the MME, starting timer T3410 and entering state EMM-REGISTERED-INITIATED (see example in figure 5.5.1.2.2.1). If timer T3402 is currently running, the UE shall stop timer T3402. If timer T3411 is currently running, the UE shall stop timer T3411.

…

If the UE supports NB-S1 mode or Non-IP PDN type, then the UE shall support the extended protocol configuration options IE.

If the UE supports the extended protocol configuration options IE, then the UE shall set the ePCO bit to "extended protocol configuration options supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE is in NB-S1 mode, then the UE shall set the control plane CIoT EPS optimization bit to "control plane CIoT EPS optimization supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE is in NB-S1 mode, supports NB-S1 mode only, and requests to attach for EPS services and "SMS only", the UE shall indicate the SMS only requested bit to "SMS only" in the additional update type IE and shall set the EPS attach type IE to "EPS attach" in the ATTACH REQUEST message.

If the UE supports CIoT EPS optimizations, it shall indicate in the UE network capability IE of the ATTACH REQUEST message whether it supports EMM-REGISTERED without PDN connection.

…

If EMM-REGISTERED without PDN connection is not supported by the UE or the MME, or if the UE wants to request PDN connection with the attach procedure, the UE shall send the ATTACH REQUEST message together with a PDN CONNECTIVITY REQUEST message contained in the ESM message container IE.

If EMM-REGISTERED without PDN connection is supported by the UE and the MME, and the UE does not want to request PDN connection with the attach procedure, the UE shall send the ATTACH REQUEST message together with an ESM DUMMY MESSAGE contained in the ESM message container information element.

[TS 24.301, clause 5.6.1.1]

The purpose of the service request procedure is to transfer the EMM mode from EMM-IDLE to EMM-CONNECTED mode. If the UE is not using EPS services with control plane CIoT EPS optimization, this procedure is used to establish the radio and S1 bearers when user data or signalling is to be sent. If the UE is using EPS services with control plane CIoT EPS optimization, this procedure can be used for UE initiated transfer of user data via the control plane. Another purpose of this procedure is to invoke MO/MT CS fallback or 1xCS fallback procedures.

This procedure is used when:

– the network has downlink signalling pending;

– the UE has uplink signalling pending;

– the UE or the network has user data pending and the UE is in EMM-IDLE mode;

…

The UE shall invoke the service request procedure when:

a) the UE in EMM-IDLE mode receives a paging request with CN domain indicator set to "PS" from the network;

b) the UE, in EMM-IDLE mode, has pending user data to be sent;

c) the UE, in EMM-IDLE mode, has uplink signalling pending;

…

Figure 5.6.1.1.2: Service request procedure (part 2)

NOTE 1: Security protected NAS message: this could be e.g. a SECURITY MODE COMMAND, SERVICE ACCEPT, or ESM DATA TRANSPORT message.

NOTE 2: AS indications (indications from lower layers) are results of procedures triggered by MME in service request procedure. Triggered procedures could be e.g. an RRC connection release procedure or RRC connection reconfiguration procedure (see 3GPP TS 36.331 [22]).

[TS 24.301, clause 5.6.1.2.2]

The UE shall send a CONTROL PLANE SERVICE REQUEST message, start T3417 and enter the state EMM-SERVICE-REQUEST-INITIATED.

For case a in subclause 5.6.1.1, the Control plane service type of the CONTROL PLANE SERVICE REQUEST message shall indicate "mobile terminating request". The UE may include the ESM DATA TRANSPORT message. The UE shall not include any ESM message other than ESM DATA TRANSPORT message.

For case b in subclause 5.6.1.1,

– if the UE has pending IP or non-IP user data that is to be sent via the control plane radio bearers, the Control plane service type of the CONTROL PLANE SERVICE REQUEST message shall indicate "mobile originating request". The UE shall include an ESM DATA TRANSPORT message in the ESM message container IE.

For cases b and m in subclause 5.6.1.1,

– if the UE has pending IP or non-IP user data that is to be sent via the user plane radio bearers, the UE shall set the "active" flag in the Control plane service type IE to 1. The UE may include the ESM DATA TRANSPORT message for PDN connection established with Control plane only indication. The UE shall not include any ESM message other than ESM DATA TRANSPORT message.

For case c in subclause 5.6.1.1, the UE shall set the Control plane service type of the CONTROL PLANE SERVICE REQUEST message to "mobile originating request". If the CONTROL PLANE SERVICE REQUEST message is:

– for sending SMS, the UE shall include the SMS message in the NAS message container IE and shall not include any ESM message container IE in the CONTROL PLANE SERVICE REQUEST message; and

– for sending signalling different from SMS, the UE shall not include any ESM message container or NAS message container IE in the CONTROL PLANE SERVICE REQUEST message.

[TS 24.301, clause 5.6.2.2.1.1]

Upon reception of a paging indication, if control plane CIoT EPS optimization is used by the UE, the UE shall stop the timer T3346, if running, and shall additionally:

– initiate a service request procedure as specified in subclause 5.6.1.2.2 if the UE is in the EMM-IDLE mode without suspend indication; or

– proceed the behaviour as specified in subclause 5.3.1.3 if the UE is in the EMM-IDLE mode with suspend indication.

NOTE 2: If the UE is in the EMM-IDLE mode without suspend indication and has an uplink user data to be sent to the network using control plane CIoT EPS optimization when receiving the paging indication, the UE can piggyback the uplink user data during the service request procedure initiated to respond to the paging, as specified in subclause 5.6.1.2.2.

[TS 24.301, clause 5.6.3.1]

The purpose of the transport of NAS messages procedure is to carry SMS messages in an encapsulated form between the MME and the UE. The procedure may be initiated by the UE or the network and can only be used when the UE is attached for EPS services and non-EPS services or for EPS services and "SMS only", and the UE is in EMM-CONNECTED mode.

NOTE 1: If the UE is in EMM-IDLE mode and is using EPS services with control plane CIoT EPS optimization, the UE transports the first SMS message by encapsulating it in the NAS message container IE in the Control Plane Service Request message.

NOTE 2: When the UE is using EPS services with control plane CIoT EPS optimization, the network can initiate downlink transport of NAS messages procedure even if the UE does not have any PDN connections established.

[TS 24.301, clause 5.6.3.2]

Upon request from the SMS entity to send an SMS message, the EMM entity in the UE initiates the procedure by sending an UPLINK NAS TRANSPORT message including the SMS message in the NAS message container IE.

NOTE: When the UE is using for EPS services with control plane CIoT EPS optimization, the UE can initiate uplink transport of NAS messages procedure even if the UE does not any PDN connections established.

[TS 24.301, clause 5.6.3.3]

The network initiates the procedure by sending a DOWNLINK NAS TRANSPORT message. When receiving the DOWNLINK NAS TRANSPORT message, the EMM entity in the UE shall forward the contents of the NAS message container IE to the SMS entity.

NOTE: When the UE is using for EPS services with control plane CIoT EPS optimization, the network can initiate downlink transport of NAS messages procedure even if the UE does not any PDN connections established.

[TS 24.301, clause 6.2A]

The UE and the MME may support robust header compression (ROHC) framework (see IETF RFC 4495 [37]) for IP header compression if control plane CIoT EPS optimization is supported for PDN connections of IP PDN type. If IP header compression for control plane CIoT EPS optimization is supported, the ROHC profiles defined in 3GPP TS 36.323 [38] shall then be supported. The ROHC configuration is negotiated and established during the UE requested PDN connectivity procedure as specified in subclause 6.5.1. Both the UE and the MME indicate whether IP header compression for control plane CIoT EPS optimization is supported during attach and tracking area updating procedures (see subclauses 5.5.1 and 5.5.3). The ROHC configuration can be re-negotiated by using the UE requested bearer resource modification procedure or the EPS bearer context modification procedure as specified in subclauses 6.4.3 and 6.5.4.

[TS 24.301, clause 6.3.8]

Serving PLMN rate control enables the serving PLMN to protect its MME and the signalling radio bearers in the E-UTRAN from load generated by NAS messages with user data over control plane. The MME can inform the UE of any local serving PLMN rate control during the default EPS bearer context activation procedure (see subclause 6.4.1). The UE shall limit the rate at which it generates uplink NAS messages with user data over control plane to comply with the serving PLMN policy provided by the network. The indicated rate in a NAS procedure applies to the PDN connection the NAS procedure corresponds to, and the indicated rate is valid until a new value is indicated or the PDN connection is released.

Serving PLMN rate control is applicable for PDN connections established for control plane CIoT EPS optimization only.

[TS 24.301, clause 6.3.9]

APN rate control controls the maximum number of uplink user data messages sent by the UE in a time interval for the APN in accordance with 3GPP TS 23.401 [10]. The UE shall limit the rate at which it generates uplink user data messages to comply with the APN rate control policy. The NAS shall provide the indicated rates to upper layers for enforcement. The indicated rate in a NAS procedure applies to the APN the NAS procedure corresponds to, and the indicated rate is valid until a new value is indicated or the last PDN connection using this APN is released.

[TS 24.301, clause 6.4.1.3]

Upon receipt of the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message, if the UE provided an APN for the establishment of the PDN connection, the UE shall stop timer T3396 if it is running for the APN provided by the UE. If the UE did not provide an APN for the establishment of the PDN connection and the request type was different from "emergency", the UE shall stop the timer T3396 associated with no APN if it is running. If the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message was received in response to a request for an emergency PDN connection, the UE shall not stop the timer T3396 associated with no APN if it is running. For any case, the UE shall then send an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message and enter the state BEARER CONTEXT ACTIVE. When the default bearer is activated as part of the attach procedure, the UE shall send the ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message together with ATTACH COMPLETE message. When the default bearer is activated as the response to the stand-alone PDN CONNECTIVITY REQUEST message, the UE shall send the ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message alone.

…

If the UE receives a serving PLMN rate control IE in the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message, the UE shall store the serving PLMN rate control IE value and use the stored serving PLMN rate control value as the maximum allowed limit of uplink User data container IEs included in ESM DATA TRANSPORT messages for the corresponding PDN connection in accordance with 3GPP TS 23.401 [10]. If the UE has a previously stored serving PLMN rate control value, the UE shall replace the stored serving PLMN rate control value with the received serving PLMN rate control IE value.

If the UE receives an APN rate control parameters container in the protocol configuration options IE in the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message, the UE shall store the APN rate control parameters value and use the stored APN rate control parameters value as the maximum allowed limit of uplink user data related to the APN indicated in the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message in accordance with 3GPP TS 23.401 [10]. If the UE has a previously stored APN rate control parameters value for this APN, the UE shall replace the stored APN rate control parameters value for this APN with the received APN rate control parameters value.

If the UE receives non-IP Link MTU parameter or IPv4 Link MTU parameter of the protocol configuration options IE in the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message, the UE shall pass the received Non-IP Link MTU or IPv4 Link MTU to the upper layer.

NOTE: The Non-IP Link MTU and IPv4 Link MTU size correspond to the maximum length of user data container that can be sent in the ESM DATA TRANSPORT message and to the maximum length of user data that can be sent via S1-U interface.

[TS 24.301, clause 6.4.3.3]

Upon receipt of the MODIFY EPS BEARER CONTEXT REQUEST message, if the UE provided an APN for the establishment of the PDN connection, the UE shall stop timer T3396, if it is running for the APN provided by the UE. If the UE did not provide an APN for the establishment of the PDN connection and the request type was different from "emergency", the UE shall stop the timer T3396 associated with no APN if it is running. If the MODIFY EPS BEARER CONTEXT REQUEST message was received for an emergency PDN connection, the UE shall not stop the timer T3396 associated with no APN if it is running. For any case, the UE shall then check the received TFT before taking it into use and send a MODIFY EPS BEARER CONTEXT ACCEPT message to the MME.

…

If the UE receives an APN rate control parameters container in the protocol configuration options IE in the MODIFY EPS BEARER CONTEXT REQUEST message, the UE shall store the APN rate control parameters value and use the stored APN rate control parameters value as the maximum allowed limit of uplink user data related to the corresponding APN in accordance with 3GPP TS 23.401 [10]. If the UE has a previously stored APN rate control parameters value for this APN, the UE shall replace the stored APN rate control parameters value for this APN with the received APN rate control parameters value.

Upon receipt of the MODIFY EPS BEARER CONTEXT ACCEPT message, the MME shall stop the timer T3486 and enter the state BEARER CONTEXT ACTIVE.

[TS 24.301, clause 6.5.1.2]

In order to request connectivity to a PDN, the UE shall send a PDN CONNECTIVITY REQUEST message to the MME, start timer T3482 and enter the state PROCEDURE TRANSACTION PENDING (see example in figure 6.5.1.2.1).

When the PDN CONNECTIVITY REQUEST message is sent together with an ATTACH REQUEST message, the UE shall not start timer T3482 and shall not include the APN.

NOTE 1: If the UE needs to provide protocol configuration options which require ciphering or provide an APN, or both, during the attach procedure, the ESM information transfer flag is included in the PDN CONNECTIVITY REQUEST. The MME then at a later stage in the PDN connectivity procedure initiates the ESM information request procedure in which the UE can provide the MME with protocol configuration options or APN or both.

…

In order to request connectivity to a PDN using the default APN, the UE includes the access point name IE in the PDN CONNECTIVITY REQUEST message or, when applicable, in the ESM INFORMATION RESPONSE message, according to the following conditions:

– if use of a PDN using the default APN requires PAP/CHAP, then the UE should include the Access point name IE; and

– in all other conditions, the UE need not include the Access point name IE.

In order to request connectivity to an additional PDN using a specific APN, the UE shall include the requested APN in the PDN CONNECTIVITY REQUEST message.

In the PDN type IE the UE shall either indicate the IP version capability of the IP stack associated with the UE or non IP as specified in subclause 6.2.2.

If the PDN type value of the PDN type IE is set to IPv4 or IPv6 or IPv4v6 and the UE indicates "Control plane CIoT EPS optimization supported" in the UE network capability IE of the ATTACH REQUEST message, the UE may include the Header compression configuration IE in the PDN CONNECTIVITY REQUEST message.

The UE shall set the request type to "initial request" when the UE is establishing a new PDN connectivity to a PDN in an attach procedure or in a stand-alone PDN connectivity procedure. The UE shall set the request type to "emergency" when the UE is requesting a new PDN connectivity for emergency bearer services. The UE shall set the request type to "handover" when the connectivity to a PDN is established upon handover from a non-3GPP access network and the UE was connected to that PDN before the handover to the 3GPP access network, or when the UE initiates the procedure to add 3GPP access to the PDN connection which is already established over WLAN.

NOTE 2: For emergency bearer services, the handover from non-3GPP access to E-UTRA is not supported.

If the UE supports DSMIPv6, the UE may include a request for obtaining the IPv6 address and optionally the IPv4 address of the home agent in the Protocol configuration options IE in the PDN CONNECTIVITY REQUEST message. The UE may also include a request for obtaining the IPv6 Home Network Prefix. The UE shall request the IPv6 Home Network Prefix only if the UE has requested the home agent IPv6 address. The requested home agent address(es) and the Home Network Prefix are related to the APN the UE requested connectivity for.

The UE may set the ESM information transfer flag in the PDN CONNECTIVITY REQUEST message to indicate that it has ESM information, i.e. protocol configuration options, APN, or both, that needs to be sent after the NAS signalling security has been activated between the UE and the MME.

…

If the UE supports APN rate control, the UE shall include an APN rate control support indicator in the protocol configuration options IE.

[TS 24.301, clause 6.5.2.1]

The purpose of the UE requested PDN disconnection procedure is for a UE to request disconnection from one PDN. If EMM-REGISTERED without PDN connection is not supported by the UE or the MME, the UE can initiate this procedure to disconnect from any PDN as long as it is connected to at least one other PDN. If EMM-REGISTERED without PDN connection is supported by the UE and the MME, the UE can initiate this procedure to disconnect from any PDN. With this procedure, all EPS bearer contexts established towards this PDN, including the default EPS bearer context, are released.

[TS 24.301, clause 6.6.4.2]

Upon receipt of a request to transfer user data via the control plane, if the UE is in EMM-CONNECTED mode, the UE initiates the procedure by sending the ESM DATA TRANSPORT message including the user data to be sent in the User data container IE. The length of the value part of the User data container IE should not exceed the link MTU size for the respective type of user data (IPv4, IPv6 or Non-IP).

NOTE: The recommended maximum size for link MTU is 1358 octets to prevent fragmentation in the backbone network (see 3GPP TS 23.060 [74]). Depending on the network configuration, setting link MTU size to a value larger than 1358 octets could lead to inefficient core network implementation due to fragmentation.

If the UE is in EMM-IDLE mode, the UE initiates the procedure by sending the ESM DATA TRANSPORT message included in a CONTROL PLANE SERVICE REQUEST message.

Based on information provided by the upper layers, the UE may include a Release assistance indication IE in the ESM DATA TRANSPORT message to inform the network that

1) subsequent to the current uplink data transmission no further uplink or downlink data transmission (e.g. an acknowledgement or response) is expected; i.e. the upper layers indicated that data exchanges have completed with the current UL data transfer; or

2) subsequent to the current uplink data transmission only a single downlink data transmission and no further uplink data transmission is expected; i.e. the upper layers indicated that data exchanges will have completed with the next downlink data transmission.

When receiving the ESM DATA TRANSPORT message, the MME shall identify the PDN connection to the SCEF or to the PDN GW, based on the EPS bearer identity included in message, and forward the contents of the User data container IE accordingly. If the ESM DATA TRANSPORT message includes a Release assistance indication IE, then ESM layer indicates to the EMM layer to initiate release of the NAS signalling connection,

1) if the release assistance indication indicates that no further uplink or downlink data transmission subsequent to the uplink data transmission is expected; or,

2) upon subsequent delivery of the next received downlink data transmission to the UE if the release assistance indication indicates that only a single downlink data transmission and no further uplink data transmission subsequent to the uplink data transmission is expected.

Figure 6.6.4.2.1: Transport of user data via the control plane procedure

22.1.1.3 Test description

22.1.1.3.1 Pre-test conditions

System Simulator:

– Ncell 50, default system information combination.

UE:

None.

Preamble:

– UE is in State 1-NB switched off according to TS 36.508 [18].

22.1.1.3.2 Test procedure sequence

Table 22.1.1.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict	Module
		U – S	Message
	Module 1 (M1): Attach for Control Plane CIoT EPS optimisation for EPS services with/without SMS-only
1	Switch-on the UE.	–	–	–	–	M1 sT07
2	Check: Does the UE transmit an RRCConnectionRequest-NB message, establishmentCause=mo-Signalling?	–>	RRC: RRCConnectionRequest-NB	1	P	M1 sT07
3	SS transmits an RRCConnectionSetup-NB message to establish SRB1 and SRB1bis.	<–	RRC: RRCConnectionSetup-NB	–	–	M1 sT07
–	EXCEPTION: Steps 4a1 and 4b1 describe behaviour that depends on UE capabilities; the "lower case letter" identifies a step sequence that take place depending on whether the UE is configured to do Attach Without PDN or not.	–	–	–	–	M1 sT01, sT05, sT06, sT07
4a1	IF px_DoAttachWithoutPDN THEN Check: Does the UE transmit an RRCConnectionSetupComplete-NB message (attachWithoutPDN-Connectivity=TRUE) containing an ATTACH REQUEST (indicating UE’s CIoT preferred and supported network behaviour) and an ESM DUMMY MESSAGE?	–>	RRC: RRCConnectionSetupComplete-NB NAS: ATTACH REQUEST NAS: ESM DUMMY MESSAGE	1	P	M1 sT01, sT05, sT07
4b1	ELSE Check: Does the UE transmit an RRCConnectionSetupComplete-NB message containing an ATTACH REQUEST (indicating UE’s CIoT preferred and supported network behaviour) and a PDN CONNECTIVITY REQUEST (type of PDN "IP" or "non-IP")?	–>	RRC: RRCConnectionSetupComplete-NB NAS: ATTACH REQUEST NAS: PDN CONNECTIVITY REQUEST	1,3	P	M1 sT01, sT06, sT07
5	The SS transmits an IDENTITY REQUEST message.	<–	RRC: DLInformationTransfer-NB NAS: IDENTITY REQUEST	–	–	M1 sT02
6	Check: Does the UE transmit an IDENTITY RESPONSE message?	–>	RRC: ULInformationTransfer-NB NAS: IDENTITY RESPONSE	2	P	M1 sT02
7	The SS transmits an AUTHENTICATION REQUEST message to initiate the EPS authentication and AKA procedure.	<–	RRC: DLInformationTransfer-NB NAS: AUTHENTICATION REQUEST	–	–	M1 sT03
8	Check: Does the UE transmit an AUTHENTICATION RESPONSE message and establishes mutual authentication?	–>	RRC: ULInformationTransfer-NB NAS: AUTHENTICATION RESPONSE	2	P	M1 sT03
9	The SS transmits a NAS SECURITY MODE COMMAND message to activate NAS security.	<–	RRC: DLInformationTransfer-NB NAS: SECURITY MODE COMMAND	–	–	M1 sT04
10	Check: Does the UE transmit a NAS SECURITY MODE COMPLETE message and establishes the initial security configuration?	–>	RRC: ULInformationTransfer-NB NAS: SECURITY MODE COMPLETE	2	P	M1 sT04
–	EXCEPTION: Steps 11a1-11a2 describe behaviour that depends on UE configuration; the "lower case letter" identifies a step sequence that take place if the UE has ESM information which needs to be transferred.	–	–	–	–	M1 sT06
11a1	IF the UE sets the ESM information transfer flag in the PDN CONNECTIVITY REQUEST message sent in step 4b1 THEN the SS transmits an ESM INFORMATION REQUEST message to initiate exchange of protocol configuration options and/or APN.	<–	RRC: DLInformationTransfer-NB NAS: ESM INFORMATION REQUEST	–	–	M1 sT06
11a2	The UE transmits an ESM INFORMATION RESPONSE message to transfer protocol configuration options and/or APN.	–>	RRC: ULInformationTransfer-NB NAS: ESM INFORMATION RESPONSE	–	–	M1 sT06
–	EXCEPTION: Steps 12a1 and 12b1 describe behaviour that depends on UE capabilities; the "lower case letter" identifies a step sequence that take place depending on whether the UE is configured to do Attach Without PDN or not.	–	–	–	–	M1 sT01
12a1	IF px_DoAttachWithoutPDN THEN SS transmits an ATTACH ACCEPT message and an ESM DUMMY MESSAGE. The SS indicates support of CP CIoT only, even if the ATTACH REQUEST message sent by the UE indicated as CIoT preferred and supported network behaviour, support of UP CIoT.	<–	RRC: DLInformationTransfer-NB NAS: ATTACH ACCEPT NAS: ESM DUMMY MESSAGE	–	–	M1 sT01, sT05
12b1	ELSE SS transmits an ATTACH ACCEPT message and an ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message, The SS indicates support of CP CIoT only, even if the ATTACH REQUEST message sent by the UE indicated as CIoT preferred and supported network behaviour, support of UP CIoT. If PDN type "IP" was included in the PDN CONNECTIVITY REQUEST step 4b1 then the network shall include the PDN type and the PDN address information within the PDN address IE in the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message sent to the UE. NOTE: Settings in ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST to check PLMN rate control – PLMN Rate control set to max of 4 messages per 6 minutes; – APN control not provided; – MTU parameters not provided.	<–	RRC: DLInformationTransfer-NB NAS: ATTACH ACCEPT NAS: ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST	–	–	M1 sT01, sT06
–	EXCEPTION: Steps 13a1 and 13b1 describe behaviour that depends on UE capabilities; the "lower case letter" identifies a step sequence that take place depending on whether the UE is configured to do Attach Without PDN or not.	–	–	–	–	M1 sT01
13a1	IF px_DoAttachWithoutPDN THEN Check: Does the UE transmit an ATTACH COMPLETE message and an ESM DUMMY MESSAGE?	–>	RRC: ULInformationTransfer-NB NAS: ATTACH COMPLETE NAS: ESM DUMMY MESSAGE	1	P	M1 sT01, sT05
–	EXCEPTION: IF not all IP address information was allocated in the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message sent in step 12b1 TNEN In parallel to the events described in step 13b1 the Generic ‘Procedure for IP address allocation in the CP CIoT’ described in TS 36.508 [18], clause 8.1.5A.1 takes place.	–	–	–	–	M1 sT01, sT06
13b1	ELSE Check: Does the UE transmit an ATTACH COMPLETE message and an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message?	–>	RRC: ULInformationTransfer-NB NAS: ATTACH COMPLETE NAS: ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT	1	P	M1 sT01, sT06
14	The SS transmits an RRCConnectionRelease-NB message to release RRC connection.	<–	RRC: RRCConnectionRelease-NB	–	–	M1 sT09
	Module 2 (M2): UE and Network transmission of user data via the control plane (non-SMS service)
–	EXCEPTION: Steps15a1 to 15a21 describe behaviour that depends on UE configuration; the "lower case letter" identifies a step sequence that takes place if the UE is configured to utilise non-SMS services as transport mechanism for user data.	–	–	–	–	M2 sT10-sT17
15a1	IF px_nonSMSTransport_CP_CIoT THEN Check: Does the ‘Test procedure to check UE response to Paging for Control Plane CIoT MT access’ as described in TS 36.508 [18], clause 8.1.5A.2 take place? NOTE: Settings in ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST to check PLMN rate control – PLMN Rate control set to max of 4 messages per 6 minutes; – APN control not provided; – MTU parameters not provided.	–	–	7,1,3	P	M2 sT09, sT12, sT16, sT17
–	EXCEPTION: Steps15a2a1-15a2a4 describe behaviour that depends on UE configuration; the "lower case letter" identifies a step sequence that takes place if the UE did not establish a PDN connection in step 15a1.	–	–	–	–	M2 sT10-sT17
15a2a1	Cause the UE to request PDN connectivity. (see Note 1)	–	–	–	–	M2 sT10-sT17
15a2a2	The UE transmits a PDN CONNECTIVITY REQUEST message.	–>	RRC: ULInformationTransfer-NB NAS: PDN CONNECTIVITY REQUEST	–	–	M2 sT10-sT17
15a2a3	The SS transmits an ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message. NOTE: Settings in ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST to check PLMN rate control – PLMN Rate control set to max of 10 messages per 6 minutes; – APN control not provided; – MTU parameters not provided.	<–	RRC: DLInformationTransfer-NB NAS: ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST	–	–	M2 sT10-sT17
–	EXCEPTION: IF pc_IP_PDN AND not all IP address information was allocated in the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message sent in step 15a2a3 TNEN In parallel to the events described in step 15a2a4 the Generic ‘Procedure for IP address allocation in the CP CIoT’ described in TS 36.508 [18], clause 8.1.5A.1 takes place.	–	–	–	–	M2 sT10-sT17
15a2a4	The UE transmits an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message.	–>	RRC: ULInformationTransfer-NB NAS: ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT	–	–	M2 sT10-sT17
15a2A	The SS transmits an ACTIVATE TEST MODE message to activate test mode G (loopback of the User data container content of any received downlink ESM DATA TRANSPORT).	<–	RRC: DLInformationTransfer-NB TC: ACTIVATE TEST MODE	–	–	M2 sT10-sT14
15a2B	The UE transmits an ACTIVATE TEST MODE COMPLETE message.	–>	RRC: ULInformationTransfer-NB TC: ACTIVATE TEST MODE COMPLETE	–	–	M2 sT10-sT14
15a3	The SS transmits a CLOSE UE TEST LOOP message to close the NB-IoT UE test loop mode for user data transfer (12 transmission; 60 sec delay).	<–	RRC: DLInformationTransfer-NB TC: CLOSE UE TEST LOOP	–	–	M2 sT10-sT17
15a4	The UE transmits a CLOSE UE TEST LOOP COMPLETE message to confirm that loopback is activated.	–>	RRC: ULInformationTransfer-NB TC: CLOSE UE TEST LOOP COMPLETE	–	–	M2 sT10-sT17
15a5	SS transmits an ESM DATA TRANSPORT message containing downlink user data of 3 octets.	<–	RRC: ULInformationTransfer-NB ESM DATA TRANSPORT	–	–	M2 sT11
–	EXCEPTION: Step 15a6a1 describes behaviour that depends on UE implementation; the "lower case letter" identifies a step sequence which may take place depending on whether the UE is configured to do Attach Without PDN or not.			–	–	M2 sT12
15a6a1	IF px_DoAttachWithoutPDN THEN The ‘Test procedure to check release of PDN connectivity before leaving RRC-CONNECTED for attach without PDN’ specified in TS 36.508 [18], clause 8.1.5A.4 takes place.	–	–	4	P	M2 sT12
15a7	The SS transmits an RRCConnectionRelease-NB message.	<–	RRC: RRCConnectionRelease-NB	–	–	M2 sT10-sT17
15a8	Wait for the time set in the CLOSE UE TEST LOOP to expire.	–	–	–	–	M2 sT10-sT17
15a9	SS starts timer 6 min PLMN Rate control	–	–	–	–	M2 sT13
15a10	Check: Does the ‘Test procedure to check UE initiation of Control Plane CIoT MO user data transfer non-SMS transport’ as described in TS 36.508 [18], clause 8.1.5A.3 take place? NOTE: The UE will transmit one ESM DATA TRANSPORT message containing user data matching the message sent in step 15a5.	–	–	5	P	M2 sT10, sT12 sT16, sT17
–	EXCEPTION: Step 15a11 is repeated 9 times. Note: The number of messages is set so that together with the message sent in step 15a10 it respects the PLMN data rate set in the latest ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST.	–	–	–	–	M2 sT13
15a11	Check: Does the UE send an ESM DATA TRANSPORT message containing the same user data sent by the SS in step 15a5?	–>	RRC: ULInformationTransfer-NB TC: ESM DATA TRANSPORT	5,6,7	P	M2 sT13
15a12	Wait until 6 min timer Expires	–	–	–	–	M2 sT13
15a13	SS starts timer 6 min PLMN Rate control	–	–	–	–	M2 sT13
–	EXCEPTION: Step 15a14 is repeated 2 times. Note: The number of messages is set so that it respects the PLMN data rate set in the latest ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST.	–	–	–	–	M2 sT13
15a14	Check: Does the UE send an ESM DATA TRANSPORT message containing the same user data sent by the SS in step15a5?	–>	RRC: ULInformationTransfer-NB TC: ESM DATA TRANSPORT	5,6,7	P	M2 sT13
15a15	SS stops timer 6 min PLMN Rate control	–	–	–	–	M2 sT13
–	EXCEPTION: Steps 15a16a1 to 15a16a8 describe behaviour that depends on UE capabilities; the "lower case letter" identifies a step sequence that take place depending on whether the UE supports APN control.	–	–	–	–	M2 sT13, sT14
15a16a1	IF pc_APN_RateControl THEN The SS sends a MODIFY EPS BEARER CONTEXT REQUEST message to modify APN, MTU and PLMN rate controls. NOTE: Settings in MODIFY EPS BEARER CONTEXT REQUEST to check APN rate control – APN control set for max 1 message per minute; – MTU parameters are not provided; – PLMN Rate control not provided (i.e. the set in step 15a1 or 15a2a3 values still apply).	<–	RRC: DLInformationTransfer-NB NAS: MODIFY EPS BEARER CONTEXT REQUEST	–	–	M2 sT22, sT14
15a16a2	Check: Does the UE transmit a MODIFY EPS BEARER CONTEXT ACCEPT message?	–>	RRC: ULInformationTransfer NAS: MODIFY EPS BEARER CONTEXT ACCEPT	10	P	M2 sT22, sT14
15a16a3	The SS transmits a CLOSE UE TEST LOOP message to close the NB-IoT UE test loop mode for user data transfer (2 transmission; 0 sec delay).	<–	RRC: DLInformationTransfer-NB TC: CLOSE UE TEST LOOP	–	–	M2 sT10-sT17
15a16a4	The UE transmits a CLOSE UE TEST LOOP COMPLETE message to confirm that loopback is activated.	–>	RRC: ULInformationTransfer-NB TC: CLOSE UE TEST LOOP COMPLETE	–	–	M2 sT10-sT17
15a16a5	SS transmits an ESM DATA TRANSPORT message containing downlink user data.	<–	RRC: DLInformationTransfer-NB ESM DATA TRANSPORT	–	–	M2 sT14
–	EXCEPTION: Steps 15a16a6-15a16a8 are repeated 2 times. Note: The number of repetitions is set so that it respects the APN rate controls set in step 15a16a1: Max of 1 message every minute.	–	–	–	–	M2 sT14
15a16a6	SS starts timer 1 min APN Rate control	–	–	–	–	M2 sT14
15a16a7	Check: Does the UE send an ESM DATA TRANSPORT message?	–>	RRC: ULInformationTransfer-NB TC: ESM DATA TRANSPORT	5,6,7	P	M2 sT14
15a16a8	Wait until timer 1 min APN Rate control expires.	–	–	–	–	M2 sT14
15a17a1-15a18	Void
15a19	The SS transmits DEACTIVATE TEST MODE message to deactivate the test mode G.	<–	RRC: DLInformationTransfer-NB TC: DEACTIVATE TEST MODE	–	–	M2 sT10-sT14
15a20	The UE transmits a DEACTIVATE TEST MODE COMPLETE message.	–>	RRC: ULInformationTransfer-NB TC: DEACTIVATE TEST MODE COMPLETE	–	–	M2 sT10-sT14
15a21	The SS transmits an RRCConnectionRelease-NB message.	<–	RRC: RRCConnectionRelease-NB	–	–	M2 sT10-sT14
	Module 3 (M3): UE and Network transmission of SMS via the control plane
–	EXCEPTION: Steps16a1 to 16a12 describe behaviour that depends on UE configuration; the "lower case letter" identifies a step sequence that takes place if the UE is configured to utilise SMS services as transport mechanism for user data.	–	–	–	–	M3 sT18-sT20
16a1	IF pc_NB_S1_only AND px_SMSTransport_CP_CIoT THEN Check: Does the ‘Test procedure to check UE response to Paging for Control Plane CIoT MT access’ as described in TS 36.508 [18], clause 8.1.5A.2 take place?	–	–	9,1	P	M3 sT09, sT19, sT20, sT17
16a1A	The SS transmits an ACTIVATE TEST MODE message to activate test mode H (loopback the content of any downlink received SMS messages).	<–	RRC: DLInformationTransfer-NB TC: ACTIVATE TEST MODE	–	–	M3 sT18-sT20
16a1B	The UE transmits an ACTIVATE TEST MODE COMPLETE message.	–>	RRC: ULInformationTransfer-NB TC: ACTIVATE TEST MODE COMPLETE	–	–	M3 sT18-sT20
16a2	The SS transmits a CLOSE UE TEST LOOP message to close the NB-IoT UE test loop mode for SMS transfer (2 transmissions; 60 sec delay).	<–	RRC: DLInformationTransfer-NB TC: CLOSE UE TEST LOOP	–	–	M3 sT18-sT20
16a3	The UE transmits a CLOSE UE TEST LOOP COMPLETE message to confirm that loopback is activated.	–>	RRC: ULInformationTransfer-NB TC: CLOSE UE TEST LOOP COMPLETE	–	–	M3 sT18-sT20
16a4	SS transmits a DOWNLINK NAS TRANSPORT message containing downlink user data (SMS).(Note 2)	<–	RRC: DLInformationTransfer-NB NAS: DOWNLINK NAS TRANSPORT	–	–	M3 sT19
16a4A	The UE transmits a CP-ACK encapsulated in an UPLINK NAS TRANSPORT message.	–>	NAS: UPLINK NAS TRANSPORT	–	–
16a4B	The UE transmits a CP-DATA containing an RP-ACK RPDU encapsulated in an UPLINK NAS TRANSPORT message.	–>	NAS: UPLINK NAS TRANSPORT	–	–
16a4C	The SS transmits a CP-ACK encapsulated in a DOWNLINK NAS TRANSPORT message to the UE.	<–	NAS: DOWNLINK NAS TRANSPORT	–	–
16a5	The SS transmits an RRCConnectionRelease-NB message.	<–	RRC: RRCConnectionRelease-NB	–	–	M3 sT18-sT20
16a6	Wait for the time set in the CLOSE UE TEST LOOP to expire.	–	–	–	–	M3 sT18-sT20
16a7	Check: Does the ‘Test procedure to check UE initiation of Control Plane CIoT MO user data transfer SMS transport’ as described in TS 36.508 [18], clause 8.1.5A.3A take place? NOTE: The UE will transmit one CONTROL PLANE SERVICE REQUEST message , data service type="mobile originating request", integrity protected and partially ciphered and including SMS in the NAS message container IE, matching the TPDU sent in step 16a4. (Note 3)	–	–	5,8	P	M3 sT18, sT20
16a7A	The SS transmits a CP-ACK encapsulated in a DOWNLINK NAS TRANSPORT message.	<–	NAS: DOWNLINK NAS TRANSPORT
16a7B	The SS transmits a CP-DATA containing an RP-ACK RPDU encapsulated in a DOWNLINK NAS TRANSPORT message	<–	NAS: DOWNLINK NAS TRANSPORT
16a7C	The UE transmits a CP-ACK encapsulated in an UPLINK NAS TRANSPORT message.	–>	NAS: UPLINK NAS TRANSPORT
16a8	Check: Does the UE send an UPLINK NAS TRANSPORT message containing SMS, matching the TP-User-Data sent in step 16a4? (Note 3)	–>	RRC: ULInformationTransfer-NB NAS: UPLINK NAS TRANSPORT	8	P	M3 sT18
16a8A	The SS transmits a CP-ACK encapsulated in a DOWNLINK NAS TRANSPORT message.	<–	NAS: DOWNLINK NAS TRANSPORT
16a8B	The SS transmits a CP-DATA containing an RP-ACK RPDU encapsulated in a DOWNLINK NAS TRANSPORT message	<–	NAS: DOWNLINK NAS TRANSPORT
16a8C	The UE transmits a CP-ACK encapsulated in an UPLINK NAS TRANSPORT message.	–>	NAS: UPLINK NAS TRANSPORT
16a9	IF px_DoAttachWithoutPDN THEN The ‘Test procedure to check release of PDN connectivity before leaving RRC-CONNECTED for attach without PDN’ specified in TS 36.508 [18], clause 8.1.5A.4 takes place.	–	–	–	–	M3 sT18-sT17
16a10	The SS transmits DEACTIVATE TEST MODE message to deactivate the test mode H.	<–	RRC: DLInformationTransfer-NB TC: DEACTIVATE TEST MODE	–	–	M3 sT18-sT20
16a11	The UE transmits an DEACTIVATE TEST MODE COMPLETE message.	–>	RRC: ULInformationTransfer-NB TC: DEACTIVATE TEST MODE COMPLETE	–	–	M3 sT18-sT20
16a12	The SS transmits an RRCConnectionRelease-NB message.	<–	RRCConnectionRelease-NB	–	–	M3 sT18-sT20
17a1-17a18	Void	–	–	–	–	–
Note 1: The request of connectivity to a PDN may be performed by MMI or AT command Note 2: TP-User-Data (SMS user data) in a downlink TPDU (SMS-DELIVER) as defined in subclause 5.1 in TS 36.509 [25]. Note 3: TP-User-Data (SMS user data) in an uplink TPDU (SMS-SUBMIT) as defined in subclause 5.1 in TS 36.509 [25].

22.1.1.3.3 Specific message contents

Table 22.1.1.3-1: SystemInformationBlockType1-NB (Preamble and all steps, Table 22.1.1.3.2-1)

Derivation Path: TS 36.508 [18], table 8.1.4.3.2-3, condition ATTACH_WITHOUT_PDN.

Table 22.1.1.3-2: Message RRCConnectionRequest-NB (step 2, Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], table 8.1.6.1-10
Information Element	Value/Remark	Comment	Condition
RRCConnectionRequest-NB ::= SEQUENCE {
criticalExtensions CHOICE {
rrcConnectionRequest-r13 SEQUENCE {
establishmentCause-r13	mo-Signalling
}
}
}

Table 22.1.1.3-3: Message RRCConnectionSetupComplete-NB (steps 4a1, 4b1, Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], table 8.1.6.1-15
Information Element	Value/Remark	Comment	Condition
RRCConnectionSetupComplete-NB ::= SEQUENCE {
rrc-TransactionIdentifier	the same value as included in the RRCConnectionSetup-NB message received from SS
criticalExtensions CHOICE {
rrcConnectionSetupComplete-r13 SEQUENCE {
attachWithoutPDN-Connectivity-r13	True		px_DoAttachWithoutPDN
	Not Present		NOT px_DoAttachWithoutPDN
}
}
}

Table 22.1.1.3-4: Message ATTACH REQUEST (steps 4a1, 4b1, Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
EPS attach type	‘0001’B	EPS attach
UE network capability
Control plane CIoT EPS optimization (CP CIoT) (octet 8, bit 3)	1	supported
User plane CIoT EPS optimization (UP CIoT) (octet 8, bit 4)	Any allowed value
EMM-REGISTERED without PDN connection (ERw/oPDN) (octet 8, bit 6)	Any allowed value
Header compression for control plane CIoT EPS optimization (HC-CP CIoT) (octet 8, bit 7)	0	not supported
	1	supported	pc_HCCPCIoT
Extended protocol configuration options (ePCO) (octet 8, bit 8)	1	supported
ESM message container	ESM DUMMY MESSAGE		px_DoAttachWithoutPDN
	PDN CONNECTIVITY REQUEST message		NOT px_DoAttachWithoutPDN
Additional update type
Additional update type value (AUTV) (Octet 1, bit 1)	0
	1	SMS only	pc_NB_S1_only AND px_SMSTransport_CP_CIoT
"Signalling active" flag (SAF) (Octet 1, bit 2)	Not checked
Preferred CIoT network behaviour (PNB-CIoT) (Octet 1, bits 3-4)	’01’B	control plane CIoT EPS optimization Note 1
	’10’B	user plane CIoT EPS optimization Note 1
Note 1: IF pc_User_Plane_CIoT_Optimisation THEN the UE can set this field either to ’01’ or to ’10’ OTHERWISE the UE shall set it to ’01’.

Table 22.1.1.3-5: PDN CONNECTIVITY REQUEST (steps 4b1, 15a1 (steps 4a1a1, 4a1b2, TS 36.506 [18], Table 8.1.5A.2.3-1), Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], table 4.7.3-20
Information Element	Value/Remark	Comment	Condition
Access point name	Not Present or Any allowed value
Protocol configuration options	Not Present
Header compression configuration	Any allowed value		pc_HCCPCIoT AND pc_IP_PDN
Extended protocol configuration options	Not Present or Any allowed value

Table 22.1.1.3-6: Message ATTACH ACCEPT (steps 12a1, 12b1, Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
EPS attach result	‘0001’B	EPS only
ESM message container	ESM DUMMY MESSAGE		px_DoAttachWithoutPDN
	ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message		NOT px_DoAttachWithoutPDN
EPS network feature support
Octet 3	‘11000100’B	– IMS voice over PS session in S1 mode not supported – emergency bearer services in S1 mode not supported – location services via EPC supported – no information about support of location services via CS domain is available – network does not support use of EXTENDED SERVICE REQUEST to request for packet services – EMM-REGISTERED without PDN connection supported – Control plane CIoT EPS optimization supported
..Octet 4	‘00001100’B	– User plane CIoT EPS optimization not supported – S1-u data transfer not supported – Header compression for control plane CIoT EPS optimization supported – support of the extended protocol configuration options IE
Additional update result	‘00000110’ B	– SMS only – control plane CIoT EPS optimization accepted – user plane EPS optimization not accepted

Table 22.1.1.3-7: Message ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST (steps 12b1, 15a1 (step 4a2, TS 36.506 [18], Table 8.1.5A.2.3-1), 15a2a3, Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], table 4.7.3-6
Information Element	Value/Remark	Comment	Condition
Protocol configuration options	Not present
Header compression configuration	Not present	No Compression profile NOTE: For the purposes of CIoT (NAS) testing regardless of the Compression files supported by the UE and indicated in the PDN CONNECTIVITY REQUEST, the SS does not agree header compression to be applied.	pc_HCCPCIoT AND pc_IP_PDN
Control plane only indication	‘0001’B	PDN connection can be used for control plane CIoT EPS optimization only
Extended protocol configuration options		The content of the IE below uses the same fields and Conditions (and their meaning) as those defined in TS 36.508 [18] for the IE ‘Protocol configuration options’
Container ID n	‘0003’H	n assigned to next available number	DNS IPv6
Length of container ID n contents		Length value determined by the TTCN implementation
Container ID n contents	IPv6 address	DNS IPv6 Address
Container ID n+1	‘000D’H	n assigned to next available number	DNS IPv4
Length of container ID n+1 contents		Length value determined by the TTCN implementation
Container ID n+1 contents	IPv4 address	DNS IPv4 Address
Serving PLMN rate control	‘00000000 00001010’B	Max of 10 uplink ESM DATA TRANSPORT messages including User data container IEs the UE is allowed to send via a PDN connection per 6 minute interval

Table 22.1.1.3-7A: Message ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT (steps 13b1, 16a1 (step 4a3, TS 36.506 [18], Table 8.1.5A.2.3-1), 15a2a4, Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], table 4.7.3-4
Information Element	Value/Remark	Comment	Condition
Protocol configuration options	Not present
Extended protocol configuration options	Not present or any allowed value

Table 22.1.1.3-8: Message MODIFY EPS BEARER CONTEXT REQUEST (step 15a16a1, Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], Table 4.7.3-18.
Information Element	Value/Remark	Comment	Condition
EPS bearer identity	The same value as the value set in the latest ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message sent prior to this message
Protocol configuration options	Not Present
Extended protocol configuration options
Container ID n+X+3	‘0016’H	APN rate control support parameters	pc_APN_RateControl
Length of container ID n+X+3 contents	4
Container ID n+X+3 contents		The container identifier contents field contains parameters for APN rate control functionality
Octet 1 AER+Uplink time unit	‘0001’B	– Additional exception reports at maximum rate reached are not allowed – minute (interval)
Octets 2-4	‘1’B	– Max 1 message per minute

Table 22.1.1.3-9: Message MODIFY EPS BEARER CONTEXT REQUEST (step 15a17a1, Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], Table 4.7.3-18
Information Element	Value/Remark	Comment	Condition
EPS bearer identity	The same value as the value set in the latest ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message sent prior to this message
Protocol configuration options	Not Present
Extended protocol configuration options
Container ID n+X+1	‘0010’H	IPv4 Link MTU	pc_IPv4_Link_MTU_Parameter
Length of container ID n+X+1 contents	2
Container ID n+X+1 contents	‘00000000 10000000’B	– 128 octets maximum length of user data container that can be sent in the ESM DATA TRANSPORT message
Container ID n+X+2	‘0015’H	Non-IP Link MTU	pc_NonIP_Link_MTU_Parameter
Length of container ID n+X+2 contents	2
Container ID n+X+2 contents	‘00000000 10000000’B	– 128 octets maximum length of user data container that can be sent in the ESM DATA TRANSPORT message
Container ID n+X+3	‘0016’H	APN rate control support parameters	pc_APN_RateControl
Length of container ID n+X+3 contents	4
Container ID n+X+3 contents		The container identifier contents field contains parameters for APN rate control functionality
Octet 1 AER+Uplink time unit	‘0000’B	– Additional exception reports at maximum rate reached are not allowed – unrestricted (interval)
Octets 2-4	‘11111111 11111111 11111111’B	– unrestricted Maximum uplink rate (octet 2 to octet 4) is a binary coded representation of the maximum number of messages the UE is restricted to send per time unit. The time unit is indicated in the uplink time unit. If the uplink time unit is set to "unrestricted", the maximum uplink data volume the UE can send is not restricted.

Table 22.1.1.3-10: Message ATTACH COMPLETE (steps 13a1, 13b1, Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], table 4.7.2-2
Information Element	Value/Remark	Comment	Condition
ESM message container	ESM DUMMY MESSAGE		px_DoAttachWithoutPDN
	ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message		NOT px_DoAttachWithoutPDN

Table 22.1.1.3-11 to -14: Void

Table 22.1.1.3-15: Message CONTROL PLANE SERVICE REQUEST (step 15a10 (step 3b1, TS 36.508 [18], Table 8.1.5A.3.3-1), Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], table 4.7.2-28.
Information Element	Value/Remark	Comment	Condition
ESM message container	The same ESM DATA TRANSPORT message sent in Table 22.1.1.3-17

Table 22.1.1.3-16: Message CONTROL PLANE SERVICE REQUEST (step 16a7 (steps 3a1, 3b1, TS 36.508 [18], Table 8.1.5A.3A.3-1), Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], table 4.7.2-28.
Information Element	Value/Remark	Comment	Condition
NAS message container	The same NAS message container (SMS) sent in DOWNLINK NAS TRANSPORT Table 22.1.1.3-22	Short message protocol message (i.e. CP-DATA, CP-ACK or CP-ERROR) as defined in subclause 7.2 in 3GPP TS 24.011 [54]

Table 22.1.1.3-17: Message ESM DATA TRANSPORT (steps 15a5, 15a10 (steps 3a4, 3b1, TS 36.508 [18], Table 8.1.5A.3.3-1), Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], table 4.7.3-12A.
Information Element	Value/Remark	Comment	Condition
Protocol discriminator
EPS bearer identity
Procedure transaction identity
ESM data transport message identity
User data container	‘11110000 11110000 11110000’B	3 Octets of user data – The value is arbitrary chosen
Release assistance indication	Not present

Table 22.1.1.3-17A: Message ESM DATA TRANSPORT (steps 15a11, 15a14, Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], table 4.7.3-12A.
Information Element	Value/Remark	Comment	Condition
Protocol discriminator
EPS bearer identity
Procedure transaction identity
ESM data transport message identity
User data container	‘11110000 11110000 11110000’B	Looped back the data specified in Table 22.1.1.3-17
Release assistance indication	Not present Or Present with DDX=’00’B	The messages sent in step 15a11 and the first message sent in step 15a14.
	Not present Or Present (with DDX=’00’B Or DDX=’01’B)	The second message sent in step 15a14.

Table 22.1.1.3-18: Message ESM DATA TRANSPORT (step 15a16a5, Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], table 4.7.3-12A.
Information Element	Value/Remark	Comment	Condition
User data container	10 Octets, not all zeroes	A randomly chosen number
Release assistance indication	Not present

Table 22.1.1.3-19: Message ESM DATA TRANSPORT (step 15a16a7, Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], table 4.7.3-12A.
Information Element	Value/Remark	Comment	Condition
User data container	The same as the one provided in the relevant DL ESM DATA TRANSPORT message
Release assistance indication	Not present Or Present with DDX=’00’B	The messages before the last.
	Not present Or Present (with DDX=’00’B Or DDX=’01’B)	The last message

Table 22.1.1.3-20: Void

Table 22.1.1.3-21: Void

Table 22.1.1.3-22: Message DOWNLINK NAS TRANSPORT (step 16a4, Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], Table 4.7.2-12A
Information Element	Value/Remark	Comment	Condition
NAS message container	An arbitrary value	Short message protocol message (i.e. CP-DATA, CP-ACK or CP-ERROR) as defined in subclause 7.2 in 3GPP TS 24.011 [54] carrying a TPDU (Note 1)
NOTE 1: The TPDU may be a random bit sequence or a TPDU as defined in subclause 9.2 in 3GPP TS 23.040 [55]

Table 22.1.1.3-23: Message UPLINK NAS TRANSPORT (steps 16a7 (steps 3a1, 3b1, TS 36.508 [18], Table 8.1.5A.3A.3-1, Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], Table 8.2.30
Information Element	Value/Remark	Comment	Condition
NAS message container	The same TPDU (Note 1) sent in DOWNLINK NAS TRANSPORT Table 22.1.1.3-22
NOTE 1: The TPDU may be a random bit sequence or a TPDU as defined in subclause 9.2 in 3GPP TS 23.040 [55]

Table 22.1.1.3-24: Message IDENTITY REQUEST (step 5, Table 22.1.1.3.2-1)

Derivation Path: 36.508 [18], Table 4.7.2-17
Information Element	Value/Remark	Comment	Condition
Identity Type	0001	IMSI

Table 22.1.1.3-25: IDENTITY RESPONSE (step 6, Table 22.1.1.3.2-1)

Derivation path: 36.508 [18], Table 4.7.2-18
Information Element	Value/Remark	Comment	Condition
Mobile Identity
Type of identity	001	IMSI
Identity digits	UE’s IMSI

Table 22.1.1.3-26: Message ACTIVATE TEST MODE (step 15a2A, Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], table 4.7A-1, Condition UE TEST LOOP MODE G

Table 22.1.1.3-26A: Message ACTIVATE TEST MODE (step 16a1A, Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], table 4.7A-1, Condition UE TEST LOOP MODE H

Table 22.1.1.3-27: Message CLOSE UE TEST LOOP (step 15a3, Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], table 4.7A-3
Information Element	Value/Remark	Comment	Condition
UE test loop mode	‘00000110’B	UE test loop mode G setup
Operation mode and repetitions
M0	0	data is returned in uplink at the EMM entity
R6..R0	‘0001100’B	12 The received DL message in uplink shall be looped back 12 times.
Uplink data delay	‘00111100’B	T_delay_modeG timer=60 sec 0..255 seconds (binary coded, T7 is most significant bit and T0 least significant bit)

Table 22.1.1.3-28: Message CLOSE UE TEST LOOP (step 15a16a3, Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], table 4.7A-3
Information Element	Value/Remark	Comment	Condition
UE test loop mode	‘00000110’B	UE test loop mode G setup
Operation mode and repetitions
M0	0	data is returned in uplink at the EMM entity
R6..R0	‘0000010’B	2 The received DL message in uplink shall be looped back 2 times
Uplink data delay	‘00000000’B	T_delay_modeG timer=0 sec 0..255 seconds (binary coded, T7 is most significant bit and T0 least significant bit)

Table 22.1.1.3-29: Message CLOSE UE TEST LOOP (step 16a2, Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], table 4.7A-3
Information Element	Value/Remark	Comment	Condition
UE test loop mode	‘00000111’B	UE test loop mode H setup (SMS)
Operation mode and repetitions
M0	‘0’B	data is returned in uplink at the SMC SAP
R6..R0	‘0000010’B	2 The received DL message in uplink shall be looped back 2 times
Uplink data delay	‘00111100’B	T_delay_modeG timer=60 sec 0..255 seconds (binary coded, T7 is most significant bit and T0 least significant bit)

Table 22.1.1.3-30: Message CLOSE UE TEST LOOP (steps 15a17a3, Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], table 4.7A-3
Information Element	Value/Remark	Comment	Condition
UE test loop mode	‘00000110’B	UE test loop mode G setup
Operation mode and repetitions
M0	0	CP data loopback mode
R6..R0	‘0000001’B	1 The received DL message in uplink shall be looped back 1 time (once)
Uplink data delay	‘00000000’B	T_delay_modeG timer=0 sec 0..255 seconds (binary coded, T7 is most significant bit and T0 least significant bit)

Table 22.1.1.3-31: Message ESM INFORMATION RESPONSE (step 11a2, Table 22.1.1.3.2-1)

Derivation path: TS 36.508 [18], table 4.7.3-13
Information Element	Value/Remark	Comment	Condition
Protocol configuration options	Not present
Extended protocol configuration options	Any allowed value
Access point name	Not Present or Any allowed value

Table 22.1.1.3-32: Message DOWNLINK NAS TRANSPORT (step 16a4, Table 22.1.1.3.2-1)

Derivation Path: 36.508 clause 4.7.2-12A
Information Element	Value/remark	Comment	Condition
NAS message container	CP-DATA

Table 22.1.1.3-33: Message CP-DATA (step 16a4, Table 22.1.1.3.2-1)

Derivation Path: 36.508 clause 6.6A.1-2
Information Element	Value/remark	Comment	Condition
CP-User data	RP-DATA

Table 22.1.1.3-34: Message UPLINK NAS TRANSPORT (step 16a4A, Table 22.1.1.3.2-1)

Derivation Path: 36.508 clause 4.7.2-27A
Information Element	Value/remark	Comment	Condition
NAS message container	CP-ACK

Table 22.1.1.3-35: Message UPLINK NAS TRANSPORT (step 16a4B, Table 22.1.1.3.2-1)

Derivation Path: 36.508 clause 4.7.2-27A
Information Element	Value/remark	Comment	Condition
NAS message container	CP-DATA

Table 22.1.1.3-36: Message CP-DATA (step 16a4B, Table 22.1.1.3.2-1)

Derivation Path: 36.508 clause 6.6A.1-2
Information Element	Value/remark	Comment	Condition
CP-User data	RP-ACK

Table 22.1.1.3-37: Message DOWNLINK NAS TRANSPORT (step 16a4C, Table 22.1.1.3.2-1)

Derivation Path: 36.508 clause 4.7.2-12A
Information Element	Value/remark	Comment	Condition
NAS message container	CP-ACK

Table 22.1.1.3-38: Message UPLINK NAS TRANSPORT (steps 16a7, 16a8, Table 22.1.1.3.2-1)

Derivation Path: 36.508 clause 4.7.2-27A
Information Element	Value/remark	Comment	Condition
NAS message container	CP-DATA

Table 22.1.1.3-39: Message CP-DATA (steps 16a7, 16a8, Table 22.1.1.3.2-1)

Derivation Path: 36.508 clause 6.6A.1-2
Information Element	Value/remark	Comment	Condition
CP-User data	RP-DATA

Table 22.1.1.3-40: Message DOWNLINK NAS TRANSPORT (steps 16a7A, 16a8A, Table 22.1.1.3.2-1)

Derivation Path: 36.508 clause 4.7.2-12A
Information Element	Value/remark	Comment	Condition
NAS message container	CP-ACK

Table 22.1.1.3-41: Message DOWNLINK NAS TRANSPORT (steps 16a7B, 16a8B, Table 22.1.1.3.2-1)

Derivation Path: 36.508 clause 4.7.2-12A
Information Element	Value/remark	Comment	Condition
NAS message container	CP-DATA

Table 22.1.1.3-42: Message CP-DATA (steps 16a7B, 16a8B, Table 22.1.1.3.2-1)

Derivation Path: 36.508 clause 6.6A.1-2
Information Element	Value/remark	Comment	Condition
CP-User data	RP-ACK

Table 22.1.1.3-43: Message UPLINK NAS TRANSPORT (steps 16a7C, 16a8C, Table 22.1.1.3.2-1)

Derivation Path: 36.508 clause 4.7.2-27A
Information Element	Value/remark	Comment	Condition
NAS message container	CP-ACK

22.1.2 NB-IoT / NTN / GSO

22.1.2.1 Test Purpose (TP)

(1)

with { UE in EMM-DEREGISTERED/RRC-IDLE and UE finds a cell which provides access by NB-IoT RAT }

ensure that {

when { Cell broadcasts systemInformationBlockType31-NB and UE has a valid GNSS position }

then { UE establishes RRC connection, and includes gnss-validityDuration in RRCConnectionSetupComplete-NB message, and successfully performs an attach procedure }

}

22.1.2.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 36.300 clauses 4.12, 23.21.1 and 23.21.6, TS 36.331 clauses 5.2.2.3, 5.2.2.4, 5.3.3.1a and 5.3.3.4. Unless otherwise stated these are Rel-17 requirements.

[TS 36.300, clause 4.12]

E-UTRAN supports radio access over non-terrestrial networks for BL UEs, UEs in enhanced coverage and NB-IoT UEs. Support for non-terrestrial networks encompasses platforms that provide radio access through Geosynchronous orbits (GSO), Non-Geosynchronous Orbit (NGSO), which includes Low-Earth Orbit (LEO) and Medium Earth Orbit (MEO) or High Altitude Platform Systems (HAPS).

The Figure 4.12-1 below illustrates an example of a Non-Terrestrial Network (NTN) providing non-terrestrial access by means of an NTN payload and an NTN Gateway, depicting a service link between the NTN payload and a UE, and a feeder link between the NTN Gateway and the NTN payload.

Figure 4.12-1: Overall illustration of an NTN

NOTE: Figure 4.12-1 illustrates an NTN; RAN4 aspects are out of scope.

The NTN payload transparently forwards the radio protocol received from the UE (via the service link) to the NTN Gateway (via the feeder link) and vice-versa. The following connectivity is supported by the NTN payload:

– An eNB may serve multiple NTN payloads;

– An NTN payload may be served by multiple eNBs.

NOTE: In this release, the NTN-payload may change the carrier frequency, before re-transmitting it on the service link, and vice versa (respectively on the feeder link).

For NTN, the following applies in addition to Network entity related Identities as described in clause 8.2:

– A Tracking Area corresponds to a fixed geographical area. Any respective mapping is configured in the RAN;

– A Mapped Cell ID as specified in clause 23.21.5.

Three types of service links are supported:

– Earth-fixed: provisioned by beam(s) continuously covering the same geographical areas all the time (e.g., the case of GSO satellites);

– Quasi-Earth-fixed: provisioned by beam(s) covering one geographic area for a limited period of time and a different geographic area during another period of time (e.g., the case of NGSO satellites generating steerable beams);

– Earth-moving: provisioned by beam(s) whose coverage area slides over the Earth surface (e.g., the case of NGSO satellites generating fixed or non-steerable beams).

With NGSO satellites, the eNB can provide either quasi-Earth-fixed cell coverage or Earth-moving cell coverage, while eNB operating with GSO satellites can provide Earth fixed cell coverage or quasi-Earth-fixed cell coverage.

[TS 36.300, clause 23.21.1]

Support for BL UEs, UEs in enhanced coverage and NB-IoT UEs over Non-Terrestrial Networks (see clause 4.12) is only applicable to E-UTRA connected to EPC. UEs not supporting NTN are barred from accessing an NTN cell.

In NTN, only BL UEs, UEs in enhanced coverage and NB-IoT UEs with GNSS capability are supported in this release of the specification.

To accommodate long propagation delays in NTN, increased timer values and window sizes, or delayed starting times are supported for the physical layer and for higher layers.

UL segmented transmission is supported for UL transmission with repetitions. The UE shall apply UE pre-compensation per segment of UL transmission of PUSCH/PUCCH/PRACH for BL UEs or UEs in enhanced coverage and NPUSCH/NPRACH for NB-IoT UEs from one segment to the next segment.

[TS 36.300, clause 23.21.6]

The Cell Identity, as defined in TS 36.413 [25] and TS 36.423 [42], corresponds to a Mapped Cell ID, irrespective of the orbit of the NTN payload or the types of service links supported in the following cases:

– The Cell Identity indicated by the eNB to the Core Network as part of the User Location Information, or as E-UTRAN CGI in the related S1AP messages;

– The Cell Identity used for Paging Optimization in S1 interface;

– The Cell Identity used for PWS.

For a BL UE or a UE in enhanced coverage, the Cell Identity included within the target identification of the handover messages allows identifying the correct target cell.

The mapping between Mapped Cell ID(s) and geographical area(s) is configured in the RAN and Core Network.

NOTE 1: A specific geographical location may be mapped to multiple Mapped Cell ID(s), and such Mapped Cell IDs may be configured to indicate different geographical areas (e.g. overlapping and/or with different dimensions).

For a BL UE or a UE in enhanced coverage or a NB-IoT UE that supports S1-U data transfer or User Plane CIoT EPS optimisation, the eNB is responsible for constructing the Mapped Cell ID based on the UE location information received from the UE, if available. The mapping may be pre-configured (e.g., depending on operator’s policy) or up to implementation.

NOTE 2: As described in TS 23.401 [17], the User Location Information may enable the MME to determine whether the UE is allowed to operate at its present location. Special Mapped Cell IDs or TACs may be used to indicate areas outside the serving PLMN’s country.

The eNB reports the broadcasted TAC(s) of the selected PLMN to the MME. In case the eNB knows the UE’s location information, the eNB may determine the TAI the UE is currently located in and provide that TAI to the MME.

[TS 36.331, clause 5.2.2.3]

The UE shall:

1> ensure having a valid version, as defined below, of (at least) the following system information, also referred to as the ‘required’ system information:

2> if in RRC_IDLE:

3> if the UE is a NB-IoT UE:

4> the MasterInformationBlock-NB/ MasterInformationBlock-TDD-NB and SystemInformationBlockType1-NB as well as SystemInformationBlockType2-NB through SystemInformationBlockType5-NB, SystemInformationBlockType22-NB;

…

3> the UE is NTN capable:

4> SystemInformationBlockType31 (SystemInformationBlockType31-NB in NB-IoT), if scheduled;

[TS 36.331, clause 5.2.2.4]

The UE shall:

…

1> if the UE is NTN capable:

2> if schedulingInfoList indicates that SystemInformationBlockType31 (SystemInformationBlockType31-NB in NB-IoT) is present:

3> immediately before establishing, resuming or re-establishing an RRC connection; or

3> if in RRC_CONNECTED and T317 is not running:

4> acquire SystemInformationBlockType31 (SystemInformationBlockType31-NB in NB-IoT);

2> if the UE supports discontinuous coverage; and

2> if schedulingInfoList indicates that SystemInformationBlockType32 (SystemInformationBlockType32-NB in NB-IoT) is present and the UE does not have a valid version of this system information block:

3> acquire SystemInformationBlockType32 (SystemInformationBlockType32-NB in NB-IoT);

[TS 36.331, clause 5.3.3.1d]

If systemInformationBlockType31 (systemInformationBlockType31-NB in NB-IoT) is broadcast, a RRC connection is initiated only if the UE has a valid GNSS position.

NOTE: The UE may need to re-acquire the GNSS position before establishing the connection to avoid interruption during the connection.

[TS 36.331, clause 5.3.3.4]

The UE shall:

…

1> set the content of RRCConnectionSetupComplete message as follows:

…

2> if the UE is connected to NTN:

3> include gnss-validityDuration in accordance with the remaining time of the GNSS validity duration;

…

1> submit the RRCConnectionSetupComplete message to lower layers for transmission;

22.1.2.3 Test description

22.1.2.3.1 Pre-test conditions

System Simulator:

– Ncell 1 as specified in TS 36.508 clause 8.1.4.1.1 is configured.

– System information combination 8 as defined in TS 36.508 [18] clause 8.1.4.3.1.1 is used.

UE:

– The UE is in Automatic PLMN selection mode.

– The UE’s positioning engine (e.g., standalone GNSS receiver) should be enabled to allow it to acquire the position. This could be done by use of AT command, such as AT+CPOS or other commands. Otherwise, or in addition any other suitable method may also be used, e.g., GNSS simulator.

Preamble:

– The UE is in State 1-NB switched off according to TS 36.508 [18].

22.1.2.3.2 Test procedure sequence

Table 22.1.2.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Power on the UE.	–	–	–	–
2	Check: Does the UE send an RRCConnectionRequest-NB on Ncell 1 within 6 minutes?	–>	RRCConnectionRequest-NB	1	P
3-14	Steps 3 to 14 of the registration procedure described in TS 36.508 [18] subclause 8.1.5.2.3 are performed on Ncell 1.	–	–	–	–
15	The SS transmits an RRCConnectionRelease-NB message to move to RRC_IDLE state.	<–	RRCConnectionRelease-NB	–	–

22.1.2.3.3 Specific message contents

Table 22.1.2.3.3-1: RRCConnectionSetupComplete-NB (step 4, table 22.1.2.3.2-1)

Derivation Path: TS 36.508 [18], Table 8.1.6.1-15
Information Element	Value/remark	Comment	Condition
RRCConnectionSetupComplete-NB ::= SEQUENCE {
criticalExtensions CHOICE {
rrcConnectionSetupComplete-r13 SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
gnss-ValidityDuration-r17	Present but contents not checked
}
}
}
}
}
}
}