22.5.13 NB-IoT / Attach Procedure / Success / Last visited TAI, TAI list and equivalent PLMN list handling
36.523-13GPPEvolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Packet Core (EPC)Part 1: Protocol conformance specificationRelease 17TSUser Equipment (UE) conformance specification
22.5.13.1 Test Purpose (TP)
(1)
with { UE attached to the network with a valid USIM inserted and a valid GUTI}
ensure that {
when { UE is powered off and then powered on }
then { the UE transmits an ATTACH REQUEST message with the EPS attach type set to "initial EPS attach", including GUTI and last visited registered TAI }
}
(2)
with { UE having a valid NAS security context and the UE switched-off }
ensure that {
when { UE is powered on}
then { the UE transmits an integrity protected ATTACH REQUEST message }
}
(3)
with { UE has sent an ATTACH REQUEST message }
ensure that {
when { UE receives an ATTACH ACCEPT message with EPS attach result matching the requested service(s), the TAI list the UE is registered to, a set of equivalent PLMNs matching the PLMNs within the TAI list }
then { UE deletes the old TAI list, stores the new TAI list, and does not perform a TAU while moving within this set of TAs }
}
(4)
with { UE has sent an ATTACH REQUEST message }
ensure that {
when { UE receives an ATTACH ACCEPT message with EPS attach result matching the requested service(s), the TAI list the UE is registered to, a set of equivalent PLMNs matching the PLMNs within the TAI list }
then { UE deletes the old TAI list, stores the new TAI list, and performs a TAU when moving out of this set of TAs}
}
(5)
with { UE has received a set of equivalent PLMNs in an ATTACH ACCEPT message }
ensure that {
when { the UE has been switched off; then switched on; and then the UE receives an ATTACH_ACCEPT message with a new set of equivalent PLMNs}
then { UE deletes the old equivalent PLMN list, and uses the new equivalent PLMN list}
}
22.5.13.2 Conformance requirements
References: The conformance requirements covered in the current TC are specified in: TS 24.301, clauses 5.3.4, 5.5.1.2.2, 5.5.1.2.4, 6.5.1.2 and 9.9.3.33, and TS 36.304 clause 4.3.
[TS 24.301, clause 5.3.4]
The UE shall store a list of equivalent PLMNs. These PLMNs shall be regarded by the UE as equivalent to each other for PLMN selection and cell selection/re-selection. The same list is used by EMM, GMM and MM.
The UE shall update or delete this list at the end of each attach or combined attach or tracking area updating or combined tracking area updating procedure. The stored list consists of a list of equivalent PLMNs as downloaded by the network plus the PLMN code of the registered PLMN that downloaded the list. When the UE is switched off, it shall keep the stored list so that it can be used for PLMN selection after switch on. The UE shall delete the stored list if the USIM is removed or when the UE attached for emergency bearer services enters the state EMM-DEREGISTERED. The maximum number of possible entries in the stored list is 16.
[TS 24.301, clause 5.5.1.2.2]
In state EMM-DEREGISTERED, the UE initiates the attach procedure by sending an ATTACH REQUEST message to the MME, starting timer T3410 and entering state EMM-REGISTERED-INITIATED (see example in figure 5.5.1.2.2.1).
…
If the UE is in NB-S1 mode, then the UE shall set the control plane CIoT EPS optimization bit to "control plane CIoT EPS optimization supported" in the UE network capability IE of the ATTACH REQUEST message.
If the UE is in NB-S1 mode, supports NB-S1 mode only, and requests to attach for EPS services and "SMS only", the UE shall indicate the SMS only requested bit to "SMS only" in the additional update type IE and shall set the EPS attach type IE to "EPS attach" in the ATTACH REQUEST message.
…
If EMM-REGISTERED without PDN connection is not supported by the UE or the MME, or if the UE wants to request PDN connection with the attach procedure, the UE shall send the ATTACH REQUEST message together with a PDN CONNECTIVITY REQUEST message contained in the ESM message container IE.
If EMM-REGISTERED without PDN connection is supported by the UE and the MME, and the UE does not want to request PDN connection with the attach procedure, the UE shall send the ATTACH REQUEST message together with an ESM DUMMY MESSAGE contained in the ESM message container information element.
If a valid EPS security context exists, the UE shall integrity protect the ATTACH REQUEST message combined with the message included in the ESM message container IE. When the UE does not have a valid EPS security context, the ATTACH REQUEST message combined with the message included in the ESM message container IE is not integrity protected.
[TS 24.301, clause 5.5.1.2.4]
The MME shall assign and include the TAI list the UE is registered to in the ATTACH ACCEPT message. The UE, upon receiving an ATTACH ACCEPT message, shall delete its old TAI list and store the received TAI list.
NOTE 3: When assigning the TAI list, the MME can take into account the eNodeB’s capability of support ofCIoT EPS optimization.
…
If the ATTACH ACCEPT message contains a GUTI, the UE shall use this GUTI as the new temporary identity. The UE shall delete its old GUTI and store the new assigned GUTI. If no GUTI has been included by the MME in the ATTACH ACCEPT message, the old GUTI, if any available, shall be kept.
…
The MME may also include a list of equivalent PLMNs in the ATTACH ACCEPT message. Each entry in the list contains a PLMN code (MCC+MNC). The UE shall store the list as provided by the network, and if the attach procedure is not for emergency bearer services, the UE shall remove from the list any PLMN code that is already in the list of "forbidden PLMNs" or in the list of "forbidden PLMNs for GPRS service". In addition, the UE shall add to the stored list the PLMN code of the registered PLMN that sent the list. The UE shall replace the stored list on each receipt of the ATTACH ACCEPT message. If the ATTACH ACCEPT message does not contain a list, then the UE shall delete the stored list.
[TS 24.301, clause 5.5.3.2.2, “Normal and periodic tracking area updating procedure initiation”]
The UE in state EMM-REGISTERED shall initiate the tracking area updating procedure by sending a TRACKING AREA UPDATE REQUEST message to the MME,
a) when the UE detects entering a tracking area that is not in the list of tracking areas that the UE previously registered in the MME, unless the UE is configured for "AttachWithIMSI" as specified in 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17] and is entering a tracking area in a new PLMN that is neither the registered PLMN nor in the list of equivalent PLMNs;
[TS 24.301, clause 6.5.1.2, “UE requested PDN connectivity procedure initiation”]
In order to request connectivity to a PDN using the default APN, the UE includes the access point name IE in the PDN CONNECTIVITY REQUEST message or, when applicable, in the ESM INFORMATION RESPONSE message, according to the following conditions:
– if use of a PDN using the default APN requires PAP/CHAP, then the UE should include the Access point name IE; and
– in all other conditions, the UE need not include the Access point name IE.
[TS 24.301, clause 9.9.3.33, “Tracking area identity list”]
The Tracking area identity list is a type 4 information element, with a minimum length of 8 octets and a maximum length of 98 octets. The list can contain a maximum of 16 different tracking area identities.
…
The value part of the Tracking area identity list information element consists of one or several partial tracking area identity lists. The length of each partial tracking area identity list can be determined from the ‘type of list’ field and the ‘number of elements’ field in the first octet of the partial tracking area identity list.
…
|
Partial tracking area identity list: |
|
Type of list (octet 1) |
|
Bits |
|
7 6 |
|
0 0 list of TACs belonging to one PLMN, with non-consecutive TAC values |
|
0 1 list of TACs belonging to one PLMN, with consecutive TAC values |
|
1 0 list of TAIs belonging to different PLMNs |
…
|
For type of list = "001" and number of elements = k: |
|
octet 2 to 4 contain the MCC+MNC, and |
|
octet 5 and 6 contain the TAC of the first TAI belonging to the partial list. |
|
The TAC values of the other k-1 TAIs are TAC+1, TAC+2, …, TAC+k-1. |
…
The MNC shall consist of 2 or 3 digits.
[TS 36.304, clause 4.3]
suitable cell:
A "suitable cell" is a cell on which the UE may camp on to obtain normal service. The UE shall have a valid USIM and such a cell shall fulfil all the following requirements.
– The cell is part of either:
– the selected PLMN, or:
– the registered PLMN, or:
– a PLMN of the Equivalent PLMN list
– For a CSG cell, the cell is a CSG member cell for the UE;
According to the latest information provided by NAS:
– The cell is not barred, see subclause 5.3.1;
– The cell is part of at least one TA that is not part of the list of "forbidden tracking areas for roaming" [4], which belongs to a PLMN that fulfils the first bullet above;
– The cell selection criteria are fulfilled, see subclause 5.2.3.2;
If more than one PLMN identity is broadcast in the cell, the cell is considered to be part of all TAs with TAIs constructed from the PLMN identities and the TAC broadcast in the cell.
22.5.13.3 Test description
22.5.13.3.1 Pre-test conditions
System Simulator:
NOTE: while this test describes the uses of 8 cells, it is intended that this test only requires 2 cells to be active at any one instant.
Table 22.5.13-1: Ncell TAI values
|
Ncell |
MCC |
MNC |
TAC (hex) |
Remark |
Freq |
List of frequencies in SIB5 |
Remark |
|
50 |
001 |
01 |
0002 |
2 digit MNC |
f1 |
f2, f3 |
HPLMN |
|
57 |
310 |
102 |
0002 |
3 digit MNC |
f3 |
f1, f2 |
See Note 1 |
|
51 |
001 |
01 |
0001 |
f1 |
f2, f3 |
HPLMN |
|
|
52 |
001 |
01 |
0027 |
f1 |
f2, f3 |
HPLMN |
|
|
55 |
004 |
07 |
fff0 |
f2 |
f1, f3 |
See Note 2 |
|
|
56 |
004 |
07 |
fff9 |
f2 |
f1, f3 |
See Note 2 |
|
|
59 |
316 |
002 |
0003 |
3 digit MNC |
f3 |
f1, f2 |
See Note 1 |
|
54 |
004 |
02 |
0003 |
f2 |
f1, f3 |
See Note 2 |
|
|
Note 1: Ncells 57 and 59 do not co-exist; the same frequency f3 is used. Note 2: Ncells 54, 55 and 56 do not co-exist; the same frequency f2 is used. |
|||||||
– System information combination 3 as defined in TS 36.508[18] clause 8.1.4.3.1.1 is used in NB-IoT cells;
– with the exception of the Physical Cell Identity and the list of frequencies in SIB5, all other parameters for these Ncells are the same as defined for Ncell 1 in TS 36.508 [18];
– the power level of Ncell 50 is the Serving Cell level defined in table 8.3.2.2.1-1 of TS 36.508 [18];
– the power levels of Ncells 51 to 59 are set to the Non-suitable Off level defined in table 8.3.2.2.1-1 of TS 36.508 [18].
Table 22.5.13-2: Time instances of cell power level and parameter changes
|
Parameter |
Unit |
Ncell 50 |
Ncell 57 |
Ncell 51 |
Ncell 52 |
Ncell 55 |
Ncell 56 |
Ncell 59 |
Ncell 54 |
|
|
T0 |
Cell-specific NRS EPRE |
dBm/ 15kHz |
-85 |
Off |
Off |
Off |
Off |
Off |
Off |
Off |
|
T1 |
Cell-specific NRS EPRE |
dBm/ 15kHz |
-97 |
-85 |
Off |
Off |
Off |
Off |
Off |
Off |
|
T2 |
Cell-specific NRS EPRE |
dBm/ 15kHz |
Off |
Off |
-85 |
Off |
Off |
Off |
Off |
Off |
|
T3 (N=3) |
Cell-specific NRS EPRE |
dBm/ 15kHz |
Off |
Off |
-97 |
-85 |
Off |
Off |
Off |
Off |
|
T3 (N=4) |
Cell-specific NRS EPRE |
dBm/ 15kHz |
Off |
Off |
Off |
-97 |
-85 |
Off |
Off |
Off |
|
T3 (N=5) |
Cell-specific NRS EPRE |
dBm/ 15kHz |
Off |
Off |
Off |
Off |
-97 |
-85 |
Off |
Off |
|
T3 (N=6) |
Cell-specific NRS EPRE |
dBm/ 15kHz |
Off |
Off |
Off |
Off |
Off |
-97 |
-85 |
Off |
|
T3 (N=7) |
Cell-specific NRS EPRE |
dBm/ 15kHz |
Off |
Off |
Off |
Off |
Off |
Off |
-97 |
-85 |
|
T4 |
Cell-specific NRS EPRE |
dBm/ 15kHz |
Off |
-85 |
Off |
Off |
Off |
Off |
Off |
-97 |
|
T5 |
Cell-specific NRS EPRE |
dBm/ 15kHz |
-85 |
Off |
Off |
Off |
Off |
Off |
Off |
-97 |
UE:
– The UE is previously registered on NB-IoT Cell, and when on NB-IoT Cell, the UE is last authenticated and registered on Ncell 50 using default message contents according to TS 36.508 [18].
Preamble:
– The UE is in state Switched OFF (State 1-NB) according to TS 36.508 [18].
22.5.13.3.2 Test procedure sequence
Table 22.5.13.3.2-1: Main behaviour
|
St |
Procedure |
Message Sequence |
TP |
Verdict |
|
|
U – S |
Message |
||||
|
– |
The following messages are to be observed on Ncell 50 unless explicitly stated otherwise. |
– |
– |
– |
– |
|
1-14b1 |
Steps 1-14b1 of the generic procedure for UE registration specified in TS 36.508 subclause 8.1.5.2.3 are performed. |
– |
– |
– |
– |
|
15 |
The SS transmits an RRCConnectionRelease-NB message. |
<– |
RRCConnectionRelease-NB |
– |
– |
|
16 |
SS adjusts the cell power levels according to row T1 in table 22.5.13-2. Note: Ncell 50 is still suitable but the UE shall select Ncell 57 |
– |
– |
– |
– |
|
– |
The following messages are to be observed on Ncell 57 unless explicitly stated otherwise. |
– |
– |
– |
– |
|
17 |
Wait 120 seconds for mobile to camp on Ncell 57 |
– |
– |
– |
– |
|
18 |
If possible (see ICS) switch off is performed or the USIM is removed. |
– |
– |
– |
– |
|
– |
EXCEPTION: Step 19 describe behaviour that depends on the UE capability. |
– |
– |
– |
– |
|
19 |
If pc_SwitchOnOff or pc_USIM_Removal (see step 18) then the UE sends DETACH REQUEST message. |
–> |
DETACH REQUEST |
– |
– |
|
20 |
SS adjusts the cell power levels according to row T2 in table 22.5.13-2. |
– |
– |
– |
– |
|
– |
The following messages are to be observed on Ncell 51 unless explicitly stated otherwise. |
– |
– |
– |
– |
|
21 |
The UE is brought back to operation or the USIM is inserted. |
– |
– |
– |
– |
|
22 |
Check: Does the UE send an integrity protected ATTACH REQUEST message (IF px_DoAttachWithoutPDN THEN the ESM DUMMY MESSAGE is piggybacked in ATTACH REQUEST, OTHERWISE the PDN CONNECTIVITY REQUEST message is piggybacked in ATTACH REQUEST) with the last visited TAI correctly indicating the TAI of Ncell 57; the GUTI allocated in step 13 and the KSIASME allocated in step 5? |
–> |
ATTACH REQUEST |
1, 2 |
P |
|
22a1-25 |
Steps 9a1-12 of the generic procedure for UE registration specified in TS 36.508 subclause 8.1.5.2.3 are performed. |
||||
|
26 |
The SS sends an ATTACH ACCEPT message allocating 16 TAIs and an aligned set of equivalent PLMNs. IF px_DoAttachWithoutPDN THEN the ESM DUMMY MESSAGE is piggybacked in ATTACH ACCEPT OTHERWISE the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message is piggybacked in ATTACH ACCEPT. |
<– |
ATTACH ACCEPT |
– |
– |
|
– |
EXCEPTION: In parallel to the event described in step 27 below the generic procedure for IP address allocation in the Control Plane specified in TS 36.508 subclause 8.1.5A.1 takes place performing IP address allocation in the Control Plane if requested by the UE. |
– |
– |
– |
– |
|
27 |
Steps 14a1-14b1 of the generic procedure for UE registration specified in TS 36.508 subclause 8.1.5.2.3 are performed. |
– |
– |
– |
|
|
27A |
The SS transmits an RRCConnectionRelease-NB message. |
RRCConnectionRelease-NB |
|||
|
28 |
The SS waits 5seconds |
– |
– |
– |
– |
|
– |
EXCEPTION steps 29 to 32 are repeated for N = 3 to N = 7 with Ncells 52, 55, 56, 59, 54 according to T3 in table 22.5.13-2. |
– |
– |
– |
– |
|
29 |
Cell power levels are set according to T3 and the value of N. |
– |
– |
– |
– |
|
30 |
Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message in the next 120 seconds? |
–> |
TRACKING AREA UPDATE REQUEST |
3 |
F |
|
31 |
Check: Does the UE camp on the strongest cell for each T3(x) in table 22.5.13-2 being applied by using the procedure in TS 36.508 subclause 8.1.5A.2? |
– |
– |
3 |
– |
|
32 |
The SS transmits an RRCConnectionRelease-NB message. |
<– |
RRCConnectionRelease-NB |
– |
– |
|
33 |
SS adjusts the cell power levels according to row T4 in table 22.5.13-2. Note: the new list of equivalent PLMNs allocated in step 26 means that list of equivalent PLMNs allocated in step 13 should have been deleted. Hence the PLMN of Ncell 57 shall not be selected by a cell reselection process, and the UE shall remain camped on Ncell 54. |
– |
– |
– |
– |
|
34 |
Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message on Ncell 57 in the next 120 seconds? |
–> |
TRACKING AREA UPDATE REQUEST |
5 |
F |
|
35 |
Check: Does the UE camp on Ncell 54 by using the procedure in TS 36.508 subclause 8.1.5A.2? |
– |
– |
5 |
– |
|
36 |
The SS transmits an RRCConnectionRelease-NB message. |
<– |
RRCConnectionRelease-NB |
– |
– |
|
37 |
SS adjusts the cell power levels according to row T5 in table 22.5.13-2. |
– |
– |
– |
– |
|
38 |
Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message on Ncell 50 with the last visited TAI set to the TAI of Ncell 54; the GUTI allocated in step 13 and the KSIASME allocated in step 5? |
–> |
TRACKING AREA UPDATE REQUEST |
4 |
P |
|
39 |
SS responds with TRACKING AREA UPDATE ACCEPT message |
<– |
TRACKING AREA UPDATE ACCEPT |
– |
– |
|
40 |
The UE transmits a TRACKING AREA UPDATE COMPLETE message |
–> |
TRACKING AREA UPDATE COMPLETE |
– |
– |
|
41 |
The SS releases the RRC connection. |
– |
– |
– |
– |
22.5.13.3.3 Specific message contents
Table 22.5.13.3.3-1: Message ATTACH ACCEPT (step 13, Table 22.5.13.3.2-1)
|
Derivation path: 36.508 table 4.7.2-1 |
|||
|
Information Element |
Value/Remark |
Comment |
Condition |
|
TAI list |
List of 2 TAIs |
||
|
Length of tracking area identity list contents |
11 |
The value in the length field |
|
|
Number of elements |
00001 |
||
|
Type of list |
010 |
More than one PLMN |
|
|
Partial tracking area identity list |
First TAI = TAI of Ncell 57; Second TAI = TAI of Ncell 50 |
||
|
GUTI |
MCC=001, MNC=01, MMEGI = 1, MMEC= 1, M-TMSI arbitrarily allocated but compliant to rules of TS 23.003 sub clause 2.8 |
Includes PLMN ID of Ncell 50 |
|
|
Equivalent PLMNs |
MCC=310, MNC=102 |
PLMN ID of Ncell 57 |
|
Table 22.5.13.3.3-2: Message ATTACH REQUEST (step 22, Table 22.5.13.3.2-1)
|
Derivation path: 36.508 table 4.7.2-4 |
|||
|
Information Element |
Value/Remark |
Comment |
Condition |
|
Sent in SECURITY PROTECTED NAS MESSAGE with valid integrity check |
|||
|
Old GUTI or IMSI |
GUTI allocated in step 13 |
||
|
NAS key set identifier |
KSI allocated in step 5 |
||
|
Last visited registered TAI |
TAI of Ncell 57 |
||
Table 22.5.13.3.3-3: Message ATTACH ACCEPT (step 26, Table 22.5.13.3.2-1)
|
Derivation path: 36.508 table 4.7.2-1 |
|||
|
Information Element |
Value/Remark |
Comment |
Condition |
|
TAI list |
Contains 3 separate partial tracking area ID lists |
||
|
Length of tracking area identity list contents |
32 |
The decimal value of the value in the length field |
|
|
Type of first partial tracking area identity list |
010 |
More than one PLMN |
|
|
Number of elements |
00010 |
3 elements |
|
|
First TAI |
MCC = 004, MNC = 02, TAC = 0003 |
||
|
Second TAI |
MCC = 005, MNC = 002, TAC = 0003 |
||
|
Third TAI |
MCC = 316, MNC = 002, TAC = 0003 |
||
|
Type of second partial tracking area identity list |
001 |
Consecutive TACs on same PLMN |
|
|
Number of consecutive TACS |
01001 |
10 elements |
|
|
TAI |
MCC = 004 MNC = 07 TAC = fff0 |
TAI with lowest numbered TAC |
|
|
Type of third partial tracking area identity list |
000 |
Individual TACs on same PLMN |
|
|
Number of elements |
00010 |
3 |
|
|
MCC |
MCC = 001 |
||
|
MNC |
MNC = 01 |
||
|
First TAC |
TAC = 0001 |
||
|
Second TAC |
TAC = 0005 |
||
|
Third TAC |
TAC = 0027 |
||
|
GUTI |
MCC=001, MNC = 01, MMEGI = 64000, MMEC= 127, M-TMSI arbitrarily allocated but compliant to rules of TS 23.003 sub clause 2.8 |
Includes PLMN ID of Ncell 51. |
|
|
Equivalent PLMNs |
MCC=004, MNC=02; MCC=004, MNC=03; MCC=004, MNC=07; MCC=316, MNC=002; |
4 equivalent PLMNs |
|
Table 22.5.13.3.3-4: Message TRACKING AREA UPDATE REQUEST (step 38, Table 22.5.13.3.2-1)
|
Derivation path: 36.508 table 4.7.2-27 |
|||
|
Information Element |
Value/Remark |
Comment |
Condition |
|
Old GUTI |
GUTI allocated in step 26 |
||
|
NAS key set identifier ASME |
Same as allocated in step 5 |
||
|
Last visited registered TAI |
TAI of Ncell 54 |
||