22.5.7a NB-IoT / Normal tracking area update List of equivalent PLMNs in the TRACKING AREA UPDATE ACCEPT message / Normal tracking area update Rejected (IMSI invalid / Illegal ME / UE identity cannot be derived by the network / UE implicitly detached / PLMN not allowed

36.523-13GPPEvolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Packet Core (EPC)Part 1: Protocol conformance specificationRelease 17TSUser Equipment (UE) conformance specification

22.5.7a.1 Test Purpose (TP)

(1)

with { UE in EMM-TRACKING-AREA-UPDATING-INITIATED state }

ensure that {

when { the UE receives TRACKING AREA UPDATE ACCEPT message including a list of equivalent PLMNs }

then { the UE stores correctly the list and considers a forbidden PLMN if the forbidden PLMN is included in the equivalent list }

}

(2)

with { UE in EMM-TRACKING-AREA-UPDATING-INITIATED state }

ensure that {

when { the UE receives TRACKING AREA UPDATE ACCEPT message without a list of equivalent PLMNs }

then { the UE deletes the stored list and applies a normal PLMN selection process }

}

(3)

with { UE has sent a TRACKING AREA UPDATE REQUEST message}

ensure that {

when { UE receives a TRACKING AREA UPDATE REJECT message with the reject cause set to "Illegal UE" or "Illegal ME" }

then { UE considers the USIM as invalid for EPS services and enters state EMM-DEREGISTERED }

(4)

with { The UE is in the state EMM-DEREGISTERED }

ensure that {

when { UE is powered up }

then { UE send ATTACH REQUEST message with Old GUTI or IMSI IE = "IMSI"}

(5)

with { UE has sent a TRACKING AREA UPDATE REQUEST message}

ensure that {

when { UE receives a TRACKING AREA UPDATE REJECT message with the reject cause set to "UE identity cannot be derived by the network" }

then { UE deletes any GUTI, last visited registered TAI, TAI list and KSI and enters the state EMM-DEREGISTERED and subsequently, UE automatically initiates the attach procedure}

(6)

with { UE has sent a TRACKING AREA UPDATE REQUEST message}

ensure that {

when { UE receives a TRACKING AREA UPDATE REJECT message with the reject cause set to "UE implicitly detached" }

then { UE enters the state EMM-DEREGISTERED.NORMAL-SERVICE and sends ATTACH REQUEST message}

(7)

with { UE has sent a TRACKING AREA UPDATE REQUEST message }

ensure that {

when { UE receives a TRACKING AREA UPDATE REJECT message with the reject cause set to "PLMN not allowed" }

then { UE deletes the GUTI, the last visited registered TAI and KSI and UE deletes the list of equivalent PLMNs and UE enters state EMM-DEREGISTERED.PLMN-SEARCH and UE stores the PLMN in the "forbidden PLMN list" }

}

(8)

with { UE is switched off having a PLMN stored in the "forbidden PLMN list" }

ensure that {

when { UE is powered up on this PLMN }

then { UE doesn’t perform an attach procedure }

}

(9)

with { UE in EMM-DEREGISTERED.PLMN-SEARCH state having a PLMN stored in the "forbidden PLMN list" }

ensure that {

when { UE enters a cell which is not in the "forbidden PLMN list" }

then { UE initiates an attach procedure }

}

(10)

with { UE in E-UTRA EMM-DEREGISTERED.PLMN-SEARCH state having a PLMN stored in the "forbidden PLMN list" }

ensure that {

when { UE is in a forbidden PLMN cells and when the PLMN is selected manually }

then { UE initiates an attach procedure }

}

22.5.7a.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 24.301 clauses 5.5.3.2.4 , 5.5.3.2.5 , 5.5.2.2.4 ,

[TS 24.301, clause 5.5.3.2.4]

The MME may also include a list of equivalent PLMNs in the TRACKING AREA UPDATE ACCEPT message. Each entry in the list contains a PLMN code (MCC+MNC). The UE shall store the list as provided by the network, and if there is no PDN connection for emergency bearer services established, the UE shall remove from the list any PLMN code that is already in the list of "forbidden PLMNs" or in the list of "forbidden PLMNs for GPRS service". If the UE is not attached for emergency bearer services and there is a PDN connection for emergency bearer services established, the UE shall remove from the list of equivalent PLMNs any PLMN code present in the list of forbidden PLMNs or in the list of "forbidden PLMNs for GPRS service" when the PDN connection for emergency bearer services is released. In addition, the UE shall add to the stored list the PLMN code of the registered PLMN that sent the list. The UE shall replace the stored list on each receipt of the TRACKING AREA UPDATE ACCEPT message. If the TRACKING AREA UPDATE ACCEPT message does not contain a list, then the UE shall delete the stored list.

[TS 36.304, clause 5.2.4.4]

If the highest ranked cell or best cell according to absolute priority reselection rules is an intra-frequency or inter-frequency cell which is not suitable due to being part of the "list of forbidden TAs for roaming" or belonging to a PLMN which is not indicated as being equivalent to the registered PLMN, the UE shall not consider this cell and other cells on the same frequency as candidates for reselection for a maximum of 300s. If the UE enters into state any cell selection, any limitation shall be removed. If the UE is redirected under E-UTRAN control to a frequency for which the timer is running, any limitation on that frequency shall be removed.

[TS 24.301 clause 5.5.3.2.5]

If the tracking area updating cannot be accepted by the network, the MME sends a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value.

If a tracking area update request from a UE with a LIPA PDN connection is not accepted due to the reasons specified in subclause 5.5.3.2.4, the MME shall send the TRACKING AREA UPDATE REJECT message with EMM cause value #10 "Implicitly detached".

If the tracking area update request is rejected due to general NAS level mobility management congestion control, the network shall set the EMM cause value to #22 "congestion" and assign a back-off timer T3346.

If the tracking area update request is rejected due to incompatibility between the CIoT EPS optimizations supported by the UE and what the network supports and the network sets the EMM cause value to #15 "no suitable cells in tracking area", the network may additionally include the Extended EMM cause IE with value "requested EPS optimization not supported".

NOTE 1: How the UE uses the Extended EMM cause IE with value "requested EPS optimization not supported" is implementation specific. The UE still behaves according to the EMM cause value #15.

Upon receiving the TRACKING AREA UPDATE REJECT message, if the message is integrity protected or contains a reject cause other than EMM cause value #25, the UE shall stop timer T3430 and stop any transmission of user data.

….

The UE shall take the following actions depending on the EMM cause value received in the TRACKING AREA UPDATE REJECT message.

#3 (Illegal UE);

#6 (Illegal ME); or

….

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI. The UE shall consider the USIM as invalid for EPS services until switching off or the UICC containing the USIM is removed or the timer T3245 expires as described in subclause 5.3.7a. The UE shall delete the list of equivalent PLMNs and shall enter the state EMM-DEREGISTERED.

If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number and the MM parameters update status, TMSI, LAI and ciphering key sequence number as specified in 3GPP TS 24.008 [13] for the case when the normal routing area updating procedure is rejected with the GMM cause with the same value. The USIM shall be considered as invalid also for non-EPS services until switching off or the UICC containing the USIM is removed or the timer T3245 expires as described in subclause 5.3.7a.

NOTE 2: The possibility to configure a UE so that the radio transceiver for a specific radio access technology is not active, although it is implemented in the UE, is out of scope of the present specification.

….

#9 (UE identity cannot be derived by the network);

The UE shall set the EPS update status to EU2 NOT UPDATED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI. The UE shall enter the state EMM-DEREGISTERED.

If the rejected request was not for initiating a PDN connection for emergency bearer services, the UE shall subsequently, automatically initiate the attach procedure.

NOTE 3: User interaction is necessary in some cases when the UE cannot re-activate the EPS bearer(s) automatically.

If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number as specified in 3GPP TS 24.008 [13] for the case when the normal routing area updating procedure is rejected with the GMM cause with the same value.

#10 (Implicitly detached);

If the EPS update type is "periodic updating", a UE in CS/PS mode 1 or CS/PS mode 2 of operation is IMSI detached for both EPS services and non-EPS services.

The UE shall enter the state EMM-DEREGISTERED.NORMAL-SERVICE. The UE shall delete any mapped EPS security context or partial native EPS security context. If the rejected request was not for initiating a PDN connection for emergency bearer services, the UE shall then perform a new attach procedure.

NOTE 4: User interaction is necessary in some cases when the UE cannot re-activate the EPS bearer(s) automatically.

If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM state as specified in 3GPP TS 24.008 [13] for the case when the normal routing area updating procedure is rejected with the GMM cause with the same value.

#11 (PLMN not allowed); or

….

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI. The UE shall reset the tracking area updating attempt counter, delete the list of equivalent PLMNs and enter the state EMM-DEREGISTERED.PLMN-SEARCH.

The UE shall store the PLMN identity in the "forbidden PLMN list" and if the UE is configured to use timer T3245 (see 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17]) then the UE shall start timer T3245 and proceed as described in subclause 5.3.7a.

The UE shall perform a PLMN selection according to 3GPP TS 23.122 [6].

If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and routing area updating attempt counter and the MM parameters update status, TMSI, LAI, ciphering key sequence number and the location update attempt counter as specified in 3GPP TS 24.008 [13] for the case when the normal routing area updating procedure is rejected with the GMM cause with the same value and no RR connection exists.

[TS 24.301 clause5.5.2.2.4]

The following abnormal cases can be identified:

…

b) Lower layer failure or release of the NAS signalling connection before reception of DETACH ACCEPT message

The detach procedure shall be aborted and the UE proceeds as follows:

– if the detach procedure was performed due to disabling of EPS services, the UE shall enter the EMM-NULL state;

– if "EPS detach" was requested for reasons other than disabling of EPS services, the UE shall enter the EMM-DEREGISTERED state;

– if "IMSI detach" was requested, the UE shall enter the EMM-REGISTERED.NORMAL-SERVICE state and the MM-NULL state; or

– if "combined EPS/IMSI detach" was requested, the UE shall enter the EMM-DEREGISTERED state and the MM-NULL state.

…

f) Change of cell into a new tracking area

If a cell change into a new tracking area that is not in the stored TAI list occurs before the UE initiated detach procedure is completed, the detach procedure shall be aborted and re-initiated after successfully performing a tracking area updating procedure. If the detach procedure was initiated due to removal of the USIM or the UE is to be switched off, the UE shall abort the detach procedure and enter the state EMM-DEREGISTERED.

22.5.7a.3 Test description

22.5.7a.3.1 Pre-test conditions

System Simulator:

– Maximum 2 Ncells are on at any given time

– Ncell 55, Ncell 56 belong to PLMN2 and Ncell 63 belongs to PLMN3

– Ncell 50, Ncell 51, Ncell 55, Ncell 56 and Ncell 63 are defined in subclause 8.1.4.2 in TS 36.508[18]

– NB-IOT system information combination 2 as defined in TS 36.508[18] clause 8.1.4.3.1.1 is used in all cells

Table 22.5.7a.3-1: Time instances of cell power level and parameter changes

	Parameter	Unit	Ncell 50	Ncell 51	Ncell 55	Ncell 56	Ncell 63
T0	Cell-specific NRS EPRE	dBm/ 15kHz	-85	Off	Off	Off	Off
T1	Cell-specific NRS EPRE	dBm/ 15kHz	Off	-85	Off	Off	Off
T2	Cell-specific NRS EPRE	dBm/ 15kHz	Off	Off	-85	Off	Off
T3	Cell-specific NRS EPRE	dBm/ 15kHz	Off	Off	Off	Off	-85
T4	Cell-specific NRS EPRE	dBm/ 15kHz	Off	-85	-120	Off	Off
T5	Cell-specific NRS EPRE	dBm/ 15kHz	-85	-120	Off	Off	Off
T6	Cell-specific NRS EPRE	dBm/ 15kHz	-120	-85	Off	Off	Off
T7	Cell-specific NRS EPRE	dBm/ 15kHz	Off	-120	-85	Off	Off
T8	Cell-specific NRS EPRE	dBm/ 15kHz	Off	-85	Off	Off	Off
T9	Cell-specific NRS EPRE	dBm/ 15kHz	-85	-120	Off	Off	Off
T10	Cell-specific NRS EPRE	dBm/ 15kHz	-120	-85	Off	Off	Off
T11	Cell-specific NRS EPRE	dBm/ 15kHz	Off	Off	-120	-85	Off
T12	Cell-specific NRS EPRE	dBm/ 15kHz	Off	Off	-85	Off	Off
T13	Cell-specific NRS EPRE	dBm/ 15kHz	Off	Off	Off	Off	-85
T14	Cell-specific NRS EPRE	dBm/ 15kHz	Off	Off	Off	-85	-120

UE:

– The Test UICC shall be inserted. This shall contain a USIM application on UICC.

Preamble:

– the UE is in state Registered, Idle mode (State 3-NB) on Ncell 50 according to TS 36.508 [18] with PLMN3 on its "forbidden PLMN list".

22.5.7a.3.2 Test procedure sequence

22.5.7a.3.2 Test procedure sequence

Table 22.5.7a.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	SS adjusts the cell power levels according to row T1 in table 22.5.7a.3-1. All TRACKING AREA UPDATE REJECT messages below shall be sent integrity protected.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST message on NB-IoT Ncell 51.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	SS responds with a TRACKING AREA UPDATE ACCEPT message including PLMN2 and PLMN3 in the list of equivalent PLMNs.	<–	TRACKING AREA UPDATE ACCEPT	–	–
4	The UE transmits a TRACKING AREA UPDATE COMPLETE message	–>	TRACKING AREA UPDATE COMPLETE	–	–
5	SS Releases the RRC Connection.	–	–	–	–
6	SS adjusts the cell power levels according to row T2 in table 22.5.7a.3-1.	–	–	–	–
7	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message on Ncell 55 (PLMN2)?	–>	TRACKING AREA UPDATE REQUEST	1	P
8	The SS transmits a TRACKING AREA UPDATE ACCEPT message including PLMN1 and PLMN3 in the list of equivalent PLMNs.	<–	TRACKING AREA UPDATE ACCEPT	–	–
9	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
10	SS Releases the RRC Connection.	–	–	–	–
11	SS adjusts the cell power levels according to row T3 in table 22.5.7a.3-1. NOTE: Ncell 63 (PLMN3) belongs to the forbidden PLMN.	–	–	–	–
12	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message on NB-IoT Ncell 63 (PLMN3) in next 30 seconds?	–>	TRACKING AREA UPDATE REQUEST	1	F
13	The UE is switched to manual PLMN selection mode and is made to select PLMN3 in order to remove PLMN3 in the forbidden PLMN list in the UE.	–	–	–	–
14	The UE transmits a TRACKING AREA UPDATE REQUEST message on NB-IoT Ncell 63 (PLMN3).	–>	TRACKING AREA UPDATE REQUEST	–	–
15	The SS transmits a TRACKING AREA UPDATE ACCEPT message without the list of equivalent PLMNs.	<–	TRACKING AREA UPDATE ACCEPT	–	–
16	Check: Does the UE transmit a TRACKING AREA UPDATE COMPLETE message?	–>	TRACKING AREA UPDATE COMPLETE	1	P
17	SS releases the RRC connection	–	–	–	–
18	The UE is switched back to automatic PLMN selection mode.	–	–	–	–
19	Void
20	SS adjusts the cell power levels according to row T4 in table 22.5.7a.3-1.	–	–	–	–
21	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message on Ncell 51 (PLMN1)?	–>	TRACKING AREA UPDATE REQUEST	2	P
22	SS responds with TRACKING AREA UPDATE ACCEPT message	<–	TRACKING AREA UPDATE ACCEPT	–	–
23	The UE transmits a TRACKING AREA UPDATE COMPLETE message	–>	TRACKING AREA UPDATE COMPLETE	–	–
23A	The SS releases the RRC connection.
–	EXCEPTION: Steps 24 to 47 shall be repeated for (k=0,1)
24	SS adjusts the cell power levels according to row T5 in table 22.5.7a.3-1.	–	–	–	–
25	The UE transmits a TRACKING AREA UPDATE REQUEST on Ncell 50.	–>	TRACKING AREA UPDATE REQUEST	–	–
26	The SS transmits a TRACKING AREA UPDATE REJECT message: – if k=0 with EMM cause = "Illegal UE" – if k=1 with EMM cause = "Illegal ME"	<–	TRACKING AREA UPDATE REJECT	–	–
27	The SS releases the RRC connection.	–	–	–	–
28	SS adjusts the cell power levels according to row T6 in table 22.5.7a.3-1.	–	–	–	–
29	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds on Ncell 51? Note: NB-IoT Ncell 51 belongs to the same PLMN where the UE was rejected but a different TAC	–>	ATTACH REQUEST	3	F
30	The user initiates an attach by MMI or by AT command.	–	–	–	–
31	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds on Ncell 51?	–>	ATTACH REQUEST	3	F
32a1	SS adjusts the cell power levels according to row T7 in table 22.5.7a.3-1.	–	–	–	–
32a2	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds on Ncell 55? Note: Ncell 55 belongs to a PLMN which is not the same like the one on which the UE was rejected.	–>	ATTACH REQUEST	3	F
32a3	The user initiates an attach by MMI or by AT command.	–	–	–	–
32a4	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds on Ncell 55?	–>	ATTACH REQUEST	3	F
33	Switch-off the UE	–	–	–	–
34	SS adjusts the cell power levels according to row T8 in table 22.5.7a.3-1.	–	–	–	–
35	Switch-on the UE	–	–	–	–
36	Check: Does the UE transmit an ATTACH REQUEST message with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN or ESM DUMMY MESSAGE on Ncell 51?	–>	ATTACH REQUEST	4	P
37-46b1	The procedure is completed by executing steps 5 to 14b1 of the UE registration procedure in TS 36.508 subclause 8.1.5.2.
47	SS Releases the RRC Connection, and the UE is in state Registered, NB-IoT Idle Mode (N1) on Ncell 51	–	–	–	–
48	SS adjusts the cell power levels according to row T9 in table 22.5.7a.3-1.	–	–	–	–
49	The UE transmits a TRACKING AREA UPDATE REQUEST on Ncell 50.	–>	TRACKING AREA UPDATE REQUEST	–	–
50	The SS transmits a TRACKING AREA UPDATE REJECT message with EMM cause = " UE identity cannot be derived by the network " as specified.	<–	TRACKING AREA UPDATE REJECT	–	–
–	EXCEPTION: Steps 51-52a1 describes the behaviour that depends on UE behaviour (Note 1).	–	–	–	–
51	The SS releases the RRC connection.	–	–	–	–
–	EXCEPTION: Step 52a1 describes a behaviour which depends on the UE capability	–	–	–	–
52a1	IF NOT pc_Automatic_EPS_Re_Attach, the user initiates an attach by MMI or by AT command.	–	–	–	–
53	Check: Does the UE transmit an ATTACH REQUEST message with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN or ESM DUMMY MESSAGE message on Ncell 50?	–>	ATTACH REQUEST	5	P
54-63b1	The attach procedure is completed by executing steps 5 to 14b1 of the UE registration procedure in TS 36.508 subclause 8.1.5.2.
64	The SS releases the RRC connection.	–	–	–	–
65	SS adjusts the cell power levels according to row T10 in table 22.5.7a.3-1.	–	–	–	–
66	The UE transmits a TRACKING AREA UPDATE REQUEST on Ncell 51.	–>	TRACKING AREA UPDATE REQUEST	–	–
67	The SS transmits a TRACKING AREA UPDATE REJECT message with EMM cause = "UE implicitly detached" as specified.	<–	TRACKING AREA UPDATE REJECT	–	–
–	EXCEPTION: Steps 68a-68a1 describes the behaviour that depends on UE behaviour (Note 1).	–	–	–	–
68a	The SS releases the RRC connection.	–	–	–	–
–	EXCEPTION: Step 68a1 describes a behaviour which depends on the UE capability	–	–	–	–
68a1	IF NOT pc_Automatic_EPS_Re_Attach THEN the user initiates an attach by MMI or by AT command.	–	–	–	–
69	Check: Does the UE transmit an ATTACH REQUEST message with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN or ESM DUMMY MESSAGE message on Ncell 51?	–>	ATTACH REQUEST	6	P
70-79b1	The attach procedure is completed by executing steps 5 to 14b1 of the UE registration procedure in TS 36.508 sub clause 8.1.5.2.
80	The SS releases the RRC connection.	–	–	–	–
81	Void.	–	–	–	–
82-91b1	Void.
92	SS adjusts the cell power levels according to row T11 in table 22.5.7a.3-1.
93	The UE transmits a TRACKING AREA UPDATE REQUEST on Ncell 56.	–>	TRACKING AREA UPDATE REQUEST	–	–
94	The SS transmits a TRACKING AREA UPDATE REJECT message with EMM cause = "PLMN not allowed".	<–	TRACKING AREA UPDATE REJECT	–	–
95	The SS releases the RRC connection.	–	–	–	–
96	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on Ncell 56?	–>	ATTACH REQUEST	7	F
97	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
98	SS adjusts the cell power levels according to row T12 in table 22.5.7a.3-1.	–	–	–	–
99	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
100	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds on Ncell 55?	–>	ATTACH REQUEST	8	F
101	The user initiates an attach by MMI or by AT command.	–	–	–	–
102	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds on Ncell 55?	–>	ATTACH REQUEST	8	F
103	The following messages are sent and shall be received on Ncell 63.	–	–	–	–
104	SS adjusts the cell power levels according to row T13 in table 22.5.7a.3-1.	–	–	–	–
105	Check: Does the UE transmit ATTACH REQUEST message with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN or ESM DUMMY MESSAGE message on Ncell 63?	–>	ATTACH REQUEST	9	P
106-115b1	The attach procedure is completed by executing steps 5 to 14b1 of the UE registration procedure in TS 36.508 sub clause 8.1.5.2.	–	–	–	–
116	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
–	EXCEPTION: Step 117a1 describes behaviour that depends on the UE capability.
117a1	If pc_SwitchOnOff or pc_USIM_Removal then the UE transmits a DETACH REQUEST.	–>	DETACH REQUEST	–	–
118	The following messages are sent and shall be received on NB-IoT Ncell 56.	–	–	–	–
119	SS adjusts the cell power levels according to row T14 in table 22.5.7a.3-1. NOTE: Ncell 56 belongs to the forbidden PLMN.	–	–	–	–
120	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
121	The UE is switched to manual PLMN selection mode and is made to select the forbidden PLMN (PLMN2).	–	–	–	–
122	Check: Does the UE transmit ATTACH REQUEST message with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN or ESM DUMMY MESSAGE message?	–>	ATTACH REQUEST	10	P
123-132b1	The attach procedure is completed by executing steps 5 to 14b1 of the UE registration procedure in TS 36.508 sub clause 8.1.5.2.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state NB-IoT manual selection Mode (N5) according to TS 36.523-3.	–	–	–	–
133	The SS releases the RRC connection.	–	–	–	–
NOTE 1: SS waits for 1.5 second to receive the Attach Request on the existing RRC Connection. In case Attach Request is not received within 1.5 second then the existing RRC Connection is released.

22.5.7a.3.3 Specific message contents

Table 22.5.7a.3.3-1: Message TRACKING AREA UPDATE ACCEPT (step 3, Table 22.5.7a.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
Equivalent PLMNs	–	Includes MCC and MNC digits for PLMN2 (same PLMN as Ncell 55) and PLMN3 (same PLMN as Ncell 63).

Table 22.5.7a.3.3-2: Message TRACKING AREA UPDATE ACCEPT (step 8, Table 22.5.7a.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
Equivalent PLMNs	–	Includes MCC and MNC digits for PLMN1 (same PLMN as Ncell 50) and PLMN3 (same PLMN as Ncell 63).

Table 22.5.7a.3.3-3: Message TRACKING AREA UPDATE REJECT (step 26, Table 22.5.7a.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EMM cause	‘00000011’B	#3 "Illegal UE"	k=0
EMM cause	‘00000110’B	#6 "Illegal ME"	k=1

Table 22.5.7a.3.3-4: Message ATTACH REQUEST (step 36, Table 22.5.7a.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	IMSI

Table 22.5.7a.3.3-5: Message TRACKING AREA UPDATE REQUEST (step 49, Table 22.5.7a.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Old GUTI	GUTI-2
Old P-TMSI signature	Absent or any allowed value

Table 22.5.7a.3.3-6: Message TRACKING AREA UPDATE REJECT (step 50, Table 22.5.7a.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EMM cause	‘00001001’B	#9 "UE identity cannot be derived by the network"

Table 22.5.7a.3.3-7: Message ATTACH REQUEST (step 53, Table 22.5.7a.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	IMSI
Old P-TMSI signature	Not present
Last visited registered TAI	Not present

Table 22.5.7a.3.3-8: Message TRACKING AREA UPDATE REJECT (step 67, Table 22.5.7a.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EMM cause	‘00001010’B	#10 "UE implicitly detached"

Table 22.5.7a.3.3-9: Message ATTACH REQUEST (step 69, Table 22.5.7a.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	GUTI-1
Last visited registered TAI	TAI-1

Table 22.5.7a.3.3-10: Message TRACKING AREA UPDATE REQUEST (step 93, Table 22.5.7a.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Old GUTI	GUTI-7

Table 22.5.7a.3.3-11: Message TRACKING AREA UPDATE REJECT (step 94, Table 22.5.7a.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EMM cause	‘00001011’B	#11 " PLMN not allowed "

Table 22.5.7a.3.3-12: Message ATTACH REQUEST (step 105, Table 22.5.7a.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	IMSI
Old P-TMSI signature	Not present
Last visited registered TAI	Not present