9.2.1 Attach procedure

36.523-13GPPEvolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Packet Core (EPC)Part 1: Protocol conformance specificationRelease 17TSUser Equipment (UE) conformance specification

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

9.2.1.1 Attach procedure for EPS services

9.2.1.1.0 General

NOTE: Although section 9.2.1.1 is specifically dedicated to Attach for EPS services, it contains also a number of TCs that verify UE behaviour in EPS and Combined attach environments. The extension of the scope of these TCs was decided on a later stage and they were kept in the present section to avoid problems with changing TC numbers which would have been the result if the TCs were moved to another section.

9.2.1.1.1 Attach / Success / Valid GUTI

9.2.1.1.1.1 Test Purpose (TP)

(1)

with { the UE is switched-off with a valid USIM inserted and the USIM contains a valid GUTI and last visited registered TAI }

ensure that {

when { UE is powered on in a cell not belonging to the last visited registered TAI and in a different PLMN }

then { the UE establishes the RRC connection without S-TMSI, with registeredMME and with the RRC establishmentCause set to ‘mo-Signalling’ }

}

(2)

with { UE is switched-off with a valid USIM inserted and the USIM contains a valid GUTI and last visited registered TAI }

ensure that {

when { UE is powered on in a cell not belonging to the last visited registered TAI }

then { the UE transmits an ATTACH REQUEST message with the EPS attach type set to "EPS attach", including the GUTI and last visited registered TAI copied from the USIM, and, a PDN CONNECTIVITY REQUEST message with the request type set to "initial request" and not including APN }

}

(3)

with { UE has sent an ATTACH REQUEST message }

ensure that {

when { UE receives an ATTACH ACCEPT message with EPS attach result matching the requested service(s), the TAI list the UE is registered to and including an ACTIVATE DEFAULT EPS CONTEXT BEARER message with IE EPS Bearer Identity for the default EPS bearer context activated for the UE }

then { UE accepts the allocated GUTI, deletes the old TAI list and transmits an ATTACH COMPLETE message, together with ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message and enters EMM-REGISTERED state }

}

9.2.1.1.1.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clauses 5.3.1.1, 5.5.1.2.1, 5.5.1.2.2, 5.5.1.2.4, 6.2.2, 6.4.1.3, 6.5.1.2 and Annex D, and TS 36.331, clauses 5.3.3.3 and 5.3.3.4.

[TS 24.301, clause 5.3.1.1]

When the UE is in EMM-IDLE mode and needs to transmit an initial NAS message, the UE shall request the lower layer to establish a RRC connection. In this request to the lower layer the NAS shall provide to the lower layer the RRC establishment cause and the call type as specified in annex D of this specification.

…

For the routing of the initial NAS message to the appropriate MME, the UE NAS provides the lower layers with either the S-TMSI or the registered globally unique MME identifier (GUMMEI) that consists of the PLMN ID, the MME group ID, and the MME code (see 3GPP TS 23.003 [2]) according to the following rules:

– When the UE is registered in the tracking area of the current cell during the NAS signalling connection establishment, the UE NAS shall provide the lower layers with the S-TMSI, but shall not provide the registered MME identifier to the lower layers. Exceptionally, when the UE in EMM-IDLE mode initiates a tracking area updating or combined tracking area updating procedure for load balancing purposes, the UE NAS shall provide the lower layers with neither S-TMSI nor registered MME identifier.

– When the UE is not registered in the tracking area of the current cell during the NAS signalling connection establishment, the UE NAS does not provide the lower layers with the S-TMSI. Instead,

a) if the TIN indicates "GUTI" or "RAT-related TMSI", or the TIN is not available, and the UE holds a valid GUTI, the UE NAS shall provide the lower layers with the MME identifier part of the valid GUTI; or

b) if the TIN indicates "P-TMSI" and the UE holds a valid P-TMSI and RAI, the UE NAS shall provide the lower layers with the MME identifier part of the mapped GUTI, which is generated from the P-TMSI and RAI.

[TS 24.301, clause 5.5.1.1]

The attach procedure is used to attach to an EPC for packet services in EPS.

The attach procedure is used for two purposes:

– by a UE in PS mode of operation to attach for EPS services only; or

– by a UE in CS/PS mode 1 or CS/PS mode 2 of operation to attach for both EPS and non-EPS services.

With a successful attach procedure, a context is established for the UE in the MME, and a default bearer is established between the UE and the PDN GW, thus enabling always-on IP connectivity to the UE. The network may also initiate the activation of dedicated bearers as part of the attach procedure.

…

[TS 24.301, clause 5.5.1.2.1]

This procedure is used by a UE to attach for EPS services only. When the UE initiates the EPS attach procedure, the UE shall indicate "EPS attach" in the EPS attach type IE.

[TS 24.301, clause 5.5.1.2.2]

In state EMM-DEREGISTERED, the UE initiates the attach procedure by sending an ATTACH REQUEST message to the MME, starting timer T3410 and entering state EMM-REGISTERED-INITIATED (see example in figure 5.5.1.2.2.1). If timer T3402 is currently running, the UE shall stop timer T3402. If timer T3411 is currently running, the UE shall stop timer T3411.

If the UE supports neither A/Gb mode nor Iu mode, the UE shall handle the Old GUTI or IMSI IE in the ATTACH REQUEST message as follows:

…

The UE shall send the ATTACH REQUEST message together with a PDN CONNECTIVITY REQUEST message contained in the ESM message container information element to request PDN connectivity.

…

If a valid NAS security context exists, the UE shall integrity protect the ATTACH REQUEST message combined with the PDN CONNECTIVITY REQUEST message. When the UE does not have a valid NAS security context, the ATTACH REQUEST message combined with the PDN CONNECTIVITY REQUEST message is not integrity protected.

…

[TS 24.301, clause 5.5.1.2.4]

…

If the ATTACH ACCEPT message contains a GUTI, the UE shall use this GUTI as the new temporary identity. The UE shall delete its old GUTI and store the new assigned GUTI. If no GUTI has been included by the MME in the ATTACH ACCEPT message, the old GUTI, if any available, shall be kept.

…

When the UE receives the ATTACH ACCEPT message combined with the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message, it shall forward the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message to the ESM sublayer. Upon receipt of an indication from the ESM sublayer that the default EPS bearer context has been activated, the UE shall send an ATTACH COMPLETE message together with an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message contained in the ESM message container information element to the network.

…

[TS 24.301, clause 6.2.2]

The UE shall set the PDN type IE in the PDN CONNECTIVITY REQUEST message based on its IP stack configuration as follows:

a) A UE, which is IPv6 and IPv4 capable and

– has not been allocated an IP address for this APN, shall set the PDN type IE to IPv4v6.

– has been allocated an IPv4 address for this APN and received the ESM cause #52, "single address bearers only allowed", and is requesting an IPv6 address, shall set the PDN type IE to IPv6.

– has been allocated an IPv6 address for this APN and received the ESM cause #52, "single address bearers only allowed", and is requesting an IPv4 address, shall set the PDN type IE to IPv4.

b) A UE, which is only IPv4 capable, shall set the PDN type IE to IPv4.

c) A UE, which is only IPv6 capable, shall set the PDN type IE to IPv6.

d) When the IP version capability of the UE is unknown in the UE (as in the case when the MT and TE are separated and the capability of the TE is not known in the MT), the UE shall set the PDN type IE to IPv4v6.

…

[TS 24.301, clause 6.4.1.3]

Upon receipt of the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message, the UE shall send an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message and enter the state BEARER CONTEXT ACTIVE. When the default bearer is activated as part of the attach procedure, the UE shall send the ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message together with ATTACH COMPLETE message. When the default bearer is activated as the response to the stand-alone PDN CONNECTIVITY REQUEST message, the UE shall send the ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message alone.

The UE checks the PTI in the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message to identify the UE requested PDN connectivity procedure to which the default bearer context activation is related (see subclause 6.5.1).

…

[TS 24.301, clause 6.5.1.2]

When the PDN CONNECTIVITY REQUEST message is sent together with an ATTACH REQUEST message, the UE shall not include the APN.

NOTE: If the UE needs to provide PCO which require ciphering or provide an APN, or both, during the attach procedure, the ESM information transfer flag is included in the PDN CONNECTIVITY REQUEST. The MME then at a later stage in the PDN connectivity procedure initiates the ESM information request procedure in which the UE can provide the MME with PCO or APN or both.

…

The UE shall set the request type to "initial request" when the UE is establishing connectivity to a PDN for the first time, i.e. when it is an initial attach to that PDN. The UE shall set the request type to "handover" when the connectivity to a PDN is established upon handover from a non-3GPP access network and the UE was connected to that PDN before the handover to the 3GPP access network.

…

[TS 24.301, Annex D]

…

Table D.1.1: Mapping of NAS procedure to establishment cause and call type

NAS procedure	RRC establishment cause (according 3GPP TS 36.331 [22])	Call type
Attach	MO signalling (See Note 1)	"originating signalling"
…
Note 1: For these NAS procedures initiated by UEs of access class 12, 13 or 14 in their home country, the RRC establishment cause will be set to "High priority access AC 11 – 15". For this purpose the home country is defined as the country of the MCC part of the IMSI, see 3GPP TS 22.011 [1A]. For these NAS procedures initiated by UE of access class 11 or 15 in their HPLMN or (if the EHPLMN list is not present or is empty) EHPLMN, (if the EHPLMN list is present) the RRC establishment cause will be set to "High priority access AC 11 – 15".

[TS 36.331, clause 5.3.3.3 “Actions related to transmission of RRCConnectionRequest message”]

The UE shall set the contents of RRCConnectionRequest message as follows:

1> set the ue-Identity as follows:

2> if upper layers provide an S-TMSI:

3> set the ue-Identity to the value received from upper layers;

2> else

3> draw a random value in the range 0 .. 2⁴⁰-1 and set the ue-Identity to this value;

NOTE 1 Upper layers provide the S-TMSI if the UE is registered in the TA of the current cell.

1> Set the establishmentCause in accordance with the information received from upper layers;

[TS 36.331 clause 5.3.3.4]

…

The UE shall:

…

1> set the content of RRCConnectionSetupComplete message as follows:

2> set the selectedPLMN-Identity to the PLMN selected by upper layers (see TS 23.122 [11], TS 24.301 [35]) from the PLMN(s) included in the plmn-IdentityList in SystemInformationBlockType1;

2> if upper layers provide the ‘Registered MME’, include and set the registeredMME as follows:

3> if the PLMN identity of the ‘Registered MME’ is different from the PLMN selected by the upper layers:

4> include the plmnIdentity in the registeredMME and set it to the value of the PLMN identity in the ‘Registered MME’ received from upper layers;

3> set the mmegi and the mmec to the value received from upper layers;

…

2> submit the RRCConnectionSetupComplete message to lower layers for transmission, upon which the procedure ends;

9.2.1.1.1.3 Test description

9.2.1.1.1.3.1 Pre-test conditions

System Simulator:

– Cell A.

UE:

– The UE is configured to initiate EPS attach;

– The UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell H using default message contents according to TS 36.508 [18].

NOTE: For cell A, (MCC, MNC, TAI) is (MCC stored in EF_IMSI, 02, TAI-8).

Preamble:

– The UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.1.3.2 Test procedure sequence

Table 9.2.1.1.1.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2	Check: Does the UE transmit an RRCConnectionRequest message not including S-TMSI and with establishmentCause set to ‘mo-Signalling’?	–	–	1	P
3	The SS transmits an RRCConnectionSetup message.	–	–	–	–
4	Check: Does the UE transmit an RRCConnectionSetupComplete message including PLMN ID, MME group ID and MME code with ATTACH REQUEST message including a GUTI and a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	2	P
5-15	Steps 5-15 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
16	Check: Does the UE transmit an ATTACH COMPLETE message including an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message?	–>	ATTACH COMPLETE	2	P
16a1-18b1	Steps 16a1-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
19	Check: Does the test result of CALL generic procedure [18] clause 6.4.2.4 indicate that the UE is in E-UTRA EMM-REGISTERED state on Cell A?	–	–	3	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.1.1.3.3 Specific message contents

Table 9.2.1.1.1.3.3-1: Message RRCConnectionRequest (step 2, Table 9.2.1.1.1.3.2-1)

Derivation path: 36.508 table 4.6.1-16
Information Element	Value/Remark	Comment	Condition
RRCConnectionRequest ::= SEQUENCE {
criticalExtensions CHOICE {
rrcConnectionRequest-r8 SEQUENCE {
ue-Identity CHOICE {
randomValue	Not checked
}
establishmentCause	mo-Signalling
}
}
}

Table 9.2.1.1.1.3.3-2: Message RRCConnectionSetupComplete (step 4, Table 9.2.1.1.1.3.2-1)

Derivation path: 36.508 table 4.6.1-18
Information Element	Value/Remark	Comment	Condition
RRCConnectionSetupComplete ::= SEQUENCE {
criticalExtensions CHOICE {
c1 CHOICE {
rrcConnectionSetupComplete-r8 SEQUENCE {
registeredMME {
plmn-Identity	PLMN ID(MCC as stored in EF_IMSI on the test USIM card and MNC 02)
mmegi	1000000000001000	Bit 0 is LSB
mmec	00000001	Bit 0 is LSB
}
}
}
}

Table 9.2.1.1.1.3.3-3: Message ATTACH REQUEST (step 4, Table 9.2.1.1.1.3.2-1)

Derivation path: TS 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	GUTI(belonging to PLMN with same MCC as stored in EF_IMSI on the test USIM card and MNC 02 )	GUTI copied from USIM Old and valid GUTI is included by the UE
ESM message container	PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN
Last visited registered TAI	TAI8	GUTI copied from USIM If available, the last TAI is included by UE and will be used to establish a good list of TAIs in subsequent ATTACH ACCEPT message.

Table 9.2.1.1.1.3.3-4: Void

Table 9.2.1.1.1.3.3-5: Void

Table 9.2.1.1.1.3.3-6: Void

Table 9.2.1.1.1.3.3-7: Void

9.2.1.1.1a Attach Procedure / Success / Last visited TAI, TAI list and equivalent PLMN list handling

9.2.1.1.1a.1 Test Purpose (TP)

(1)

with { UE attached to the network with a valid USIM inserted and a valid GUTI}

ensure that {

when { UE is powered off and then powered on }

then { the UE transmits an ATTACH REQUEST message with the EPS attach type set to "initial EPS attach", including GUTI and last visited registered TAI and a PDN CONNECTIVITY REQUEST message with the request type set to "initial attach" and not including APN }

}

(2)

with { UE having a valid NAS security context and the UE switched-off }

ensure that {

when { UE is powered on}

then { the UE transmits an integrity protected ATTACH REQUEST message combined with the PDN CONNECTIVITY REQUEST message}

}

(3)

with { UE has sent an ATTACH REQUEST message }

ensure that {

when { UE receives an ATTACH ACCEPT message with EPS attach result matching the requested service(s), the TAI list the UE is registered to, a set of equivalent PLMNs matching the PLMNs within the TAI list, and including an ACTIVATE DEFAULT EPS CONTEXT BEARER message with IE EPS Bearer Identity for the default EPS bearer context activated for the UE }

then { UE deletes the old TAI list, stores the new TAI list, and does not perform a TAU while moving within this set of TAs }

}

(4)

with { UE has sent an ATTACH REQUEST message }

ensure that {

then { UE deletes the old TAI list, stores the new TAI list, and performs a TAU when moving out of this set of TAs}

}

(5)

with { UE has received a set of equivalent PLMNs in an ATTACH ACCEPT message }

ensure that {

when { the UE has been switched off; then switched on; and then the UE receives an ATTACH_ACCEPT message with a new set of equivalent PLMNs}

then { UE deletes the old equivalent PLMN list, and uses the new equivalent PLMN list}

}

9.2.1.1.1a.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clauses 5.3.3, 5.5.1.2.2, 5.5.1.2.4, 6.5.1.2 and 9.9.3.33, and TS 36.304 clause 4.3.

[TS 24.301, clause 5.3.3]

The UE shall store a list of equivalent PLMNs. These PLMNs shall be regarded by the UE as equivalent to each other for PLMN selection and cell selection/re-selection. The same list is used by EMM, GMM and MM.

The UE shall update or delete this list at the end of each attach or tracking area updating procedure. The stored list consists of a list of equivalent PLMNs as downloaded by the network plus the PLMN code of the registered PLMN that downloaded the list. When the UE is switched off, it shall keep the stored list so that it can be used for PLMN selection after switch on. The UE shall delete the stored list if the USIM is removed. The maximum number of possible entries in the stored list is 16.

[TS 24.301, clause 5.5.1.2.2]

…

The UE shall include in the ATTACH REQUEST message a valid GUTI together with the last visited registered TAI, if available. If there is no valid GUTI available, the UE shall include the IMSI in the ATTACH REQUEST message.

The UE shall send the ATTACH REQUEST message together with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN (see subclause 6.5.1).

…

If a valid NAS security context exists, the UE shall integrity protect the ATTACH REQUEST message combined with the PDN CONNECTIVITY REQUEST message.

[TS 24.301, clause 5.5.1.2.4]

The MME shall assign and include the TAI list the UE is registered to in the ATTACH ACCEPT message. The UE, upon receiving an ATTACH ACCEPT message, shall delete its old TAI list and store the received TAI list.

…

If the ATTACH ACCEPT message contains a GUTI, the UE shall use this GUTI as the new temporary identity and set its TIN to "GUTI". The UE shall delete its old GUTI and store the new assigned GUTI. If no GUTI has been included by the MME in the ATTACH ACCEPT message, the old GUTI, if any available, shall be kept.

…

The MME may also include a list of equivalent PLMNs in the ATTACH ACCEPT message. Each entry in the list contains a PLMN code (MCC+MNC). The UE shall store the list as provided by the network, after having removed from the list any PLMN code that is already in the list of forbidden PLMNs. In addition, the UE shall add to the stored list the PLMN code of the registered PLMN that sent the list. The UE shall replace the stored list on each receipt of the ATTACH ACCEPT message. If the ATTACH ACCEPT message does not contain a list, then the UE shall delete the stored list.

[TS 24.301, clause 5.5.3.2.2, “Normal and periodic tracking area updating procedure initiation”]

The UE in state EMM-REGISTERED shall initiate the tracking area updating procedure by sending a TRACKING AREA UPDATE REQUEST message to the MME,

a) when the UE detects entering a tracking area that is not in the list of tracking areas that the UE previously registered in the MME;

[TS 24.301, clause 6.5.1.2, “UE requested PDN connectivity procedure initiation”]

In order to request connectivity to the default PDN, the UE shall not include any APN in the PDN CONNECTIVITY REQUEST message.

[TS 24.301, clause 9.9.3.33, “Tracking area identity list”]

The Tracking area identity list is a type 4 information element, with a minimum length of 8 octets and a maximum length of 98 octets. The list can contain a maximum of 16 different tracking area identities.

…

The value part of the Tracking area identity list information element consists of one or several partial tracking area identity lists. The length of each partial tracking area identity list can be determined from the ‘type of list’ field and the ‘number of elements’ field in the first octet of the partial tracking area identity list.

…

Partial tracking area identity list:

Type of list (octet 1)

Bits

7 6

0 0 list of TACs belonging to one PLMN, with non-consecutive TAC values

0 1 list of TACs belonging to one PLMN, with consecutive TAC values

1 0 list of TAIs belonging to different PLMNs

…

For type of list = "001" and number of elements = k:

octet 2 to 4 contain the MCC+MNC, and

octet 5 and 6 contain the TAC of the first TAI belonging to the partial list.

The TAC values of the other k-1 TAIs are TAC+1, TAC+2, …, TAC+k-1.

…

The MNC shall consist of 2 or 3 digits.

[TS 36.304, clause 4.3]

suitable cell:

A "suitable cell" is a cell on which the UE may camp on to obtain normal service. Such a cell shall fulfil all the following requirements.

The cell is part of either:
the selected PLMN, or:
the registered PLMN, or:
a PLMN of the Equivalent PLMN list

according to the latest information provided by NAS:

9.2.1.1.1a.3 Test description

9.2.1.1.1a.3.1 Pre-test conditions

System Simulator:

NOTE: while this test describes the uses of 8 cells, it is intended that this test only requires 2 cells to be active at any one instant.

Table 9.2.1.1.1a-1: Cell TAI values

Cell	MCC	MNC	TAC (hex)	Remark	Freq	List of frequencies in SIB5	Remark
A	001	01	0002	2 digit MNC	f1	f2, f3	HPLMN
I	005	102	0002	3 digit MNC	f3	f1, f2	See Note 1
B	001	01	0001		f1	f2, f3	HPLMN
C	001	01	0027		f1	f2, f3	HPLMN
G	004	07	fff0		f2	f1, f3	See Note 2
H	004	07	fff9		f2	f1, f3	See Note 2
K	006	002	0003	3 digit MNC	f3	f1, f2	See Note 1
E	004	02	0003		f2	f1, f3	See Note 2
Note 1: Cell I and Cell K do not co-exist; the same frequency f3 is used. Note 2: Cell E and Cells G and H do not co-exist; the same frequency f2 is used.

– System information combination 3 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells;

– with the exception of the Physical Cell Identity and the list of frequencies in SIB5, all other parameters for these cells are the same as defined for cell 1 in TS 36.508 [18];

– The power level of cell A is the Serving Cell level defined in table 6.2.2.1-1 of TS 36.508 [18];

– The power levels of cells B to K are set to the Non-suitable Off level defined in table 6.2.2.1-1 of TS 36.508 [18].

Table 9.2.1.1.1a-2: Time instances of cell power level and parameter changes

	Parameter	Unit	Cell A	Cell I	Cell B	Cell C	Cell G	Cell H	Cell K	Cell E
T0	Cell-specific RS EPRE	dBm/ 15kHz	-85	Off	Off	Off	Off	Off	Off	Off
T1	Cell-specific RS EPRE	dBm/ 15kHz	-97	-85	Off	Off	Off	Off	Off	Off
T2	Cell-specific RS EPRE	dBm/ 15kHz	Off	Off	-85	Off	Off	Off	Off	Off
T3 (N=3)	Cell-specific RS EPRE	dBm/ 15kHz	Off	Off	-97	-85	Off	Off	Off	Off
T3 (N=4)	Cell-specific RS EPRE	dBm/ 15kHz	Off	Off	Off	-97	-85	Off	Off	Off
T3 (N=5)	Cell-specific RS EPRE	dBm/ 15kHz	Off	Off	Off	Off	-97	-85	Off	Off
T3 (N=6)	Cell-specific RS EPRE	dBm/ 15kHz	Off	Off	Off	Off	Off	-97	-85	Off
T3 (N=7)	Cell-specific RS EPRE	dBm/ 15kHz	Off	Off	Off	Off	Off	Off	-97	-85
T4	Cell-specific RS EPRE	dBm/ 15kHz	Off	-85	Off	Off	Off	Off	Off	-97
T5	Cell-specific RS EPRE	dBm/ 15kHz	-85	Off	Off	Off	Off	Off	Off	-97

UE:

– The UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

Preamble:

– The UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.1a.3.2 Test procedure sequence

Table 9.2.1.1.1a.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
1	The UE is switched on.	–	–	–	–
2-7C	Steps 4-13 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
8	SS responds with ATTACH ACCEPT message including a valid TAI list containing the TAIs of Cell A and Cell I; with PLMN ID of Cell A included in the GUTI; and with the PLMN ID of Cell I included in the Equivalent PLMNs IE. The ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message is piggybacked in ATTACH ACCEPT message	<–	ATTACH ACCEPT	–	–
8A	The UE transmits an RRCConnectionReconfigurationComplete message to confirm the establishment of default bearer	–>	RRC: RRCConnectionReconfigurationComplete	–	–
9-11Ab1	Steps 16-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
12	SS adjusts the cell power levels according to row T1 in table 9.2.1.1.1a-2. Note: Cell A is still suitable but the UE shall select Cell I	–	–	–	–
–	The following messages are to be observed on Cell I unless explicitly stated otherwise.	–	–	–	–
13	Wait 70 seconds for mobile to camp on Cell I	–	–	–	–
14	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
–	EXCEPTION: Step 14A and 15 describe behaviour that depends on the UE capability.	–	–	–	–
14A	UE may optionally perform IMS de-registration using the generic procedure defined in 34.229-1 [35] Annex C.30.	–	–	–	–
15	If pc_SwitchOnOff or pc_USIM_Removal (see step 14) then the UE sends DETACH REQUEST message.	–>	DETACH REQUEST	–	–
16	SS adjusts the cell power levels according to row T2 in table 9.2.1.1.1a-2.	–	–	–	–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
17	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
18	Check: Does the UE send an integrity protected ATTACH REQUEST message (including a PDN CONNECTIVITY REQUEST message) with the last visited TAI correctly indicating the TAI of cell I; the GUTI allocated in step 8 and the KSI_ASME allocated in step 3?	–>	ATTACH REQUEST	1, 2	P
18A	Void	–	–	–	–
18B	Void	–	–	–	–
–	EXCEPTION: Steps 18a1 to 18a2 describe behaviour that depends on UE configuration; the "lower case letter" identifies a step sequence that take place if the UE has ESM information which needs to be transferred.	–	–	–	–
18a1	IF the UE sets the ESM information transfer flag in the last PDN CONNECTIVITY REQUEST message THEN the SS transmits an ESM INFORMATION REQUEST message to initiate exchange of protocol configuration options and/or APN.	<–	ESM INFORMATION REQUEST	–	–
18a2	The UE transmits the ESM INFORMATION REQUEST message to transfer protocol configuration options and/or APN.	–>	ESM INFORMATION RESPONSE	–	–
19	The SS sends an ATTACH ACCEPT message allocating 16 TAIs and an aligned set of equivalent PLMNs. The ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message is piggybacked in ATTACH ACCEPT message.	<–	ATTACH ACCEPT	–	–
–	EXCEPTION: In parallel to the event described in step 20 below the generic procedure for IP address allocation in the U-plane specified in TS 36.508 subclause 4.5A.1 takes place performing IP address allocation in the U-plane if requested by the UE.	–	–	–	–
20-22b1	Steps 16-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
23	The SS waits 5seconds	–	–	–	–
–	EXCEPTION steps 24 to 26 are repeated for N = 3 to N = 7 with cells C, G, H, K, E according to T3 in table 9.2.1.1.1a-2.	–	–	–	–
24	Cell power levels are set according to T3 and the value of N.	–	–	–	–
25	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message in the next 70 seconds?	–>	TRACKING AREA UPDATE REQUEST	3	F
26	Check: Does the UE camp on the strongest cell for each T3(x) in table 9.2.1.1.1a-2 being applied by using the procedure in clause 6.4.2.2 of TS 36.508 [18]?	–	–	3	–
27	SS adjusts the cell power levels according to row T4 in table 9.2.1.1.1a-2. Note: the new list of equivalent PLMNs allocated in step 19 means that list of equivalent PLMNs allocated in step 8 should have been deleted. Hence the PLMN of Cell I shall not be selected by a cell reselection process, and the UE shall remain camped on Cell E.	–	–	–	–
28	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message on cell I in the next 70 seconds?	–>	TRACKING AREA UPDATE REQUEST	5	F
29	Check: Does the UE camp on cell E by using the procedure in clause 6.4.2.2 of TS 36.508 [18]?	–	–	5	–
30	SS adjusts the cell power levels according to row T5 in table 9.2.1.1.1a-2.	–	–	–	–
31	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message on cell A with the last visited TAI set to the TAI of cell E; the GUTI allocated in step 8 and the KSI_ASME allocated in step 3?	–>	TRACKING AREA UPDATE REQUEST	4	P
32	SS responds with TRACKING AREA UPDATE ACCEPT message	<–	TRACKING AREA UPDATE ACCEPT	–	–
33	The UE transmits a TRACKING AREA UPDATE COMPLETE message	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA connected (E2_T3440) according to TS 36.508.	–	–	–	–

9.2.1.1.1a.3.3 Specific message contents

Table 9.2.1.1.1a.3.3-1: Message ATTACH ACCEPT (step 8, Table 9.2.1.1.1a.3.2-1)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark	Comment	Condition
TAI list		List of 2 TAIs
Length of tracking area identity list contents	11	The value in the length field
Number of elements	00001
Type of list	010	More than one PLMN
Partial tracking area identity list	First TAI = TAI of Cell I; Second TAI = TAI of Cell A
GUTI	MCC=001, MNC=01, MMEGI = 1, MMEC= 1, M-TMSI arbitrarily allocated but compliant to rules of TS 23.003 sub clause 2.8	Includes PLMN ID of cell A
Equivalent PLMNs	MCC=005, MNC=102	PLMN ID of cell I

Table 9.2.1.1.1a.3.3-2: Message ATTACH REQUEST (step 18, Table 9.2.1.1.1a.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Sent in SECURITY PROTECTED NAS MESSAGE with valid integrity check
Old GUTI or IMSI	GUTI allocated in step 8
NAS key set identifier	KSI allocated in step 3
Last visited registered TAI	TAI of cell I

Table 9.2.1.1.1a.3.3-3: Message ATTACH ACCEPT (step 19, Table 9.2.1.1.1a.3.2-1)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark	Comment	Condition
TAI list		Contains 3 separate partial tracking area ID lists
Length of tracking area identity list contents	32	The decimal value of the value in the length field
Type of first partial tracking area identity list	010	More than one PLMN
Number of elements	00010	3 elements
First TAI	MCC = 004, MNC = 02, TAC = 0003
Second TAI	MCC = 005, MNC = 002, TAC = 0003
Third TAI	MCC = 006, MNC = 002, TAC = 0003
Type of second partial tracking area identity list	001	Consecutive TACs on same PLMN
Number of consecutive TACS	01001	10 elements
TAI	MCC = 004 MNC = 07 TAC = fff0	TAI with lowest numbered TAC
Type of third partial tracking area identity list	000	Individual TACs on same PLMN
Number of elements	00010	3
MCC	MCC = 001
MNC	MNC = 01
First TAC	TAC = 0001
Second TAC	TAC = 0005
Third TAC	TAC = 0027
GUTI	MCC=001, MNC = 01, MMEGI = 64000, MMEC= 127, M-TMSI arbitrarily allocated but compliant to rules of TS 23.003 sub clause 2.8	Includes PLMN ID of cell B.
Equivalent PLMNs	MCC=004, MNC=02; MCC=004, MNC=03; MCC=004, MNC=07; MCC=006, MNC=002;	4 equivalent PLMNs

Table 9.2.1.1.1a.3.3-4: Message TRACKING AREA UPDATE REQUEST (step 31, Table 9.2.1.1.1a.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Old GUTI	GUTI allocated in step 19
NAS key set identifier _ASME	Same as allocated in step 3
Last visited registered TAI	TAI of cell E

9.2.1.1.1b Attach Procedure / Success / Last visited TAI, TAI list and equivalent PLMN list handling / Single Frequency operation

9.2.1.1.1b.1 Test Purpose (TP)

Same Test Purpose as in clause 9.2.1.1.1a.1

9.2.1.1.1b.2 Conformance requirements

Same Conformance requirements as in clause 9.2.1.1.1a.2

9.2.1.1.1b.3 Test description

9.2.1.1.1b.3.1 Pre-test conditions

System Simulator:

– Eight intra-frequency cells with the PLMNs identified in the test by the identifiers in Table 9.2.1.1.1b-1.

NOTE: while this test describes the uses of 8 cells, it is intended that this test only requires 2 cells to be active at any one instant.

Table 9.2.1.1.1b-1: Cell TAI values

Cell	MCC	MNC	TAC (hex)	Remark	Freq	Remark
A	001	01	0002	2 digit MNC	f1	HPLMN
L	005	102	0002	3 digit MNC	f1
B	001	01	0001		f1	HPLMN
C	001	01	0027		f1	HPLMN
G	004	07	fff0		f1
H	004	07	fff9		f1
K	006	002	0003	3 digit MNC	f1
E	004	02	0003		f1

– System information combination 2 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells;

– with the exception of the Physical Cell Identity, all other parameters for these cells are the same as defined for cell 1 in TS 36.508 [18];

– the power level of cell A is the Serving Cell level defined in table 6.2.2.1-1 of TS 36.508 [18];

– the power levels of cells B to K are set to the Non-suitable Off level defined in table 6.2.2.1-1 of TS 36.508 [18].

Table 9.2.1.1.1b-2: Time instances of cell power level and parameter changes

	Parameter	Unit	Cell A	Cell L	Cell B	Cell C	Cell G	Cell H	Cell K	Cell E
T0	Cell-specific RS EPRE	dBm/ 15kHz	-85	Off	Off	Off	Off	Off	Off	Off
T1	Cell-specific RS EPRE	dBm/ 15kHz	-91	-85	Off	Off	Off	Off	Off	Off
T2	Cell-specific RS EPRE	dBm/ 15kHz	Off	Off	-85	Off	Off	Off	Off	Off
T3 (N=3)	Cell-specific RS EPRE	dBm/ 15kHz	Off	Off	-91	-85	Off	Off	Off	Off
T3 (N=4)	Cell-specific RS EPRE	dBm/ 15kHz	Off	Off	Off	-91	-85	Off	Off	Off
T3 (N=5)	Cell-specific RS EPRE	dBm/ 15kHz	Off	Off	Off	Off	-91	-85	Off	Off
T3 (N=6)	Cell-specific RS EPRE	dBm/ 15kHz	Off	Off	Off	Off	Off	-91	-85	Off
T3 (N=7)	Cell-specific RS EPRE	dBm/ 15kHz	Off	Off	Off	Off	Off	Off	-91	-85
T4	Cell-specific RS EPRE	dBm/ 15kHz	Off	-91	Off	Off	Off	Off	Off	-85
T5	Cell-specific RS EPRE	dBm/ 15kHz	-85	Off	Off	Off	Off	Off	Off	Off

UE:

– ehe UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

Preamble:

– The UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.1b.3.2 Test procedure sequence

Same Test procedure sequence as in clause 9.2.1.1.1a.3.2, except for the check in step 28 which cannot be covered due to the specific cell power levels at T4 in Table 9.2.1.1.1b-2. Cell I shall be replaced by Cell L. At step 27 Cell K is set to the Non-suitable “Off” level. The signal strength of Cell L is set to that of a Suitable Neighbour Cell and that of Cell E is set to the Serving Cell level. At step 30 Cells E and L are set to the Non-suitable “Off” level, the signal strength of Cell A is set to the Serving Cell level.

In all steps other than those mentioned before the references to table 9.2.1.1.1a-2 are to be replaced by references to table 9.2.1.1.1b-2.

9.2.1.1.1b.3.3 Specific message contents

Same Specific message contents as in clause 9.2.1.1.1a.3.3. Cell I shall be replaced by Cell L.

9.2.1.1.2 Attach Procedure / Success / With IMSI / GUTI reallocation

9.2.1.1.2.1 Test Purpose (TP)

(1)

with { UE in EMM-DEREGISTERED state }

ensure that {

when { there is no valid GUTI available in UE }

then { UE sends ATTACH REQUEST message, containing IMSI as the EPS mobile identity }

}

(2)

with { UE having received reallocated GUTI in the ATTACH ACCEPT message }

ensure that {

when { UE detaches from the EPS services }

then { UE sends DETACH REQUEST message, containing GUTI as the EPS mobile identity }

}

9.2.1.1.2.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clause 5.5.1.2.

[TS 24.301, clause 5.5.1.2.2]

If the UE supports neither A/Gb mode nor Iu mode, the UE shall handle the Old GUTI or IMSI IE in the ATTACH REQUEST message as follows:

[TS 24.301, clause 5.5.1.2.4]

If the attach request is accepted by the network, the MME shall send an ATTACH ACCEPT message to the UE and start timer T3450. The MME shall send the ATTACH ACCEPT message together with an ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message contained in the ESM message container information element to activate the default bearer (see subclause 6.4.1). The network may also initiate the activation of dedicated bearers towards the UE by invoking the dedicated EPS bearer context activation procedure (see subclause 6.4.2).

…

Upon receiving the ATTACH ACCEPT message, the UE shall stop timer T3410.

The GUTI reallocation may be part of the attach procedure. When the ATTACH REQUEST message includes the IMSI, the MME considers the GUTI provided by the UE is invalid, or the GUTI provided by the UE was assigned by another MME, the MME shall allocate a new GUTI to the UE. The MME shall include in the ATTACH ACCEPT message the new assigned GUTI together with the assigned TAI list. In this case the MME shall enter state EMM-COMMON-PROCEDURE-INITIATED as described in subclause 5.4.1.

For a shared network, the TAIs included in the TAI list can contain different PLMN identities. The MME indicates the selected core network operator PLMN identity to the UE in the GUTI (see 3GPP TS 23.251).If the ATTACH ACCEPT message contains a GUTI, the UE shall use this GUTI as the new temporary identity. The UE shall delete its old GUTI and store the new assigned GUTI. If no GUTI has been included by the MME in the ATTACH ACCEPT message, the old GUTI, if any available, shall be kept.

If A/Gb mode or Iu mode is supported in the UE, the UE shall set its TIN to "GUTI" when receiving the ATTACH ACCEPT message.

9.2.1.1.2.3 Test description

9.2.1.1.2.3.1 Pre-test conditions

System Simulator:

– cell A (HPLMN).

UE:

– the UE is configured to initiate EPS attach.

Preamble:

– the UE is in state Registered, Idle Mode (State 2) according to TS 36.508 [18].

9.2.1.1.2.3.2 Test procedure sequence

Table 9.2.1.1.2.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS transmits Paging on cell A with IMSI. Upon reception of paging with IMSI the UE shall locally deactivate any EPS bearer context(s), locally detach from EPS and delete the GUTI-1. After local detach the UE shall perform an EPS attach procedure.	–	–	–	–
	EXCEPTION: Steps 1a describes a behaviour which depends on the UE capability	–	–	–	–
1a	IF NOT pc_Automatic_EPS_Re_Attach, the user initiates an attach by MMI or by AT command.	–	–	–	–
2	Check: Does the UE transmit an ATTACH REQUEST message including IMSI in the EPS mobile identity IE including a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	1	P
3-6Aa2	Void	–	–	–	–
6B-6H	Steps 5-11 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
7	SS responds with ATTACH ACCEPT message with a new GUTI-2 included in the EPS mobile identity IE. The ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message is piggybacked in ATTACH ACCEPT message.	<–	ATTACH ACCEPT	–	–
8	Void	–	–	–	–
8A-8Ac1	Steps 16-16c1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
8B-8D	IF MULTI_PDN = TRUE (NOTE) THEN steps 10-12 of the generic procedure for network initiated release of additional PDN connectivity specified in TS 36.508 subclause 4.5A.18.3 are performed for the non-IMS PDN.	–	–	–	–
9	Cause UE to detach from the EPS services	–	–	–	–
10	Check: Does the UE transmit a DETACH REQUEST message including GUTI-2 in the EPS mobile identity IE?	–>	DETACH REQUEST	2	P
11	SS responds with DETACH ACCEPT message	<–	DETACH ACCEPT	–	–
12	The SS releases the RRC connection.	–	–	–	–
NOTE: MULTI_PDN as defined in TS 36.508 subclause 4.5.2.

9.2.1.1.2.3.3 Specific message contents

Table 9.2.1.1.2.3.3-1: ATTACH REQUEST (step 2, Table 9.2.1.1.2.3.2-1)

Derivation Path: 36.508, Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
Old GUTI or IMSI	IMSI
Last visited registered TAI	Not present

Table 9.2.1.1.2.3.3-2: DETACH REQUEST (step 10, Table 9.2.1.1.2.3.2-1)

Derivation Path: 36.508, Table 4.7.2-11
Information Element	Value/remark	Comment	Condition
GUTI or IMSI	GUTI-2

9.2.1.1.2a Attach Procedure / AttachWithIMSI configured / Selected PLMN is neither the registered PLMN nor in the list of equivalent PLMNs / Success

9.2.1.1.2a.1 Test Purpose (TP)

(1)

with { UE in state EMM-REGISTERED and EMM-IDLE mode and configured for "AttachWithIMSI" }

ensure that {

when { UE enters a tracking area in a new PLMN that is neither the registered PLMN nor in the list of equivalent PLMNs }

then { UE sends ATTACH REQUEST message, containing IMSI as the EPS mobile identity }

}

9.2.1.1.2a.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clause 5.5.1.2.2, and, TS 24.368 clauses 4 and 5.4.

[TS 24.301, clause 5.5.1.2.2]

If the UE is configured for "AttachWithIMSI" as specified in 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17] and the selected PLMN is neither the registered PLMN nor in the list of equivalent PLMNs, the UE shall include the IMSI in the EPS mobile identity IE in the ATTACH REQUEST message.

[TS 24.368, clause 4]

The NAS configuration MO is used to manage configuration parameters related to NAS functionality for a UE supporting provisioning of such information. The presence and format of the non access stratum configuration file on the USIM is specified in 3GPP TS 31.102 [6].

…

The following nodes and leaf objects are possible in the NAS configuration MO as described in figure 4-1:

Figure 4-1: The NAS configuration Management Object

[TS 24.368, clause 5.4]

The AttachWithIMSI leaf indicates whether attach with IMSI is performed when moving to a non-equivalent PLMN as specified in 3GPP TS 24.008 [4] and 3GPP TS 24.301 [5].

– Occurrence: ZeroOrOne

– Format: bool

– Access Types: Get, Replace

– Values: 0, 1

0 Indicates that normal behaviour is applied.

1 Indicates that attach with IMSI is performed when moving to a non-equivalent PLMN.

The default value 0 applies if this leaf is not provisioned.

9.2.1.1.2a.3 Test description

9.2.1.1.2a.3.1 Pre-test conditions

System Simulator:

– cell A (HPLMN), cell B a different PLMN.

UE:

– The UE is configured to do "AttachWithIMSI".

The UE is equipped with a USIM containing values shown in Table 9.2.1.1.2a.3.1–1.

Table 9.2.1.1.2a.3.1–1: USIM Configuration

USIM field	Value
EF_UST	Services 96 is supported.
EF_NASCONFIG	“Attach with IMSI is performed when moving to a non-equivalent PLMN” as defined in TS 24.368, clause 5.4.

– The UE is configured to initiate EPS attach.

Preamble:

– The UE is in state Registered, Idle Mode (State 2) according to TS 36.508 [18] on cell A. During the registration a list with 2 equivalent PLMNs is provided. The PLMN of cell B is not among them.

9.2.1.1.2a.3.2 Test procedure sequence

Table 9.2.1.1.2a.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – Cell B as the "Serving cell". – Cell A as a "Non-Suitable cell".	–	–	–	–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
2	Check: Does the UE transmit an ATTACH REQUEST message including IMSI as the EPS mobile identity? The UE includes a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	1	P
3-14Bb1	Steps 5-18b1 from the UE Registration (State 2) procedure described in TS 36.508 [18], Table 4.5.2.3-1 take place.	–	–	–	–
15	Void	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508 [18].	–	–	–	–

9.2.1.1.2a.3.3 Specific message contents

Table 9.2.1.1.2a.3.3-1: ATTACH REQUEST (step 2, Table 9.2.1.1.2a.3.2-1)

Derivation Path: 36.508, Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
Old GUTI or IMSI	IMSI

9.2.1.1.3 Attach Procedure / Success / Request for obtaining the IPv6 address of the home agent

9.2.1.1.3.1 Test Purpose (TP)

(1)

with { UE is configured to request the IPv6 address of the Home Agent during Attach procedure }

ensure that {

when { UE is switched on and has established the RRC connection }

then { UE transmits an ATTACH REQUEST message and a PDN CONNECTIVITY REQUEST message indicating a request for DSMIPv6 Home Agent Address in the protocol configuration options }

}

(2)

with { UE having transmitted an ATTACH REQUEST message and a PDN CONNECTIVITY REQUEST message indicating a request for DSMIPv6 Home Agent Address in the protocol configuration options }

ensure that {

when { the SS responds to the ATTACH REQUEST with an IPv6 Home Agent address }

then { the UE transmits an ATTACH COMPLETE message }

}

9.2.1.1.3.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clauses 5.5.1.1 and 6.5.1.2, and TS 24.008, clause 10.5.6.3.

[24.301 clause 5.5.1.1]

During the attach procedure, the UE may also obtain the home agent IPv4 and IPv6 addresses.

[24.301 clause 6.5.1.2]

If the UE supports DSMIPv6, the UE may include a request for obtaining the IPv6 address and optionally the IPv4 address of the home agent in the Protocol configuration options IE in the PDN CONNECTIVITY REQUEST message. The UE may also include a request for obtaining the IPv6 Home Network Prefix. The UE shall request the IPv6 Home Network Prefix only if the UE has requested the home agent IPv6 address. The requested home agent address(es) and the Home Network Prefix are related to the APN the UE requested connectivity for.

[24.008 clause 10.5.6.3]

Table 10.5.154/3GPP TS 24.008: Protocol configuration options information element

Additional parameters list (octets w+1 to z)

The additional parameters list is included when special parameters and/or requests (associated with a PDP context) need to be transferred between the MS and the network. These parameters and/or requests are not related to a specific configuration protocol (e.g. PPP), and therefore are not encoded as the "Packets" contained in the configuration protocol options list.

The additional parameters list contains a list of special parameters, each one in a separate container. The type of the parameter carried in a container is identified by a specific container identifier. In this version of the protocol, the following container identifiers are specified:

MS to network direction:

– 0001H (P-CSCF Address Request);

– 0002H (IM CN Subsystem Signalling Flag);

– 0003H (DNS Server Address Request);

– 0004H (Not Supported);

– 0005H (MS Support of Network Requested Bearer Control indicator);

– 0006H (Reserved);

– 0007H (DSMIPv6 Home Agent Address Request;

– 0008H (DSMIPv6 Home Network Prefix Request);

– 0009H (DSMIPv6 IPv4 Home Agent Address Request);

– 000AH (IP address allocation via NAS signalling); and

– 000BH (IPv4 address allocation via DHCPv4).

Network to MS direction:

– 0001H (P-CSCF Address);

– 0002H (IM CN Subsystem Signalling Flag);

– 0003H (DNS Server Address);

– 0004H (Policy Control rejection code);

– 0005H (Selected Bearer Control Mode;

– 0006H (Reserved);

– 0007H (DSMIPv6 Home Agent Address) ;

– 0008H (DSMIPv6 Home Network Prefix); and

– 0009H (DSMIPv6 IPv4 Home Agent Address).

If the additional parameters list contains a container identifier that is not supported by the receiving entity the corresponding unit shall be discarded.

The container identifier field is encoded as the protocol identifier field and the length of container identifier contents field is encoded as the length of the protocol identifier contents field.

When the container identifier indicates P-CSCF Address Request or DNS Server Address Request, the container identifier contents field is empty and the length of container identifier contents indicates a length equal to zero. If the container identifier contents field is not empty, it shall be ignored.

When the container identifier indicates IM CN Subsystem Signalling Flag (see 3GPP TS 24.229 [95]), the container identifier contents field is empty and the length of container identifier contents indicates a length equal to zero. If the container identifier contents field is not empty, it shall be ignored. In Network to MS direction this information may be used by the MS to indicate to the user whether the requested dedicated signalling PDP context was successfully established.

When the container identifier indicates P-CSCF Address, the container identifier contents field contains one IPv6 address corresponding to a P-CSCF address (see 3GPP TS 24.229 [95]). This IPv6 address is encoded as a 128-bit address according to RFC 3513 [99]. When there is need to include more than one P-CSCF address, then more logical units with container identifier indicating P-CSCF Address are used.

When the container identifier indicates DNS Server Address, the container identifier contents field contains one IPv6 DNS server address (see 3GPP TS 27.060 [36a]). This IPv6 address is encoded as a 128-bit address according to RFC 3513 [99]. When there is need to include more than one DNS server address, then more logical units with container identifier indicating DNS Server Address are used.

When the container identifier indicates Policy Control rejection code, the container identifier contents field contains a Go interface related cause code from the GGSN to the UE (see 3GPP TS 29.207 [100]). The length of container identifier contents indicates a length equal to one. If the container identifier contents field is empty or its actual length is greater than one octet, then it shall be ignored by the receiver.

When the container identifier indicates MS Support of Network Requested Bearer Control indicator, the container identifier contents field is empty and the length of container identifier contents indicates a length equal to zero. If the container identifier contents field is not empty, it shall be ignored.

When the container identifier indicates Selected Bearer Control Mode, the container identifier contents field contains the selected bearer control mode, where ‘01H’ indicates that ‘MS only’ mode has been selected and ‘02H’ indicates that ‘MS/NW’ mode has been selected. The length of container identifier contents indicates a length equal to one. If the container identifier contents field is empty or its actual length is greater than one octet, then it shall be ignored by the receiver.

When the container identifier indicates DSMIPv6 Home Agent Address Request, the container identifier contents field is empty and the length of container identifier contents indicates a length equal to zero. If the container identifier contents field is not empty, it shall be ignored.

When the container identifier indicates DSMIPv6 Home Network Prefix Request, the container identifier contents field is empty and the length of container identifier contents indicates a length equal to zero. If the container identifier contents field is not empty, it shall be ignored.

When the container identifier indicates DSMIPv6 IPv4 Home Agent Address Request, the container identifier contents field is empty and the length of container identifier contents indicates a length equal to zero. If the container identifier contents field is not empty, it shall be ignored.

When the container identifier indicates DSMIPv6 Home Agent Address, the container identifier contents field contains one IPv6 address corresponding to a DSMIPv6 HA address (see 3GPP TS 24.303 [124] and 3GPP TS 24.327 [125]). This IPv6 address is encoded as a 128-bit address according to IETF RFC 3513 [99].

When the container identifier indicates DSMIPv6 Home Network Prefix, the container identifier contents field contains one IPv6 Home Network Prefix (see 3GPP TS 24.303 [124] and 3GPP TS 24.327 [125]). This IPv6 prefix is encoded as an IPv6 address according to RFC 3513 [99] followed by 8 bits which specifies the prefix length.

When the container identifier indicates DSMIPv6 IPv4 Home Agent Address, the container identifier contents field contains one IPv4 address corresponding to a DSMIPv6 IPv4 Home Agent address (see 3GPP TS 24.303 [124] and 3GPP TS 24.327 [125]).

When the container identifier indicates IP address allocation via NAS signalling, the container identifier contents field is empty and the length of container identifier contents indicates a length equal to zero. If the container identifier contents field is not empty, it shall be ignored.

When the container identifier indicates IP address allocation DHCPv4, the container identifier contents field is empty and the length of container identifier contents indicates a length equal to zero. If the container identifier contents field is not empty, it shall be ignored.

NOTE 1: The additional parameters list and the configuration protocol options list are logically separated since they carry different type of information. The beginning of the additional parameters list is marked by a logical unit, which has an identifier (i.e. the first two octets) equal to a container identifier (i.e. it is not a protocol identifier).

9.2.1.1.3.3 Test description

9.2.1.1.3.3.1 Pre-test conditions

System Simulator:

– cell A.

UE:

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to [18];

NOTE: Any type of attach is acceptable.

– the UE is configured to request the IPv6 address of the Home Agent in the protocol configuration options IE as part of the Attach / PDN connectivity request procedure.

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.3.3.2 Test procedure sequence

Table 9.2.1.1.3.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message with IE PROTOCOL CONFIGURATION OPTIONS indicating a DSMIPv6 Home Agent Address Request?	–>	ATTACH REQUEST	1	P
3-11	Steps 5 to 13 of the generic test procedure in TS 36.508 Table 4.5.2.3-1 (Attach procedure) are performed on Cell A.	–	–	–	–
12	SS responds with ATTACH ACCEPT message including a valid TAI list. The ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message is piggybacked in ATTACH ACCEPT message, including the IE PROTOCOL CONFIGURATION OPTIONS indicating a DSMIPv6 Home Agent Address.	<–	ATTACH ACCEPT	–	–
–	EXCEPTION: In parallel to the event described in step 13 below the generic procedure for IP address allocation in the U-plane specified in TS 36.508 subclause 4.5A.1 takes place performing IP address allocation in the U-plane if requested by the UE.	–	–	–	–
13	Check: Does the UE transmit an ATTACH COMPLETE message including an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message?	–>	ATTACH COMPLETE	2	P
14	The SS releases the RRC connection.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.1.3.3.3 Specific message contents

Table 9.2.1.1.3.3.3-1: Message ATTACH REQUEST (step 2, Table 9.2.1.1.3.3.2-1)

Derivation path: TS 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
ESM message container	PDN CONNECTIVITY REQUEST message as specified in table 9.2.1.1.3.3.3-2.

Table 9.2.1.1.3.3.3-2: PDN CONNECTIVITY REQUEST (Table 9.2.1.1.3.3.3-1)

Derivation path: TS 36.508 table 4.7.3-20
Information Element	Value/Remark	Comment	Condition
Protocol configuration options	The IE Protocol configuration options contains a configuration protocol option = ‘0007H’ (“DSMIPv6 Home Agent Address Request”, length of contents = 0).

Table 9.2.1.1.3.3.3-3: Message ATTACH ACCEPT (step 12, Table 9.2.1.1.3.3.2-1)

Derivation path: TS 36.508 table 4.7.3-1
Information Element	Value/Remark	Comment	Condition
ESM message container	Contains the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message specified in table 9.2.1.1.3.3.3-4.

Table 9.2.1.1.3.3.3-4: Message ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST (Table 9.2.1.1.3.3.3-3)

Derivation path: TS 36.508 table 4.7.3-6
Information Element	Value/Remark	Comment	Condition
Protocol configuration options	The IE Protocol configuration options contains a configuration protocol option = ‘0007H’ (“DSMIPv6 Home Agent Address”, non-zero length), with the value set to the IPv6 address of the Home Agent.

9.2.1.1.4 Attach Procedure / Success / Request for obtaining the IPv4 address of the home agent

9.2.1.1.4.1 Test Purpose (TP)

(1)

with { UE is configured to request the DSMIPv6 IPv4 Home Agent Address }

ensure that {

when { UE is switched on and has established the RRC connection }

then { UE transmits an ATTACH REQUEST and a PDN CONNECTIVITY REQUEST message indicating a request for DSMIPv6 IPv4 Home Agent Address in the protocol configuration options }

}

(2)

with { UE having transmitted an ATTACH REQUEST and a PDN CONNECTIVITY REQUEST message indicating a request for DSMIPv6 IPv4 Home Agent Address in the protocol configuration options }

ensure that {

when { SS responds to the ATTACH REQUEST with a DSMIPv6 IPv4 Home Agent Address }

then { UE transmits an ATTACH COMPLETE message }

}

9.2.1.1.4.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clauses 5.5.1.1, and 6.5.1.2, and TS 24.008, clause 10.5.6.3.

[24.301 clause 5.5.1.1]

During the attach procedure, the UE may also obtain the home agent IPv4 and IPv6 addresses.

[24.301 clause 6.5.1.2]

[24.008 clause 10.5.6.3]

Table 10.5.154/3GPP TS 24.008: Protocol configuration options information element

Additional parameters list (octets w+1 to z)

MS to network direction:

– 0001H (P-CSCF Address Request);

– 0002H (IM CN Subsystem Signalling Flag);

– 0003H (DNS Server Address Request);

– 0004H (Not Supported);

– 0005H (MS Support of Network Requested Bearer Control indicator);

– 0006H (Reserved);

– 0007H (DSMIPv6 Home Agent Address Request;

– 0008H (DSMIPv6 Home Network Prefix Request);

– 0009H (DSMIPv6 IPv4 Home Agent Address Request);

– 000AH (IP address allocation via NAS signalling); and

– 000BH (IPv4 address allocation via DHCPv4).

Network to MS direction:

– 0001H (P-CSCF Address);

– 0002H (IM CN Subsystem Signalling Flag);

– 0003H (DNS Server Address);

– 0004H (Policy Control rejection code);

– 0005H (Selected Bearer Control Mode;

– 0006H (Reserved);

– 0007H (DSMIPv6 Home Agent Address) ;

– 0008H (DSMIPv6 Home Network Prefix); and

– 0009H (DSMIPv6 IPv4 Home Agent Address).

If the additional parameters list contains a container identifier that is not supported by the receiving entity the corresponding unit shall be discarded.

9.2.1.1.4.3 Test description

9.2.1.1.4.3.1 Pre-test conditions

System Simulator:

– cell A.

UE:

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18];

NOTE: Any type of attach is acceptable.

– the UE is configured to request the DSMIPv6 IPv4 Home Agent Address in the protocol configuration options IE as part of the Attach / PDN connectivity request procedure.

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.4.3.2 Test procedure sequence

Table 9.2.1.1.4.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2	Void	–	–	–	–
3	Void	–	–	–	–
4	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message with IE PROTOCOL CONFIGURATION OPTIONS indicating a DSMIPv6 IPv4 Home Agent Address Request?	–>	ATTACH REQUEST	1	P
5-13	Steps 5 to 13 of the generic test procedure in TS 36.508 Table 4.5.2.3-1 (Attach procedure) are performed on Cell A.	–	–	–	–
14	SS responds with ATTACH ACCEPT message including a valid TAI list. The ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message is piggybacked in ATTACH ACCEPT message, including the IE PROTOCOL CONFIGURATION OPTIONS indicating a DSMIPv6 IPv4 Home Agent Address	<–	ATTACH ACCEPT	–	–
–	EXCEPTION: In parallel to the event described in step 11 below the generic procedure for IP address allocation in the U-plane specified in TS 36.508 subclause 4.5A.1 takes place performing IP address allocation in the U-plane if requested by the UE.	–	–	–	–
15	Check: Does the UE transmit an ATTACH COMPLETE message including an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message?	–>	ATTACH COMPLETE	2	P
16	The SS releases the RRC connection.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.1.4.3.3 Specific message contents

Table 9.2.1.1.4.3.3-1: Void

Table 9.2.1.1.4.3.3-2: Message ATTACH REQUEST (step 4, Table 9.2.1.1.4.3.2-1)

Derivation path: TS 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
ESM message container	PDN CONNECTIVITY REQUEST message as specified in table 9.2.1.1.4.3.3-3.

Table 9.2.1.1.4.3.3-3: PDN CONNECTIVITY REQUEST (Table 9.2.1.1.4.3.3-2)

Derivation path: TS 36.508 table 4.7.3-20
Information Element	Value/Remark	Comment	Condition
Protocol configuration options	The IE Protocol configuration options contains a configuration protocol option = ‘0009H’ (“DSMIPv6 IPv4 Home Agent Address Request”, length of contents = 0).

Table 9.2.1.1.4.3.3-4: Message ATTACH ACCEPT (step 11, Table 9.2.1.1.4.3.2-1)

Derivation path: TS 36.508 table 4.7.3-1
Information Element	Value/Remark	Comment	Condition
ESM message container	Contains the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message specified in table 9.2.1.1.4.3.3-5.

Table 9.2.1.1.4.3.3-5: Message ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST (Table 9.2.1.1.4.3.3-4)

Derivation path: TS 36.508 table 4.7.3-6
Information Element	Value/Remark	Comment	Condition
Protocol configuration options	The IE Protocol configuration options contains a configuration protocol option = ‘0009H’ (“DSMIPv6 IPv4 Home Agent Address”, non-zero length), with the value set to the IPv4 address of the Home Agent.

9.2.1.1.5 Void

9.2.1.1.6 Void

9.2.1.1.7 Attach Procedure / Success / List of equivalent PLMNs in the ATTACH ACCEPT message

9.2.1.1.7.1 Test Purpose (TP)

(1)

with { UE in EMM-REGISTERED-INITIATED state }

ensure that {

when { the UE receives ATTACH ACCEPT message including a list of equivalent PLMNs }

then { the UE stores correctly the list and does not consider forbidden PLMNs as equivalent PLMNs }

}

(2)

with { UE in EMM-REGISTERED-INITIATED state }

ensure that {

when { the UE receives ATTACH ACCEPT message without a list of equivalent PLMNs }

then { the UE deletes the stored list and applies a normal PLMN selection process }

}

9.2.1.1.7.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clause 5.5.1.2.4.

[TS 24.301, clause 5.5.1.2.4]

9.2.1.1.7.3 Test description

9.2.1.1.7.3.1 Pre-test conditions

System Simulator:

– Cell A (PLMN1, HPLMN), cell G (PLMN2, visited PLMN), cell I (PLMN3, another visited PLMN) and cell J (PLMN4, another visited PLMN, different than cell I and switched OFF) are configured according to table 6.3.2.2-1 in TS 36.508 [18];

– At most 3 cells are active simultaneously.

– System information combination 3 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cell A

UE:

– The UE is configured to initiate EPS attach;

– The UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE last attempted to register on cell I and received reject cause "forbidden PLMN".

Preamble:

– The UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.7.3.2 Test procedure sequence

Table: 9.2.1.1.7.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – Cell A as the "Serving cell". – Cell G as a "Non-Suitable cell". – Cell I as a "Non-Suitable cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
2	The UE is switched on.	–	–	–	–
3-9Jb1	Steps 2-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
10	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.			–	–
–	EXCEPTION: Step 10a1 describes behaviour that depends on the UE capability.
10a	If pc_SwitchOnOff or pc_USIM_Removal then UE sends DETACH REQUEST message	–>	DETACH REQUEST
11	The SS configures: – Cell A as the "Non-Suitable cell". – Cell G as a "Suitable cell". – Cell I as a "Serving cell". Note: Cell I belongs to the forbidden PLMN.	–	–	–	–
–	The following messages are to be observed on Cell G unless explicitly stated otherwise.	–	–	–	–
12	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
–	EXCEPTION: The behaviour in table 9.2.1.1.7.3.2-2 occurs in parallel with step 13.
13	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	1	P
13A-15AKb1	Steps 5-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
15A	The SS configures: – Cell A as a "Suitable cell". – Cell G as a "Non-Suitable cell". – Cell I as a "Non-suitable "Off” cell". – Cell J as a "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
–	EXCEPTION: The behaviour in table 9.2.1.1.7.3.2-3 occurs in parallel with step 15B.
15B	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	2	P
15C	SS responds with TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
15D	The UE transmits a TRACKING AREA UPDATE COMPLETE message	–>	TRACKING AREA UPDATE COMPLETE
15E	The SS releases the RRC connection.	–	–	–	–
–	EXCEPTION: Step 15Fa1 describes optional behaviour that depends on the UE capability.	–	–	–	–
15Fa1	The UE may attempt the generic test procedure for IMS Re-registration on EPS HPLMN as specified in TS 36.508 [18] subclause 4.5A.30.	–	–	–	–
16-34	Void	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA Idle (E1) according to TS 36.508.	–	–	–	–

Table: 9.2.1.1.7.3.2-2: Parallel behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Check: Does the UE transmit an ATTACH REQUEST message on Cell I (PLMN3)?	–>	ATTACH REQUEST	1	F

Table: 9.2.1.1.7.3.2-3: Parallel behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message on Cell J (PLMN4)?	–>	TRACKING AREA UPDATE REQUEST	2	F

9.2.1.1.7.3.3 Specific message contents

Table 9.2.1.1.7.3.3-1: SystemInformationBlockType5 for Cell A

Derivation path: 36.508 Table 4.4.3.3-4
Information Element	Value/Remark	Comment	Condition
SystemInformationBlockType5 ::= SEQUENCE {
interFreqCarrierFreqList SEQUENCE (SIZE (1..maxFreq)) OF SEQUENCE {	3 entries
dl-CarrierFreq[1]	Same downlink EARFCN as used for Cell G
dl-CarrierFreq[1]	maxEARFCN		Band > 64
dl-CarrierFreq[2]	Same downlink EARFCN as used for Cell I
dl-CarrierFreq[2]	maxEARFCN		Band > 64
dl-CarrierFreq[3]	Same downlink EARFCN as used for Cell J
dl-CarrierFreq[3]	maxEARFCN		Band > 64
}
SystemInformationBlockType5-v8h0-IEs SEQUENCE {			Band > 64
nonCriticalExtension SEQUENCE {
interFreqCarrierFreqList-v9e0 SEQUENCE (SIZE (1..maxFreq)) OF SEQUENCE {
dl-CarrierFreq-v9e0[1]	Same downlink EARFCN as used for Cell G
dl-CarrierFreq-v9e0[2]	Same downlink EARFCN as used for Cell I
dl-CarrierFreq-v9e0[3]	Same downlink EARFCN as used for Cell J
}
}
}
}

Condition	Explanation
Band > 64	If band > 64 is selected

Table 9.2.1.1.7.3.3-2: Message ATTACH ACCEPT (step 8, Table 9.2.1.1.7.3.2-1)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark	Comment	Condition
Equivalent PLMNs	–	Includes MCC and MNC digits for PLMN2, PLMN3 and PLMN4.

Table 9.2.1.1.7.3.3-3: Message ATTACH ACCEPT (step 14, Table 9.2.1.1.7.3.2-1)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark	Comment	Condition
Equivalent PLMNs	Not present

9.2.1.1.7a Attach Procedure / Success / List of equivalent PLMNs in the ATTACH ACCEPT message / Single Frequency operation

9.2.1.1.7a.1 Test Purpose (TP)

Same Test Purpose as in clause 9.2.1.1.7.1

9.2.1.1.7a.2 Conformance requirements

Same Conformance requirements as in clause 9.2.1.1.7.2

9.2.1.1.7a.3 Test description

9.2.1.1.7a.3.1 Pre-test conditions

System Simulator:

– Cell A (PLMN1, HPLMN), cell B (PLMN2, visited PLMN), and cell C (PLMN3, another visited PLMN)

– The cells are configured according to Table 6.3.2.2-1 and Table 6.3.2.2-3 in 36.508 [18], and are configured on same frequency f1;

– System information combination 2 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cell A

UE:

– The UE is configured to initiate EPS attach;

– The UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE last attempted to register on cell C and received reject cause "forbidden PLMN".

Preamble:

– The UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.7a.3.2 Test procedure sequence

Table: 9.2.1.1.7a.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – Cell A as the "Serving cell". – Cell B as a "Non-Suitable cell". – Cell C as a "Non-Suitable cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
2	The UE is switched on.	–	–	–	–
3-9Ib1	Steps 2-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
10	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.			–	–
–	EXCEPTION: Step 10a1 describes behaviour that depends on the UE capability.
10a	If pc_SwitchOnOff or pc_USIM_Removal then UE sends DETACH REQUEST message	–>	DETACH REQUEST
11	The SS configures: – Cell A as the "Non-Suitable cell". – Cell B as a "Non-Suitable cell ". – Cell C as a "Serving cell". Note: Cell C belongs to the forbidden PLMN.	–	–	–	–
12	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
12a	Check: Does the UE transmit an ATTACH REQUEST message in the next 60 seconds on Cell C	–	–	1	F
12b	The SS configures: – Cell A as the "Non-Suitable cell". – Cell B as a "Serving cell". – Cell C as a "Non-Suitable cell".
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
13	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	1	P
–	EXCEPTION: Steps 13Aa1 to 13Aa2 describe behaviour that depends on UE configuration; the "lower case letter" identifies a step sequence that take place if the UE has ESM information which needs to be transferred.	–	–	–	–
13Aa1-15AGb1	Steps 9a1-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
15A	The SS configures: – Cell A as a " Serving cell ". – Cell B as a "Non-Suitable cell". – Cell C as a "Non-suitable "Off” cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
15B	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	2	P
15C	SS responds with TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
15D	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE
15 E	The SS releases the RRC connection.	–	–	–	–
–	EXCEPTION: Step 15Fa1 describes optional behaviour that depends on the UE capability.	–	–	–	–
15 Fa1	The UE may attempt the generic test procedure for IMS Re-registration on EPS HPLMN as specified in TS 36.508 [18] subclause 4.5A.30.	–	–	–	–
16-34	Void	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA Idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.1.7a.3.3 Specific message contents

Table 9.2.1.1.7a.3.3-1: Message ATTACH ACCEPT (step 8, Table 9.2.1.1.7a.3.2-1)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark	Comment	Condition
Equivalent PLMNs	–	Includes MCC and MNC digits for PLMN2, PLMN3 and PLMN4.

Table 9.2.1.1.7a.3.3-2: Message ATTACH ACCEPT (step 14, Table 9.2.1.1.7a.3.2-1)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark	Comment	Condition
Equivalent PLMNs	Not present

9.2.1.1.7b Attach / Success / native GUMMEI

9.2.1.1.7b.1 Test Purpose (TP)

(1)

with { the UE is switched-off with a valid USIM inserted and the USIM contains a valid GUTI and last visited registered TAI }

ensure that {

when { UE is powered on in a cell not belonging to the last visited registered TAI and in a different PLMN }

then { the UE establishes the RRC connection without S-TMSI, with registeredMME and with the RRC establishmentCause set to ‘mo-Signalling’ }

}

(2)

with { UE is switched-off with a valid USIM inserted and the USIM contains a valid GUTI and last visited registered TAI }

ensure that {

when { UE is powered on in a cell not belonging to the last visited registered TAI }

then { the UE completes the RRC establishment with an indication that the MME identifier is a native GUMMEI and the UE transmits an ATTACH REQUEST message with the EPS attach type set to "EPS attach", including the GUTI and last visited registered TAI copied from the USIM }

}

9.2.1.1.7b.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clauses 5.3.1.1, 5.5.1.2.1, 5.5.1.2.2, 5.5.1.2.4 and Annex D, and TS 36.331, clause 5.3.3.4.

[TS 24.301, clause 5.3.1.1]

…

– When the UE is not registered in the tracking area of the current cell during the NAS signalling connection establishment, the UE NAS does not provide the lower layers with the S-TMSI. Instead,

[TS 24.301, clause 5.5.1.1]

The attach procedure is used to attach to an EPC for packet services in EPS.

The attach procedure is used for two purposes:

– by a UE in PS mode of operation to attach for EPS services only; or

– by a UE in CS/PS mode 1 or CS/PS mode 2 of operation to attach for both EPS and non-EPS services.

…

[TS 24.301, clause 5.5.1.2.1]

This procedure is used by a UE to attach for EPS services only. When the UE initiates the EPS attach procedure, the UE shall indicate "EPS attach" in the EPS attach type IE.

[TS 24.301, clause 5.5.1.2.2]

If the UE supports neither A/Gb mode nor Iu mode, the UE shall handle the Old GUTI or IMSI IE in the ATTACH REQUEST message as follows:

…

The UE shall send the ATTACH REQUEST message together with a PDN CONNECTIVITY REQUEST message contained in the ESM message container information element to request PDN connectivity.

…

[TS 24.301, clause 5.5.1.2.4]

…

[TS 24.301, Annex D]

…

Table D.1.1: Mapping of NAS procedure to establishment cause and call type

NAS procedure	RRC establishment cause (according 3GPP TS 36.331 [22])	Call type
Attach	MO signalling (See Note 1)	"originating signalling"
…
Note 1: For these NAS procedures initiated by UEs of access class 12, 13 or 14 in their home country, the RRC establishment cause will be set to "High priority access AC 11 – 15". For this purpose the home country is defined as the country of the MCC part of the IMSI, see 3GPP TS 22.011 [1A]. For these NAS procedures initiated by UE of access class 11 or 15 in their HPLMN or (if the EHPLMN list is not present or is empty) EHPLMN, (if the EHPLMN list is present) the RRC establishment cause will be set to "High priority access AC 11 – 15".

[TS 36.331, clause 5.3.3.4 “Reception of the RRCConnectionSetup by the UE”]

NOTE: Prior to this, lower layer signalling is used to allocate a C-RNTI. For further details see TS 36.321 [6];

The UE shall:

1> perform the radio resource configuration procedure in accordance with the received radioResourceConfigDedicated and as specified in 5.3.10;

1> if stored, discard the cell reselection priority information provided by the idleModeMobilityControlInfo or inherited from another RAT;

…

1> set the content of RRCConnectionSetupComplete message as follows:

2> set the selectedPLMN-Identity to the PLMN selected by upper layers (see TS 23.122 [11], TS 24.301 [35]) from the PLMN(s) included in the plmn-IdentityList in SystemInformationBlockType1;

2> if upper layers provide the ‘Registered MME’, include and set the registeredMME as follows:

3> if the PLMN identity of the ‘Registered MME’ is different from the PLMN selected by the upper layers:

4> include the plmnIdentity in the registeredMME and set it to the value of the PLMN identity in the ‘Registered MME’ received from upper layers;

3> set the mmegi and the mmec to the value received from upper layers;

2> if upper layers provided the ‘Registered MME’:

3> include and set the gummei-Type to the value provided by the upper layers;

…

2> submit the RRCConnectionSetupComplete message to lower layers for transmission, upon which the procedure ends;

9.2.1.1.7b.3 Test description

9.2.1.1.7b.3.1 Pre-test conditions

System Simulator:

– Cell A.

UE:

– The UE is configured to initiate EPS attach;

– The UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell E, using default message contents according to TS 36.508 [18].

Preamble:

– The UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.7b.3.2 Test procedure sequence

Table 9.2.1.1.7b.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2	Check: Does the UE transmit an RRCConnectionRequest message not including S-TMSI and with establishmentCause set to ‘mo-Signalling’?	–	–	1	P
3	The SS transmits an RRCConnectionSetup message.	–	–	–	–
4	Check: Does the UE transmit an RRCConnectionSetupComplete message including PLMN ID, MME group ID and MME code with ATTACH REQUEST message including a GUTI and a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	2	P
5-19	Steps 5-19, from Table 9.2.1.1.1.3.2-1 in test case 9.2.1.1.1, are performed.
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.1.7b.3.3 Specific message contents

Table 9.2.1.1.7b.3.3-1: Message RRCConnectionRequest (step 2, Table 9.2.1.1.7b.3.2-1)

Derivation path: 36.508 table 4.6.1-16
Information Element	Value/Remark	Comment	Condition
RRCConnectionRequest ::= SEQUENCE {
criticalExtensions CHOICE {
rrcConnectionRequest-r8 SEQUENCE {
ue-Identity CHOICE {
randomValue	Not checked
}
establishmentCause	mo-Signalling
}
}
}

Table 9.2.1.1.7b.3.3-2: Message RRCConnectionSetupComplete (step 4, Table 9.2.1.1.7b.3.2-1)

Derivation path: 36.508 table 4.6.1-18
Information Element	Value/Remark	Comment	Condition
RRCConnectionSetupComplete ::= SEQUENCE {
criticalExtensions CHOICE {
c1 CHOICE {
rrcConnectionSetupComplete-r8 SEQUENCE {
registeredMME {
plmn-Identity	PLMN ID(MCC and MNC as stored in EF_IMSI on the test USIM card)
mmegi	1000000000001001	Bit 0 is LSB
mmec	00000001	Bit 0 is LSB
}
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
gummei-Type-r10	native
}
}
}
}
}
}

Table 9.2.1.1.7b.3.3-3: Message ATTACH REQUEST (step 4, Table 9.2.1.1.7b.3.2-1)

Derivation path: TS 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	GUTI(belonging to PLMN with same MCC/MNC as stored in EF_IMSI on the test USIM card)	GUTI copied from USIM Old and valid GUTI is included by the UE
ESM message container	PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN
Last visited registered TAI	TAI12	GUTI copied from USIM If available, the last TAI is included by UE and will be used to establish a good list of TAIs in subsequent ATTACH ACCEPT message.

9.2.1.1.7c Attach / Success / PSM

9.2.1.1.7c.1 Test Purpose (TP)

(1)

with { the UE is switched-off with a valid USIM inserted and the UE is configured to attach with PSM }

ensure that {

when { UE is powered on }

then { the UE transmits an ATTACH REQUEST message including the T3324 IE set to a configured value }

}

(2)

with { the UE in IDLE mode }

ensure that {

when { UE receives a paging message before timer T3324 is expired }

then { the UE responds to the paging request }

}

9.2.1.1.7c.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clauses 5.3.11, 5.5.1.2.2.

[TS 24.301, clause 5.3.11]

The UE can request the use of power saving mode (PSM) during an attach or tracking area updating procedure (see 3GPP TS 23.682 [11A] and 3GPP TS 23.401 [10]). The UE shall not request the use of PSM during:

– an attach for emergency bearer services procedure;

– an attach procedure for initiating a PDN connection for emergency bearer services with attach type not set to "EPS emergency attach";

– a tracking area updating procedure for initiating a PDN connection for emergency bearer services; or

– a tracking area updating procedure when the UE has a PDN connection established for emergency bearer services.

The network accepts the use of PSM by providing a specific value for timer T3324 when accepting the attach or tracking area updating procedure. The UE may use PSM only if the network has provided the T3324 value IE during the last attach or tracking area updating procedure with a value different from "deactivated".

NOTE: Timer T3324 is specified in 3GPP TS 24.008 [13].

Upon expiry of the timer T3324 or if the T3324 value provided by the network is zero, the UE may deactivate the AS layer and activate PSM by entering the state EMM-REGISTERED.NO-CELL-AVAILABLE if:

a) the UE is not attached for emergency bearer services;

b) the UE has no PDN connection for emergency bearer services;

c) the UE is in EMM-IDLE mode; and

d) in the EMM-REGISTERED.NORMAL-SERVICE state.

If conditions a, b and c are fulfilled, but the UE is in a state other than EMM-REGISTERED.NORMAL-SERVICE when timer T3324 expires, the UE may activate PSM when the MS returns to state EMM-REGISTERED.NORMAL-SERVICE.

A UE that has already been allocated timer T3324 with a value different from "deactivated" and the timer T3324 has expired, may activate PSM if it receives an "Extended wait time" from lower layers.

If the UE is attached for emergency bearer services or has a PDN connection for emergency bearer services, the UE shall not activate PSM.

The UE may deactivate PSM at any time (e.g. for the transfer of mobile originated signalling or user data), by activating the AS layer before initiating the necessary EMM procedures. When PSM is activated all NAS timers are stopped and associated procedures aborted except for T3412, T3346 and T3396.

[TS 24.301, clause 5.5.1.2.2]

If the UE supports PSM and requests the use of PSM, then the UE shall include the T3324 value IE with a requested timer value in the ATTACH REQUEST message. When the UE includes the T3324 value IE and the UE indicates support for extended periodic timer value in the MS network feature support IE, it may also include the T3412 extended value IE to request a particular T3412 value to be allocated.

9.2.1.1.7c.3 Test description

9.2.1.1.7c.3.1 Pre-test conditions

System Simulator:

– cell A.

UE:

– The UE is configured to initiate EPS attach;

– The UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

– The UE is configured to use Power Saving Mode

– The UE is configured to use a specific value of T3324

Preamble:

– The UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.7c.3.2 Test procedure sequence

Table 9.2.1.1.7c.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2	The UE transmits an RRCConnectionRequest message.	–	–	–	–
3	The SS transmits an RRCConnectionSetup message.	–	–	–	–
4	Check: Does the UE transmit an ATTACH REQUEST message including the T3324 IE set to two minutes?	–>	ATTACH REQUEST	1	P
5 -13Eb1	Steps 5-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
	The SS shall wait for 1 minute and then execute the following steps before timer T3324 expires.
14 – 24	Check: Does the UE accept the paging request? Steps 1-10, from Table 4.5.3.3-1 in TS 36.508, are performed.	–	–	2	P

9.2.1.1.7c.3.3 Specific message contents

Table 9.2.1.1.7c.3.3-1: Void

Table 9.2.1.1.7c.3.3-2: Message ATTACH REQUEST (step 4, Table 9.2.1.1.7c.3.2-1)

Derivation path: TS 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	GUTI(belonging to PLMN with same MCC as stored in EF_IMSI on the test USIM card)	GUTI copied from USIM Old and valid GUTI is included by the UE
ESM message container	PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN
Last visited registered TAI	TAI1	GUTI copied from USIM If available, the last TAI is included by UE and will be used to establish a good list of TAIs in subsequent ATTACH ACCEPT message.
T3324	’0010 0010’B	2 minutes
T3412 extended value	Not present
	Any allowed value		IF the UE indicates support for extended periodic timer value in the MS network feature support IE

Table 9.2.1.1.7c.3.3-4: Void

Table 9.2.1.1.7c.3.3-5: Message ATTACH ACCEPT (step 10, Table 9.2.1.1.7c.3.2-1)

Derivation path: TS 36.508 table 4.7.2-1
Information Element	Value/Remark	Comment	Condition
T3324	T3324 timer value	Timer set to the same value as in table 9.2.1.1.7c.3.3-2
T3412 extended value	Value received in ATTACH REQUEST	Included only if the IE ‘T3412 extended value’ was provided in the ATTACH REQUEST

9.2.1.1.7d Attach / Success / DCN

9.2.1.1.7d.1 Test Purpose (TP)

(1)

with { the UE is switched-off with a valid USIM inserted and the UE is pre-configured with a Default DCN-ID}

ensure that {

when { UE is powered on }

then { the UE transmits an RRCConnectionSetupComplete message including the dcn-ID IE set to the Default DCN-ID }

}

(2)

with { the UE in IDLE mode having received a DCN-ID in a previous ATTACH ACCEPT message}

ensure that {

when { UE receives a paging message }

then { the UE transmits an RRCConnectionSetupComplete message including the dcn-ID IE set to the received DCN-ID }

}

9.2.1.1.7d.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clauses 5.3.1.1 and 5.5.1.2.4 and in TS 36.331, clause 5.3.3.4.

[TS 24.301, clause 5.3.1.1]

…

When an ATTACH REQUEST message, or a TRACKING AREA UPDATE REQUEST message when the TAI of the current cell is not included in the TAI list, is sent to establish a signalling connection, the UE NAS also provides the lower layers with the DCN-ID according to the following rules:

a) if a DCN-ID for the PLMN code of the selected PLMN is available in the UE, the UE NAS shall provide this DCN-ID to the lower layers; or

b) if no DCN-ID for the PLMN code of the selected PLMN is available but a Default_DCN_ID value is available in the UE, as specified in 3GPP TS 24.368 [15A] or in USIM file NAS_CONFIG as specified in 3GPP TS 31.102 [17], the UE NAS shall provide this DCN-ID to the lower layers.

…

[TS 24.301, clause 5.5.1.2.4]

…

If the ATTACH ACCEPT message contains the DCN-ID IE, then the UE shall store the included DCN-ID value together with the PLMN code of the registered PLMN in a DCN-ID list in a non-volatile memory in the ME as specified in annex C.

…

[TS 36.331, clause 5.3.3.4]

The UE shall:

1> if the RRCConnectionSetup is received in response to an RRCConnectionResumeRequest:

2> discard the stored UE AS context and resumeIdentity;

2> indicate to upper layers that the RRC connection resume has been fallbacked;

1> perform the radio resource configuration procedure in accordance with the received radioResourceConfigDedicated and as specified in 5.3.10;

1> if stored, discard the cell reselection priority information provided by the idleModeMobilityControlInfo or inherited from another RAT;

1> for NB-IoT, if stored, discard the dedicated frequency offset provided by the redirectedCarrierOffsetDedicated;

1> stop timer T300;

1> stop timer T302, if running;

1> stop timer T303, if running;

1> stop timer T305, if running;

1> stop timer T306, if running;

1> stop timer T308, if running;

1> perform the actions as specified in 5.3.3.7;

1> stop timer T320, if running;

1> stop timer T350, if running;

1> perform the actions as specified in 5.6.12.4;

1> release rclwi-Configuration, if configured, as specified in 5.6.16.2;

1> stop timer T360, if running;

1> stop timer T322, if running;

1> enter RRC_CONNECTED;

1> stop the cell re-selection procedure;

1> consider the current cell to be the PCell;

1> set the content of RRCConnectionSetupComplete message as follows:

2> if the RRCConnectionSetup is received in response to an RRCConnectionResumeRequest:

3> if upper layers provide an S-TMSI:

4> set the s-TMSI to the value received from upper layers;

2> set the selectedPLMN-Identity to the PLMN selected by upper layers (see TS 23.122 [11], TS 24.301 [35]) from the PLMN(s) included in the plmn-IdentityList in SystemInformationBlockType1 (or SystemInformationBlockType1-NB in NB-IoT);

2> if upper layers provide the ‘Registered MME’, include and set the registeredMME as follows:

3> if the PLMN identity of the ‘Registered MME’ is different from the PLMN selected by the upper layers:

4> include the plmnIdentity in the registeredMME and set it to the value of the PLMN identity in the ‘Registered MME’ received from upper layers;

3> set the mmegi and the mmec to the value received from upper layers;

2> if upper layers provided the ‘Registered MME’:

3> include and set the gummei-Type to the value provided by the upper layers;

2> if the UE supports CIoT EPS optimisation(s):

3> include attachWithoutPDN-Connectivity if received from upper layers;

3> include up-CIoT-EPS-Optimisation if received from upper layers;

3> except for NB-IoT, include cp-CIoT-EPS-Optimisation if received from upper layers;

2> if connecting as an RN:

3> include the rn-SubframeConfigReq;

2> set the dedicatedInfoNAS to include the information received from upper layers;

2> except for NB-IoT:

3> if the UE has radio link failure or handover failure information available in VarRLF-Report and if the RPLMN is included in plmn-IdentityList stored in VarRLF-Report:

4> include rlf-InfoAvailable;

3> if the UE has MBSFN logged measurements available for E-UTRA and if the RPLMN is included in plmn-IdentityList stored in VarLogMeasReport:

4> include logMeasAvailableMBSFN;

3> else if the UE has logged measurements available for E-UTRA and if the RPLMN is included in plmn-IdentityList stored in VarLogMeasReport:

4> include logMeasAvailable;

3> if the UE has connection establishment failure information available in VarConnEstFailReport and if the RPLMN is equal to plmn-Identity stored in VarConnEstFailReport:

4> include connEstFailInfoAvailable;

3> include the mobilityState and set it to the mobility state (as specified in TS 36.304 [4]) of the UE just prior to entering RRC_CONNECTED state;

3> if the UE supports storage of mobility history information and the UE has mobility history information available in VarMobilityHistoryReport:

4> include the mobilityHistoryAvail;

2> include dcn-id if a DCN value (see TS 23.401 [41]) is received from upper layers;

2> if UE needs UL gaps during continuous uplink transmission:

3> include ue-CE-NeedULGaps;

2> submit the RRCConnectionSetupComplete message to lower layers for transmission, upon which the procedure ends;

9.2.1.1.7d.3 Test description

9.2.1.1.7d.3.1 Pre-test conditions

System Simulator:

– cell A.

UE:

– the UE is configured to initiate EPS attach;

The UE is equipped with a USIM containing values shown in Table 9.2.1.1.7d.3.1-1.

Table 9.2.1.1.7d.3.1: USIM Configuration

USIM field	Value
EF_UST	Services 96 is supported.
EF_NASCONFIG	“Default_DCN_ID value” provisioned with the value 0, as defined in TS 24.368, clause 5.10e.

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.7d.3.2 Test procedure sequence

Table 9.2.1.1.7d.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2	The UE transmit an RRCConnectionRequest message not including S-TMSI and with establishmentCause set to ‘mo-Signalling’?	–	–	–	–
3	The SS transmits an RRCConnectionSetup message.	–	–	–	–
4	Check: Does the UE transmit an RRCConnectionSetupComplete message including the dcn-ID IE set to the default DCN ID provisioned in the UE?	–>	ATTACH REQUEST	1	P
5 -13Eb1	Steps 5-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
14 – 18	Steps 1-5, from Table 4.5.3.3-1 in TS 36.508, are performed. Check: Does the UE transmit an RRCConnectionSetupComplete message including the dcn-ID IE set to the DCN ID received in step 10?	–	–	2	P
19	The SS transmits a SERVICE REJECT message with the EMM cause set to ‘Illegal UE’.	<–	SERVICE REJECT	–	–
20	The SS releases the RRC connection.	–	–	–	–

9.2.1.1.7d.3.3 Specific message contents

Table 9.2.1.1.7d.3.3-1: Message RRCConnectionSetupComplete (step 2, Table 9.2.1.1.7d.3.2-1)

Derivation path: 36.508 table 4.6.1-18
Information Element	Value/Remark	Comment	Condition
RRCConnectionSetupComplete ::= SEQUENCE {
criticalExtensions CHOICE {
rrcConnectionSetupComplete-r8 SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
dcn-ID-r14	Integer value	The Default DCN-ID as defined in the USIM
}
}
}
}
}
}
}
}
}
}

Table 9.2.1.1.7d.3.3-2: Message ATTACH ACCEPT (step 10, Table 9.2.1.1.7d.3.2-1)

Derivation path: TS 36.508 table 4.7.2-1
Information Element	Value/Remark	Comment	Condition
DCN-ID	Integer value	Any allowed value different from the Default DCN-ID in the USIM

Table 9.2.1.1.7d.3.3-3: Message RRCConnectionSetupComplete (step 18, Table 9.2.1.1.7d.3.2-1)

Derivation path: 36.508 table 4.6.1-18
Information Element	Value/Remark	Comment	Condition
RRCConnectionSetupComplete ::= SEQUENCE {
criticalExtensions CHOICE {
rrcConnectionSetupComplete-r8 SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
dcn-ID-r14	Integer value	The same DCN-ID value as used in Table 9.2.1.1.7d.3.3-2
}
}
}
}
}
}
}
}
}
}

9.2.1.1.8 Void

9.2.1.1.9 Attach / Rejected / IMSI invalid

9.2.1.1.9.1 Test Purpose (TP)

(1)

with { UE has sent an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message }

ensure that {

when { UE receives an ATTACH REJECT message with the reject cause set to "Illegal UE" }

then { UE considers the USIM as invalid for EPS services and non-EPS services and enters state EMM-DEREGISTERED }

}

(2)

with { UE receives an ATTACH REJECT message with the reject cause set to "Illegal UE" }

ensure that {

when { the UE has been switched off, then switched on }

then { the UE sends an ATTACH REQUEST message with IMSI, including a PDN CONNECTIVITY REQUEST message }

}

9.2.1.1.9.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.1.2.5.

[TS 24.301, clause 5.5.1.2.5]

Upon receiving the ATTACH REJECT message, the UE shall stop timer T3410 and take the following actions depending on the reject cause value received.

#3 (Illegal UE); or

…

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI and KSI. The UE shall consider the USIM as invalid for EPS services and non-EPS services until switching off or the UICC containing the USIM is removed. Additionally, the UE shall delete the list of equivalent PLMNs and enter state EMM-DEREGISTERED.

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the MM parameters update status, TMSI, LAI and ciphering key sequence number, and the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number as specified in 3GPP TS 24.008 [13] for the case when the normal attach procedure is rejected with the GMM cause with the same value.

NOTE: The possibility to configure a UE so that the radio transceiver for a specific RAT is not active, although it is implemented in the UE, is out of scope of the present specification.

9.2.1.1.9.3 Test description

9.2.1.1.9.3.1 Pre-test conditions

System Simulator:

– cell A, cell B and If (px_SinglePLMN_Tested = Multi PLMN) cell G:

– Cell A and Cell B (home PLMN, different TAs),

– If (px_SinglePLMN_Tested = Multi PLMN), Cell G (another PLMN);

– the different cells may not be simultaneously activated (at most 2 cells are active simultaneously).

UE:

– the UE is configured to initiate EPS attach;

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.9.3.2 Test procedure sequence

Table 9.2.1.1.9.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – cell A as the "Serving cell". – cell B as a "Non-Suitable cell". – If present, Cell G as a "Non-Suitable Off cell".	–	–	–	–
–	The following messages are to be observed on cell A unless explicitly stated otherwise.	–	–	–	–
2	The UE is switched on.	–	–	–	–
3	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message on cell A.	–>	ATTACH REQUEST	–	–
3A-3D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
4	The SS transmits an ATTACH REJECT message with EMM cause = "Illegal UE" as specified.	<–	ATTACH REJECT	–	–
5	The SS releases the RRC connection.	–	–	–	–
6	The SS configures: – Cell A as a "Non-Suitable cell". – Cell B as the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
7	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds? Note: Cell B belongs to the same PLMN where the UE was rejected but a different TA	–>	ATTACH REQUEST	1	F
8	The operator initiates an attach by MMI or by AT command.	–	–	–	–
9	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	1	F
10	Void	–	–	–	–
11	Check: Does the test result of the generic procedure defined in TS 36.508 subclause 6.4.2.5 indicates that the UE responds to paging on cell B for PS domain with S-TMSI included in GUTI-1?	–	–	1	–
–	EXCEPTION: Steps 12a1 to 12a4 describe behaviour that depends on the network capability / preference; the "lower case letter" identifies a step sequence that takes place if the network is capable or prefers.	–	–	–	–
12 a1	IF (px_SinglePLMN_Tested = Multi PLMN) The SS configures: – Cell A as a “Non-Suitable Off cell”. – Cell B as a "Non-Suitable cell". – Cell G as the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell G unless explicitly stated otherwise.	–	–	–	–
12a2	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds? Note: Cell G belongs to a PLMN which is not the same like the one on which the UE was rejected.	–>	ATTACH REQUEST	1	F
12a3	The user initiates an attach by MMI or by AT command.	–	–	–	–
12a4	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	1	F
13-15	Void	–	–	–	–
16	if possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.
16A	The SS configures: – Cell A as a "Non-Suitable cell". – Cell B as the "Serving cell". -If present Cell G as a "Non-Suitable off cell".	–	–	–	–
17	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
17A	The following messages are to be observed on Cell B unless explicitly stated otherwise	–	–	–	–
18	Void	–	–	–	–
19	Check: Does the UE transmit an ATTACH REQUEST message with IMSI-1?	–>	ATTACH REQUEST	2	P
20-33 b1	The attach procedure is completed by executing steps 5 to 18b1 of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.1.9.3.3 Specific message contents

Table 9.2.1.1.9.3.3-1: Message ATTACH REJECT (step 4, Table 9.2.1.1.9.3.2-1)

Derivation path: 36.508 table 4.7.2-3
Information Element	Value/Remark	Comment	Condition
EMM cause	00000011	#3 "Illegal UE"
ESM message container	Not present

Table 9.2.1.1.9.3.3-2: Message ATTACH REQUEST (step 19, Table 9.2.1.1.9.3.2-1)

Derivation path: TS 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	IMSI-1
ESM message container	PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN
Last visited registered TAI	Not present
Old LAI	Not present
TMSI status	Not present

9.2.1.1.10 Attach / Rejected / Illegal ME

9.2.1.1.10.1 Test Purpose (TP)

(1)

with { UE has sent an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message }

ensure that {

when { UE receives an ATTACH REJECT message with the reject cause set to "Illegal ME" }

then { UE considers the USIM as invalid for EPS services and non-EPS services and enters state EMM-DEREGISTERED }

}

(2)

with { UE receives an ATTACH REJECT message with the reject cause set to "Illegal ME" }

ensure that {

when { the UE has been switched off, then switched on }

then { the UE sends an ATTACH REQUEST message with IMSI, including a PDN CONNECTIVITY REQUEST message }

}

9.2.1.1.10.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.1.2.5.

[TS 24.301, clause 5.5.1.2.5]

Upon receiving the ATTACH REJECT message, the UE shall stop timer T3410 and take the following actions depending on the reject cause value received.

#6 (Illegal ME);

9.2.1.1.10.3 Test description

The test description is identical to the one of subclause 9.2.1.1.9 except that in the test procedure and in the specific message contents, the reject cause #3 "Illegal UE" is replaced with the reject cause #6 "Illegal ME".

9.2.1.1.11 Attach / Rejected / EPS services and non-EPS services not allowed

9.2.1.1.11.1 Test Purpose (TP)

(1)

with { UE has sent an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message }

ensure that {

when { UE receives an ATTACH REJECT message with the reject cause set to "EPS services and non-EPS services not allowed" }

then { UE considers the USIM as invalid for EPS services and non-EPS services and enters state EMM-DEREGISTERED }

}

(2)

with { UE receives an ATTACH REJECT message with the reject cause set to "EPS services and non-EPS services not allowed" }

ensure that {

when { the UE has been switched off, then switched on }

then { the UE sends an ATTACH REQUEST message with IMSI, including a PDN CONNECTIVITY REQUEST message }

}

(3)

with { UE receives an ATTACH REJECT message with the reject cause set to "EPS services and non-EPS services not allowed" }

ensure that {

when { the UE has been switched off, then switched on and a UMTS or GSM cell is found }

then { the UE sends an ATTACH REQUEST message with IMSI }

}

9.2.1.1.11.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.1.2.5 and TS 24.008, clause 4.7.3.2.4.

[TS 24.301, clause 5.5.1.2.5]

Upon receiving the ATTACH REJECT message, the UE shall stop timer T3410 and take the following actions depending on the reject cause value received.

#8 (EPS services and non-EPS services not allowed);

[TS 24.008, clause 4.7.3.2.4]

The MS shall then take one of the following actions depending upon the reject cause:

# 8 (GPRS services and non-GPRS services not allowed);

…

The MS shall set the GPRS update status to GU3 ROAMING NOT ALLOWED (shall store it according to subclause 4.1.3.2) and shall delete any P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number. The new GMM state is GMM-DEREGISTERED. The new MM state is MM IDLE.

The MS shall set the update status to U3 ROAMING NOT ALLOWED, shall delete any TMSI, LAI and ciphering key sequence number. The SIM/USIM shall be considered as invalid for GPRS and non-GPRS services until switching off or the SIM/USIM is removed.

9.2.1.1.11.3 Test description

The test description is identical to the one of subclause 9.2.1.1.9 with the following exceptions:

9.2.1.1.11.3.1 Pre-test conditions

System Simulator:

– cell A, Cell B (home PLMN, different TAs) and if (px_SinglePLMN_Tested = Multi PLMN) Cell G TS 36.508 (another PLMN)

– If (px_RATComb_Tested = EUTRA_UTRA OR px_RATComb_Tested = EUTRA_GERAN) ;

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 9 (is configured);

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, cell 24 (is configured);

– system information combination 10 as defined in TS 36.508[18] clause 4.4.3.1 is applied in E-UTRA cells;

– If (px_RATComb_Tested = EUTRA_Only):

– neither cell 9 nor cell 24 is configured;

– system information combination 1 as defined in TS 36.508[18] clause 4.4.3.1 is applied in E-UTRA cells;

UE:

– the UE is configured to initiate EPS attach;

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18];

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, the UE is previously registered on UTRAN cell 9 using default message contents according to TS 36.508 [18].

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, the UE is previously registered on GERAN cell 24 using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.11.3.2 Test procedure sequence

Table 9.2.1.1.11.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – Cell A as the "Serving cell". – Cell B as a "Non-Suitable cell". – If present, Cell G as a "Non-Suitable cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
2	The UE is switched on.	–	–	–	–
3	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
3A-3D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
4	The SS transmits an ATTACH REJECT message with EMM cause = "EPS services and non-EPS services not allowed" as specified.	<–	ATTACH REJECT	–	–
5	The SS releases the RRC connection.	–	–	–	–
6	The SS configures: – Cell A as a "Non-Suitable cell". – Cell B as the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
7	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds? Note: Cell B belongs to the same PLMN where the UE was rejected but a different TA	–>	ATTACH REQUEST	1	F
8	The operator initiates an attach by MMI or by AT command.	–	–	–	–
9	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	1	F
10	Void	–	–	–	–
11	Check: Does the test result of the generic procedure defined in TS 36.508 subclause 6.4.2.5 indicates that the UE responds to paging on cell B for PS domain with S-TMSI included in GUTI-1?	–	–	1	–
–	EXCEPTION: Steps 12a1 to 12a4 describe behaviour that depends on the network capability / preference; the "lower case letter" identifies a step sequence that takes place if the network is capable or prefers.	–	–	–	–
12a1	IF (px_SinglePLMN_Tested = Multi PLMN) The SS configures: – Cell A as a "Non-Suitable “off" cell". – Cell B as a "Non-Suitable cell". – Cell G as the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell G unless explicitly stated otherwise.	–	–	–	–
12a2	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds? Note: Cell G belongs to a PLMN which is not the same like the one on which the UE was rejected.	–>	ATTACH REQUEST	1	F
12a3	The user initiates an attach by MMI or by AT command.	–	–	–	–
12a4	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	1	F
13-15	Void	–	–	–	–
16	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
16A	The SS configures: – Cell A as a "Non-Suitable cell". – Cell B as the "Serving cell". -If present, Cell G as a "Non-Suitable off cell".	–	–	–	–
17	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
18	Void	–	–	–	–
–	The following messages are sent on Cell B.	–	–	–	–
19	Check: Does the UE transmit an ATTACH REQUEST message with IMSI-1?	–>	ATTACH REQUEST	2	P
19A-19D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
20	The SS transmits an ATTACH REJECT message with EMM cause = "EPS services and non-EPS services not allowed" as specified.	<–	ATTACH REJECT	–	–
20A	The SS releases the RRC connection.	–	–	–	–
–	EXCEPTION: Steps 21a1 to 21a10 describe behaviour that depends on the UE capability.	–	–	–	–
21a1	IF pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA OR pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN THEN the SS sets – Cell B as a "Non-Suitable cell". – Cell 24 (GERAN) or Cell 9 (UTRAN) as the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell 24 or Cell 9 (depending on which cell was set as "Serving cell" in the preceding step) unless explicitly stated otherwise.	–	–	–	–
21a2	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	1	F
21a3	The user initiates an attach by MMI or by AT command.	–	–	–	–
21a4	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	1	F
21a5	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
21a6	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
–	EXCEPTION: Steps 21a6a1, 21a6a2 describe behaviour that depends on the UE capability; the “lower case letter” identifies a step sequence that take place if pc_AutomaticAttachSwitchON is NOT supported	–	–	–	–
21a6Aa1	IF NOT pc_AutomaticAttachSwitchON	–	Registration on CS	–	–
21a6Aa2	IF NOT pc_AutomaticAttachSwitchON the user initiates an attach by MMI or by AT command.	–	–	–	–
21a7	Void	–	–	–	–
21a8	Check: Does the UE transmit an ATTACH REQUEST message with IMSI-1?	–>	ATTACH REQUEST	3	P
22	The attach procedure is completed	–	–	–	–
23	IF pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA	–	–	–	–
23a1	The SS releases the RRC connection
23a2	The generic test procedure in TS 36.508 subclause 4.5A.3A.2 is performed	–	–	–	–
–	If (px_RATComb_Tested = EUTRA_UTRA OR px_RATComb_Tested = EUTRA_GERAN); At the end of this test procedure sequence, the UE is in end state either U1_IDLE or G1_IDLE E-UTRA connected (E2) according to TS 36.508. Else: At the end of this test procedure sequence, the UE is in end state E-UTRA deregistered (E4) according to TS 36.508.	–	–	–	–

9.2.1.1.11.3.3 Specific message contents

Table 9.2.1.1.11.3.3-1: Message ATTACH REJECT (steps 4 and 20, Table 9.2.1.1.11.3.2-1)

Derivation path: 36.508 table 4.7.2-3
Information Element	Value/Remark	Comment	Condition
EMM cause	00001000	#8 "EPS services and non-EPS services not allowed"
ESM message container	Not present

Table 9.2.1.1.11.3.3-2: Message ATTACH REQUEST (step 19, Table 9.2.1.1.11.3.2-1)

Derivation path: TS 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	IMSI-1
ESM message container	PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN
Last visited registered TAI	Not present
Old LAI	Not present
TMSI status	Not present

Table 9.2.1.1.11.3.3-3: Message ATTACH REQUEST (step 21a8, Table 9.2.1.1.11.3.2-1)

Derivation path: TS 24.008 table 9.4.1
Information Element	Value/Remark	Comment	Condition
MS network capability	Not checked
Attach type	Not checked
GPRS ciphering key sequence number	111	No key is available
DRX parameter	Not checked
P-TMSI or IMSI	IMSI-1
Old routing area identification	Deleted RAI-1	The MNC and the MCC in the coding of the RAI are replaced by the RAC of RAC-1
MS Radio Access capability	Not checked
Old P-TMSI signature	Not present
Requested READY timer Value	Not checked
TMSI status	Not checked
PS LCS Capability	Not checked
Mobile station classmark 2	Not checked
Mobile station classmark 3	Not checked
Supported Codecs	Not checked
UE network capability	Not checked
Additional mobile identity	Not present
Additional old routing area identification	Not present

9.2.1.1.12 Attach / Rejected / EPS services not allowed

9.2.1.1.12.1 Test Purpose (TP)

(1)

with { UE has sent an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message }

ensure that {

when { UE receives an ATTACH REJECT message with the reject cause set to "EPS services not allowed" }

then { UE deletes the GUTI and the last visited registered TAI and KSI and considers the USIM as invalid for EPS services until switching off or the UICC containing the USIM is removed and deletes the list of equivalent PLMNs and UE enters state EMM-DEREGISTERED }

}

9.2.1.1.12.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clauses 5.5.1.2.2 and 5.5.1.2.5.

[TS 24.301, clause 5.5.1.2.2]

If the UE supports neither A/Gb mode nor Iu mode, the UE shall handle the Old GUTI or IMSI IE in the ATTACH REQUEST message as follows:

…

[TS 24.301, clause 5.5.1.2.5]

…

Upon receiving the ATTACH REJECT message, the UE shall stop timer T3410 and take the following actions depending on the reject cause value received.

#7 (EPS services not allowed);

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI and KSI. The UE shall consider the USIM as invalid for EPS services until switching off or the UICC containing the USIM is removed. Additionally, the UE shall delete the list of equivalent PLMNs and enter state EMM-DEREGISTERED.

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number as specified in 3GPP TS 24.008 [6] for the case when the normal attach procedure is rejected with the GMM cause with the same value.

9.2.1.1.12.3 Test description

9.2.1.1.12.3.1 Pre-test conditions

System Simulator:

– cell A, cell B and cell G:

– cell A and cell B (HPLMN, different TAs), if (px_SinglePLMN_Tested = Multi PLMN) cell G (another PLMN);

– If (px_RATComb_Tested = EUTRA_UTRA OR px_RATComb_Tested = EUTRA_GERAN) ;

– if pc_UTRA, AND px_RATComb_Tested = EUTRA_UTRA cell 9 (HPLMN, UTRAN);

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, cell 24 (HPLMN, GERAN);

– If (px_RATComb_Tested = EUTRA_Only):

– neither cell 9 nor cell 24 is configured;

– system information combination 1 as defined in TS 36.508[18] clause 4.4.3.1 is applied in E-UTRA cells;

– the different cells may not be simultaneously activated (at most 2 cells are active simultaneously);

UE:

– the UE is configured to initiate EPS attach;

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18];

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, the UE is previously registered on UTRAN cell 9 using default message contents according to TS 36.508 [18].

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, the UE is previously registered on GERAN cell 24 using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.12.3.2 Test procedure sequence

Table 9.2.1.1.12.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – Cell A as the "Serving cell". – Cell B as a " Suitable neighbour cell". – If present, Cell G as a "Non-Suitable Off cell". – If present, Cell 9 or 24 as a "Non-Suitable Off cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
2	The user switches the UE on.	–	–	–	–
3	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
3A-3D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
4	The SS transmits an ATTACH REJECT message with EMM cause = "EPS services not allowed".	<–	ATTACH REJECT	–	–
5	The SS releases the RRC connection.	–	–	–	–
6	The SS reconfigures: Cell A as a " Suitable neighbour cell". Cell B as the "Serving cell". Note: Cell A and Cell B are in different TAIs – same PLMN.	–	–	–	–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
7	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	1	F
8	The user initiates an attach by MMI or by AT command.	–	–	–	–
9	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	1	F
–	EXCEPTION: Steps 10a1 to 10a6 describe behaviour that depends on the UE capability.	–	–	–	–
10a1	IF pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA OR pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN THEN the SS configures – Cell A as "Non-suitable Off cell" – Cell B as a " Suitable neighbour cell". – Cell 24 (GERAN) or 9 (UTRAN) as the "Serving cell". Note: Cell B and Cell 24 (GERAN) or 9 (UTRAN) are in different PLMNs	–	–	–	–
10a2	Void	–	–	–	–
–	EXCEPTION: The following messages are to be observed on Cell 24 or Cell 9 (depending on which cell was set as "Serving cell" in the preceding step) unless explicitly stated otherwise.	–	–	–	–
–	EXCEPTION: Depending on UE capabilities the behaviour in table 9.2.1.1.12.3.2-2 occurs in parallel with step 10a3.	–	–	–	–
	EXCEPTION: The behaviour in table 9.2.1.1.12.3.2-2 occurs in parallel with step 10a3.
10a3	Check: Does the UE transmit an ATTACH REQUEST message in the next 2 minutes?	–>	ATTACH REQUEST	1	F
10a4	The user initiates an attach by MMI or by AT command.	–	–	–	–
10a5	Check : Does the UE transmit an ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	1	F
10a6	The SS configures cell 24 or cell 9 as " Non-Suitable Off cell".	–	–	–	–
–	EXCEPTION: Steps 11a1 to 11a4 describe behaviour that depends on the network capability / preference; the "lower case letter" identifies a step sequence that takes place if the network is capable or prefers.	–	–	–	–
11a1	If (px_SinglePLMN_Tested = Multi PLMN) The SS sets: – Cell B as a "Non-Suitable Off cell". – Cell G as the "Serving cell". Note: Cell B and Cell G are different PLMNs.	–	–	–	–
–	The following messages are to be observed on Cell G unless explicitly stated otherwise.	–	–	–	–
11a2	Check: Does the UE transmit an ATTACH REQUEST message in the next 60 seconds?	–>	ATTACH REQUEST	1	F
11a3	The operator initiates an attach by MMI or by AT command.	–	–	–	–
11a4	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	1	F
–	At the end of this test procedure sequence, the UE is in end state E-UTRA deregistered (E4) according to TS 36.508.	–	–	–	–

Table 9.2.1.1.12.3.2-2: Parallel behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
–	EXCEPTION: Steps 1a1-1a 5 describe a behaviour which depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported.	–	–	–	–
1a1	IF pc_CS THEN the UE transmits a LOCATION UPDATING REQUEST message.	–>	LOCATION UPDATING REQUEST	–	–
–	EXCEPTION: The messages in the next two steps are sent only IF pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN	–	–	–	–
1a2a1	The UE transmits a Classmark Change message	–>	CLASSMARK CHANGE	–	–
1a2a2	IF pc_UTRA THEN the UE transmits a Utran Classmark Change message.	–>	UTRAN CLASSMARK CHANGE.	–	–
1a3	The SS transmits an AUTHENTICATION REQUEST message to initiate the authentication and AKA procedure.	<–	AUTHENTICATION REQUEST	–	–
1a4	The UE transmits an AUTHENTICATION RESPONSE message.	–>	AUTHENTICATION RESPONSE	–	–
1a5	The SS transmits a LOCATION UPDATING ACCEPT message including IMSI-1	<–	LOCATION UPDATING ACCEPT	–	–

9.2.1.1.12.3.3 Specific message contents

Table 9.2.1.1.12.3.3-1: Message ATTACH REJECT (step 4, Table 9.2.1.1.12.3.2-1)

Derivation path: 36.508 table 4.7.2-3
Information Element	Value/Remark	Comment	Condition
EMM cause	00000111	#7 "EPS services not allowed"
ESM message container	Not present

Table 9.2.1.1.12.3.3-2: LOCATION UPDATING ACCEPT (step 5, Table 9.2.1.1.12.3.2-2)

Derivation Path: TS 36.508 Table 4.7B.2-5
Information Element	Value/remark	Comment	Condition
Mobile identity
IMSI	IMSI-1

9.2.1.1.13 Attach / Rejected / PLMN not allowed

9.2.1.1.13.1 Test Purpose (TP)

(1)

with { the UE has sent an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message }

ensure that {

when { the UE receives an ATTACH REJECT message with the reject cause set to "PLMN not allowed" }

then { the UE deletes the GUTI, the last visited registered TAI, KSI, the list of equivalent PLMNs and UE enters state EMM-DEREGISTERED.PLMN-SEARCH and UE stores the PLMN in the "forbidden PLMN list" in the USIM }

}

(2)

with { the UE is switched off and a PLMN is stored in the "forbidden PLMN list" in the USIM }

ensure that {

when { the UE is switched on }

then { the UE doesn’t attempt to attach on this PLMN }

}

(3)

with { the UE in E-UTRA EMM-DEREGISTERED.PLMN-SEARCH state and a PLMN is stored in the "forbidden PLMN list" }

ensure that {

when { the UE detects a cell belonging to a PLMN which is not in the "forbidden PLMN list" }

then { the UE attaches to this PLMN }

}

(4)

with {the UE in E-UTRA EMM-DEREGISTERED.PLMN-SEARCH state and a PLMN is stored in the "forbidden PLMN list" }

ensure that {

when { the forbidden PLMN is selected manually }

then { the UE attaches to the forbidden PLMN and deletes this PLMN from the USIM}

}

9.2.1.1.13.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clauses 5.5.1.2.2 and 5.5.1.2.5.

[TS 24.301, clause 5.5.1.2.2]

If the UE supports neither A/Gb mode nor Iu mode, the UE shall handle the Old GUTI or IMSI IE in the ATTACH REQUEST message as follows:

If the UE supports A/Gb mode or Iu mode, the UE shall handle the Old GUTI or IMSI IE as follows:

…

– If the TIN indicates "GUTI" or "RAT-related TMSI" and the UE holds a valid GUTI, the UE shall indicate the GUTI in the Old GUTI or IMSI IE.

…

– Otherwise the UE shall include the IMSI in the Old GUTI or IMSI IE.

…

[TS 24.301, clause 5.5.1.2.5]

If the attach request cannot be accepted by the network, the MME shall send an ATTACH REJECT message to the UE including an appropriate EMM cause value.

…

Upon receiving the ATTACH REJECT message, the UE shall stop timer T3410 and take the following actions depending on the EMM cause value received.

…

#11 (PLMN not allowed);

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI and KSI. Additionally, the UE shall delete the list of equivalent PLMNs and reset the attach attempt counter, and enter state EMM-DEREGISTERED.PLMN-SEARCH.

In S1 mode, the UE shall store the PLMN identity in the "forbidden PLMN list" and enter state EMM-DEREGISTERED.PLMN-SEARCH. The UE shall perform a PLMN selection according to 3GPP TS 23.122 [6].

…

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the MM parameters update status, TMSI, LAI, ciphering key sequence number and location update attempt counter, and the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and GPRS attach attempt counter as specified in 3GPP TS 24.008 [13] for the case when the normal attach procedure is rejected with the GMM cause with the same value and no RR connection exists.

9.2.1.1.13.3 Test description

9.2.1.1.13.3.1 Pre-test conditions

System Simulator:

– cell G, cell H (VPLMN, same MCC like HPLMN, different TAs) and cell I (VPLMN, different MCC from HPLMN);

– the cells are configured according to Table 6.3.2.2-1 and Table 6.3.2.2-3 in36.508[18], except replacing f3 with f1;

– the cells may not be simultaneously activated.

UE:

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell G using default message contents according to TS 36.508 [18];

– the "forbidden PLMN list" is empty;

– the UE is configured to initiate EPS attach.

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.13.3.2 Test procedure sequence

Table 9.2.1.1.13.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – Cell G as the "Serving cell". – Cell H as a " Suitable Neighbour cell". – Cell I as a "Non-Suitable Off cell". Note: Cell G and Cell H are in the different TAI – same PLMN.	–	–	–	–
–	The following messages are to be observed on Cell G unless explicitly stated otherwise.	–	–	–	–
2	The UE is switched on.	–	–	–	–
3	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
3A-3D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
4	The SS transmits an ATTACH REJECT message including EMM cause = "PLMN not allowed".	<–	ATTACH REJECT	–	–
5	The SS releases the RRC connection.	–	–	–	–
6	Check: Does the UE transmit an ATTACH REQUEST message on cell G or H in the next 30 seconds?	–>	ATTACH REQUEST	1	F
7	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
8	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
9	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds?	–>	ATTACH REQUEST	2	F
10	The SS configures: – Cell G as the "Serving cell" – Cell H as a "Non-Suitable Off cell" – Cell I as a " Suitable neighbour cell".	–	–	–	–
11	The following messages are to be observed on Cell I unless explicitly stated otherwise.	–	–	–	–
12	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message as specified?	–>	ATTACH REQUEST	1, 3	P
12A-12M	The attach procedure is completed and the RRC connection is released by executing steps 5 to 17 of the UE registration procedure in TS 36.508 clause 4.5.2.3.	–	–	–
13 – 19	Void	–	–	–	–
20	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
–	EXCEPTION: Step 21 describes behaviour that depends on the UE capability.
21	If pc_SwitchOnOff or pc_USIM_Removal then the UE transmits a DETACH REQUEST message.	–>	DETACH REQUEST	–	–
22	The SS configures: – Cell G as the "Serving cell" – Cell I as a "Non-suitable Off cell". Note: Cell G belongs to the forbidden PLMN.	–	–	–	–
23	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
24	The following messages are to be observed on Cell G unless explicitly stated otherwise.	–	–	–	–
25	The user sets the UE in manual PLMN selection mode or requests a PLMN search.	–	–	–	–
26	The user selects PLMN of cell G.	–	–	–	–
27	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message as specified?	–>	ATTACH REQUEST	4	P
28-40	The attach procedure is completed and the RRC connection is released by executing steps 5 to 17 of the UE registration procedure in TS 36.508 clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA manual selection (E5) according to TS 36.523-3.	–	–	–	–

9.2.1.1.13.3.3 Specific message contents

Table 9.2.1.1.13.3.3-1: Message ATTACH REJECT (step 4, Table 9.2.1.1.13.3.2-1)

Derivation path: 36.508 table 4.7.2-3
Information Element	Value/Remark	Comment	Condition
EMM cause	00001011	#11 "PLMN not allowed"
ESM message container	Not present

Table 9.2.1.1.13.3.3-2: Message ATTACH REQUEST (step 12, Table 9.2.1.1.13.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	IMSI-1	GUTI has been deleted after receiving ATTACH REJECT at step 5; only IMSI is available.
Last visited registered TAI	Not present	TAI has been deleted after receiving ATTACH REJECT at step 5.

Table 9.2.1.1.13.3.3-3: Message ATTACH REQUEST (step 27, Table 9.2.1.1.13.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	GUTI allocated in step 18
Last visited registered TAI	TAI-9	TAI 9 is allocated on Cell I according to 36.508 table 6.3.2.2-1

9.2.1.1.13a Attach / Rejected / PLMN not allowed / Single Frequency operation

9.2.1.1.13a.1 Test Purpose (TP)

Same test purpose as in clause 9.2.1.1.13.1

9.2.1.1.13a.2 Conformance requirements

Same conformance requirements as in clause 9.2.1.1.13.2

9.2.1.1.13a.3 Test description

9.2.1.1.13a.3.1 Pre-test conditions

System Simulator:

– cell A(belongs to TAI-7, visited PLMN, MCC = MCC in USIM MNC=02),

– cell B (belongs to TAI-8, visited PLMN, MCC = MCC in USIM MNC=02)) and

– cell C (belongs to TAI-9, visited PLMN, MCC=002 MNC=101);

– the cells may not be simultaneously activated.

UE:

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18];

– the "forbidden PLMN list" is empty;

– the UE is configured to initiate EPS attach.

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.13a.3.2 Test procedure sequence

Table 9.2.1.1.13a.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – Cell A as the "Serving cell". – Cell B as a " Suitable Neighbour cell". – Cell C as a "Non-Suitable Off cell". Note: Cell A and Cell B are in the different TAI – same PLMN.	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
2	The UE is switched on.	–	–	–	–
3	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
3A-3D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
4	The SS transmits an ATTACH REJECT message including EMM cause = "PLMN not allowed".	<–	ATTACH REJECT	–	–
5	The SS releases the RRC connection.	–	–	–	–
6	Check: Does the UE transmit an ATTACH REQUEST message on cell A or B in the next 30 seconds?	–>	ATTACH REQUEST	1	F
7	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
8	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
9	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds?	–>	ATTACH REQUEST	2	F
10	The SS configures: – Cell A as the " Suitable neighbour intrafrequency cell" – Cell B as a "Non-Suitable Off cell" – Cell C as a " Serving cell".	–	–	–	–
11	The following messages are to be observed on Cell C unless explicitly stated otherwise.	–	–	–	–
12	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message as specified?	–>	ATTACH REQUEST	1, 3	P
12A-12M	The attach procedure is completed and the RRC connection is released by executing steps 5 to 17 of the UE registration procedure in TS 36.508 clause 4.5.2.3.	–	–	–
13-19	Void	–	–	–	–
20	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
–	EXCEPTION: Step 21 describes behaviour that depends on the UE capability.
21	If pc_SwitchOnOff or pc_USIM_Removal then the UE transmits a DETACH REQUEST message.	–>	DETACH REQUEST	–	–
22	The SS configures: – Cell A as the "Serving cell" – Cell C as a "Non-suitable Off cell". Note: Cell A belongs to the forbidden PLMN.	–	–	–	–
23	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
24	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
25	The user sets the UE in manual PLMN selection mode or requests a PLMN search.	–	–	–	–
26	The user selects PLMN of cell A.	–	–	–	–
27	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message as specified?	–>	ATTACH REQUEST	4	P
28-40	The attach procedure is completed and the RRC connection is released by executing steps 5 to 17 of the UE registration procedure in TS 36.508 clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.1.13a.3.3 Specific message contents

Table 9.2.1.1.13a.3.3-1: Message ATTACH REJECT (step 4, Table 9.2.1.1.13a.3.2-1)

Derivation path: 36.508 table 4.7.2-3
Information Element	Value/Remark	Comment	Condition
EMM cause	00001011	#11 "PLMN not allowed"
ESM message container	Not present

Table 9.2.1.1.13a.3.3-2: Message ATTACH REQUEST (step 12, Table 9.2.1.1.13a.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	IMSI-1	GUTI has been deleted after receiving ATTACH REJECT at step 5; only IMSI is available.
Last visited registered TAI	Not present	TAI has been deleted after receiving ATTACH REJECT at step 5.

Table 9.2.1.1.13a.3.3-3: Message ATTACH REQUEST (step 27, Table 9.2.1.1.13a.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	GUTI allocated in step 18
Last visited registered TAI	TAI-9	TAI 9 is allocated on Cell C according to 36.508 table 6.3.2.2-1

9.2.1.1.14 Attach / Rejected / Tracking area not allowed

9.2.1.1.14.1 Test Purpose (TP)

(1)

with { UE has sent an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message }

ensure that {

when { UE receives an ATTACH REJECT message with the reject cause set to "Tracking area not allowed" }

then { UE sets the EPS update status to EU3 ROAMING NOT ALLOWED, UE deletes the GUTI, last visited registered TAI and KSI, UE enters the state EMM-DEREGISTERED.LIMITED-SERVICE and UE stores the current TAI in the list of "forbidden tracking areas for regional provision of service" }

}

(2)

with { UE is in EMM-DEREGISTERED.LIMITED-SERVICE state and the current TAI in the list of "forbidden tracking areas for regional provision of service"}

ensure that {

when { serving cell belongs to TAI where UE was rejected }

then { UE does not attempt to attach on any other cell }

}

(3)

with { UE is in EMM-DEREGISTERED.LIMITED-SERVICE state and the current TAI in the list of "forbidden tracking areas for regional provision of service"}

ensure that {

when { UE re-selects a new cell in the same TAI it was already rejected }

then { UE does not attempt to attach }

}

(4)

with { UE is in EMM-DEREGISTERED.LIMITED-SERVICE state and the current TAI in the list of "forbidden tracking areas for regional provision of service"}

ensure that {

when { UE enters a cell belonging to a tracking area not in the list of "forbidden tracking areas for regional provision of service"}

then { UE attempts to attach with IMSI }

}

(5)

with { UE is in EMM-DEREGISTERED.LIMITED-SERVICE state and the list of "forbidden tracking areas for regional provision of service" contains more than one TAI}

ensure that {

when { UE re-selects a cell belonging to one of the TAIs in the list of "forbidden tracking areas for regional provision of service" }

then { UE does not attempt to attach }

}

(6)

with { UE is switched off }

ensure that {

when { UE is powered on in the cell belonging to the TAI which was in the list of "forbidden tracking areas for regional provision of service" before the UE was switched off }

then { UE performs registration on that cell }

}

9.2.1.1.14.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clauses 5.3.2, 5.5.1.2.2, 5.5.1.2.5, 5.2.2.3.2, Annex C and TS 36.304 clause 4.3.

[TS 24.301, clause 5.3.2]

…

In S1 mode, the UE shall update the suitable list whenever an ATTACH REJECT, TRACKING AREA UPDATE REJECT, SERVICE REJECT or DETACH REQUEST message is received with the EMM cause #12 "tracking area not allowed", #13 "roaming not allowed in this tracking area", or #15 "no suitable cells in tracking area".

Each list shall accommodate 40 or more TAIs. When the list is full and a new entry has to be inserted, the oldest entry shall be deleted.

[TS 24.301, clause 5.5.1.2.2]

…

If the UE supports neither A/Gb mode nor Iu mode, the UE shall handle the Old GUTI or IMSI IE in the ATTACH REQUEST message as follows:

If the UE supports A/Gb mode or Iu mode, the UE shall handle the Old GUTI or IMSI IE as follows:

…

– If the TIN indicates "GUTI" or "RAT-related TMSI" and the UE holds a valid GUTI, the UE shall indicate the GUTI in the Old GUTI or IMSI IE.

…

The UE shall send the ATTACH REQUEST message together with a PDN CONNECTIVITY REQUEST message contained in the ESM message container information element to request PDN connectivity.

…

[TS 24.301, clause 5.5.1.2.5]

If the attach request cannot be accepted by the network, the MME shall send an ATTACH REJECT message to the UE including an appropriate EMM cause value.

…

Upon receiving the ATTACH REJECT message, the UE shall stop timer T3410 and take the following actions depending on the EMM cause value received.

…

#12 (Tracking area not allowed);

In S1 mode, the UE shall store the current TAI in the list of "forbidden tracking areas for regional provision of service" and enter the state EMM-DEREGISTERED.LIMITED-SERVICE.

…

[TS 24.301, clause 5.2.2.3.2]

The UE shall perform an attach or combined attach procedure when entering a cell which provides normal service.

[TS 24.301, Annex C (normative)]

The following EMM parameters shall be stored on the USIM if the corresponding file is present:

– GUTI;

– last visited registered TAI;

– EPS update status;

– Allowed CSG list; and

– EPS security context parameters from a full native EPS security context (see 3GPP TS 33.401 [19]).

The presence and format of corresponding files on the USIM is specified in 3GPP TS 31.102 [17].

If the corresponding file is not present on the USIM, these EMM parameters except allowed CSG list are stored in a non-volatile memory in the ME together with the IMSI from the USIM. The allowed CSG list is stored in a non-volatile memory in the ME if the UE supports CSG selection. These EMM parameters can only be used if the IMSI from the USIM matches the IMSI stored in the non-volatile memory; else the UE shall delete the EMM parameters.

…

[TS 36.304, clause 4.3]

…

suitable cell:

…

Following exceptions to these definitions are applicable for UEs:

– camped on a cell that belongs to a registration area that is forbidden for regional provision of service; a cell that belongs to a registration area that is forbidden for regional provision service ([5], [16]) is suitable but provides only limited service.

…

9.2.1.1.14.3 Test description

9.2.1.1.14.3.1 Pre-test conditions

System Simulator:

– cell A (home PLMN) and cell B (home PLMN, another TA) are configured according to table 6.3.2.2-1 in TS 36.508 [18] and belong to the same frequency as specified in TS 36.523-3 [20].

– System information combination 3 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells;

UE:

– the UE is configured to initiate EPS attach;

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.14.3.2 Test procedure sequence

Table 9.2.1.1.14.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – Cell A as the "Serving cell". – Cell B as a "Suitable Neighbour cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
2	The UE is switched on.	–	–	–	–
3	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
3A-3D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
4	The SS transmits an ATTACH REJECT message, EMM cause = "Tracking area not allowed". (The list of "forbidden tracking areas for regional provision of service " in the UE should now contain TAI-1)	<–	ATTACH REJECT	–	–
5	The SS releases the RRC connection.	–	–	–	–
6	Check: Does the UE transmit the ATTACH REQUEST message in the next 30 seconds on Cell A or Cell B?	–>	ATTACH REQUEST	1, 2	F
7	The user initiates an attach by MMI or by AT command.	–	–	–	–
8	Check: Does the UE transmit the ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	1	F
9	The SS reconfigures: Cell A as a "Suitable Neighbour cell", Cell B as the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
10	Check: Does the UE transmit the ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	1,4	P
10A-10D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
11	The SS transmits an ATTACH REJECT message, EMM cause = "Tracking area not allowed". (The list of "forbidden tracking areas for regional provision of service " in the UE should now contain TAI-1 and TAI-2)	<–	ATTACH REJECT	–	–
12	The SS releases the RRC connection.	–	–	–	–
13	The SS reconfigures: Cell A as the "Serving cell". Cell B as a " Suitable Neighbour cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
14	Check: Does the UE transmit the ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	1, 3, 5	F
15	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
16	The SS reconfigures: Cell A as the "Serving cell", Cell B as a "Non-Suitable cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
17	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
18	Void	–	–	–	–
19	Check: Does the UE transmit the ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message as specified?	–>	ATTACH REQUEST	1, 6	P
20-32	The attach procedure is completed and the RRC connection released by executing steps 5 to 17 of the UE registration procedure in TS 36.508 clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.1.14.3.3 Specific message contents

Table 9.2.1.1.14.3.3-1: Message ATTACH REJECT (steps 4 and 11, Table 9.2.1.1.14.3.2-1)

Derivation path: 36.508 table 4.7.2-3
Information Element	Value/Remark	Comment	Condition
EMM cause	00001100	#12 "Tracking area not allowed"
ESM message container	Not present

Table 9.2.1.1.14.3.3-2: Message ATTACH REQUEST (steps 10 and 18 Table 9.2.1.1.14.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	IMSI-1	GUTI has been deleted after receiving ATTACH REJECT at step 4; only IMSI is available.
Last visited registered TAI	Not present	TAI has been deleted after receiving ATTACH REJECT at step 4.

9.2.1.1.15 Attach / Rejected / Roaming not allowed in this tracking area

9.2.1.1.15.1 Test Purpose (TP)

(1)

with { the UE has sent an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message }

ensure that {

when { the UE receives an ATTACH REJECT message with the reject cause set to "roaming not allowed in this tracking area" }

then { the UE sets the EPS update status to EU3 ROAMING NOT ALLOWED and the UE deletes the GUTI, the last visited registered TAI and KSI and the UE enters the state EMM-DEREGISTERED.LIMITED-SERVICE or optionally EMM-DEREGISTERED.PLMN-SEARCH and the UE stores the current TAI in the list of "forbidden tracking areas for roaming" }

}

(2)

with { the UE is in EMM-DEREGISTERED.LIMITED-SERVICE or EMM-DEREGISTERED.PLMN-SEARCH state and the TAI of the current cell belongs to the list of "forbidden tracking areas for roaming"}

ensure that {

when { the UE enters a cell belonging to a tracking area not in the list of "forbidden tracking areas for roaming"}

then { the UE attempts to attach with IMSI }

}

(3)

with { the UE is in EMM-DEREGISTERED.LIMITED-SERVICE or EMM-DEREGISTERED.PLMN-SEARCH state and the list of "forbidden tracking areas for roaming" contains more than one TAI}

ensure that {

when { the UE selects a cell belonging to one of the TAIs in the list of "forbidden tracking areas for roaming" }

then { the UE does not attempt to attach }

}

(4)

with { the UE is switched off or the UICC containing the USIM is removed }

ensure that {

when { UE is powered on in the cell belonging to the TAI which was in the list of "forbidden tracking areas for roaming" before the UE was switched off or the USIM is inserted again on that cell }

then { UE performs registration on that cell }

}

(5)

with { the UE has sent an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message }

ensure that {

when { the UE receives an ATTACH REJECT message with the reject cause set to "roaming not allowed in this tracking area" }

then { the UE performs a PLMN selection }

}

9.2.1.1.15.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clauses 5.3.2, 5.5.1.2.2, 5.5.1.2.5 and in TS 36.304 clause 5.2.4.4.

[TS 24.301, clause 5.3.2]

…

Each list shall accommodate 40 or more TAIs. When the list is full and a new entry has to be inserted, the oldest entry shall be deleted.

[TS 24.301, clause 5.5.1.2.2]

…

If the UE supports neither A/Gb mode nor Iu mode, the UE shall handle the Old GUTI or IMSI IE in the ATTACH REQUEST message as follows:

– The UE shall include in the ATTACH REQUEST message a valid GUTI together with the last visited registered TAI, if available. If there is no valid GUTI available, the UE shall include the IMSI in the ATTACH REQUEST message. If the UE supports A/Gb mode or Iu mode, the UE shall handle the Old GUTI or IMSI IE as follows:

…

– If the TIN indicates "GUTI" or "RAT-related TMSI" and the UE holds a valid GUTI, the UE shall indicate the GUTI in the Old GUTI or IMSI IE.

…

The UE shall send the ATTACH REQUEST message together with a PDN CONNECTIVITY REQUEST message contained in the ESM message container information element to request PDN connectivity.

…

[TS 24.301, clause 5.5.1.2.5]

If the attach request cannot be accepted by the network, the MME shall send an ATTACH REJECT message to the UE including an appropriate EMM cause value.

…

Upon receiving the ATTACH REJECT message, the UE shall stop timer T3410 and take the following actions depending on the EMM cause value received.

…

#13 (Roaming not allowed in this tracking area);

In S1 mode, the UE shall store the current TAI in the list of "forbidden tracking areas for roaming". Additionally, the UE shall enter the state EMM-DEREGISTERED.LIMITED-SERVICE or optionally EMM-DEREGISTERED.PLMN-SEARCH. The UE shall perform a PLMN selection according to 3GPP TS 23.122 [6].

…

[TS 36.304 subclause 5.2.4.4]

…

If the highest ranked cell is an intra-frequency or inter-frequency cell which is not suitable due to being part of the "list of forbidden TAs for roaming" or belonging to a PLMN which is not indicated as being equivalent to the registered PLMN, the UE shall not consider this cell and other cells on the same frequency, as candidates for reselection for a maximum of 300s. If the UE enters into state any cell selection, any limitation shall be removed. If the UE is redirected under E-UTRAN control to a frequency for which the timer is running, any limitation on that frequency shall be removed.

…

9.2.1.1.15.3 Test description

9.2.1.1.15.3.1 Pre-test conditions

System Simulator:

– cell C (home PLMN), cell I (visited PLMN) and cell E (same visited PLMN, another TA), but at most two cells are simultaneously activated.

NOTE 1: Cell E shall not use the same frequency as cell I.

NOTE 2: The requirement in 3GPP TS 24.301 to store at least 40 entries in the list of "forbidden tracking areas for roaming" is not fully tested.

NOTE 3: Different types of UE may use different methods to periodically clear the list of forbidden areas (e.g. every day at 12 am) for roaming. If the list is cleared while the test is being run, it may be necessary to re-run the test.

UE:

– the UE is configured to initiate EPS attach;

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell I using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.15.3.2 Test procedure sequence

Table 9.2.1.1.15.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: Cell I as the "Serving cell". cell E as a " Non-Suitable Off cell", cell C as a "Non-Suitable Off cell".	–	–	–	–
–	The following messages are to be observed on cell I unless explicitly stated otherwise.	–	–	–	–
2	The UE is switched on.	–	–	–	–
3	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
3A-3D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
4	The SS transmits an ATTACH REJECT message, EMM cause = "roaming not allowed in this tracking area ". (The list of "forbidden tracking areas for roaming" in the UE should now contain TAI-9)	<–	ATTACH REJECT	–	–
5	The SS releases the RRC connection.	–	–	–	–
6	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	1,5	F
7	The user initiates an attach by MMI or by AT command.	–	–	–	–
8	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	1,5	F
–	The following messages are to be observed on Cell E unless explicitly stated otherwise.	–	–	–	–
8A	The SS configures: Cell I as the "Serving cell". Cell E as a "Suitable Neighbour cell", Cell C as a "Non-Suitable Off cell".	–	–	–	–
9	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message on Cell E as specified? Note: according to TS 24.301, the UE has the choice to enter "LIMITED-SERVICE" or "PLMN- SEARCH" state. But in any case it shall do a PLMN selection. In the first option, the UE shall apply reselection so it will select cell E and then attempt to attach; in the second option it will select the same PLMN again and exclude cells from forbidden TAs so it will select cell E.	–>	ATTACH REQUEST	1, 2	P
9A-9D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
10	The SS transmits an ATTACH REJECT message, EMM cause = "roaming not allowed in this tracking area". (The list of "forbidden tracking areas for roaming" in the UE should now contain TAI-9 and TAI-12)	<–	ATTACH REJECT	–	–
11	The SS releases the RRC connection.	–	–	–	–
12	Check: Does the UE transmit an ATTACH REQUEST message in the next 60 seconds on Cell I or Cell E?	–>	ATTACH REQUEST	1, 3	F
13	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
14	The SS reconfigures: Cell I as the "Serving cell", Cell E as a "Non-Suitable Off cell", Cell C as a "Non-Suitable Off cell".	–	–	–	–
–	The following messages are to be observed on Cell I unless explicitly stated otherwise.	–	–	–	–
15	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
16	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message as specified.	–>	ATTACH REQUEST	4	P
16A-16D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
17	The SS transmits an ATTACH REJECT message, EMM cause = "roaming not allowed in this tracking area ". (The list of "forbidden tracking areas for roaming" in the UE should now contain TAI-9)	<–	ATTACH REJECT	–	–
18	The SS reconfigures: Cell I as the "Serving cell", Cell E as a "Non-Suitable Off cell", Cell C as a "Suitable neighbour cell".	–	–	–	–
–	The following messages are to be observed on Cell C unless explicitly stated otherwise.	–	–	–	–
19	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message as specified?	–>	ATTACH REQUEST	5	P
20-32	The attach procedure is completed and the RRC connection released by executing steps 5 to 17 of the UE registration procedure in TS 36.508 clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.1.15.3.3 Specific message contents

Table 9.2.1.1.15.3.3-1: Message ATTACH REJECT (steps 4, 10 and 17 in table 9.2.1.1.15.3.2-1)

Derivation path: 36.508 table 4.7.2-3
Information Element	Value/Remark	Comment	Condition
EMM cause	00001101	#13 " roaming not allowed in this tracking area "
ESM message container	Not present

Table 9.2.1.1.15.3.3-2: Message ATTACH REQUEST (steps 9,12, 16 and 19 in table 9.2.1.1.15.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	IMSI1	GUTI has been deleted after receiving ATTACH REJECT at step 4; only IMSI is available.
Last visited registered TAI	Not present	TAI has been deleted after receiving ATTACH REJECT at step 4.

9.2.1.1.15a Attach / Rejected / Roaming not allowed in this tracking area / Single Frequency operation

9.2.1.1.15a.1 Test Purpose (TP)

Same test purpose as in clause 9.2.1.1.15.1.

9.2.1.1.15a.2 Conformance requirements

Same conformance requirements as in clause 9.2.1.1.15.2

9.2.1.1.15a.3 Test description

9.2.1.1.15a.3.1 Pre-test conditions

System Simulator:

– Three intra-frequency cells.

– cell C (home PLMN), cell B (visited PLMN, TAI-9) and cell A (same visited PLMN, TAI-12), but at most two cells are simultaneously activated.

NOTE 1: The requirement in 3GPP TS 24.301 to store at least 40 entries in the list of "forbidden tracking areas for roaming" is not fully tested.

NOTE 2: Different types of UE may use different methods to periodically clear the list of forbidden areas (e.g. every day at 12 am) for roaming. If the list is cleared while the test is being run, it may be necessary to re-run the test.

UE:

– the UE is configured to initiate EPS attach;

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell B using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.15a.3.2 Test procedure sequence

Table 9.2.1.1.15a.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: Cell B as the "Serving cell". cell A as a " Non-Suitable Off cell", cell C as a "Non-Suitable Off cell".	–	–	–	–
–	The following messages are to be observed on cell B unless explicitly stated otherwise.	–	–	–	–
2	The UE is switched on.	–	–	–	–
3	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
3A-3D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
4	The SS transmits an ATTACH REJECT message, EMM cause = "roaming not allowed in this tracking area ". (The list of "forbidden tracking areas for roaming" in the UE should now contain TAI-9)	<–	ATTACH REJECT	–	–
5	The SS releases the RRC connection.	–	–	–	–
6	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds?	–>	ATTACH REQUEST	1,5	F
7	The user initiates an attach by MMI or by AT command.	–	–	–	–
8	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds?	–>	ATTACH REQUEST	1,5	F
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
8A	The SS configures: Cell A as the "Serving cell". Cell B as a "Suitable Neighbour intrafrequency cell", Cell C as a "Non-Suitable Off cell".	–	–	–	–
9	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message on Cell A as specified? Note: according to TS 24.301, the UE has the choice to enter "LIMITED-SERVICE" or "PLMN- SEARCH" state. But in any case it shall do a PLMN selection. In the first option, the UE shall apply reselection so it will select cell A and then attempt to attach; in the second option it will select the same PLMN again and exclude cells from forbidden TAs so it will select cell A.	–>	ATTACH REQUEST	1, 2	P
9A-9D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
10	The SS transmits an ATTACH REJECT message, EMM cause = "roaming not allowed in this tracking area". (The list of "forbidden tracking areas for roaming" in the UE should now contain TAI-9 and TAI-12)	<–	ATTACH REJECT	–	–
11	The SS releases the RRC connection.	–	–	–	–
12	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds on Cell B or Cell A?	–>	ATTACH REQUEST	1, 3	F
13	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
14	The SS reconfigures: Cell B as the "Serving cell", Cell A as a "Non-Suitable Off cell", Cell C as a "Non-Suitable Off cell".	–	–	–	–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
15	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
16	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message as specified.	–>	ATTACH REQUEST	4	P
16A-16D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
17	The SS transmits an ATTACH REJECT message, EMM cause = "roaming not allowed in this tracking area ". (The list of "forbidden tracking areas for roaming" in the UE should now contain TAI-9)	<–	ATTACH REJECT	–	–
18	The SS reconfigures: Cell B as the " Suitable neighbour intrafrequency cell", Cell A as a "Non-Suitable Off cell", Cell C as a " Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell C unless explicitly stated otherwise.	–	–	–	–
19	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message as specified?	–>	ATTACH REQUEST	5	P
20-32	The attach procedure is completed and the RRC connection released by executing steps 5 to 17 of the UE registration procedure in TS 36.508 clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.1.15a.3.3 Specific message contents

Same specific message contents as clause 9.2.1.1.15.3.3

9.2.1.1.16 Attach / Rejected / EPS services not allowed in this PLMN

9.2.1.1.16.1 Test Purpose (TP)

(1)

with { UE has sent an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message }

ensure that {

when { UE receives an ATTACH REJECT message with the reject cause set to "EPS services not allowed in this PLMN" }

then { UE deletes any GUTI, last visited registered TAI, KSI and enters EMM-DEREGISTERED.PLMN-SEARCH state}

}

(2)

with { UE in E-UTRA EMM-DEREGISTERED.PLMN-SEARCH state, and a PLMN is stored in the "forbidden PLMNs for GPRS service list" }

ensure that {

when { UE detects a cell which belongs to a PLMN which is in the "forbidden PLMNs for GPRS service list" }

then { UE doesn’t perform an attach procedure }

}

(3)

with { UE in E-UTRA EMM-DEREGISTERED.PLMN-SEARCH state, and a PLMN is stored in the "forbidden PLMNs for GPRS service list" }

ensure that {

when { UE detects a cell which belongs to a PLMN which is not in the "forbidden PLMNs for GPRS service list" }

then { UE performs an attach procedure }

}

(4)

with { UE is switched off when a PLMN is stored in the "forbidden PLMNs for GPRS service list" }

ensure that {

when { UE is powered on a cell which belongs to this PLMN }

then { UE performs an attach procedure }

}

(5)

with { UE in E-UTRA EMM-DEREGISTERED.PLMN-SEARCH state, and a PLMN is stored in the "forbidden PLMNs for GPRS service list" }

ensure that {

when { UE is in the cell which belongs to the rejected PLMN and when that PLMN is selected manually }

then { UE performs an attach procedure }

9.2.1.1.16.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clauses 5.5.1.2.5 and TS 23.122, clause 3.1.

[TS 24.301 clause 5.5.1.2.5]

If the attach request cannot be accepted by the network, the MME shall send an ATTACH REJECT message to the UE including an appropriate EMM cause value. If the attach procedure fails due to a default EPS bearer setup failure, an ESM procedure failure, or operator determined barring is applied on default EPS bearer context activation during attach procedure, the MME shall combine the ATTACH REJECT message with a PDN CONNECTIVITY REJECT message contained in the ESM message container information element. In this case the EMM cause value in the ATTACH REJECT message shall be set to #19 "ESM failure".

Upon receiving the ATTACH REJECT message, the UE shall stop timer T3410 and take the following actions depending on the EMM cause value received.

…

#14 (EPS services not allowed in this PLMN);

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI and KSI.

In S1 mode, the UE shall store the PLMN identity in the "forbidden PLMNs for GPRS service" list. Additionally, the UE shall enter state EMM-DEREGISTERED.PLMN-SEARCH. The UE shall perform a PLMN selection according to 3GPP TS 23.122 [6]:

In S101 mode, the UE shall store the PLMN identity provided with the indication from the lower layers to prepare for an S101 mode to S1 mode handover in the list of "forbidden PLMNs for attach in S101 mode" and enter the state EMM-DEREGISTERED.NO-CELL-AVAILABLE.

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and GPRS attach attempt counter as specified in 3GPP TS 24.008 [13] for the case when the normal attach procedure is rejected with the GMM cause with the same value.

…

[TS 23.122 clause 3.1]

…

If a message with cause value "GPRS services not allowed in this PLMN" is received by an MS in response to an GPRS attach, GPRS detach, routing area update, attach or tracking area update request (see 3GPP TS 24.008 [23] and 3GPP TS 24.301 [23A]) from a VPLMN, that VPLMN is added to a list of "forbidden PLMNs for GPRS service" which is stored in the MS and thereafter that VPLMN will not be accessed by the MS for GPRS service when in automatic mode. This list is deleted when the MS is switched off or when the SIM is removed. A PLMN is removed from the list of "forbidden PLMNs for GPRS service" if, after a subsequent manual selection of that PLMN, there is a successful GPRS attach. The maximum number of possible entries in this list is implementation dependant, but must be at least one entry. The HPLMN (if the EHPLMN list is not present or is empty) or an EHPLMN (if the EHPLMN list is present) shall not be stored on the list of "forbidden PLMNs for GPRS service".

…

9.2.1.1.16.3 Test description

9.2.1.1.16.3.1 Pre-test conditions

System Simulator:

– cell G, Cell H and cell I are configured according to Table 6.3.2.2-1 in; [18].

– cell G and Cell H with MCC-1/MNC-2 (visited PLMN, different TAs)

– Cell I with MCC-2/MNC-101 (visited PLMN)

– the cells may not be simultaneously activated;

– the cells are configured according to Table 6.3.2.2-1 and Table 6.3.2.2-3 in36.508[18], except replacing f3 with f1.

UE:

– the UE is configured to initiate EPS attach;

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell G using default message contents according to TS 36.508 [18];

– the "forbidden PLMNs for GPRS service list" is empty.

– the different cells may not be simultaneously activated (at most 2 cells are active simultaneously).

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

Test procedure sequence

Table 9.2.1.1.16.3.2-1: Main Behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – Cell G as the "Serving cell". – Cell H as a "Non-Suitable cell". – Cell I as a "Non-Suitable off cell".	–	–	–	–
–	The following messages are to be observed on Cell G unless explicitly stated otherwise.	–	–	–	–
2	Void	–	–	–	–
3	The UE is switched on.	–	–	–	–
4	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
3A-3D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
5	The SS transmits an ATTACH REJECT message including EMM cause = "EPS services not allowed in this PLMN".	<–	ATTACH REJECT	–	–
6	The SS releases the RRC connection.	–	–	–	–
7	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds?	–>	ATTACH REQUEST	1	F
8	The SS configures: Cell G as a "Non-Suitable cell". Cell H as the "Serving cell". Note: Cell G and Cell H are in the different TAI – same PLMN.	–	–	–	–
–	The following messages are to be observed on Cell H unless explicitly stated otherwise.	–	–	–	–
9	Void	–	–	–	–
10	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds?	–>	ATTACH REQUEST	2	F
11	The SS configures: Cell H as a "Non-Suitable off cell". Cell I as the "Serving cell". Note: Cell G and Cell I are different PLMNs.	–	–	–	–
–	The following messages are to be observed on Cell I unless explicitly stated otherwise.	–	–	–	–
12	Void	–	–	–	–
13	Check: Does the UE transmit an ATTACH REQUEST message including and a PDN CONNECTIVITY REQUEST message as specified?	–>	ATTACH REQUEST	3	P
13A	The SS completes the attach procedure successfully and then releases the RRC -connection by executing steps 5 to 17 of UE registration procedure in TS 36.508 clause 4.5.2.3.
14 – 20	Void	–	–	–	–
21	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
22	The SS configures – Cell I as a "Non-Suitable cell". – Cell G as the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell G unless explicitly stated otherwise.	–	–	–	–
23	The UE is brought back to operation or the USIM is inserted.
24	Void	–	–	–	–
25	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	4	P
25A-25D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
26	The SS transmits an ATTACH REJECT message including EMM cause = "EPS services not allowed in this PLMN".	<–	ATTACH REJECT	–	–
26A	SS releases the RRC connection.	–	–	–	–
27	The user sets the UE in manual PLMN selection mode or requests a PLMN search.
28	The user selects PLMN (MCC-1/MNC-2)
29	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message as specified?	–>	ATTACH REQUEST	5	P
30-42	The attach procedure is completed and the RRC connection released by executing steps 5 to 17 of the UE registration procedure in TS 36.508 clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.1.16.3.3 Specific message contents

Table 9.2.1.1.16.3.3-1: Message ATTACH REJECT (step 5, Table 9.2.1.1.16.3.2-1)

Derivation path: 36.508 table 4.7.2-3 (Plain NAS message)
Information Element	Value/Remark	Comment	Condition
EMM cause	00001110	#14 "EPS services not allowed in this PLMN "
ESM message container	Not present

Table 9.2.1.1.16.3.3-2: Message ATTACH REQUEST (step 13 and step 29, Table 9.2.1.1.16.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	IMSI-1	GUTI has been deleted after receiving ATTACH REJECT at step 5 and step25; only IMSI is available.
Last visited registered TAI	Not present	TAI has been deleted after receiving ATTACH REJECT at step 5 and step26.

Table 9.2.1.1.16.3.3-3: Message ATTACH REJECT (step 26, Table 9.2.1.1.16.3.2-1)

Derivation path: 36.508 table 4.7.2-3
Information Element	Value/Remark	Comment	Condition
EMM cause	00001110	#14 "EPS services not allowed in this PLMN "
ESM message container	Not present

9.2.1.1.16a Attach / Rejected / EPS services not allowed in this PLMN / Single Frequency operation

9.2.1.1.16a.1 Test Purpose (TP)

Same test purpose as in clause 9.2.1.1.16.1

9.2.1.1.16a.2 Conformance requirements

Same conformance requirements as in clause 9.2.1.1.16.2

9.2.1.1.16a.3 Test description

9.2.1.1.16a.3.1 Pre-test conditions

System Simulator:

– cell A(TAI-7), Cell B(TAI-8) and intra-frequency cells cell C(TAI-9) are configured according to Table 6.3.2.2-1 in; [18].

– cell A and Cell B with MCC-1/MNC-2 (visited PLMN, different TAs)

– Cell C with MCC-2/MNC-101 (visited PLMN)

– the cells may not be simultaneously activated.

UE:

– the UE is configured to initiate EPS attach;

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18];

– the "forbidden PLMNs for GPRS service list" is empty.

– the different cells may not be simultaneously activated (at most 2 cells are active simultaneously).

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.16a.3.2 Test procedure sequence

Table 9.2.1.1.16a.3.2-1: Main Behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – Cell A as the "Serving cell". – Cell B as a "Non-Suitable cell". – Cell C as a "Non-Suitable off cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
2	Void	–	–	–	–
3	The UE is switched on.	–	–	–	–
4	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
3A-3D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
5	The SS transmits an ATTACH REJECT message including EMM cause = "EPS services not allowed in this PLMN".	<–	ATTACH REJECT	–	–
6	The SS releases the RRC connection.	–	–	–	–
7	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds?	–>	ATTACH REQUEST	1	F
8	The SS configures: Cell A as a "Non-Suitable cell". Cell B as the "Serving cell". Note: Cell A and Cell B are in the different TAI – same PLMN.	–	–	–	–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
9	Void	–	–	–	–
10	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds?	–>	ATTACH REQUEST	2	F
11	The SS configures: Cell B as a "Non-Suitable off cell". Cell C as the "Serving cell". Note: Cell A and Cell C are different PLMNs.	–	–	–	–
–	The following messages are to be observed on Cell C unless explicitly stated otherwise.	–	–	–	–
12	Void	–	–	–	–
13	Check: Does the UE transmit an ATTACH REQUEST message including and a PDN CONNECTIVITY REQUEST message as specified?	–>	ATTACH REQUEST	3	P
13A	The SS completes the attach procedure successfully and then releases the RRC -connection by executing steps 5 to 17 of UE registration procedure in TS 36.508 clause 4.5.2.3.
14 – 20	Void	–	–	–	–
21	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
22	The SS configures – Cell C as a "Non-Suitable cell". – Cell A as the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
23	The UE is brought back to operation or the USIM is inserted.
24	Void	–	–	–	–
25	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	4	P
25A-25D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
26	The SS transmits an ATTACH REJECT message including EMM cause = "EPS services not allowed in this PLMN".	<–	ATTACH REJECT	–	–
26A	SS releases the RRC connection.	–	–	–	–
27	The user sets the UE in manual PLMN selection mode or requests a PLMN search.
28	The user selects PLMN of cell A
29	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message as specified?	–>	ATTACH REQUEST	5	P
30-42	The attach procedure is completed and the RRC connection released by executing steps 5 to 17 of the UE registration procedure in TS 36.508 clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.1.16a.3.3 Specific message contents

Same specific message contents as in clause 9.2.1.1.16.3.3

9.2.1.1.17 Attach / Rejected / No suitable cells in tracking area

9.2.1.1.17.1 Test Purpose (TP)

(1)

with { the UE has sent an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message }

ensure that {

when { the UE receives an ATTACH REJECT message with the EMM cause set to "No suitable cells in tracking area" }

then { the UE sets the EPS update status to EU3 ROAMING NOT ALLOWED, UE deletes any GUTI, last visited registered TAI and KSI and the UE enters the state EMM-DEREGISTERED.LIMITED-SERVICE and the UE stores the current TAI in the list of "forbidden tracking areas for roaming" }

}

(2)

with { the UE is in EMM-DEREGISTERED.LIMITED-SERVICE state and the current TAI in the list of "forbidden tracking areas for roaming"}

ensure that {

when { the UE re-selects a cell that belongs to the TAI where UE was rejected }

then { the UE does not attempt to attach }

}

(3)

with { the UE is in EMM-DEREGISTERED.LIMITED-SERVICE state and the current TAI in the list of "forbidden tracking areas for roaming" and KSI was deleted }

ensure that {

when { in the same PLMN, the UE enters a cell which provides normal service and belongs to a tracking area not in the list of "forbidden tracking areas for roaming" }

then { the UE attempts to attach with IMSI }

}

(4)

with { the UE is in EMM-DEREGISTERED.LIMITED-SERVICE state and the current TAI in the list of "forbidden tracking areas for roaming"}

ensure that {

when { there are cells in the same PLMN and other PLMN that provide normal service and belong to tracking areas not in the list of "forbidden tracking areas for roaming" }

then { UE attempts to attach to the cell in the same PLMN }

}

NOTE: TP 4 is applicable only for Multi PLMN environment

(5)

with { UE is in EMM-DEREGISTERED.LIMITED-SERVICE state and the list of "forbidden tracking areas for roaming" contains more than one TAI}

ensure that {

when { UE re-selects a cell that belongs to one of the TAIs in the list of "forbidden tracking areas for roaming" }

then { UE does not attempt to attach }

}

(6)

with { UE is switched off }

ensure that {

when { UE is powered on in the cell belonging to the TAI which was in the list of "forbidden tracking areas for roaming" before the UE was switched off }

then { UE attempts to attach }

}

9.2.1.1.17.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clauses 5.3.2, 5.5.1.2.2 and 5.5.1.2.5, and in TS 36.304 clause 5.2.4.4.

[TS 24.301, clause 5.3.2]

…

Each list shall accommodate 40 or more TAIs. When the list is full and a new entry has to be inserted, the oldest entry shall be deleted.

…

[TS 24.301, clause 5.5.1.2.2]

…

If the UE supports neither A/Gb mode nor Iu mode, the UE shall handle the Old GUTI or IMSI IE in the ATTACH REQUEST message as follows:

If the UE supports A/Gb mode or Iu mode, the UE shall handle the Old GUTI or IMSI IE as follows:

…

– If the TIN indicates "GUTI" or "RAT-related TMSI" and the UE holds a valid GUTI, the UE shall indicate the GUTI in the Old GUTI or IMSI IE.

…

– Otherwise the UE shall include the IMSI in the Old GUTI or IMSI IE.

…

The UE shall send the ATTACH REQUEST message together with a PDN CONNECTIVITY REQUEST message contained in the ESM message container information element to request PDN connectivity.

…

[TS 24.301, clause 5.5.1.2.5]

If the attach request cannot be accepted by the network, the MME shall send an ATTACH REJECT message to the UE including an appropriate EMM cause value.

…

Upon receiving the ATTACH REJECT message, the UE shall stop timer T3410 and take the following actions depending on the EMM cause value received.

…

#15 (No suitable cells in tracking area);

In S1 mode, the UE shall store the current TAI in the list of "forbidden tracking areas for roaming" and enter the state EMM-DEREGISTERED.LIMITED-SERVICE. The UE shall search for a suitable cell in another tracking area or in another location area in the same PLMN according to 3GPP TS 36.304 [21].

…

[TS 36.304 subclause 5.2.4.4]

…

9.2.1.1.17.3 Test description

9.2.1.1.17.3.1 Pre-test conditions

System Simulator:

– cell I, , cell K, cell L and if (px_SinglePLMN_Tested = MultiPLMN) cell J are configured according to table 6.3.2.2-1 in TS 36.508 [18] (maximum 3 cells are simultaneously active):

– cell I and cell K (visited PLMN, same TA);

– cell L (same visited PLMN, another TA);

– If (px_SinglePLMN_Tested = Multi PLMN) cell J (another VPLMN).

NOTE: Different types of UE may use different methods to periodically clear the list of forbidden areas (e.g. every day at 12 am) for roaming. If the list is cleared while the test is being run, it may be necessary to re-run the test.

UE:

– the UE is configured to initiate EPS attach;

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell I using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.17.3.2 Test procedure sequence

Table 9.2.1.1.17.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: Cell I as the "Serving cell", Cell K as a "Suitable Neighbour intrafrequency cell", Cell L as a "Non-Suitable Off cell", If present, Cell J as a "Non-Suitable Off cell".	–	–	–	–
–	The following messages are to be observed on Cell I unless explicitly stated otherwise.	–	–	–	–
2	The UE is switched on.	–	–	–	–
3	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
3A-3D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
4	The SS transmits an ATTACH REJECT message, EMM cause = “No suitable cells in tracking area”. (The list of “forbidden tracking areas for roaming” in the UE should now contain TAI-9)	<–	ATTACH REJECT	–	–
5	The SS releases the RRC connection.	–	–	–	–
6	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on Cell I or Cell K?	–>	ATTACH REQUEST	1	F
7	The SS reconfigures: Cell I as a "Suitable neighbour intrafrequency cell", Cell K as the "Serving cell", Cell L as a "Non-Suitable Off cell", If present, Cell J as a "Non-Suitable Off cell ".	–	–	–	–
8	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on Cell K or Cell I?	–>	ATTACH REQUEST	2	F
8A	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
9	The SS reconfigures: Cell I as a " Serving cell", Cell K is the " Non-Suitable Off cell ", Cell L as a "Non-Suitable Off cell", If present, Cell J as a "Non-Suitable Off cell".	–	–	–	–
9A	The UE is brought back to operation or the USIM is inserted.
9B	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
9BA-9BD	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
9C	The SS reconfigures: Cell I as a "Suitable Neighbour intrafrequency cell", Cell L as a " Serving cell", If present, Cell J as a "Suitable Neighbour intrafrequency cell”.	–	–
9D	The SS transmits an ATTACH REJECT message, EMM cause = “No suitable cells in tracking area”. (The list of “forbidden tracking areas for roaming” in the UE should now contain TAI-9)	<–	ATTACH REJECT	–	–
9E	The SS releases the RRC connection.	–	–	–	–
10	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message as specified on Cell L?	–>	ATTACH REQUEST	3, 4	P
10A-10D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
11	The SS transmits an ATTACH REJECT message, EMM cause = “No suitable cells in tracking area”. (The list of “forbidden tracking areas for roaming” in the UE should now contain TAI-9 and TAI-11)	<–	ATTACH REJECT	–	–
12	The SS releases the RRC connection.	–	–	–	–
13	The SS reconfigures: Cell I as the "Serving cell". Cell K as a “Non-Suitable Off cell”, Cell L as a " Suitable Neighbour intrafrequency cell", If present, Cell J as a "Non-Suitable Off cell".	–	–	–	–
–	The following messages are to be observed on Cell I unless explicitly stated otherwise.	–	–	–	–
14	Check: Does the UE transmit the ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	5	F
15	If possible (see ICS) switch off is performed. Otherwise the power is removed.	–	–	–	–
16	The UE is brought back to operation.	–	–	–	–
17	Void	–	–	–	–
18	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	6	P
19-31	The attach procedure is completed and the RRC connection released by executing steps 5 to 17 of the UE registration procedure in TS 36.508 clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.1.17.3.3 Specific message contents

Table 9.2.1.1.17.3.3-1: Message ATTACH REJECT (step 4 and 11 Table 9.2.1.1.17.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-3
Information Element	Value/remark	Comment	Condition
EMM cause	0000 1111	#15 “No suitable cells in tracking area”
ESM message container	Not present

Table 9.2.1.1.17.3.3-2: Message ATTACH REQUEST (step 10 Table 9.2.1.1.17.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
NAS key set identifier	111	"No key is available"
Old GUTI or IMSI	IMSI-1	GUTI has been deleted after receiving ATTACH REJECT at step 4; only IMSI is available.
Last visited registered TAI	Not present	TAI has been deleted after receiving ATTACH REJECT at step 4.

9.2.1.1.18 Attach / Rejected / Not authorized for this CSG

9.2.1.1.18.1 Test Purpose (TP)

(1)

with { UE has sent an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message }

ensure that {

when { UE receives an ATTACH REJECT message with the reject cause set to " Not authorized for this CSG " with integrity protection }

then { UE shall remove the CSG ID from the allowed CSG list and search for a suitable cell in the same PLMN }

}

(2)

with { UE in state EMM-REGISTERED and EMM-IDLE mode and the CSG ID is removed from the Allowed CSG list }

ensure that {
when { UE detects entering new tracking areas not included in the TAI list }

then { UE attempts to enter a normal cell and does not choose a cell which not included in the allowed CSG list }

}

9.2.1.1.18.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clause 5.5.1.2.5.

[TS 24.301, clause 5.5.1.2.5]

#25 (Not authorized for this CSG);

Cause #25 is only applicable when received from a CSG cell. Cause #25 received from a non-CSG cell is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.5.1.2.6.

If the ATTACH REJECT message with cause #25 was received without integrity protection, then the UE shall discard the message.

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3). Additionally, the UE shall reset the attach attempt counter and shall enter the state EMM-DEREGISTERED.LIMITED-SERVICE.

The UE shall remove the CSG ID of the cell where the UE has sent the ATTACH REQUEST message from the Allowed CSG list.

The UE shall search for a suitable cell in the same PLMN according to 3GPP TS 36.304 [21].

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the GMM parameters GMM state, GPRS update status and GPRS attach attempt counter as specified in 3GPP TS 24.008 [13] for the case when the normal attach procedure is rejected with the GMM cause with the same value.

9.2.1.1.18.3 Test description

9.2.1.1.18.3.1 Pre-test conditions

System Simulator:

– cell A (TAC 1, frequency 1, not a CSG cell);

– cell B (TAC 2, frequency 1, is a CSG cell);

– cell D (TAC 3, frequency 1, not a CSG cell).

– System information combination 2 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells A and D;

– System information combination 7 as defined in TS 36.508[18] clause 4.4.3.1 is used in cell B;

UE:

– the UE is configured to initiate EPS attach;

– the UE is previously registered on cell B using either manual CSG selection or a USIM with field EFACSGL preconfigured (so the allowed CSG list includes CSG ID of cell B);

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered in E-UTRAN using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.18.3.2 Test procedure sequence

Table 9.2.1.1.18.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – Cell A as a "Not Suitable cell". – Cell B as a "Serving cell". – Cell D as a "Not Suitable cell".	–	–	–	–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
2	The UE is switched on.	–	–	–	–
3	UE initiate attach procedure and send ATTACH REQUEST including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
4	The SS transmits an ATTACH REJECT message with EMM cause = "Not authorized for this CSG".	<–	ATTACH REJECT	–	–
5	The SS releases the RRC connection.	–	–	–	–
6	The SS configures: – Cell A as a "Not Suitable cell". – Cell B as a "Serving cell". – Cell D as a "Suitable neighbour intra-frequency cell".	–	–	–	–
–	The following messages are to be observed on Cell D unless explicitly stated otherwise.	–	–	–	–
7	Check: Does the UE transmit an ATTACH REQUEST message? Note: The UE shall search for a suitable cell in the same PLMN	–>	ATTACH REQUEST	1	P
8-14A	Void	–	–	–	–
14B-14Ob1	Steps 5-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed	–	–	–	–
15	The SS configures: – Cell A as a "Non-Suitable cell". – Cell B as the "Serving cell". – Cell D as a "Not Suitable cell".	–	–	–	–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
16	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message in the next 30 seconds?	–>	TRACKING AREA UPDATE REQUEST	2	F
17	The SS configures: – Cell A as a "Serving cell". – Cell B as the "Not Suitable cell". – Cell D as a "Non-Suitable cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
18	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	2	P
19	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
20	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA connected (E2_T3440) according to TS 36.508.	–	–	–	–

9.2.1.1.18.3.3 Specific message contents

Table 9.2.1.1.18.3.3-1: Message ATTACH REJECT (step 4, Table 9.2.1.1.18.3.2-1)

Derivation path: 36.508 table 4.7.2-3
Information Element	Value/Remark	Comment	Condition
EMM cause	00011001	#25 " Not authorized for this CSG "
ESM message container	Not present

Table 9.2.1.1.18.3.3-2: SystemInformationBlockType1 for Cell A, B, D (Pre-test conditions and all steps in Table 9.2.1.1.18.3.2-1)

Derivation Path: 36.508 clause 4.4.3-2
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType1 ::= SEQUENCE {
cellAccessRelatedInfo SEQUENCE {
csg-Indication	TRUE		Cell B
	FALSE		Cell A
	FALSE		Cell D
csg-Identity	Not present		Cell A
	Not present		Cell D
	‘000 0000 0000 0000 0000 0000 0010’B		Cell B

9.2.1.1.19 Attach / Abnormal case / Failure due to non integrity protection

9.2.1.1.19.1 Test Purpose (TP)

(1)

with { UE having been initiated an Attach }

ensure that {

when { UE receives an ATTACH ACCEPT messages without NAS integrity protection before NAS security mode control procedure being performed }

then { UE discards this message }

}

(2)

with { a valid NAS security context exists and the NAS security mode control procedure has been successfully completed in the network and the UE }

ensure that {

when { UE receives a valid NAS signalling message without integrity protection }

then { UE discards this NAS signalling message }

}

(3)

with { a valid NAS security context exists and the NAS security mode control procedure has been successfully completed in the network and the UE }

ensure that {

when { UE receives a valid security protected NAS signalling message with the Message authentication code set to an incorrect value }

then { UE discards this NAS signalling message }

}

(4)

with { a valid NAS security context exists and the NAS security mode control procedure has been successfully completed in the network and the UE }

ensure that {

when { UE receives a valid NAS signalling message with integrity protection which require a response from the UE }

then { UE sends the response as a security protected NAS message }

}

9.2.1.1.19.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clauses 4.4.4.1, 4.4.4.2 and 5.5.2.2.

[TS 24.301, clause 4.4.4.1]

For the UE, integrity protected signalling is mandatory for the NAS messages once a valid EPS security context exists and has been taken into use. For the network, integrity protected signalling is mandatory for the NAS messages once a secure exchange of NAS messages has been established for the NAS signalling connection. Integrity protection of all NAS signalling messages is the responsibility of the NAS. It is the network which activates integrity protection.

…

[TS 24.301, clause 4.4.4.2]

Except the messages listed below, no NAS signalling messages shall be processed by the receiving EMM entity in the UE or forwarded to the ESM entity, unless the secure exchange of NAS messages has been established for the NAS signalling connection:

– EMM messages:

– IDENTITY REQUEST (if requested identification parameter is IMSI);

– AUTHENTICATION REQUEST;

– AUTHENTICATION REJECT;

– ATTACH REJECT;

– DETACH REQUEST;

– DETACH ACCEPT (for non switch off);

– TRACKING AREA UPDATE REJECT;

– SERVICE REJECT.

NOTE: These messages are accepted by the UE without integrity protection, as in certain situations they are sent by the network before security can be activated.

All ESM messages are integrity protected.

Once the secure exchange of NAS messages has been established, the receiving EMM or ESM entity in the UE shall not process any NAS signalling messages unless they have been successfully integrity checked by the NAS. If NAS signalling messages, having not successfully passed the integrity check, are received, then the NAS in the UE shall discard that message. If any NAS signalling message is received as not integrity protected even though the secure exchange of NAS messages has been established by the network, then the NAS shall discard this message.

[TS 24.301, clause 5.5.2.2.1]

…

If the UE is to be switched off, the UE shall:

– delete the current EPS security context stored in the UE as specified in annex C, if it is a mapped EPS security context;

– store the native EPS security context (if it is valid), as specified in annex C; and

– try for a period of 5 seconds to send the DETACH REQUEST message. During this period, the UE may be switched off as soon as the DETACH REQUEST message has been sent.

…

9.2.1.1.19.3 Test description

9.2.1.1.19.3.1 Pre-test conditions

System Simulator:

– Cell A.

UE:

– The UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

NOTE: Any type of attach is acceptable.

Preamble:

– The UE is in state Switched OFF (state 1) according to TS 36.508 [18].

– The NAS integrity algorithm shall be set to a different value than ‘EPS integrity algorithm’ EIA0 throughout the whole duration of the test.

9.2.1.1.19.3.2 Test procedure sequence

Table 9.2.1.1.19.3.2-1: Main behaviour

St	Procedure		Message Sequence				TP	Verdict
			U – S		Message
1	The UE is switched on.		–		–		–	–
2	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message. Note: The ATTACH REQUEST message shall be sent as a security protected NAS message (see TS 24.301 – clause 9.1).		–>		ATTACH REQUEST		–	–
2Aa1-2Aa2	Void		–		–		–	–
2Ba1-2D	Steps 9a1-11 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.		–		–		–	–
3	The SS transmits an ATTACH ACCEPT although UE has not successfully completed any NAS security mode control procedure. Note: The ATTACH ACCEPT message is sent as a plain NAS message (see TS 24.301 – clause 9.1).		<–		ATTACH ACCEPT		–	–
4	Check: Does the UE transmit an ATTACH COMPLETE message within the next 3s? Note: The UE is expected to discard the ATTACH ACCEPT message without security protection.		–>		ATTACH COMPLETE		1	F
5	The SS transmits an AUTHENTICATION REQUEST message to initiate the EPS authentication and AKA procedure.		<–		AUTHENTICATION REQUEST		–	–
6	The UE transmits an AUTHENTICATION RESPONSE message to establish mutual authentication.		–>		AUTHENTICATION RESPONSE		–	–
7	The SS transmits a SECURITY MODE COMMAND message to activate NAS security.		<–		SECURITY MODE COMMAND		–	–
8	The UE transmits a SECURITY MODE COMPLETE message and establishes the initial security configuration.		–>		SECURITY MODE COMPLETE		–	–
9	The SS transmits an ATTACH ACCEPT without integrity protection. Note: The ATTACH ACCEPT message is sent as a plain NAS message (see TS 24.301 – clause 9.1).		<–		ATTACH ACCEPT		–	–
10	Check: Does the UE transmit an ATTACH COMPLETE message within the next 3s? Note: The UE is expected to discard the ATTACH ACCEPT message without security protection		–>		ATTACH COMPLETE		2	F
11	The SS transmits an ATTACH ACCEPT with integrity protection with the Message authentication code set to an incorrect value. Note: The ATTACH ACCEPT message is sent as a security protected NAS message (see TS 24.301 – clause 9.1).		<–		ATTACH ACCEPT		–	–
12	Check: Does the UE transmit an ATTACH COMPLETE message within the next 3s? Note: The UE is expected to discard the ATTACH ACCEPT message because the integrity check is failed.		–>		ATTACH COMPLETE		3	F
13	The SS transmits an ATTACH ACCEPT message including an ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST. Note: The ATTACH ACCEPT message is sent as a security protected NAS message (see TS 24.301 – clause 9.1). Note 1: SS allocates a PDN address of a PDN type which is compliant with the PDN type requested by the UE.		<–		ATTACH ACCEPT		–	–
–	EXCEPTION: In parallel to the event described in step 14 below the generic procedure for IP address allocation in the U-plane specified in TS 36.508 subclause 4.5A.1 takes place performing IP address allocation in the U-plane if requested by the UE.		–		–		–	–
–	EXCEPTION: IF PDN1_IMS (Note) THEN in parallel to the event described in step 16 below the generic procedure for IMS signalling in the Uplane specified in TS 36.508 subclause 4.5A.3 takes place if requested by the UE		–		–		–	–
14	Check: Does the UE transmit an ATTACH COMPLETE message including an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message as specified? Note: The ATTACH COMPLETE message is sent as a security protected NAS message (see TS 24.301 – clause 9.1).		–>		ATTACH COMPLETE		4	P
14A1a1-14A3b1	Steps 16a1-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–		–		–		–
15	Void		–		–		–	–
16	Check: Does the test results of test procedure in 36.508 clause 6.4.2.4 indicate that the UE is in E-UTRA EMM-REGISTERED state with S-TMSI-2? Note: This step verifies that the UE has correctly stored the GUTI-4 which was included in the protected ATTACH ACCEPT messages.		–		–		4	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.		–		–		–	–
Note: PDN1_IMS as defined in TS 36.508 subclause 4.5.2.

9.2.1.1.19.3.3 Specific message contents

Table 9.2.1.1.19.3.3-1: Message ATTACH ACCEPT (steps 3 and 9, Table 9.2.1.1.19.3.2-1)

Derivation path: 36.508 table 4.7.2-1 (Plain NAS message)
Information Element	Value/Remark	Comment	Condition
GUTI	GUTI-2	The SS chooses a value different from GUTI-1.

Table 9.2.1.1.19.3.3-2: Message SECURITY PROTECTED NAS MESSAGE (step 11, Table 9.2.1.1.19.3.2-1)

Derivation path: 36.508 table 4.7.1-1 with condition CIPHERED
Information Element	Value/Remark	Comment	Condition
Message authentication code	Incorrect value	The SS chooses an incorrect value which fails integrity checks. (e.g. 00000000)
NAS message	ATTACH ACCEPT (see table 9.2.1.1.19.3.3-3)

Table 9.2.1.1.19.3.3-3: Message ATTACH ACCEPT (step 11, Table 9.2.1.1.19.3.2-1)

Derivation path: 36.508 table 4.7.2-1 (Security protected NAS message)
Information Element	Value/Remark	Comment	Condition
GUTI	GUTI-3	The SS chooses a value different from GUTI-1 and GUTI-2.

Table 9.2.1.1.19.3.3-4: Message ATTACH ACCEPT (step 13, Table 9.2.1.1.19.3.2-1)

Derivation path: 36.508 table 4.7.2-1 (Security protected NAS message)
Information Element	Value/Remark	Comment	Condition
GUTI	GUTI-4	The SS chooses a value different from GUTI-1, GUTI-2 and GUTI-3.

9.2.1.1.20 Attach / Abnormal case / Access barred because of access class barring or NAS signalling connection establishment rejected by the network

9.2.1.1.20.1 Test Purpose (TP)

(1)

with { UE switched-on, and not yet attached to EPS }

ensure that {

when { Access is barred for signalling in the cell UE is camping [Access Class barred in System information] }

then { the UE will not initiate any Attach procedure on the current cell }

}

(2)

with { UE switched-on, and not yet attached to EPS }

ensure that {

when { Access is barred for signalling in the cell UE is camping [T302 running due to RRCConnectionReject message reception] }

then { the UE will not initiate any Attach procedure on the current cell }

}

(3)

with { UE switched-on, and not yet attached to EPS }

ensure that {

when { Access is not barred for signalling in the cell UE is camping }

then { the UE will initiate Attach procedure on the current cell }

}

(4)

with { UE switched-on, and not yet attached to EPS }

ensure that {

when { Access was barred for signalling in the cell and UE has reselected an new cell where access for "signalling" is granted }

then { the UE will initiate Attach procedure on the new cell }

}

9.2.1.1.20.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clause 5.5.1.2.6 and TS 36.331, clause 5.3.3.2

[TS 24.301, clause 5.5.1.2.6]

The following abnormal cases can be identified:

a) Access barred because of access class barring or NAS signalling connection establishment rejected by the network

If access is barred for "signalling" (see 3GPP TS 36.331 [22]), the attach procedure shall not be started. The UE stays in the current serving cell and applies the normal cell reselection process. The attach procedure is started as soon as possible, i.e. when access for "signalling" is granted on the current cell or when the UE moves to a cell where access for "signalling" is granted.

[TS 36.331, clause 5.3.3.2]

1> else (the UE is establishing the RRC connection for mobile originating signalling):

2> if timer T302 or T305 is running:

3> consider access to the cell as barred;

2> else if SystemInformationBlockType2 includes the ac-BarringInformation and the ac-BarringForMO-Signalling is present:

3> if the UE has one or more Access Classes, as stored on the USIM, with a value in the range 11..15, which is valid for the UE to use according to TS 22.011 [10] and TS 23.122 [11], and

3> for at least one of these Access Classes the corresponding bit in the ac-BarringForSpecialAC contained in ac-BarringForMO-Signalling is set to zero:

4> consider access to the cell as not barred;

3> else:

4> draw a random number ‘rand’ uniformly distributed in the range: 0 ≤ rand < 1;

4> if ‘rand’ is lower than the value indicated by accessProbabilityFactor included in accessBarringForSignalling:

5> consider access to the cell as not barred;

4> else:

5> consider access to the cell as barred;

2> else:

3> consider access to the cell as not barred;

9.2.1.1.20.3 Test description

9.2.1.1.20.3.1 Pre-test conditions

System Simulator:

– cell I and cell K are configured according to table 6.3.2.2-1 in TS 36.508 [18].

– cell I and cell K belong to TAI-9 (home PLMN)

UE:

– the UE is configured to initiate EPS attach;

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell K using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.20.3.2 Test procedure sequence

Table 9.2.1.1.20.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS sets the cell type of cell I to the ”Serving cell”, set the cell type of cell K to the ” Non- Suitable cell”, and sets SystemInformationBlockType2 parameters as described below. The UE is switched on.	–	–	–	–
–	The following messages are to be observed on Cell I unless explicitly stated otherwise.	–	–	–	–
2	Check: For 90 seconds if UE initiates Attach procedure and hence transmits RRC Connection Request?	–	–	1	F
3	The SS transmits a Paging message including systemInfoModification.	–	–	–	–
4	The SS changes SystemInformationBlockType2 parameters to default parameters defined in [18].	–	–	–	–
5	The UE transmits RRC Connection Request	–	–	–	–
6	SS responds with RRCConnectionReject message with IE waitTime set to 10 seconds (Max Value).	–	–	–	–
7	Check: For 10 seconds if UE initiates Attach procedure and hence transmits RRC Connection Request?	–	–	2	F
8	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	3	P
8A-8Nb1	The attach procedure is completed by executing steps 5 to 18b1 the UE registration procedure in TS 36.508 sub clause 4.5.2.3	–	–	–	–
9-15	Void
–	EXCEPTION: Step 16a describes behaviour that depends on the UE capability.
16a	If pc_SwitchOnOff or pc_USIM_Removal then UE sends DETACH REQUEST message	–>	DETACH REQUEST
17	The SS sets the cell type of cell I to the ”Serving cell”, sets the cell type of cell K to the ” Non- Suitable cell”, and sets SystemInformationBlockType1 and SystemInformationBlockType2 parameters as described below. The UE is brought back to operation or the USIM is inserted.	–	–	–	–
18	Check: for 90 seconds if UE initiates Attach procedure and hence transmits RRC Connection Request?	–	–	1	F
19	The SS sets the cell type of cell K to the ”serving cell” and cell I to “suitable Cell”.
–	The following messages are to be observed on Cell K unless explicitly stated otherwise.	–	–	–	–
20	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	4	P
21-34 b1	The attach procedure is completed by executing steps 5 to 18b1 of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.1.20.3 Specific message contents

Table 9.2.1.1.20.3.3-0: SystemInformationBlockType1 for Cell I (step 4, Table 9.2.1.1.20.3.2-1)

Derivation Path: 36.508, Table 4.4.3.2-3
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType1 ::= SEQUENCE {
systemInfoValueTag	1
}

Table 9.2.1.1.20.3.3-0A: SystemInformationBlockType1-BR-r13 for Cell I (step 4 when UE under test is CAT-M1, Table 9.2.1.1.20.3.2-1)

Derivation Path: 36.508, Table 4.4.3.2-3A
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType1-BR-r13 ::= SEQUENCE {
systemInfoValueTag	1
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {	Not present
nonCriticalExtension SEQUENCE {			UECAT0
nonCriticalExtension SEQUENCE {
bandwidthReducedAccessRelatedInfo-r13 SEQUENCE {
systemInfoValueTagList-r13 SEQUENCE (SIZE (1..maxSI-Message)) OF	n entries	The same number of entries, and listed in the same order, as in SchedulingInfoList (without suffix)
SystemInfoValueTagSI-r13[1]	SystemInfoValueTagSI-r13[k]=1, where k is the entry corresponding to the system info including SystemInformationBlockType2. For all other entries the value is set to 0 (same as in the default SystemInformationBlockType1-BR-r13 message).
SystemInfoValueTagSI-r13[n]
}
}
}
}
}
}
}

Table 9.2.1.1.20.3.3-1: SystemInformationBlockType2 for Cell I (step 1 and 17)

Derivation Path: 36.508, Table 4.4.3.3-1
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType2 ::= SEQUENCE {
accessBarringInformation SEQUENCE {
accessBarringForEmergencyCalls	FALSE
accessBarringForSignalling SEQUENCE {
accessProbabilityFactor	p00
accessBarringTime	s4
accessClassBarringList SEQUENCE (SIZE (maxAC)) OF SEQUENCE {	5 entries
accessClassBarring[1]	TRUE
accessClassBarring[2]	TRUE
accessClassBarring[3]	TRUE
accessClassBarring[4]	TRUE
accessClassBarring[5]	TRUE
}
}
accessBarringForOriginatingCalls	Not present
}
}

Table 9.2.1.1.20.3.3-2: SystemInformationBlockType1 for Cell I (step 17)

Derivation Path: 36.508, Table 4.4.3.2-3
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType1 ::= SEQUENCE {
cellAccessRelatedInfo SEQUENCE {
intraFreqReselection	allowed
}
}

Table 9.2.1.1.20.3.3-3: SystemInformationBlockType1-BR-r13 for Cell I (step 17 when UE under test is CAT M1)

Derivation Path: 36.508, Table 4.4.3.2-3A
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType1-BR-r13 ::= SEQUENCE {
cellAccessRelatedInfo SEQUENCE {
intraFreqReselection	allowed
}
}

9.2.1.1.21 Void

NOTE: The present test (Attach / Abnormal case / Success after several attempts due to no network response) is superseded by test case 9.2.1.1.22 (i.e. all requirements which the present test verified are verified in test case 9.2.1.1.22).

9.2.1.1.22 Attach / Abnormal case / Unsuccessful attach after 5 attempts

9.2.1.1.22.1 Test Purpose (TP)

(0)

with { UE has sent an ATTACH REQUEST message and started T3410 timer}

ensure that {

when { T3410 timer expires }

then { the UE release NAS signalling connection locally }

}

(0A)

with { UE has sent an ATTACH REQUEST message and T3410 timer expired}

ensure that {

when { T3411 timer expires and attach attempt counter is less than 5 }

then { the UE restarts the attach procedure }

}

(0B)

with { UE has sent an ATTACH REQUEST message }

ensure that {

when { Lower Layer failure (RRC Connection is released) before the ATTACH ACCEPT or ATTACH REJECT message is received, T3411 has expired and attach attempt counter is less than 5}

then { the UE restarts the attach procedure }

}

(1)

with { UE has sent an ATTACH REQUEST message }

ensure that {

when { T3411 has expired and attach attempt counter is equal to 5}

then { the UE stops attach attempts and starts timer T3402 }

}

9.2.1.1.22.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clause 5.5.1.2.6 & 10.2

[TS 24.301, clause 5.5.1.2.6]

The following abnormal cases can be identified:

…

b) Lower layer failure or release of the NAS signalling connection before the ATTACH ACCEPT or ATTACH REJECT message is received

The attach procedure shall be aborted, and the UE shall proceed as described below.

c) T3410 timeout

The UE shall abort the attach procedure and proceed as described below. The NAS signalling connection shall be released locally.

…

For the cases b, c, and d the UE shall proceed as follows:

– Timer T3410 shall be stopped if still running. The attach attempt counter shall be incremented, unless it was already set to 5.

If the attach attempt counter is less than 5:

timer T3411 is started and the state is changed to EMM-DEREGISTERED.ATTEMPTING-TO-ATTACH. When timer T3411 expires the attach procedure shall be restarted.

If the attach attempt counter is equal to 5:

– the UE shall delete any GUTI, TAI list, last visited registered TAI, list of equivalent PLMNs and KSI, shall set the update status to EU2 NOT UPDATED, and shall start timer T3402. The state is changed to EMM-DEREGISTERED.ATTEMPTING-TO-ATTACH or optionally to EMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection according to 3GPP TS 23.122 [6].

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number as specified in 3GPP TS 24.008 [13] for the abnormal case when a normal attach procedure fails and the attach attempt counter is equal to 5.

[TS 24.301, clause 10.2]

Table 10.2.1: EPS mobility management timers – UE side

TIMER NUM.	TIMER VALUE	STATE	CAUSE OF START	NORMAL STOP	ON EXPIRY
T3402	Default 12 min. NOTE 1	EMM-DEREGISTERED EMM-REGISTERED	At attach failure and the attempt counter is equal to 5. At tracking area updating failure and the attempt counter is equal to 5.	ATTACH REQUEST sent TRACKING AREA UPDATE REQUEST sent	Initiation of the attach procedure or TAU procedure
…
T3410	15s	EMM-REGISTERED-INITIATED	ATTACH REQUEST sent	ATTACH ACCEPT received ATTACH REJECT received	Start T3411 or T3402 as described in subclause 5.5.1.2.6
T3411	10s	EMM-DEREGISTERED. ATTEMPTING-TO-ATTACH EMM-REGISTERED. ATTEMPTING-TO-UPDATE	At attach failure due to lower layer failure, T3410 timeout or attach rejected with other EMM cause values than those treated in subclause 5.5.1.2.5. At tracking area updating failure due to lower layer failure, T3430 timeout or TAU rejected with other EMM cause values than those treated in subclause 5.5.3.2.5.	ATTACH REQUEST sent TRACKING AREA UPDATE REQUEST sent	Retransmission of the ATTACH REQUEST or TRACKING AREA UPDATE REQUEST
…
Note 1: The default value of this timer is used if the network does not indicate another value in an EMM signalling procedure.

9.2.1.1.22.3 Test description

9.2.1.1.22.3.1 Pre-test conditions

System Simulator:

– cell A.

UE:

– the UE is configured to initiate EPS attach;

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.22.3.2 Test procedure sequence

Table 9.2.1.1.22.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2	The UE transmits an ATTACH REQUEST message. (Attach attempt counter = 1)	–>	ATTACH REQUEST	–	–
3	The SS waits 25 seconds (15 seconds T3410 and 10 seconds T3411).	–	–	–	–
3A	Check: Does the UE transmit an RRCConnectionRequest message?	–	–	0	P
4	Check: Does the UE transmit an ATTACH REQUEST message? (Attach attempt counter = 2)	–>	ATTACH REQUEST	0A	P
5	The SS releases the RRC connection.
6	The SS waits 10 seconds (T3411).
7	Check: Does the UE transmit an ATTACH REQUEST message? (Attach attempt counter = 3)	–>	ATTACH REQUEST	0B	P
8	The SS waits 25 seconds (15 seconds T3410 and 10 seconds T3411).	–		–	–
9	The UE transmits an ATTACH REQUEST message. (Attach attempt counter = 4)	–>	ATTACH REQUEST	–	–
10	The SS releases the RRC connection.
11	The SS waits 10 seconds (T3411).
12	The UE transmits an ATTACH REQUEST message. (Attach attempt counter = 5)	–>	ATTACH REQUEST
13	The SS releases the RRC connection.
14	Check: Does the UE transmit an ATTACH REQUEST message after 12 minutes (the default value of T3402), after step 13?	–>	ATTACH REQUEST	1	P
15-28 b1	The attach procedure is completed by executing steps 5 to 18b1 of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.1.22.3.3 Specific message contents

Table 9.2.1.1.22.3.3-1: Message ATTACH REQUEST (step 14, Table 9.2.1.1.22.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
NAS key set identifier	111	"No key is available"
Old GUTI or IMSI	IMSI-1	GUTI has been deleted; only IMSI is available.
Last visited registered TAI	Not present	TAI has been deleted.

9.2.1.1.23 Attach / Abnormal case / Repeated rejects for network failures

9.2.1.1.23.1 Test Purpose (TP)

(1)

with { UE having valid GUTI, has sent an ATTACH REQUEST message }

ensure that {

when { UE receives an ATTACH REJECT message with the reject cause set to #17 or #22 and attach attempt counter is less than 5}

then { UE starts timer T3411 and shall not delete stored GUTI }

when { Timer T3411 expires}

then { UE restarts attach procedure }

}

(2)

with { UE having valid GUTI, has sent an ATTACH REQUEST message }

ensure that {

when { UE receives an ATTACH REJECT message with the reject cause set to #22 and attempt counter is set to 5}

then { the UE stops attach attempts and starts timer T3402, shall delete stored GUTI }

}

NOTE: Only representative coverage for various abnormal reject causes is provided.

9.2.1.1.23.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clause 5.5.1.2.5, 5.5.1.2.6, 9.9.3.9 & 10.2

[TS 24.301, clause 5.5.1.2.5]

Upon receiving the ATTACH REJECT message, the UE shall stop timer T3410 and take the following actions depending on the EMM cause value received.

…

Other values are considered as abnormal cases. The behaviour of the UE in those cases is specified in subclause 5.5.1.2.6.

[TS 24.301, clause 5.5.1.2.6]

The following abnormal cases can be identified:

…

d) ATTACH REJECT, other EMM cause values than those treated in subclause 5.5.1.2.5

Upon reception of the EMM cause #19, "ESM failure", the UE may set the attach attempt counter to 5. Upon reception of the EMM causes #95, #96, #97, #99 and #111 the UE should set the attach attempt counter to 5.

The UE shall proceed as described below.

…

For the cases b, c, and d the UE shall proceed as follows:

– Timer T3410 shall be stopped if still running. The attach attempt counter shall be incremented, unless it was already set to 5.

If the attach attempt counter is less than 5:

timer T3411 is started and the state is changed to EMM-DEREGISTERED.ATTEMPTING-TO-ATTACH. When timer T3411 expires the attach procedure shall be restarted.

If the attach attempt counter is equal to 5:

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number as specified in 3GPP TS 24.008 [13] for the abnormal case when a normal attach procedure fails and the attach attempt counter is equal to 5.

[TS 24.301, clause 9.9.3.9]

Table 9.9.3.9.1: EMM cause information element

Cause value (octet 2)

Bits
8	7	6	5	4	3	2	1
								…
0	0	0	1	0	0	0	1	Network failure
0	0	0	1	0	0	1	0	CS domain not available
0	0	0	1	0	0	1	1	ESM failure
0	0	0	1	0	1	0	0	MAC failure
0	0	0	1	0	1	0	1	Synch failure
0	0	0	1	0	1	1	0	Congestion
0	0	0	1	0	1	1	1	UE security capabilities mismatch
								…
Any other value received by the mobile station shall be treated as 0110 1111, "protocol error, unspecified". Any other value received by the network shall be treated as 0110 1111, "protocol error, unspecified".

[TS 24.301, clause 10.2]

Table 10.2.1: EPS mobility management timers – UE side

TIMER NUM.	TIMER VALUE	STATE	CAUSE OF START	NORMAL STOP	ON EXPIRY
T3402	Default 12 min. NOTE 1	EMM-DEREGISTERED EMM-REGISTERED	At attach failure and the attempt counter is equal to 5. At tracking area updating failure and the attempt counter is equal to 5.	ATTACH REQUEST sent TRACKING AREA UPDATE REQUEST sent	Initiation of the attach procedure or TAU procedure
…
T3410	15s	EMM-REGISTERED-INITIATED	ATTACH REQUEST sent	ATTACH ACCEPT received ATTACH REJECT received	Start T3411 or T3402 as described in subclause 5.5.1.2.6
T3411	10s	EMM-DEREGISTERED. ATTEMPTING-TO-ATTACH EMM-REGISTERED. ATTEMPTING-TO-UPDATE	At attach failure due to lower layer failure, T3410 timeout or attach rejected with other EMM cause values than those treated in subclause 5.5.1.2.5. At tracking area updating failure due to lower layer failure, T3430 timeout or TAU rejected with other EMM cause values than those treated in subclause 5.5.3.2.5.	ATTACH REQUEST sent TRACKING AREA UPDATE REQUEST sent	Retransmission of the ATTACH REQUEST or TRACKING AREA UPDATE REQUEST
…
Note 1: The default value of this timer is used if the network does not indicate another value in an EMM signalling procedure.

9.2.1.1.23.3 Test description

9.2.1.1.23.3.1 Pre-test conditions

System Simulator:

– cell A.

NOTE: T3402 is set to default (12 min.).

UE:

– the UE is configured to initiate EPS attach

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.23.3.2 Test procedure sequence

Table 9.2.1.1.23.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2	The UE transmits an ATTACH REQUEST message. (Attach attempt counter = 1)	–>	ATTACH REQUEST	–	–
3	The SS transmits an ATTACH REJECT message, EMM cause = Network failure (#17)	<–	ATTACH REJECT	–	–
4	The SS releases the RRC connection.	–	–	–	–
5	The SS waits 10 seconds (T3411).	–	–	–	–
6	Check: Does the UE transmit an ATTACH REQUEST message? (Attach attempt counter = 2)	–>	ATTACH REQUEST	1	P
7	The SS transmits an ATTACH REJECT message, EMM cause = Network failure (#17)	<–	ATTACH REJECT	–	–
8	The SS releases the RRC connection.	–	–	–	–
9	The SS waits 10 seconds (T3411).	–	–	–	–
10	Check: Does the UE transmit an ATTACH REQUEST message? (Attach attempt counter = 3)	–>	ATTACH REQUEST	1	P
11	The SS transmits an ATTACH REJECT message, EMM cause = Congestion (#22)	<–	ATTACH REJECT	–	–
12	The SS releases the RRC connection.	–	–	–	–
13	The SS waits 10 seconds (T3411).	–	–	–	–
14	Check: Does the UE transmit an ATTACH REQUEST message? (Attach attempt counter = 4)	–>	ATTACH REQUEST	–	–
15	The SS transmits an ATTACH REJECT message, EMM cause = Congestion (#22)	<–	ATTACH REJECT	–	–
16	The SS releases the RRC connection.	–	–	–	–
17	The SS waits 10 seconds (T3411).	–	–	–	–
18	Check: Does the UE transmit an ATTACH REQUEST message? (Attach attempt counter = 5)	–>	ATTACH REQUEST	1	P
19	The SS transmits an ATTACH REJECT message, EMM cause = Congestion (#22)	<–	ATTACH REJECT	–	–
20	The SS releases the RRC connection.	–	–	–	–
21	The SS waits 12 minutes (default value of T3402).	–	–	–	–
22	Check: Does the UE transmit an ATTACH REQUEST message?	–>	ATTACH REQUEST	2	P
23-36 b1	The attach procedure is completed by executing steps 5 to 18b1 ofthe UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.1.23.3.3 Specific message contents

Table 9.2.1.1.23.3.3-1: Message ATTACH REQUEST (step 2, 6, 10 &14 Table 9.2.1.1.23.2-1)

Derivation path: TS 36.508 table 4.7.2.-4
Information Element	Value/Remark	Comment	Condition
NAS key set identifier	Any allowed value other than ‘111’B	"Stored key is available"
Old GUTI or IMSI	GUTI-1	As stored in USIM
Last visited registered TAI	TAI-1	Stored TAI.

Table 9.2.1.1.23.3.3-2: Message ATTACH REJECT (steps 3 & 7 Table 9.2.1.1.23.3.2-1)

Derivation path: 36.508 table 4.7.2.3
Information Element	Value/Remark	Comment	Condition
Security header type	0000	" Plain NAS message, not security protected "
EMM cause	00010001	#17 " Network failure"
ESM message container	Not present

Table 9.2.1.1.23.3.3-3: Message ATTACH REJECT (steps 11, 15 & 19 Table 9.2.1.1.23.3.2-1)

Derivation path: 36.508 table 4.7.2.3
Information Element	Value/Remark	Comment	Condition
Security header type	0000	" Plain NAS message, not security protected "
EMM cause	00010110	#22 "Congestion "
ESM message container	Not present

Table 9.2.1.1.23.3.3-4: Message ATTACH REQUEST (step 22, Table 9.2.1.1.23.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2.4
Information Element	Value/remark	Comment	Condition
NAS key set identifier	111	"No key is available"
Old GUTI or IMSI	IMSI-1	GUTI has been deleted; only IMSI is available.
Last visited registered TAI	Not present	TAI has been deleted.

9.2.1.1.24 Attach / Abnormal case / Change of cell into a new tracking area

9.2.1.1.24.1 Test Purpose (TP)

(1)

with { UE has sent an ATTACH Request message }

ensure that {

when { cell change into a new tracking area occurs before the ATTACH procedure is completed }

then { the UE aborts the ATTACH procedure and re-initiates it immediately in the new tracking area }

}

(2)

with { UE has sent an ATTACH REQUEST message and received ATTACH ACCEPT message containing GUTI }

ensure that {

when { UE reselects a cell belonging to a new tracking area }

then { the UE restarts the attach procedure }

}

9.2.1.1.24.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clause 5.5.1.2.6 and 5.5.1.3.6.

[TS 24.301, clause 5.5.1.2.6]

The following abnormal cases can be identified:

…

e) Change of cell into a new tracking area

If a cell change into a new tracking area occurs before the attach procedure is completed, the attach procedure shall be aborted and re-initiated immediately. If a tracking area border is crossed when the ATTACH ACCEPT message has been received but before an ATTACH COMPLETE message is sent, the attach procedure shall be re-initiated. If a GUTI was allocated during the attach procedure, this GUTI shall be used in the attach procedure.

[TS 24.301, clause 5.5.1.3.6]

The UE shall proceed as follows:

…

– otherwise, the abnormal cases specified in subclause 5.5.1.2.6 apply with the following modification.

If the attach attempt counter is incremented according to subclause 5.5.1.2.6 the next actions depend on the value of the attach attempt counter:

9.2.1.1.24.3 Test description

9.2.1.1.24.3.1 Pre-test conditions

System Simulator:

– Cells A and B:

– Cell A is the serving cell with TAI 1 (PLMN1+TAC1);

– Cell B is the non-suitable cell with TAI 2 (PLMN1+TAC2).

– System information combination 3 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells;

UE:

– The UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

NOTE: Any type of attach is acceptable.

Preamble:

– The UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.24.3.2 Test procedure sequence

Table 9.2.1.1.24.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
0A	The SS configures: – Cell B as a "serving cell" – Cell A as a "non-suitable cell".	–	–	–	–
1	The UE is switched on.	–	–	–	–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
2	The UE transmits an ATTACH REQUEST message in Cell B including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
3	SS does not send ATTACH ACCEPT to the UE and update TAC value in SystemInformationBlockType1.	–		–	–
–	EXCEPTION: IF pc_ue_CategoryDL_M1 THEN execute 3Ab1 to 3Ab3 ELSE execute step 3Aa1.	–	–	–	–
3A a1	The SS transmits a Paging message paging occasion including a systemInfoModification. From the beginning of the next modification period the SS transmits a modified SystemInformationBlockType1 as specified.	<–	Paging	–	–
3Ab1	The SS transmits an RRCConnectionRelease message in Cell B.	–	–	–	–
3Ab2	Void	–	–	–	–
3Ab3	The SS indicates a new system information by Direct Indication information with bit 1 and transmitted on MPDCCH using P-RNTI. From the beginning of the next modification period the SS transmits a modified SystemInformationBlockType1-BR-r13.	–	–	–	–
4	Check: Does the UE transmit an ATTACH REQUEST message in Cell B including a PDN CONNECTIVITY REQUEST message in the next 12 seconds? Note: Wait time is more than 2.1* modification period for the UE to receive system information and inferior to T3410.	–>	ATTACH REQUEST	1	P
4A-8b	Void	–	–	–	–
8A-8G	Steps 5-11 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
9	The SS configures: – Cell A as a “serving cell”	–	–	–	–
10	SS is configured to not allocate any UL grant or respond to any PRACH preambles for ATTACH COMPLETE in Cell B.	–	–	–	–
11	SS responds with ATTACH ACCEPT message including a valid TAI list. The ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message is piggybacked in ATTACH ACCEPT message. GUTI-1 is allocated.	<–	ATTACH ACCEPT	–	–
12	The SS configures: – Cell B as a "non-suitable cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
13	UE transmits RRCConnectionReestablishmentRequest message in Cell A	–	–	–	–
14	SS Sends RRCConnectionReestablishment	–	–	–	–
15	The UE transmits a RRCConnectionReestablishmentComplete message	–	–	–	–
16	Check: Does the UE transmit an ATTACH REQUEST message, containing GUTI-1?	–>	ATTACH REQUEST	2	P
17	SS responds with ATTACH ACCEPT message including a valid TAI list. The ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message is piggybacked in ATTACH ACCEPT message	<–	ATTACH ACCEPT	–	–
–	EXCEPTION: In parallel to the event described in step 18 below the generic procedure for IP address allocation in the U-plane specified in TS 36.508 subclause 4.5A.1 takes place performing IP address allocation in the U-plane if requested by the UE.	–	–	–	–
–	EXCEPTION: IF PDN1_IMS (NOTE 2) THEN in parallel to the event described in step 18 below the generic procedure for IMS signalling in the Uplane specified in TS 36.508 subclause 4.5A.3 takes place if requested by the UE	–	–	–	–
18	The UE transmits an ATTACH COMPLETE message including an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message.	–>	ATTACH COMPLETE	–	–
18A1a1-18A3b1	Steps 16a1-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
19	Void	–	–	–	–
NOTE 1: UE already has NAS security context in step 17 and just sending a DL message with Integrity and Ciphering will start enable NAS security. NOTE 2: PDN1_IMS as defined in TS 36.508 subclause 4.5.2.

9.2.1.1.24.3.3 Specific message contents

Table 9.2.1.1.24.3.3-1: Message ATTACH ACCEPT (step 11, Table 9.2.1.1.24.3.2-1)

Derivation path: TS 36.508 table 4.7.2-1
Information Element		Value/Remark	Comment	Condition
TAI list
Length of tracking area identity list contents	‘0000 0110’B
Partial tracking area identity list 1
Number of elements	‘0 0000’B
Type of list	’00’B
MCC	MCC of cell B
MNC	MNC of cell B
TAC 1	TAC-4
GUTI		GUTI-1

Table 9.2.1.1.24.3.3-2: SystemInformationBlockType1 for Cell B (From step 3 in Table 9.2.1.1.24.3.2-1)

Derivation Path: 36.508 clause 4.4.3.2, Table 4.4.3.2-3
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType1 ::= SEQUENCE {
systemInfoValueTag	1	Default value is 0
cellAccessRelatedInfo SEQUENCE {
trackingAreaCode	TAC-4
}
}

Table 9.2.1.1.24.3.3-2A: SystemInformationBlockType1-BR-r13 for Cell B (From step 3 in Table 9.2.1.1.24.3.2-1 when UE under test is CAT M1)

Derivation Path: 36.508 clause 4.4.3.2, Table 4.4.3.2-3A
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType1-BR-r13 ::= SEQUENCE {
systemInfoValueTag	1	Default value is 0
cellAccessRelatedInfo SEQUENCE {
trackingAreaCode	TAC-4
}
}

Table 9.2.1.1.24.3.3-3: Paging (step 3Aa1, Table 9.2.1.1.24.3.2-1)

Derivation Path: 36.508 Table 4.6.1-7
Information Element	Value/remark	Comment	Condition
Paging ::= SEQUENCE {
pagingRecordList	Not present
systemInfoModification	true
}

Table 9.2.1.1.24.3.3-4: Message ATTACH REQUEST (step 16, Table 9.2.1.1.24.3.2-1)

Derivation path: TS 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	GUTI-1
Last visited registered TAI	TAI of cell B with TAC-4

9.2.1.1.25 Attach / Abnormal case / Mobile originated detach required

9.2.1.1.25.1 Test Purpose (TP)

(1)

with { UE in EMM-REGISTERED-INITIATED state }

ensure that {

when { the UE initiates mobile originated detach }

then { the UE aborts the attach procedure }

}

9.2.1.1.25.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clause 5.5.1.2.6 and 5.5.1.3.6

[TS 24.301, clause 5.5.1.2.6]

The following abnormal cases can be identified:

f) Mobile originated detach required

The attach procedure shall be aborted, and the UE initiated detach procedure shall be performed.

[TS 24.301, clause 5.5.1.3.6]

The UE shall proceed as follows:

…

– otherwise, the abnormal cases specified in subclause 5.5.1.2.6 apply with the following modification.

If the attach attempt counter is incremented according to subclause 5.5.1.2.6 the next actions depend on the value of the attach attempt counter:

9.2.1.1.25.3 Test description

9.2.1.1.25.3.1 Pre-test conditions

System Simulator:

– Cell A.

UE:

None.

Preamble:

– The UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.25.3.2 Test procedure sequence

Table 9.2.1.1.25.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2	The UE transmits an ATTACH REQUEST message. (NOTE 2)	–>	ATTACH REQUEST	–	–
3	The SS transmits an AUTHENTICATION REQUEST message to initiate the EPS authentication and AKA procedure.	<–	AUTHENTICATION REQUEST	–	–
4	The UE transmits an AUTHENTICATION RESPONSE message and establishes mutual authentication.	–>	AUTHENTICATION RESPONSE	–	–
5	The SS transmits a NAS SECURITY MODE COMMAND message to activate NAS security.	<–	SECURITY MODE COMMAND	–	–
6	The UE transmits a NAS SECURITY MODE COMPLETE message and establishes the initial security configuration.	–>	SECURITY MODE COMPLETE	–	–
7	The SS does not respond to ATTACH REQUEST message.	–	–	–	–
7A	Cause UE to initiate detach before the T3410 times out. (NOTE 1)	–	–	–	–
8	Check: Does the UE initiate mobile originated detach and abort the attach procedure while T3410 is running?	–>	DETACH REQUEST	1	P
9	The SS transmits DETACH ACCEPT message.	<–	DETACH ACCEPT	–	–
9A	The SS releases the RRC connection.	–	–	–	–
10	Check: Does the test result of the generic procedure defined in clause 6.4.2.5 of 36.508 [18] indicates that the UE responds to paging when paged with S-TMSI included in GUTI-1 and with CN domain indicator set to "PS"?	–	–	1	–
11	Void	–	–	–	–
NOTE 1: T3410 value is specified as 15s in TS 24.301. NOTE 2: Any type of attach is acceptable.

9.2.1.1.25.3.3 Specific message contents

Table 9.2.1.1.25.3.3-1: Message DETACH REQUEST (step 8, Table 9.2.1.1.25.3.2-1)

Derivation path: 36.508 table 4.7.2-11
Information Element	Value/Remark	Comment	Condition
Detach type
Type of detach	001 or 011	EPS detach or combined EPS/IMSI detach
Switch off	0	Normal detach

9.2.1.1.26 Attach / Abnormal case / Detach procedure collision

9.2.1.1.26.1 Test Purpose (TP)

(1)

with { UE in EMM-REGISTERED-INITIATED state }

ensure that {

when { UE receives a DETACH REQUEST message and detach type indicates “re-attach not required” }

then { the UE sends DETACH ACCEPT }

}

(2)

with { UE in EMM-REGISTERED-INITIATED state }

ensure that {

when { UE receives a DETACH REQUEST message and detach type indicates “re-attach required” }

then { the UE continues with ATTACH procedure or the UE sends DETACH ACCEPT and re-initiates the ATTACH procedure}

}

9.2.1.1.26.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301 [28], clause 5.5.1.2.6, 5.5.1.3.6 and 5.5.3.2.

[TS 24.301 [28], clause 5.5.1.2.6]

[Rel-14]

g) Detach procedure collision

If the UE receives a DETACH REQUEST message from the network in state EMM-REGISTERED-INITIATED and the detach type indicates "re-attach not required" and no EMM cause IE, or "re-attach not required" and the EMM cause value is not #2 "IMSI unknown in HSS", the detach procedure shall be progressed and the attach procedure shall be aborted. Otherwise the attach procedure shall be progressed and the DETACH REQUEST message shall be ignored.

[Rel-15]

The following abnormal cases can be identified:

…

g) Detach procedure collision

If the UE receives a DETACH REQUEST message from the network in state EMM-REGISTERED-INITIATED and the detach type indicates "re-attach not required", and no EMM cause IE, or "re-attach not required" and the EMM cause value is not #2 "IMSI unknown in HSS", the detach procedure shall be progressed and the attach procedure shall be aborted. If the UE receives a DETACH REQUEST message from the network in state EMM-REGISTERED-INITIATED and the detach type indicates "re-attach required", the detach procedure shall be progressed and the UE shall locally release the NAS signalling connection, before re-initiating the attach procedure. Otherwise the attach procedure shall be progressed and the DETACH REQUEST message shall be ignored.

[TS 24.301 [28], clause 5.5.1.3.6]

[Rel-14]

The UE shall proceed as follows:

…

3) otherwise, the abnormal cases specified in subclause 5.5.1.2.6 apply with the following modification.

If the attach attempt counter is incremented according to subclause 5.5.1.2.6 the next actions depend on the value of the attach attempt counter:

– if the attach attempt counter is less than 5, the UE shall set the update status to U2 NOT UPDATED but shall not delete any LAI, TMSI, ciphering key sequence number and list of equivalent PLMNs;

[TS 24.301 [28], clause 5.5.3.2][Rel-15]

When receiving the DETACH REQUEST message and the detach type indicates "re-attach required", the UE shall deactivate the EPS bearer context(s), if any, including the default EPS bearer context locally without peer-to-peer signalling between the UE and the MME. The UE shall stop the timer T3346, if it is running. The UE shall also stop timer(s) T3396, if it is running. The UE shall send a DETACH ACCEPT message to the network and enter the state EMM-DEREGISTERED. Furthermore, the UE shall, after the completion of the detach procedure, and the release of the existing NAS signalling connection, initiate an attach or combined attach procedure. The UE should also re-establish any previously established PDN connection(s).

9.2.1.1.26.3 Test description

9.2.1.1.26.3.1 Pre-test conditions

System Simulator:

– Cell A.

UE:

None.

Preamble:

– The UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.26.3.2 Test procedure sequence

Table 9.2.1.1.26.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message. (NOTE 2)	–>	ATTACH REQUEST	–	–
3	The SS initiates Detach procedure with the Detach Type IE "re-attach not required"	<–	DETACH REQUEST	–	–
4	Check: Does the UE send DETACH ACCEPT message?	–>	DETACH ACCEPT	1	P
5	The SS releases the RRC connection.	–	–	–	–
5A	The SS waits 5 seconds (NOTE 1)	–	–	–	–
6	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
6A	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
7	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message. (NOTE 2)	–>	ATTACH REQUEST	–	–
8-12a2	Void	–	–	–	–
12A-12G	Steps 5-11 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
13	The SS initiates Detach procedure with the Detach Type IE "re-attach required". Note: A pre Release 15 UE ignores the DETACH REQUEST.	<–	DETACH REQUEST	–	–
13A	Start a 5 second timer.
–	EXCEPTION: Steps 13Ba1 to 13Bb1 describe behaviour that depends on the UE implementation; the "lower case letter" identifies a step sequence that take place if UE have particular implementation.	–	–	–	–
13Ba1	Check: Does the UE send DETACH ACCEPT message.	–>	DETACH ACCEPT	2	P
13Ba2	Cancel the timer started in step 13A.
13Ba3	The UE locally releases the NAS signalling connection. The SS locally releases the RRC connection.
13Ba4	Check: Does the UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message. (NOTE 2)	–>	ATTACH REQUEST	2	P
13Ba4-13Ba10	Steps 5-11 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
13Bb1	The timer started in step 13A expires.
14	SS responds with ATTACH ACCEPT message including a valid TAI list. The ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message is piggybacked in ATTACH ACCEPT message. GUTI-1 is allocated.	<–	ATTACH ACCEPT	–	–
–	EXCEPTION: In parallel to the event described in steps 15 to 16 below the generic procedure for IP address allocation in the U-plane specified in TS 36.508 subclause 4.5A.1 takes place performing IP address allocation in the U-plane if requested by the UE.	–	–	–	–
–	EXCEPTION: IF PDN1_IMS (NOTE 3) THEN in parallel to the event described in steps 15 to 16 below the generic procedure for IMS signalling in the Uplane specified in TS 36.508 subclause 4.5A.3 takes place if requested by the UE	–	–	–	–
15	The UE transmits an ATTACH COMPLETE message including an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message?	–>	ATTACH COMPLETE	2	P
15Aa1-15Ac1	Steps 16a1-16c1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.
16	Void	–	–	–	–
16A1a1-16A3b1	Void	–	–	–	–
16B-16Cb1	Steps 17-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
17	Void	–	–	–	–
NOTE 1: The time delay is added to additionally guarantee UE has respected the content of the DETACH REQUEST message. NOTE 2: Any type of attach is acceptable. NOTE 3: PDN1_IMS as defined in TS 36.508 subclause 4.5.2.

Table 9.2.1.1.26.3.2-2: Void

9.2.1.1.26.3.3 Specific message contents

Table 9.2.1.1.26.3.3-1: Message DETACH REQUEST (step 3, Table 9.2.1.1.26.3.2-1)

Derivation path: 36.508 table 4.7.2-12
Information Element	Value/Remark	Comment	Condition
Detach type	‘010’B	"re-attach not required"
EMM cause	‘07’H	EPS services not allowed

Table 9.2.1.1.26.3.3-2: Message DETACH REQUEST (step 13, Table 9.2.1.1.26.3.2-1)

Derivation path: 36.508 table 4.7.2-12
Information Element	Value/Remark	Comment	Condition
Detach type	‘001’B	"re-attach required"
EMM cause	NOT PRESENT

9.2.1.1.27 Attach / Abnormal case / Network reject with Extended Wait Timer

9.2.1.1.27.1 Test Purpose (TP)

(1)

with { UE configured for low access priority, has sent an ATTACH REQUEST message with NAS low priority signalling indication }

ensure that {

when { UE receives “Extended Wait Time” in the RRCConnectionRelease message }

then { UE starts timer T3346 and abort the attach procedure }

}

(2)

with { UE having aborted attach procedure and with timer T3346 running }

ensure that {

when { Timer T3346 expires }

then { UE restarts attach procedure }

}

9.2.1.1.27.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clause 5.5.1.2.6

[TS 24.301, clause 5.5.1.2.6]

The following abnormal cases can be identified:

…

l) "Extended wait time" from the lower layers

If the ATTACH REQUEST message contained the NAS signalling low priority indicator set to "MS is configured for NAS signalling low priority", the UE shall start timer T3346 with the "Extended wait time" value.

In other cases the UE shall ignore the "Extended wait time".

The UE shall abort the attach procedure, reset the attach attempt counter, stay in the current serving cell, change the state to EMM-DEREGISTERED.ATTEMPTING-TO-ATTACH and apply the normal cell reselection process.

The UE shall proceed as described below.

m) Timer T3346 is running

The UE shall not start the attach procedure unless the UE is accessing the network with access class 11 – 15 or needs to attach for emergency bearer services. The UE stays in the current serving cell and applies the normal cell reselection process.

NOTE: It is considered an abnormal case if the UE needs to initiate an attach procedure while timer T3346 is running independent on whether timer T3346 was started due to an abnormal case or a non successful case.

The UE shall proceed as described below.

For the cases b, c, and d the UE shall proceed as follows:

– Timer T3410 shall be stopped if still running. The attach attempt counter shall be incremented, unless it was already set to 5.

If the attach attempt counter is less than 5:

– for the cases l and m, the attach procedure is started, if still necessary, when timer T3346 expires or is stopped;

– for all other cases, timer T3411 is started and the state is changed to EMM-DEREGISTERED.ATTEMPTING-TO-ATTACH. When timer T3411 expires the attach procedure shall be restarted, if still required by ESM sublayer.

9.2.1.1.27.3 Test description

9.2.1.1.27.3.1 Pre-test conditions

System Simulator:

– cell A.

UE:

– the UE is configured to initiate EPS attach

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

– the UE is configured for NAS signalling low priority

The UE is equipped with a USIM containing values shown in Table 9.2.1.1.27.3.1-1.

Table 9.2.1.1.27.3.1-1: USIM Configuration

USIM field	Value
EF_UST	Services 96 is supported.
EF_NASCONFIG	“NAS_SignallingPriority is set to NAS signalling low priority” as defined in TS 24.368, clause 5.3.
EF_NASCONFIG	“ExtendedAccessBarring is set to extended access barring is applied for the UE” as defined in TS 24.368, clause 5.8
Note: As per TS 23.401 [22] clause 4.3.17.4, UE’s configuration of low access priority and Extended Access Barring shall match each other.

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.27.3.2 Test procedure sequence

Table 9.2.1.1.27.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2	The UE transmits an ATTACH REQUEST message. (Device properties IE included)	–>	ATTACH REQUEST	–	–
3	The SS releases the RRC connection.	–	The SS includes the IE “Extended Wait Time” in the RRCConnectionRelease message. UE starts timer T3346 with the value 5 seconds	–	–
4	The SS waits 5 seconds (T3346).	–	–	–	–
5	Check: Does the UE transmit an ATTACH REQUEST message?	–>	ATTACH REQUEST	1,2	P
619b1	The attach procedure is completed by executing steps 5 to 18b1of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.1.27.3.3 Specific message contents

Table 9.2.1.1.27.3.3-1: Message ATTACH REQUEST (step 2 and 5 Table 9.2.1.1.27.2-1)

Derivation path: TS 36.508 table 4.7.2.-4
Information Element	Value/Remark	Comment	Condition
NAS key set identifier	Any allowed value other than ‘111’B	"Stored key is available"
Old GUTI or IMSI	GUTI-1	As stored in USIM
Last visited registered TAI	TAI-1	Stored TAI.
Device properties	1	“MS is configured for NAS signalling low priority”

Table 9.2.1.1.27.3.3-2: RRCConnectionRelease (step 3 Table 9.2.1.1.27.2-1)

Derivation Path: 36.508 Table 4.6.1-15
Information Element	Value/remark	Comment	Condition
RRCConnectionRelease ::= SEQUENCE {
criticalExtensions CHOICE {
c1 CHOICE {
rrcConnectionRelease-r8 SEQUENCE {
nonCriticalExtension SEQUENCE {		RRCConnectionRelease-v890-IEs
lateNonCriticalExtension	Not Present
nonCriticalExtension SEQUENCE {		RRCConnectionRelease-v920-IEs
cellInfoList-r9	Not Present
nonCriticalExtension SEQUENCE {		RRCConnectionRelease-v1020-IEs
extendedWaitTime-r10	5 seconds
nonCriticalExtension	Not Present
}
}
}
}
}
}
}

9.2.1.1.27a Attach Procedure / EAB broadcast handling / ExtendedAccessBarring configured in the UE

9.2.1.1.27a.1 Test Purpose (TP)

(1)

with { UE being configured for ExtendedAccessBarring (EAB) and not configured for Override_ExtendedAccessBarring and accessing the network with an access class different to classes 11 – 15 }

ensure that {

when { the UE finds a suitable cell to attach for services, and, the cell is broadcasting EAB information effectively barring the cell for the UE }

then { the UE will not initiate Attach procedure on the cell }

}

9.2.1.1.27a.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clause 5.3.10 and D.1, TS 24.368 clauses 4 and 5.8, and, TS 36.331, clauses 5.2.2.4, 5.3.3.2 and 5.3.3.12. Unless otherwise stated these are Rel-11 requirements.

[TS 24.301, clause 5.3.10]

The network can restrict the access for certain groups of UEs by means of barring their access class.

The UE shall evaluate the access control information for Access Class Barring, Access Control for CSFB and Extended Access Barring (EAB) as specified in 3GPP TS 36.331 [22].

[TS 24.301, clause D.1]

When EMM requests the establishment of a NAS-signalling connection, the RRC establishment cause used by the UE shall be selected according to the NAS procedure as specified in table D.1.1. The EMM shall also indicate to the lower layer for the purpose of access control, the call type associated with the RRC establishment cause as specified in table D.1.1. If the UE is configured for EAB (see the "ExtendedAccessBarring" leaf of NAS configuration MO in 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17]), the EMM shall indicate to the lower layer for the purpose of access control that EAB applies for this request except for the following cases:

– the UE is accessing the network with one of the access classes 11 – 15;

– the UE is answering to paging;

– the RRC Establishment cause is set to "Emergency call"; or

– the UE is configured to allow overriding EAB (see the "Override_ExtendedAccessBarring" leaf of the NAS configuration MO as specified in 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17]) and receives an indication from the upper layers to override EAB.

[TS 24.368, clause 4]

The NAS configuration MO is used to manage configuration parameters related to NAS functionality for a UE supporting provisioning of such information. The presence and format of the non-access stratum configuration file on the USIM is specified in 3GPP TS 31.102 [6].

The MO identifier is: urn:oma:mo:ext-3gpp-nas-config:1.0.

The OMA DM Access Control List (ACL) property mechanism (see OMA-ERELD-DM-V1_2 [2]) may be used to grant or deny access rights to OMA DM servers in order to modify nodes and leaf objects of the NAS configuration MO.

The following nodes and leaf objects are possible in the NAS configuration MO as described in figure 4-1:

Figure 4-1: The NAS configuration Management Object

[TS 24.368, clause 5.8]

The ExtendedAccessBarring leaf indicates whether the extended access barring is applicable for the UE as specified in 3GPP TS 24.008 [4] and 3GPP TS 24.301 [5].

– Occurrence: ZeroOrOne

– Format: bool

– Access Types: Get, Replace

– Values: 0, 1

0 Indicates that the extended access barring is not applied for the UE.

1 Indicates that the extended access barring is applied for the UE.

The default value 0 applies if this leaf is not provisioned.

[TS 36.331, clause 5.2.2.4]

The UE shall:

…

1> not initiate the RRC connection establishment subject to EAB until the UE has a valid version of SystemInformationBlockType14, if broadcast;

…

1> if the UE is EAB capable:

2> when the UE does not have stored a valid version of SystemInformationBlockType14 upon entering RRC_IDLE, or when the UE acquires SystemInformationBlockType1 following EAB parameters change notification or upon entering a cell during RRC_IDLE:

3> if schedulingInfoList indicates that SystemInformationBlockType14 is present:

4> start acquiring SystemInformationBlockType14 immediately;

3> else:

4> discard SystemInformationBlockType14, if previously received;

NOTE 4: EAB capable UEs start acquiring SystemInformationBlockType14 as described above even when systemInfoValueTag in SystemInformationBlockType1 has not changed.

NOTE 5: EAB capable UEs maintain an up to date SystemInformationBlockType14 in RRC_IDLE.

[TS 36.331, clause 5.3.3.2]

The UE initiates the procedure when upper layers request establishment of an RRC connection while the UE is in RRC_IDLE.

Upon initiation of the procedure, the UE shall:

1> if upper layers indicate that the RRC connection is subject to EAB (see TS 24.301 [35]):

2> if the result of the EAB check, as specified in 5.3.3.12, is that access to the cell is barred:

3> inform upper layers about the failure to establish the RRC connection and that EAB is applicable, upon which the procedure ends;

[TS 36.331, clause 5.3.3.12]

The UE shall:

1> if SystemInformationBlockType14 is present and includes the eab-Param:

2> if the eab-Common is included in the eab-Param:

3> if the UE belongs to the category of UEs as indicated in the eab-Category contained in eab-Common; and

3> if for the Access Class of the UE, as stored on the USIM and with a value in the range 0..9, the corresponding bit in the eab-BarringBitmap contained in eab-Common is set to one:

4> consider access to the cell as barred;

3> else:

4> consider access to the cell as not barred due to EAB;

9.2.1.1.27a.3 Test description

9.2.1.1.27a.3.1 Pre-test conditions

System Simulator:

– Cell A.

UE:

– The UE is configured to respect "ExtendedAccessBarring" as per TS 24.368 [49]. This is achieved by equipping the UE with a USIM containing values shown in Table 9.2.1.1.27a.3.1-1.

Table 9.2.1.1.27a.3.1-1: USIM Configuration

USIM field	Value
EF_UST	Services 96 ‘Non-Access Stratum configuration by USIM’ is supported.
EF_NASCONFIG	– Extended access barring activated: UE shall apply extended access barring – Override Extended access barring not activated
EF_NASCONFIG	– “NAS_SignallingPriority is set to NAS signalling low priority” as defined in TS 24.368, clause 5.3. – Override_NAS_SignallingLowPriority not activated

– The UE is configured to initiate EPS attach.

Preamble:

– The UE is first registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18]. During the registration, the SS is not transmitting SystemInformationBlockType14.

– The UE is Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.27a.3.2 Test procedure sequence

Table 9.2.1.1.27a.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS starts transmitting SystemInformationBlockType14 Extended access barring activated on Cell A. System information combination 21 as defined in TS 36.508[18] clause 4.4.3.1.2 is used.	–	–	–	–
2	The UE is switched on.	–	–	–	–
3	Check: Does the UE send an ATTACH REQUEST message in the next 60 sec?	–	ATTACH REQUEST	1	F
4	The SS stops transmitting SystemInformationBlockType14 on Cell A.	–	–	–	–
5	Check: Does the result of generic procedure UE Registration (State 2) as described in TS 36.508 [18] clause 4.5.2.3 indicate that UE is registered on Cell A?	–	–	1	P
–	At the end of the present test procedure sequence, the UE is in end state E-UTRA RRC_IDLE (State 2) according to TS 36.508 [18].	–	–	–	–

9.2.1.1.27a.3.3 Specific message contents

Table 9.2.1.1.27a.3.3-1: Message ATTACH REQUEST (preamble and all steps)

Derivation path: TS 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Device properties	1	“MS is configured for NAS signalling low priority”

9.2.1.1.27b Attach / EAB / CE-level based access barring

9.2.1.1.27b.1 Test Purpose (TP)

(1)

with { UE configured for CE-level based ExtendedAccessBarring(EAB) }

ensure that {

when { the UE finds a suitable cell to attach for services, and the RSRP level is below the CE level access barring RSRP threshold }

then { the UE does not initiate Attach procedure on the cell }

}

(2)

with { UE configured for CE-level based ExtendedAccessBarring(EAB) }

ensure that {

when { the UE finds a suitable cell to attach for services, and the RSRP level is above the CE level access barring RSRP threshold }

then { the UE initiates Attach procedure on the cell }

}

9.2.1.1.27b.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301 clause 5.3.10, and TS 36.331, clause 5.3.3.12, 5.2.1.6, 5.3.2.3 and 5.3.3.2.

[TS 24.301, clause 5.3.10]

The network can restrict the access for certain groups of UEs by means of barring their access class.

The UE shall evaluate the access control information as specified in 3GPP TS 36.331 [22] for:

– Access Class Barring;

– Access Control for CSFB and Extended Access Barring (EAB);

– Access Control for Application specific Congestion control for Data Communication (ACDC), if the UE supports ACDC; and

– Access Barring.

[TS 36.331, clause 5.3.3.12]

The UE shall:

1> if SystemInformationBlockType14 is present:

2> if eab-PerRSRP is included:

3> if the establishmentCause received from higher layers is set to a value other than emergency; and

3> if the UE has no Access Class, as stored on the USIM, with a value in the range 11..15, which is valid for the UE to use according to TS 22.011 [10] and TS 23.122 [11] :

4> if eab-PerRSRP is set to thresh0:

5> consider access to the cell as barred when in enhanced coverage as specified in TS 36.304 [4];

4> else if eab-PerRSRP is set to thresh1:

5> if the measured RSRP is less than the first entry in rsrp-ThresholdsPrachInfoList:

6> consider access to the cell as barred;

5> else:

6> consider that only the resources indicated for the first CE level are configured;

4> else if eab-PerRSRP is set to thresh2:

5> if the measured RSRP is less than the second entry in rsrp-ThresholdsPrachInfoList:

6> consider access to the cell as barred;

5> else:

6> consider that only the resources indicated for the first and second CE levels are configured;

4> else if eab-PerRSRP is set to thresh3:

5> if the measured RSRP is less than the third entry rsrp-ThresholdsPrachInfoList:

6> consider access to the cell as barred;

5> else:

6> consider that only the resources indicated for the first, second, and third CE levels are configured;

[TS 36.331, clause 5.2.1.6]

Change of EAB parameters can occur at any point in time. The EAB parameters are contained in SystemInformationBlockType14. The Paging message is used to inform EAB capable UEs in RRC_IDLE about a change of EAB parameters or that SystemInformationBlockType14 is no longer scheduled. If the UE receives a Paging message including the eab-ParamModification, it shall acquire SystemInformationBlockType14 according to schedulingInfoList contained in SystemInformationBlockType1. If the UE receives a Paging message including the eab-ParamModification while it is acquiring SystemInformationBlockType14, the UE shall continue acquiring SystemInformationBlockType14 based on the previously acquired schedulingInfoList until it re-acquires schedulingInfoList in SystemInformationBlockType1.

[TS 36.331, clause 5.3.2.3]

Upon receiving the Paging message, the UE shall:

…

1> if in RRC_IDLE, the eab-ParamModification is included and the UE is EAB capable:

2> consider previously stored SystemInformationBlockType14 as invalid;

2> re-acquire SystemInformationBlockType1 immediately, i.e., without waiting until the next system information modification period boundary as specified in 5.2.1.6;

2> re-acquire SystemInformationBlockType14 using the system information acquisition procedure as specified in 5.2.2.4;

[TS 36.331, clause 5.3.3.2]

The UE initiates the procedure when upper layers request establishment or resume of an RRC connection while the UE is in RRC_IDLE or when upper layers request resume of an RRC connection or RRC layer requests resume of an RRC connection for, e.g. RNAU or reception of RAN paging while the UE is in RRC_INACTIVE.

Except for NB-IoT, upon initiation of the procedure, if the UE is connected to EPC, the UE shall:

1> if upper layers indicate that the RRC connection is subject to EAB (see TS 24.301 [35]):

2> if the result of the EAB check, as specified in 5.3.3.12, is that access to the cell is barred:

3> inform upper layers about the failure to establish the RRC connection or failure to resume the RRC connection with suspend indication and that EAB is applicable, upon which the procedure ends;

9.2.1.1.27b.3 Test description

9.2.1.1.27b.3.1 Pre-test conditions

System Simulator:

– Cell A supports CE.

UE:

– The UE is configured to respect "ExtendedAccessBarring" as per TS 24.368 [49]. This is achieved by equipping the UE with a USIM containing values shown in Table 9.2.1.1.27a.3.1-1.

Table 9.2.1.1.27b.3.1-1: USIM Configuration

USIM field	Value
EF_UST	Services 96 ‘Non-Access Stratum configuration by USIM’ is supported.
EF_NASCONFIG	– Extended access barring activated: UE shall apply extended access barring – Override Extended access barring not activated
EF_NASCONFIG	– “NAS_SignallingPriority is set to NAS signalling low priority” as defined in TS 24.368, clause 5.3. – Override_NAS_SignallingLowPriority not activated

– The UE is configured to initiate EPS attach.

Preamble:

– The UE is Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.27b.3.2 Test procedure sequence

Table 9.2.1.1.27b.3.2-1 illustrates the downlink power levels and other changing parameters to be applied for the cell at various time instants of the test execution. The exact instants on which these values shall be applied are described in the texts in this clause.

Table 9.2.1.1.27b.3.2-1: Time instances of cell power level and parameter changes

	Parameter	Unit	Cell A	Remark
T1	Cell-specific RS EPRE	dBm/15kHz	-102	The power level value is such that the measured RSRP is higher than the third entry in rsrp-ThresholdsPrachInfoList but lower than the first and second entries in rsrp-ThresholdsPrachInfoList

Table 9.2.1.1.27b.3.2-2: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS starts transmitting SystemInformationBlockType14. System information combination 21 as defined in TS 36.508[18] clause 4.4.3.1.2 is used.	–	–	–	–
2	The UE is switched on.	–	–	–	–
3	Check: Does the UE send an ATTACH REQUEST message in the next 90 sec?	–>	ATTACH REQUEST	1	F
4	The SS changes Cell A parameters according to the row "T1" in table 9.2.1.1.27b.3.2-1	–	–	–	–
5	SS sends Paging with eab-ParamModification.	<–	Paging	–	–
6	SS starts transmitting modified SIB14 with eab-PerRSRP set to thresh1	–	–	–	–
7	Check: Does the UE send an ATTACH REQUEST message in the next 90 sec?	–>	ATTACH REQUEST	1	F
8	SS sends Paging with eab-ParamModification.	<–	Paging	–	–
9	SS starts transmitting modified SIB14 with eab-PerRSRP set to thresh2	–	–	–	–
10	Check: Does the UE send an ATTACH REQUEST message in the next 90 sec?	–>	ATTACH REQUEST	1	F
11	SS sends Paging with eab-ParamModification.	<–	Paging	–	–
12	SS starts transmitting modified SIB14 with eab-PerRSRP set to thresh3	–	–	–	–
13	Check: Does the result of generic procedure UE Registration (State 2) as described in TS 36.508 [18] clause 4.5.2.3 indicate that UE is registered on Cell A?	–	–	2	P
–	At the end of the present test procedure sequence, the UE is in end state E-UTRA RRC_IDLE (State 2) according to TS 36.508 [18].	–	–	–	–

9.2.1.1.27b.3.3 Specific message contents

Table 9.2.1.1.27b.3.3-1: SystemInformationBlockType2 (all steps, Table 9.2.1.1.27b.3.2-2)

Derivation Path: 36.508-1 Table 4.4.3.3-1
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType2 ::= SEQUENCE {
radioResourceConfigCommon	RadioResourceConfigCommonSIB-RSRPList
}

Table 9.2.1.1.27b.3.3-2: RadioResourceConfigCommonSIB-RSRPList (Table 9.2.1.1.27b.3.3-1)

Derivation Path: 36.508-1 Table 4.6.3-14
Information Element	Value/remark	Comment	Condition
RadioResourceConfigCommonSIB::= SEQUENCE {
prach-ConfigCommon-v1310	PRACH-ConfigSIB-v1310-DEFAULT with condition CEmodeB PRACH_4CE	RSRP-Range[1] = 49 (-92 dBm) RSRP-Range[2] = 42 (-99 dBm) RSRP-Range[3] = 34 (-107dBm)
}

Table 9.2.1.1.27b.3.3-3: SystemInformationBlockType14 (step 1 in 9.2.1.1.27b.3.2-2 )

Derivation path: 36.508 Table 4.4.3.3-13A
Information Element	Value/Remark	Comment	Condition
SystemInformationBlockType14-r11 ::= SEQUENCE {
eab-Param-r11	Not Present
eab-PerRSRP-r15	thresh0
}

Table 9.2.1.1.27b.3.3-4: Paging (steps 5, 8 and 11 in table 9.2.1.1.27b.3.2-2)

Derivation Path: 36.508-1 Table 4.6.1-7
Information Element	Value/remark	Comment	Condition
Paging ::= SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
eab-ParamModification-r11	true
}
}
}
}

Table 9.2.1.1.27b.3.3-5: SystemInformationBlockType14 (step 6 in table 9.2.1.1.27b.3.2-2)

Derivation path: 36.508 Table 4.4.3.3-13A
Information Element	Value/Remark	Comment	Condition
SystemInformationBlockType14-r11 ::= SEQUENCE {
eab-Param-r11	Not Present
eab-PerRSRP-r15	thresh1
}

Table 9.2.1.1.27b.3.3-6: SystemInformationBlockType14 (step 9 in table 9.2.1.1.27b.3.2-2)

Derivation path: 36.508 Table 4.4.3.3-13A
Information Element	Value/Remark	Comment	Condition
SystemInformationBlockType14-r11 ::= SEQUENCE {
eab-Param-r11	Not Present
eab-PerRSRP-r15	thresh2
}

Table 9.2.1.1.27b.3.3-7: SystemInformationBlockType14 (step 12 in table 9.2.1.1.27b.3.2-2)

Derivation path: 36.508 Table 4.4.3.3-13A
Information Element	Value/Remark	Comment	Condition
SystemInformationBlockType14-r11 ::= SEQUENCE {
eab-Param-r11	Not Present
eab-PerRSRP-r15	thresh3
}

9.2.1.1.28 Attach / Success / IMS

9.2.1.1.28.1 Test Purpose (TP)

(1)

with { the UE is switched-off and supports method II for P-CSCF discovery }

ensure that {

when { UE is powered on }

then { the UE transmits either an ATTACH REQUEST message and a PDN CONNECTIVITY REQUEST message or an ESM Information Transfer response with method II for P-CSCF discovery }

}

(2)

with { the UE supports conversational speech }

ensure that {

when { UE is available for calls }

then { the UE performs an initial IMS registration }

}

(3)

with { the UE is switched-off and IPv6 and IPv4 capable }

ensure that {

when { UE is powered on }

then { the UE transmits either an ATTACH REQUEST message and a PDN CONNECTIVITY REQUEST message or an ESM Information Transfer response with IPv4v6 for the PDN type }

9.2.1.1.28.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.229, clauses L.2.2.1, L.3.1.2 and TS 23.401 clause 5.3.1.1. Unless otherwise stated these are Rel-8 requirements.

[TS 24.229, clause L.2.2.1 “EPS bearer context activation and P-CSCF discovery”]

Prior to communication with the IM CN subsystem, the UE shall:

…

c) acquire a P-CSCF address(es).

The methods for P-CSCF discovery are:

I. When using IPv4, employ the Dynamic Host Configuration Protocol (DHCP) RFC 2132 [20F], the DHCPv4 options for SIP servers RFC 3361 [35A], and RFC 3263 [27A] as described in subclause 9.2.1. When using IPv6, employ Dynamic Host Configuration Protocol for IPv6 (DHCPv6) RFC 3315 [40], the DHCPv6 options for SIP servers RFC 3319 [41] and DHCPv6 options for Domain Name Servers (DNS) RFC 3646 [56C] as described in subclause 9.2.1.

II. Transfer P-CSCF address(es) within the EPS bearer context activation procedure.

The UE shall indicate the request for a P-CSCF address to the network within the Protocol Configuration Options information element of the PDN CONNECTIVITY REQUEST message or BEARER RESOURCE ALLOCATION REQUEST message.

If the network provides the UE with a list of P-CSCF IPv4 or IPv6 addresses in the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message or ACTIVATE DEDICATED EPS BEARER CONTEXT REQUEST message, the UE shall assume that the list is prioritised with the first address within the Protocol Configuration Options information element as the P-CSCF address with the highest priority.

III. The UE selects a P-CSCF from the list (see 3GPP TS 31.103 [15B]) stored in the ISIM.

IV. The UE selects a P-CSCF from the list in IMS management object.

[TS 24.229, clause L.3.1.2 “Availability for calls”]

A UE shall perform an initial registration as specified in subclause 5.1.1.2, if all the following conditions are met:

1) if the UE is operating in one of the following modes of operation (see 3GPP TS 24.301 [8J]):

a) PS mode 1;

b) CS/PS mode 1 and the UE is attached for EPS-Services only;

2) if the UE is capable of receiving any (but not necessarily all) of the media types which the CS domain supports, such that the media type can also be used when accessing the IM CN subsystem using the current IP-CAN;

3) if the media type of item 2 is an "audio" media type, and the UE supports codecs suitable for (conversational) speech;

4) if the UE determines that its contact has not been bound to a public user identity using the IP-CAN, such that the contact is expected to be used for the delivery of incoming requests in the IM CN subsystem relating to the media of item 2 and item 3;

5) if the IMSVoPS indicator, provided by the lower layers (see 3GPP TS 24.301 [8J]), indicates voice is supported; and

6) if the procedures to perform the initial registration are enabled (see 3GPP TS 24.305 [8T]).

NOTE: Regardless of any of the above conditions, a UE might attempt to register with the IM CN subsystem at any time.

[TS 23.401, clause 5.3.1.1]

…

The UE sets the PDN type during the Attach procedure based on its IP stack configuration as follows:

– A UE which is IPv6 and IPv4 capable shall request for PDN type IPv4v6.

– A UE which is only IPv4 capable shall request for PDN type IPv4.

– A UE which is only IPv6 capable shall request for PDN type IPv6.

– When the IP version capability of the UE is unknown in the UE (as in the case when the MT and TE are separated and the capability of the TE is not known in the MT), the UE shall request for PDN type IPv4v6.

9.2.1.1.28.3 Test description

9.2.1.1.28.3.1 Pre-test conditions

System Simulator:

– cell A.

UE:

– The UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.28.3.2 Test procedure sequence

Table 9.2.1.1.28.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2-4	Steps 1 to 3 of the generic test procedure for UE registration (TS 36.508 4.5.2.3-1).	–	–	–	–
5	Check: Does the UE transmit an RRCConnectionSetupComplete message to confirm the successful completion of the connection establishment and to initiate the Attach procedure by including the ATTACH REQUEST message. The PDN CONNECTIVITY REQUEST message is piggybacked in ATTACH REQUEST	–>	RRC: RRCConnectionSetupComplete NAS: ATTACH REQUEST NAS: PDN CONNECTIVITY REQUEST	1, 3	P
6-16	Check: Does the UE transmit steps 5 to 15 of the generic test procedure for UE registration (TS 36.508 4.5.2.3-1).	–	–	1	P
–	EXCEPTION: In parallel to the event described in step 17 below the generic procedure for IMS signalling in the U-plane specified in table 9.2.1.1.28.3.2-2 takes place.	–	–	–	–
17-19b1	Steps 16-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–

Table 9.2.1.1.28.3.2-2: Procedure for IMS signalling in the U-plane

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1-9	Check: Does the UE transmit the registration procedure according TS 34.229-1 [43] subclause C.2 (steps 3-11)	–	–	2	P

9.2.1.1.28.3.3 Specific message contents

Table 9.2.1.1.28.3.3-1: Message PDN CONNECTIVITY REQUEST (step 5, table 9.2.1.1.28.3.2-1)

Derivation Path: TS 36.508 Table 4.7.3-20
Information Element	Value/remark	Comment	Condition
PDN type	‘011’B (IPv4v6)
Protocol configuration options
Container ID n	‘0001’H (P-CSCF IPv6)	At least one value shall be present.
Container ID n	‘000C’H (P-CSCF IPv4)	At least one value shall be present.

Table 9.2.1.1.28.3.3-2: Message ESM INFORMATION TRANSFER RESPONSE (step 9a2 of the generic test procedure referenced in steps 6 -16, table 9.2.1.1.28.3.2-1)

Derivation Path: TS 36.508 Table 4.7.3-20
Information Element	Value/remark	Comment	Condition
Protocol configuration options
Container ID n	‘0001’H (P-CSCF IPv6)	At least one value shall be present.
Container ID n	‘000C’H (P-CSCF IPv4)	At least one value shall be present.

NOTE: The containers can be transferred in PDN CONNECTIVITY REQUEST and/or in ESM INFORMATION TRANSFER RESPONSE message.

9.2.1.1.28a Attach / Success / IMS / Second PDN

9.2.1.1.28a.1 Test Purpose (TP)

(1)

with { the UE is switched-off and supports method II for P-CSCF discovery }

ensure that {

when { UE is powered on }

then { the UE transmits a PDN CONNECTIVITY REQUEST message with method II for P-CSCF discovery }

}

(2)

with { the UE supports conversational speech }

ensure that {

when { UE is available for calls }

then { the UE performs an initial IMS registration }

}

(3)

with { the UE is switched-off and IPv6 and IPv4 capable }

ensure that {

when { UE is powered on }

then { the UE transmits a PDN CONNECTIVITY REQUEST message with IPv4v6 for the PDN type }

9.2.1.1.28a.2 Conformance requirements

[TS 24.229, clause L.2.2.1 “EPS bearer context activation and P-CSCF discovery”]

Prior to communication with the IM CN subsystem, the UE shall:

…

c) acquire a P-CSCF address(es).

The methods for P-CSCF discovery are:

II. Transfer P-CSCF address(es) within the EPS bearer context activation procedure.

III. The UE selects a P-CSCF from the list (see 3GPP TS 31.103 [15B]) stored in the ISIM.

IV. The UE selects a P-CSCF from the list in IMS management object.

[TS 24.229, clause L.3.1.2 “Availability for calls”]

A UE shall perform an initial registration as specified in subclause 5.1.1.2, if all the following conditions are met:

1) if the UE is operating in one of the following modes of operation (see 3GPP TS 24.301 [8J]):

a) PS mode 1;

b) CS/PS mode 1 and the UE is attached for EPS-Services only;

3) if the media type of item 2 is an "audio" media type, and the UE supports codecs suitable for (conversational) speech;

5) if the IMSVoPS indicator, provided by the lower layers (see 3GPP TS 24.301 [8J]), indicates voice is supported; and

6) if the procedures to perform the initial registration are enabled (see 3GPP TS 24.305 [8T]).

NOTE: Regardless of any of the above conditions, a UE might attempt to register with the IM CN subsystem at any time.

[TS 23.401, clause 5.3.1.1]

…

The UE sets the PDN type during the Attach procedure based on its IP stack configuration as follows:

– A UE which is IPv6 and IPv4 capable shall request for PDN type IPv4v6.

– A UE which is only IPv4 capable shall request for PDN type IPv4.

– A UE which is only IPv6 capable shall request for PDN type IPv6.

9.2.1.1.28a.3 Test description

9.2.1.1.28a.3.1 Pre-test conditions

System Simulator:

– cell A.

UE:

– The UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.28a.3.2 Test procedure sequence

Table 9.2.1.1.28a.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2-17	Steps 1 to 16 of the generic test procedure for UE registration (TS 36.508 subclause 4.5.2.3-1).	–	–	–	–
18	Check: Does the UE transmit step 1 of the generic test procedure to establish additional PDN connectivity (TS 36.508 subclause 4.5A.16.3-1)?	–>	RRC: ULInformationTransfer NAS: PDN CONNECTIVITY REQUEST	1, 3	P
19	Step 2 of the generic test procedure to establish additional PDN connectivity (TS 36.508 subclause 4.5A.16.3-1).	–	–	–	–
20	The UE transmits an RRCConnectionReconfigurationComplete message to confirm the establishment of additional default bearer	–>	RRC: RRCConnectionReconfigurationComplete	–	–
–	EXCEPTION: In parallel to the event described in step 21 below, if initiated by the UE the generic procedure for IP address allocation in the U-plane specified in TS 36.508 subclause 4.5A.1 takes place performing IP address allocation in the U-plane.	–	–	–	–
–	EXCEPTION: In parallel to the event described in step 21 below the generic procedure for IMS signalling in the U-plane specified in table 9.2.1.1.28a.3.2-2 takes place.	–	–	–	–
21	The UE transmits an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message.	–>	RRC: ULInformationTransfer NAS:ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT	–	–
22-23	Void	–	–	–	–
24-27	Steps 10 to 13 of the generic test procedure for network initiated release of additional PDN connectivity (TS 36.508 subclause 4.5A.18.3) are executed. The internet PDN is released.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508 Table 6.4.3A.2-1.	–	–	–	–

Table 9.2.1.1.28a.3.2-2: Procedure for IMS signalling in the U-plane

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1-9	Check: Does the UE transmit the registration procedure according TS 34.229-1 [43] subclause C.2 (steps 3-11)?	–	–	2	P

9.2.1.1.28a.3.3 Specific message contents

Table 9.2.1.1.28a.3.3-1: Message PDN CONNECTIVITY REQUEST (step 18, table 9.2.1.1.28a.3.2-1)

Derivation Path: TS 36.508 Table 4.7.3-20
Information Element	Value/remark	Comment	Condition
PDN type	‘011’B (IPv4v6)
Protocol configuration options
Container ID n	‘0001’H (P-CSCF IPv6)	At least one value shall be present.
Container ID n	‘000C’H (P-CSCF IPv4)	At least one value shall be present.

9.2.1.1.28b Attach / Success / IMS / New P-CSCF Discovery using PCO

9.2.1.1.28b.1 Test Purpose (TP)

(1)

with { the UE is switched-off and supports method II for P-CSCF discovery }

ensure that {

when { UE is powered on }

then { the UE transmits either an ATTACH REQUEST message and a PDN CONNECTIVITY REQUEST message or an ESM Information Transfer response with method II for P-CSCF discovery }

}

(2)

with { the UE sends SIP REGISTER to perform a SIP registration }

ensure that {

when { IM CN responds with 305 Use Proxy }

then { the UE re-establishes an IMS PDN to get a new P-CSCF address using method II and performs a SIP registration using the new P-CSCF}

}

9.2.1.1.28b.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.229, clauses 5.1.1.2.1, 9.2.1, L.2.2.1.

[TS 24.229, clause 5.1.1.2.1]:

On receiving a 305 (Use Proxy) response to the unprotected REGISTER request, unless otherwise specified in access specific annexes (as described in annex B, annex L or annex U), the UE shall:

a) ignore the contents of the Contact header field if it is included in the received message;

NOTE 17: The 305 response is not expected to contain a Contact header field.

b) release all IP-CAN bearers used for the transport of media according to the procedures in subclause 9.2.2;

c) initiate either a new P-CSCF discovery procedure as described in subclause 9.2.1, or select a new P-CSCF, if the UE was pre-configured with more than one P-CSCF’s IP addresses or domain names;

d) select a P-CSCF address, which is different from the previously used address, from the address list; and

e) perform the procedures for initial registration as described in subclause 5.1.1.2.

[TS 24.229, clause 9.2.1]:

Prior to communication with the IM CN subsystem, the UE shall:

a) establish a connection with the IP-CAN;

b) obtain an IP address using either the standard IETF protocols (e.g., DHCP or IPCP) or a protocol that is particular to the IP-CAN technology that the UE is utilising. The UE shall fix the obtained IP address throughout the period the UE is connected to the IM CN subsystem, i.e. from the initial registration and at least until the last deregistration; and

c) acquire a P-CSCF address(es).

The UE may acquire an IP address via means other than the DHCP. In this case, upon acquiring an IP address, the UE shall request the configuration information (that includes the DNS and P-CSCF addresses) from the DHCP server.

The methods for acquiring a P-CSCF address(es) are:

I. Employ Dynamic Host Configuration Protocol for IPv4 RFC 2131 [40A] or for IPv6 (DHCPv6) RFC 3315 [40]. Employ the DHCP options for SIP servers RFC 3319 [41] or, for IPv6, RFC 3361 [35A]. Employ the DHCP options for Domain Name Servers (DNS) RFC 3646 [56C].

The UE shall either:

– in the DHCP query, request a list of SIP server domain names of P-CSCF(s) and the list of Domain Name Servers (DNS); or

– request a list of SIP server IP addresses of P-CSCF(s).

II. Obtain the P-CSCF address(es) by employing a procedure that the IP-CAN technology supports. (e.g. GPRS).

III. The UE may use pre-configured P-CSCF address(es) (IP address or domain name). For example:

a. The UE selects a P-CSCF from the list stored in ISIM or IMC;

b. The UE selects a P-CSCF from the list in IMS management object.

NOTE 1: Access-specific annexes provide additional guidance on the method to be used by the UE to acquire P-CSCF address(es).

When acquiring a P-CSCF address(es), the UE can freely select either method I or II or III.

NOTE 2: In case a P-CSCF address is provisioned or received as a FQDN, procedures according to RFC 3263 [27A] will provide the resolution of the FQDN.

The UE may also request a DNS Server IP address(es) as specified in RFC 3315 [40] and RFC 3646 [56C] or RFC 2131 [40A].

[TS 24.229, clause L.2.2.1]:

Prior to communication with the IM CN subsystem, the UE shall:

…

c) acquire a P-CSCF address(es).

The methods for P-CSCF discovery are:

…

II. Transfer P-CSCF address(es) within the EPS bearer context activation procedure.

If the network provides the UE with a list of P-CSCF IPv4 or IPv6 addresses in the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message or ACTIVATE DEDICATED EPS BEARER CONTEXT REQUEST message, the UE shall assume that the list is ordered top-down with the first P-CSCF address within the Protocol Configuration Options information element as the P-CSCF address having the highest preference and the last P-CSCF address within the Protocol Configuration Options information element as the P-CSCF address having the lowest preference.

…

If the UE is configured to use Option II above and detects that all P-CSCFs known by the UE have been used when the UE selects a different P-CSCF as a result of:

– receiving 305 (Use Proxy) to the REGISTER request;

– receiving 504 (Server Time-out); or

– expiration of the timer F at the UE,

then if there are more than one PDN connection that UE is connected to and unless the IP-CAN bearer is in use by other applications, the UE shall:

1) release IP-CAN bearer that is used only for the transport of SIP signalling and that are not used for other non-IMS applications, but shall not release emergency IP-CAN bearers; and

2) unless the UE decides the service is no longer needed,

a) perform a new P-CSCF discovery procedure as described in subclause 9.2.1; and

b) perform the procedures for initial registration as described in subclause 5.1.1.2.

9.2.1.1.28b.3 Test description

9.2.1.1.28b.3.1 Pre-test conditions

System Simulator:

– cell A.

UE:

– None

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.28b.3.2 Test procedure sequence

Table 9.2.1.1.28b.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2-4	Steps 1 to 3 of the generic test procedure for UE registration (TS 36.508 4.5.2.3-1).	–	–	–	–
5	Check: Does the UE transmit an RRCConnectionSetupComplete message to confirm the successful completion of the connection establishment and to initiate the Attach procedure by including the ATTACH REQUEST message?	–>	RRC: RRCConnectionSetupComplete NAS: ATTACH REQUEST NAS: PDN CONNECTIVITY REQUEST	1	P
6-16	Check: Does the UE transmit steps 5 to 15 of the generic test procedure for UE registration (TS 36.508 4.5.2.3-1)?	–	–	1	P
–	EXCEPTION: In parallel to the event described in step 17 below, if initiated by the UE the generic procedure for IP address allocation in the U-plane specified in TS 36.508 subclause 4.5A.1 takes place performing IP address allocation in the U-plane.	–	–
–	EXCEPTION: In parallel to the event described in step 17 below the procedure for IMS signalling specified in Table 9.2.1.1.28b.3.2-2 takes place	–	–
17	This message includes the ATTACH COMPLETE message. The ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message is piggybacked in ATTACH COMPLETE.	–>	RRC: ULInformationTransfer NAS: ATTACH COMPLETE NAS: ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT
17Aa1-17Ac1	Steps 16a1-16c1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3-1 are performed.	–	–
18	Check: After the parallel behaviour in Table 9.2.1.1.28b.3.2-2, does the UE transmit a PDN DISCONNECT REQUEST?	–>	RRC: ULInformationTransfer PDN DISCONNECT REQUEST	2	P
19-20	Steps 1 to 2 of the generic test procedure for EPS Bearer Deactivation (TS 36.508 4.5A.15A.3-1).	–	–	–	–
21	Check: Does the UE transmit a PDN CONNECTIVITY REQUEST message to request an IMS PDN?	–>	RRC: ULInformationTransfer NAS: PDN CONNECTIVITY REQUEST	2	P
22	The SS transmits an RRCConnectionReconfiguration message to establish the default bearer with condition SRB2-DRB(1, 0) according to TS 36.508 subclause 4.8.2.2.1.1. This message includes The ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message.	<–	RRC: RRCConnectionReconfiguration NAS: ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST
23	The UE transmits an RRCConnectionReconfigurationComplete message to confirm the establishment of the default bearer.	–>	RRC: RRCConnectionReconfigurationComplete
–	EXCEPTION: In parallel to the event described in step 24 below, if initiated by the UE the generic procedure for IP address allocation in the U-plane specified in TS 36.508 subclause 4.5A.1 takes place performing IP address allocation in the U-plane.	–	–
–	EXCEPTION: In parallel to the event described in step 24 below the procedure for IMS signalling specified in Table 9.2.1.1.28b.3.2-3 takes place	–	–
24	This message includes the ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message.	–>	RRC: ULInformationTransfer NAS: ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT	2	P

Table 9.2.1.1.28b.3.2-2: Parallel behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Void	–	–	–	–
2	Step 4 defined in annex C.2 of TS 34.229-1 [35].	–>	REGISTER	–	–
3	SS responds with 305 Use Proxy defined in annex A.4.8 of TS 34.229-1 [35]	<–	305 Use Proxy	–	–

Table 9.2.1.1.28b.3.2-3: Parallel behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Void	–	–	–	–
2	Check: Does the UE send REGISTER request as defined in Step4 in TS 34.229-1 [43] subclause C.2 for SIP registration?	–>	REGISTER	2	P
3-9	Steps 5 to 11 defined in TS 34.229-1 [43] subclause C.2 for SIP registration	–	–	–	–

9.2.1.1.28b.3.3 Specific message contents

Table 9.2.1.1.28b.3.3-1: PDN CONNECTIVITY REQUEST (step 5, table 9.2.1.1.28b.3.2-1)

Derivation Path: TS 36.508 Table 4.7.3-20
Information Element	Value/remark	Comment	Condition
PDN type	‘011’B (IPv4v6)
Protocol configuration options
Container ID 1	‘0001’H (P-CSCF IPv6)	At least one value shall be present.
Container ID 2	‘000C’H (P-CSCF IPv4)	At least one value shall be present.

Table 9.2.1.1.28b.3.3-2: ESM INFORMATION TRANSFER RESPONSE (step 9a2 of the generic test procedure referenced in steps 6 -16, table 9.2.1.1.28b.3.2-1)

Derivation Path: TS 36.508 Table 4.7.3-20
Information Element	Value/remark	Comment	Condition
Protocol configuration options
Container ID 1	‘0001’H (P-CSCF IPv6)	At least one value shall be present.
Container ID 2	‘000C’H (P-CSCF IPv4)	At least one value shall be present.

NOTE: The containers can be transferred in PDN CONNECTIVITY REQUEST and/or in ESM INFORMATION TRANSFER RESPONSE message.

Table 9.2.1.1.28b.3.3-3: ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST (step 22, table 9.2.1.1.28b.3.2-1)

Derivation Path: TS 36.508 Table 4.7.3-20
Information Element	Value/remark	Comment	Condition
Protocol configuration options
Container ID 1	‘0001’H (P-CSCF IPv6)		P-CSCF IPv6
Container ID 1 contents	IPv6 address different from the value in step 5	P-CSCF IPv6 Address
Container ID 2	‘000C’H (P-CSCF IPv4)		P-CSCF IPv4
Container ID 2 contents	IPv4 address different from the value in step 5	P-CSCF IPv4 Address

9.2.1.1.29 Attach / Rejected / IMEI not accepted

9.2.1.1.29.1 Test Purpose (TP)

(1)

with { the UE has sent an ATTACH REQUEST for emergency bearer services }

ensure that {

when { the UE receives an ATTACH REJECT message with the EMM cause set to “IMEI not accepted” }

then { UE enters state EMM-DEREGISTERED }

}

9.2.1.1.29.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.1.2.5A.

[TS 24.301, clause 5.5.1.2.5A]

If the attach request for emergency bearer services cannot be accepted by the network, the MME shall send an ATTACH REJECT message to the UE including EMM cause #5 "IMEI not accepted" or one of the EMM cause values as described in subclause 5.5.1.2.5.

NOTE: If EMM cause #11 is sent to a UE of a roaming subscriber attaching for emergency bearer services and the UE is in automatic network selection mode, it cannot obtain normal service provided by this PLMN.

Upon receiving the ATTACH REJECT message including EMM cause #5, the UE shall enter the state EMM-DEREGISTERED.NO-IMSI.

…

9.2.1.1.29.3 Test description

9.2.1.1.29.3.1 Pre-test conditions

System Simulator:

– cell A, cell B:

– Cell A and Cell B (home PLMN, different TAs),

UE:

Without a valid USIM inserted

Preamble:

– The UE is in state Switched OFF (state 1) according to [18].

9.2.1.1.29.3.2 Test procedure sequence

Table 9.2.1.1.29.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – cell A as the "Serving cell". – cell B as a "Non-Suitable cell".	–	–	–	–
–	The following messages are to be observed on cell A unless explicitly stated otherwise.	–	–	–	–
2	The UE is switched on without a USIM inserted.	–	–	–	–
3	Causes the UE originate an emergency bearer service (Note1).	–	–	–	–
4	The UE transmits an ATTACH REQUEST message to attach for emergency bearer services, including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
5	The SS transmits an ATTACH REJECT message with EMM cause = " IMEI not accepted " as specified.	<–	ATTACH REJECT	–	–
6	The SS releases the RRC connection.	–	–	–	–
7	The SS configures: – Cell A as a "Non-Suitable cell". – Cell B as the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
8	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds? Note: Cell B belongs to the same PLMN where the UE was rejected but a different TA	–>	ATTACH REQUEST	1	F
Note 1: The request to originate an emergency service may be performed by MMI or AT command.

9.2.1.1.29.3.3 Specific message contents

Table 9.2.1.1.29.3.3-1: Message ATTACH REJECT (steps 5, Table 9.2.1.1.29.3.2-1)

Derivation path: 36.508 table 4.7.2-3
Information Element	Value/Remark	Comment	Condition
Security header type	0000	"Plain NAS message, not security protected "
EMM cause	00000101	"#5 IMEI not accepted "
ESM message container	Not present

9.2.1.1.30 Void

9.2.1.1.31 Attach / Success / Extended and spare fields in UE Network Capability

9.2.1.1.31.1 Test Purpose (TP)

(1)

with { the UE is powered on and has transmitted an ATTACH REQUEST message }

ensure that {

when { the UE receives additional octets in ATTACH ACCEPT that it does not comprehend (those added in later versions of the protocols without using the mechanisms defined in TS 24.007 c) or d)) }

then { the UE ignores the contents of these octets and transmits ATTACH COMPLETE }

}

9.2.1.1.31.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.007, clause 11.2.2.1, and TS 24.301 clauses 5.5.1.2.2, 5.5.1.2.3, and 5.5.1.2.4.

[TS 24.007, clause 11.2.2.1 “Description methods for IE structures, Tables”]

According to this description method, the IE is presented in its maximum format, i.e., T, TV, TLV or TLV-E, in a picture representing the bits in a table, each line representing an octet. Bits appear in the occidental order, i.e., from left of the page to right of the page, and from top of the page to bottom of the page.

Boxes so delimited contains typically the field name, possibly an indication of which bits in the field are in the box, and possibly a value (e.g., for spare bits).

A specific method can be used in the IE description to describe a branching structure, i.e., a structure variable according to the value of particular fields in the IE. This design is unusual outside type 4 and type 6 IEs, and as, a design rule, should be used only in type 4 and type 6 IEs.

a) The octet number of an octet within the IE is defined typically in the table. It consists of a positive integer, possibly of an additional letter, and possibly of an additional asterisk, see clause f). The positive integer identifies one octet or a group of octets.

b) Each octet group is a self-contained entity. The internal structure of an octet group may be defined in alternative ways.

c) An octet group is formed by using some extension mechanism. The preferred extension mechanism is to extend an octet (N) through the next octet(s) (Na, Nb, etc.) by using bit 8 in each octet as an extension bit.

– The bit value "0" indicates that the octet group continues through to the next octet. The bit value "1" indicates that this octet is the last octet of the group. If one octet (Nb) is present, the preceding octets (N and Na) shall also be present.

– In the format descriptions of the individual information elements, bit 8 is marked "0/1 ext" if another octet follows. Bit 8 is marked "1 ext" if this is the last octet in the extension domain.

– Additional octets may be defined in later versions of the protocols ("1 ext" changed to "0/1 ext") and equipments shall be prepared to receive such additional octets; the contents of these octets shall be ignored. However the length indicated in the formal description of the messages and of the individual information elements only takes into account this version of the protocols.

d) In addition to the extension mechanism defined above, an octet (N) may be extended through the next octet(s) (N+1, N+2 etc.) by indications in bits 7-1 (of octet N).

e) The mechanisms in c) and d) may be combined.

f) Optional octets are marked with asterisks (*). As a design rule, the presence or absence of an optional octet should be determinable from information in the IE and preceding the optional octet. Care should be taken not to introduce ambiguities with optional octets.

g) At the end of the IE, additional octets may be added in later versions of the protocols also without using the mechanisms defined in c) and d). Equipments shall be prepared to receive such additional octets; the contents of these octets shall be ignored. However the length indicated in the formal description of the messages and of the individual information elements only takes into account this version of the protocols.

[TS 24.301, clause 5.5.1.2.2 “Attach procedure initiation”]

The UE shall include the IMSI in the EPS mobile identity IE in the ATTACH REQUEST message if the selected PLMN is neither the registered PLMN nor in the list of equivalent PLMNs and:

a) the UE is configured for "AttachWithIMSI" as specified in 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17]; or

b) the UE is in NB-S1 mode.

For all other cases, the UE shall handle the EPS mobile identity IE in the ATTACH REQUEST message as follows:

a) if the UE operating in the single-registration mode is performing an inter-system change from N1 mode to S1 mode or the UE was previously registered in N1 mode before entering state 5GMM-DEREGISTERED and:

1) the UE has received the interworking without N26 interface indicator set to "interworking without N26 interface supported" from the network and:

i) if the UE holds a valid GUTI, the UE shall include the valid GUTI into the EPS mobile identity IE, include Old GUTI type IE with GUTI type set to "native GUTI" and include the UE status IE with a 5GMM registration status set to:

– "UE is in 5GMM-REGISTERED state" if the UE is in 5GMM-REGISTERED state; or

– "UE is in 5GMM-DEREGISTERED state" if the UE is in 5GMM-DEREGISTERED state; or

ii) if the UE does not hold a valid GUTI, the UE shall include the IMSI in the EPS mobile identity IE; or

2) the UE has received the interworking without N26 interface indicator set to "interworking without N26 interface not supported" from the network and:

i) if the UE holds a valid 5G-GUTI, the UE shall include a GUTI, mapped from 5G-GUTI into the EPS mobile identity IE, include Old GUTI type IE with GUTI type set to "native GUTI" and include the UE status IE with a 5GMM registration status set to "UE is in 5GMM-DEREGISTERED state";

ii) if the UE holds a valid GUTI and does not hold a valid 5G-GUTI, the UE shall indicate the GUTI in the EPS mobile identity IE and include Old GUTI type IE with GUTI type set to "native GUTI"; or

iii) if the UE holds neither a valid GUTI nor a valid 5G-GUTI, the UE shall include the IMSI in the EPS mobile identity IE; or

NOTE 1: The value of the EMM registration status included by the UE in the UE status IE is not used by the MME.

b) otherwise:

1) if the UE supports neither A/Gb mode nor Iu mode, the UE shall include in the ATTACH REQUEST message a valid GUTI together with the last visited registered TAI, if available. In addition, the UE shall include Old GUTI type IE with GUTI type set to "native GUTI". If there is no valid GUTI available, the UE shall include the IMSI in the ATTACH REQUEST message; or

2) If the UE supports A/Gb mode or Iu mode or both and:

i) if the TIN indicates "P-TMSI" and the UE holds a valid P-TMSI and RAI, the UE shall map the P-TMSI and RAI into the EPS mobile identity IE, and include Old GUTI type IE with GUTI type set to "mapped GUTI". If a P-TMSI signature is associated with the P-TMSI, the UE shall include it in the Old P-TMSI signature IE. Additionally, if the UE holds a valid GUTI, the UE shall indicate the GUTI in the Additional GUTI IE;

NOTE 2: The mapping of the P-TMSI and the RAI to the GUTI is specified in 3GPP TS 23.003 [2].

ii) if the TIN indicates "GUTI" or "RAT-related TMSI" and the UE holds a valid GUTI, the UE shall indicate the GUTI in the EPS mobile identity IE, and include Old GUTI type IE with GUTI type set to "native GUTI";

iii) if the TIN is deleted and:

– the UE holds a valid GUTI, the UE shall indicate the GUTI in the EPS mobile identity IE, and include Old GUTI type IE with GUTI type set to "native GUTI";

– the UE does not hold a valid GUTI but holds a valid P-TMSI and RAI, the UE shall map the P-TMSI and RAI into the EPS mobile identity IE, and include Old GUTI type IE with GUTI type set to "mapped GUTI". If a P-TMSI signature is associated with the P-TMSI, the UE shall include it in the Old P-TMSI signature IE; or

– the UE does not hold a valid GUTI, P-TMSI or RAI, the UE shall include the IMSI in the EPS mobile identity IE; or

iv) otherwise the UE shall include the IMSI in the EPS mobile identity IE.

If the UE is operating in the dual-registration mode and it is in 5GMM state 5GMM-REGISTERED, the UE shall include the UE status IE with the 5GMM registration status set to "UE is in 5GMM-REGISTERED state".

NOTE 3: The value of the EMM registration status included by the UE in the UE status IE is not used by the MME.

If the UE is attaching for emergency bearer services and does not hold a valid GUTI, P-TMSI or IMSI as described above, the IMEI shall be included in the EPS mobile identity IE.

If the UE in limited service state is attaching for access to RLOS and does not hold a valid GUTI, P-TMSI or IMSI as described above, the IMEI shall be included in the EPS mobile identity IE.

If the UE supports A/Gb mode or Iu mode or if the UE needs to indicate its UE specific DRX parameter to the network, the UE shall include the UE specific DRX parameter in the DRX parameter IE in the ATTACH REQUEST message. If the UE in NB-S1 mode needs to indicate the UE specific DRX parameter in NB-S1 mode to the network, it shall include the UE specific DRX parameter in NB-S1 mode in the DRX parameter in NB-S1 mode IE in the ATTACH REQUEST message.

If the UE supports eDRX and requests the use of eDRX, the UE shall include the extended DRX parameters IE in the ATTACH REQUEST message.

If the UE supports WUS assistance, then the UE shall set the WUSA bit to "WUS assistance supported" in the UE network capability IE, and if the UE is not attaching for emergency bearer services, the UE may include its UE paging probability information in the Requested WUS assistance information IE of the ATTACH REQUEST message.

If the UE supports SRVCC to GERAN/UTRAN, the UE shall set the SRVCC to GERAN/UTRAN capability bit to "SRVCC from UTRAN HSPA or E-UTRAN to GERAN/UTRAN supported".

If the UE supports vSRVCC from S1 mode to Iu mode, then the UE shall set the H.245 after handover capability bit to "H.245 after SRVCC handover capability supported" and additionally set the SRVCC to GERAN/UTRAN capability bit to "SRVCC from UTRAN HSPA or E-UTRAN to GERAN/UTRAN supported" in the ATTACH REQUEST message.

If the UE supports ProSe direct discovery, then the UE shall set the ProSe bit to "ProSe supported" and set the ProSe direct discovery bit to "ProSe direct discovery supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports ProSe direct communication, then the UE shall set the ProSe bit to "ProSe supported" and set the ProSe direct communication bit to "ProSe direct communication supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports acting as a ProSe UE-to-network relay, then the UE shall set the ProSe bit to "ProSe supported" and set the ProSe UE-to-network relay bit to "acting as a ProSe UE-to-network relay supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports NB-S1 mode, Non-IP or Ethernet PDN type, N1 mode, or if the UE supports DNS over (D)TLS (see 3GPP TS 33.501 [24]), then the UE shall support the extended protocol configuration options IE.

If the UE supports the extended protocol configuration options IE, then the UE shall set the ePCO bit to "extended protocol configuration options supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports the restriction on use of enhanced coverage, then the UE shall set the RestrictEC bit to "Restriction on use of enhanced coverage supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports the control plane data back-off timer T3448, the UE shall set the CP backoff bit to "back-off timer for transport of user data via the control plane supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE is in NB-S1 mode, then the UE shall set the Control plane CIoT EPS optimization bit to "Control plane CIoT EPS optimization supported" in the UE network capability IE of the ATTACH REQUEST message. If the UE is capable of NB-N1 mode, then the UE shall set the Control plane CIoT 5GS optimization bit to "Control plane CIoT 5GS optimization supported" in the N1 UE network capability IE of the ATTACH REQUEST message.

If the UE is in NB-S1 mode, supports NB-S1 mode only, and requests to attach for EPS services and "SMS only", the UE shall indicate the SMS only requested bit to "SMS only" in the additional update type IE and shall set the EPS attach type IE to "EPS attach" in the ATTACH REQUEST message.

If the UE supports CIoT EPS optimizations, it shall indicate in the UE network capability IE of the ATTACH REQUEST message whether it supports EMM-REGISTERED without PDN connection.

If the UE supports S1-U data transfer and multiple user plane radio bearers (see 3GPP TS 36.306 [44], 3GPP TS 36.331 [22]) in NB-S1 mode, then the UE shall set the Multiple DRB support bit to "Multiple DRB supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports control plane MT-EDT, then the UE shall set the CP-MT-EDT bit to "Control plane Mobile Terminated-Early Data Transmission supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports user plane MT-EDT, then the UE shall set the UP-MT-EDT bit to "User plane Mobile Terminated-Early Data Transmission supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports V2X communication over E-UTRA-PC5, then the UE shall set the V2X PC5 bit to "V2X communication over E-UTRA-PC5 supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports V2X communication over NR-PC5, then the UE shall set the V2X NR-PC5 bit to "V2X communication over NR-PC5 supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports service gap control, then the UE shall set the SGC bit to "service gap control supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports dual connectivity with New Radio (NR), then the UE shall set the DCNR bit to "dual connectivity with NR supported" in the UE network capability IE of the ATTACH REQUEST message and shall include the UE additional security capability IE in the ATTACH REQUEST message.

If the UE supports N1 mode, the UE shall set the N1mode bit to "N1 mode supported" in the UE network capability IE of the ATTACH REQUEST message and shall include the UE additional security capability IE in the ATTACH REQUEST message.

If the UE supports signalling for a maximum number of 15 EPS bearer contexts, then the UE shall set the 15 bearers bit to "Signalling for a maximum number of 15 EPS bearer contexts supported" in the UE network capability IE of the ATTACH REQUEST message.

If the UE supports ciphered broadcast assistance data and needs to obtain new ciphering keys, the UE shall include the Additional information requested IE with the CipherKey bit set to "ciphering keys for ciphered broadcast assistance data requested" in the ATTACH REQUEST message.

If EMM-REGISTERED without PDN connection is not supported by the UE or the MME, or if the UE wants to request PDN connection with the attach procedure, the UE shall send the ATTACH REQUEST message together with a PDN CONNECTIVITY REQUEST message contained in the ESM message container IE.

If EMM-REGISTERED without PDN connection is supported by the UE and the MME, and the UE does not want to request PDN connection with the attach procedure, the UE shall send the ATTACH REQUEST message together with an ESM DUMMY MESSAGE contained in the ESM message container information element.

In WB-S1 mode, if the UE supports RACS, the UE shall:

a) set the RACS bit to "RACS supported" in the UE network capability IE of the ATTACH REQUEST message; and

b) if the UE has an applicable UE radio capability ID for the current UE radio configuration in the selected PLMN, set the URCIDA bit to "UE radio capability ID available" in the UE radio capability ID availability IE of the ATTACH REQUEST message.

If the attach procedure is initiated following an inter-system change from N1 mode to S1 mode in EMM-IDLE mode or the UE which was previously registered in N1 mode before entering state 5GMM-DEREGISTERED initiates the attach procedure:

a) if the UE has received an "interworking without N26 interface not supported" indication from the network and a valid 5G NAS security context exists in the UE, the UE shall integrity protect the ATTACH REQUEST message combined with the message included in the ESM message container IE using the 5G NAS security context;

b) otherwise:

1) if a valid EPS security context exists, the UE shall integrity protect the ATTACH REQUEST message combined with the message included in the ESM message container IE using the EPS security context; or

2) if the UE does not have a valid EPS security context, the ATTACH REQUEST message combined with the message included in the ESM message container IE is not integrity protected.

Figure 5.5.1.2.2.1: Attach procedure and combined attach procedure

[TS 24.301, clause 5.5.1.2.3 “EMM common procedure initiation”]

The network may initiate EMM common procedures, e.g. the identification, authentication and security mode control procedures during the attach procedure, depending on the information received in the ATTACH REQUEST message (e.g. IMSI, GUTI and KSI).

If the network receives an ATTACH REQUEST message containing the Old GUTI type IE and the EPS mobile identity IE with type of identity indicating "GUTI", and the network does not follow the use of the most significant bit of the <MME group id> as specified in 3GPP TS 23.003 [2], subclause 2.8.2.2.2, the network shall use the Old GUTI type IE to determine whether the mobile identity included in the EPS mobile identity IE is a native GUTI or a mapped GUTI.

During an attach for emergency bearer services or an attach for access to RLOS, the MME may choose to skip the authentication procedure even if no EPS security context is available and proceed directly to the execution of the security mode control procedure as specified in subclause 5.4.3.

[TS 24.301, clause 5.5.1.2.4 “Attach accepted by the network”]

During an attach for emergency bearer services, if not restricted by local regulations, the MME shall not check for mobility and access restrictions, regional restrictions, subscription restrictions, or perform CSG access control when processing the ATTACH REQUEST message. The network shall not apply subscribed APN based congestion control during an attach procedure for emergency bearer services.

During an attach for access to RLOS, the MME shall not check for access restrictions, regional restrictions and subscription restrictions when processing the ATTACH REQUEST message.

If the attach request is accepted by the network, the MME shall send an ATTACH ACCEPT message to the UE and start timer T3450.

If the attach request included the PDN CONNECTIVITY REQUEST message in the ESM message container information element to request PDN connectivity, the MME when accepting the attach request shall:

– send the ATTACH ACCEPT message together with an ESM DUMMY MESSAGE contained in the ESM message container information element and discard the ESM message container information element included in the attach request if:

– the UE indicated support of EMM-REGISTERED without PDN connection in the UE network capability IE of the ATTACH REQUEST message;

– the MME supports EMM-REGISTERED without PDN connection and PDN connection is restricted according to the user’s subscription data;

– the attach type is not set to "EPS emergency attach" or "EPS RLOS attach"; and

– the request type of the UE requested PDN connection is not set to "emergency" or "RLOS";

– otherwise, send the ATTACH ACCEPT message together with an ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message contained in the ESM message container information element to activate the default bearer (see subclause 6.4.1). In WB-S1 mode, the network may also initiate the activation of dedicated bearers towards the UE by invoking the dedicated EPS bearer context activation procedure (see subclause 6.4.2). In NB-S1 mode the network shall not initiate the activation of dedicated bearers.

If EMM-REGISTERED without PDN connection is supported by the UE and the MME, and the UE included an ESM DUMMY MESSAGE in the ESM message container information element of the ATTACH REQUEST message, the MME shall send the ATTACH ACCEPT message together with an ESM DUMMY MESSAGE contained in the ESM message container information element.

If the attach request is accepted by the network, the MME shall delete the stored UE radio capability information or the UE radio capability ID, if any.

In NB-S1 mode, if the attach request is accepted by the network, the MME shall set the EMC BS bit to zero in the EPS network feature support IE included in the ATTACH ACCEPT message to indicate that support of emergency bearer services in NB-S1 mode is not available.

If the UE has included the UE network capability IE or the MS network capability IE or both in the ATTACH REQUEST message, the MME shall store all octets received from the UE, up to the maximum length defined for the respective information element.

NOTE 1: This information is forwarded to the new MME during inter-MME handover or to the new SGSN during inter-system handover to A/Gb mode or Iu mode.

NOTE 2: For further details concerning the handling of the MS network capability and UE network capability in the MME see also 3GPP TS 23.401 [10].

If the UE specific DRX parameter was included in the DRX Parameter IE in the ATTACH REQUEST message, the MME shall replace any stored UE specific DRX parameter with the received parameter and use it for the downlink transfer of signalling and user data in WB-S1 mode.

In NB-S1 mode, if the DRX parameter in NB-S1 mode IE was included in the ATTACH REQUEST message, the MME shall provide to the UE the Negotiated DRX parameter in NB-S1 mode IE in the ATTACH ACCEPT message. The MME shall replace any stored UE specific DRX parameter in NB-S1 mode with the negotiated DRX parameter and use it for the downlink transfer of signalling and user data in NB-S1 mode.

NOTE 3: In NB-S1 mode, if a DRX parameter was included in the Negotiated DRX parameter in NB-S1 mode IE in the ATTACH ACCEPT message, then the UE stores and uses the received DRX parameter in NB-S1 mode (see 3GPP TS 36.304 [21]). If the UE did not receive a DRX parameter in the Negotiated DRX parameter in NB-S1 mode IE, or if the Negotiated DRX parameter in NB-S1 mode IE was not included in the ATTACH ACCEPT message, then the UE uses the cell specific DRX value in NB-S1 mode (see 3GPP TS 36.304 [21]).

In NB-S1 mode, if the UE requested "SMS only" in the Additional update type IE, supports NB-S1 mode only and the MME decides to accept the attach request for EPS services and "SMS only", the MME shall indicate "SMS only" in the Additional update result IE and shall set the EPS attach result IE to "EPS only" in the ATTACH ACCEPT message.

The MME shall include the extended DRX parameters IE in the ATTACH ACCEPT message only if the extended DRX parameters IE was included in the ATTACH REQUEST message, and the MME supports and accepts the use of eDRX.

– the UE supports WUS assistance; and

– the MME supports and accepts the use of WUS assistance,

then the MME shall determine the negotiated UE paging probability information for the UE, store it in the EMM context of the UE, and if the UE is not attaching for emergency bearer services, the MME shall include it in the Negotiated WUS assistance information IE in the ATTACH ACCEPT message. The MME may take into account the UE paging probability information received in the Requested WUS assistance information IE when determining the negotiated UE paging probability information for the UE.

NOTE 4: Besides the UE paging probability information requested by the UE, the MME can take local configuration or previous statistical information for the UE into account when determining the negotiated UE paging probability information for the UE (see 3GPP TS 23.401 [10]).

The MME shall assign and include the TAI list the UE is registered to in the ATTACH ACCEPT message. The MME shall not assign a TAI list containing both tracking areas in NB-S1 mode and tracking areas in WB-S1 mode. The UE, upon receiving an ATTACH ACCEPT message, shall delete its old TAI list and store the received TAI list.

NOTE 5: When assigning the TAI list, the MME can take into account the eNodeB’s capability of support of CIoT EPS optimization.

The MME may include T3412 extended value IE in the ATTACH ACCEPT message only if the UE indicates support of the extended periodic timer T3412 in the MS network feature support IE in the ATTACH REQUEST message.

The MME shall include the T3324 value IE in the ATTACH ACCEPT message only if the T3324 value IE was included in the ATTACH REQUEST message, and the MME supports and accepts the use of PSM.

If the MME supports and accepts the use of PSM, and the UE included the T3412 extended value IE in the ATTACH REQUEST message, then the MME shall take into account the T3412 value requested when providing the T3412 value IE and the T3412 extended value IE in the ATTACH ACCEPT message.

NOTE 6: Besides the value requested by the UE, the MME can take local configuration or subscription data provided by the HSS into account when selecting a value for T3412 (3GPP TS 23.401 [10] subclause 4.3.17.3).

If the UE indicates support for EMM-REGISTERED without PDN connection in the ATTACH REQUEST message and the MME supports EMM-REGISTERED without PDN connection, the MME shall indicate support for EMM-REGISTERED without PDN connection in the EPS network feature support IE of the ATTACH ACCEPT message. The UE and the MME shall use the information whether the peer entity supports EMM-REGISTERED without PDN connection as specified in the present clause 5 and in clause 6.

If the UE requests "control plane CIoT EPS optimization" in the Additional update type IE, indicates support of control plane CIoT EPS optimization in the UE network capability IE and the MME decides to accept the requested CIoT EPS optimization and the attach request, the MME shall indicate "control plane CIoT EPS optimization supported" in the EPS network feature support IE.

If the MME supports NB-S1 mode, Non-IP or Ethernet PDN type, inter-system change with 5GS or the network wants to enforce the use of DNS over (D)TLS (see 3GPP TS 33.501 [24]), then the MME shall support the extended protocol configuration options IE.

NOTE 7: Support of DNS over (D)TLS is based on the informative requirements as specified in 3GPP TS 33.401 [19] and it is implemented based on the operator requirement.

If the MME supports the extended protocol configuration options IE and the UE indicated support of the extended protocol configuration options IE, then the MME shall set the ePCO bit to "extended protocol configuration options supported" in the EPS network feature support IE of the ATTACH ACCEPT message.

If the UE indicates support for restriction on use of enhanced coverage in the ATTACH REQUEST message, and the network decides to restrict the use of enhanced coverage for the UE, then the MME shall set the RestrictEC bit to "Use of enhanced coverage is restricted" in the EPS network feature support IE of the ATTACH ACCEPT message.

If the UE has indicated support for the control plane data back-off timer, and the MME decides to activate the congestion control for transport of user data via the control plane, then the MME shall include the T3448 value IE in the ATTACH ACCEPT message.

If the UE indicates support for dual connectivity with NR in the ATTACH REQUEST message, and the MME decides to restrict the use of dual connectivity with NR for the UE, then the MME shall set the RestrictDCNR bit to "Use of dual connectivity with NR is restricted" in the EPS network feature support IE of the ATTACH ACCEPT message.

If the UE indicates support for N1 mode in the ATTACH REQUEST message and the MME supports inter-system interworking with 5GS, the MME may set the IWK N26 bit to either:

– "interworking without N26 interface not supported" if the MME supports N26 interface; or

– "interworking without N26 interface supported" if the MME does not support N26 interface

in the EPS network feature support IE in the ATTACH ACCEPT message.

If the UE requests ciphering keys for ciphered broadcast assistance data in the ATTACH REQUEST message and the MME has valid ciphering key data applicable to the UE’s subscription, then the MME shall include the ciphering key data in the Ciphering key data IE of the ATTACH ACCEPT message.

If due to operator policies unsecured redirection to a GERAN cell is not allowed in the current PLMN, the MME shall set the redir-policy bit to "Unsecured redirection to GERAN not allowed" in the Network policy IE of the ATTACH ACCEPT message.

The MME may include the T3447 value IE set to the service gap time value in the ATTACH ACCEPT message if:

– the UE has indicated support for service gap control; and

– a service gap time value is available in the EMM context.

If the network supports signalling for a maximum number of 15 EPS bearer contexts and the UE indicated support of signalling for a maximum number of 15 EPS bearer contexts in the ATTACH REQUEST message, then the MME shall set the 15 bearers bit to "Signalling for a maximum number of 15 EPS bearer contexts supported" in the EPS network feature support IE of the ATTACH ACCEPT message.

Upon receiving the ATTACH ACCEPT message, the UE shall stop timer T3410.

The GUTI reallocation may be part of the attach procedure. When the ATTACH REQUEST message includes the IMSI or IMEI, or the MME considers the GUTI provided by the UE is invalid, or the GUTI provided by the UE was assigned by another MME, the MME shall allocate a new GUTI to the UE. The MME shall include in the ATTACH ACCEPT message the new assigned GUTI together with the assigned TAI list. In this case the MME shall enter state EMM-COMMON-PROCEDURE-INITIATED as described in subclause 5.4.1.

If A/Gb mode or Iu mode is supported in the UE, the UE shall set its TIN to "GUTI" when receiving the ATTACH ACCEPT message.

If the ATTACH ACCEPT message contains the T3412 extended value IE, then the UE shall use the value in T3412 extended value IE as periodic tracking area update timer (T3412). If the ATTACH ACCEPT message does not contain T3412 extended value IE, then the UE shall use the value in T3412 value IE as periodic tracking area update timer (T3412).

If the ATTACH ACCEPT message contains the T3324 value IE, then the UE shall use the included timer value for T3324 as specified in 3GPP TS 24.008 [13], subclause 4.7.2.8.

The MME may also include a list of equivalent PLMNs in the ATTACH ACCEPT message. Each entry in the list contains a PLMN code (MCC+MNC). The UE shall store the list as provided by the network, and if the attach procedure is neither for emergency bearer services nor for access to RLOS, the UE shall remove from the list any PLMN code that is already in the list of "forbidden PLMNs" or in the list of "forbidden PLMNs for GPRS service". In addition, the UE shall add to the stored list the PLMN code of the registered PLMN that sent the list. The UE shall replace the stored list on each receipt of the ATTACH ACCEPT message. If the ATTACH ACCEPT message does not contain a list, then the UE shall delete the stored list.

If the attach procedure is neither for emergency bearer services nor for access to RLOS, and if the PLMN identity of the registered PLMN is a member of the list of "forbidden PLMNs" or the list of "forbidden PLMNs for GPRS service", any such PLMN identity shall be deleted from the corresponding list(s).

The network informs the UE about the support of specific features, such as IMS voice over PS session, location services (EPC-LCS, CS-LCS), emergency bearer services, or CIoT EPS optimizations, in the EPS network feature support information element. In a UE with IMS voice over PS capability, the IMS voice over PS session indicator and the emergency bearer services indicator shall be provided to the upper layers. The upper layers take the IMS voice over PS session indicator into account as specified in 3GPP TS 23.221 [8A], subclause 7.2a and subclause 7.2b, when selecting the access domain for voice sessions or calls. When initiating an emergency call, the upper layers also take both the IMS voice over PS session indicator and the emergency bearer services indicator into account for the access domain selection. In a UE with LCS capability, location services indicators (EPC-LCS, CS-LCS) shall be provided to the upper layers. When MO-LR procedure is triggered by the UE’s application, those indicators are taken into account as specified in 3GPP TS 24.171 [13C].

If the RestrictDCNR bit is set to "Use of dual connectivity with NR is restricted" in the EPS network feature support IE of the ATTACH ACCEPT message, the UE shall provide the indication that dual connectivity with NR is restricted to the upper layers.

The UE supporting N1 mode shall operate in the mode for inter-system interworking with 5GS as follows:

– if the IWK N26 bit in the EPS network feature support IE is set to "interworking without N26 interface not supported", the UE shall operate in single-registration mode;

– if the IWK N26 bit in the EPS network feature support IE is set to "interworking without N26 interface supported" and the UE supports dual-registration mode, the UE may operate in dual-registration mode; or

NOTE 8: The registration mode used by the UE is implementation dependent.

– if the IWK N26 bit in the EPS network feature support IE is set to "interworking without N26 interface supported" and the UE only supports single-registration mode, the UE shall operate in single-registration mode.

The UE shall treat the interworking without N26 interface indicator as valid in the entire PLMN and equivalent PLMNs. The interworking procedures required for coordination between 5GMM and EMM without N26 interface are specified in 3GPP TS 24.501 [54].

If the redir-policy bit is set to "Unsecured redirection to GERAN not allowed" in the Network policy IE of the ATTACH ACCEPT message, the UE shall set the network policy on unsecured redirection to GERAN for the current PLMN to "Unsecured redirection to GERAN not allowed" and indicate to the lower layers that unsecured redirection to a GERAN cell is not allowed. If the redir-policy bit is set to "Unsecured redirection to GERAN allowed" or if the Network policy IE is not included in the ATTACH ACCEPT message, the UE shall set the network policy for the current PLMN to "Unsecured redirection to GERAN allowed" and indicate to the lower layers that unsecured redirection to a GERAN cell is allowed. The UE shall set the network policy on unsecured redirection to GERAN to "Unsecured redirection to GERAN not allowed" and indicate this to the lower layers when any of the following events occurs:

– the UE initiates an EPS attach or tracking area updating procedure in a PLMN different from the PLMN where the UE performed the last successful EPS attach or tracking area updating procedure;

– the UE is switched on; or

– the UICC containing the USIM is removed.

If the UE has initiated the attach procedure due to manual CSG selection and receives an ATTACH ACCEPT message; and the UE sent the ATTACH REQUEST message in a CSG cell, the UE shall check if the CSG ID and associated PLMN identity of the cell are contained in the Allowed CSG list. If not, the UE shall add that CSG ID and associated PLMN identity to the Allowed CSG list and the UE may add the HNB Name (if provided by lower layers) to the Allowed CSG list if the HNB Name is present in neither the Operator CSG list nor the Allowed CSG list.

When the UE receives the ATTACH ACCEPT message combined with the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message, and if the UE has requested PDN connectivity the UE shall forward the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message to the ESM sublayer. Upon receipt of an indication from the ESM sublayer that the default EPS bearer context has been activated, the UE shall send an ATTACH COMPLETE message together with an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message contained in the ESM message container information element to the network.

Additionally, the UE shall reset the attach attempt counter, enter state EMM-REGISTERED, and set the EPS update status to EU1 UPDATED.

If EMM-REGISTERED without PDN connection is supported by the UE and the MME, and the UE receives the ATTACH ACCEPT message combined with an ESM DUMMY MESSAGE, the UE shall send an ATTACH COMPLETE message together with an ESM DUMMY MESSAGE contained in the ESM message container information element to the network.

If the UE receives the ATTACH ACCEPT message from a PLMN for which a PLMN-specific attempt counter or PLMN-specific PS-attempt counter is maintained (see subclause 5.3.7b), then the UE shall reset these counters. If the UE maintains a counter for "SIM/USIM considered invalid for GPRS services", then the UE shall reset this counter.

When the UE receives any ACTIVATE DEDICATED EPS BEARER CONTEXT REQUEST messages during the attach procedure, and if the UE has requested PDN connectivity the UE shall forward the ACTIVATE DEDICATED EPS BEARER CONTEXT REQUEST message(s) to the ESM sublayer. The UE shall send a response to the ACTIVATE DEDICATED EPS BEARER CONTEXT REQUEST message(s) after successful completion of the attach procedure.

If the attach procedure was initiated in S101 mode, the lower layers are informed about the successful completion of the procedure.

Upon receiving an ATTACH COMPLETE message, the MME shall stop timer T3450, enter state EMM-REGISTERED and consider the GUTI sent in the ATTACH ACCEPT message as valid.

If the T3448 value IE is present in the received ATTACH ACCEPT message, the UE shall:

– stop timer T3448 if it is running; and

– start timer T3448 with the value provided in the T3448 value IE.

If the UE is using EPS services with control plane CIoT EPS optimization, the T3448 value IE is present in the ATTACH ACCEPT message and the value indicates that this timer is either zero or deactivated, the UE shall consider this case as an abnormal case and proceed as if the T3448 value IE is not present.

If the UE has indicated "service gap control supported" in the ATTACH REQUEST message and:

– the ATTACH ACCEPT message contains the T3447 value IE, then the UE shall store the new T3447 value, erase any previous stored T3447 value if exists and use the new T3447 value with the T3447 timer next time it is started; or

– the ATTACH ACCEPT message does not contain the T3447 value IE, then the UE shall erase any previous stored T3447 value if exists and stop the T3447 timer if running.

In WB-S1 mode, if the UE has set the RACS bit to "RACS supported" in the UE network capability IE of the ATTACH REQUEST message, the MME may include a UE radio capability ID IE or a UE radio capability ID deletion indication IE in the ATTACH ACCEPT message.

In WB-S1 mode, if the UE has set the RACS bit to "RACS supported" in the UE network capability IE of the ATTACH REQUEST message and the ATTACH ACCCEPT message includes:

– a UE radio capability ID deletion indication IE set to "Network-assigned UE radio capability IDs deletion requested", the UE shall delete any network-assigned UE radio capability IDs associated with the registered PLMN stored at the UE, then the UE shall, after the completion of the ongoing attach procedure, initiate a tracking area updating procedure as specified in subclause 5.5.3; and

– a UE radio capability ID IE, the UE shall store the UE radio capability ID as specified in annex C.

9.2.1.1.31.3 Test description

9.2.1.1.31.3.1 Pre-test conditions

System Simulator:

– Cell A.

UE:

– The UE is configured to initiate EPS attach;

– The UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.31.3.2 Test procedure sequence

Table 9.2.1.1.31.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2	The UE transmits an RRCConnectionRequest message on Cell A.	–>	RRCConnectionRequest	–	–
3	The SS transmits an RRCConnectionSetup message on Cell A.	<–	RRCConnectionSetup	–	–
4	The UE transmits an RRCConnectionSetupComplete message with an accompanying ATTACH REQUEST message.	–>	RRCConnectionSetupComplete ATTACH REQUEST	–	–
5-14	Steps 5-14 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
15	The SS transmits ATTACH ACCEPT with additional octets included that the UE does not comprehend.	<–	ATTACH ACCEPT	–	–
16	Check: Does the UE transmit an ATTACH COMPLETE message including an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message?	–>	ATTACH COMPLETE	1	P

9.2.1.1.31.3.3 Specific message contents

Table 9.2.1.1.31.3.3-1: Message ATTACH ACCEPT (step 15, table 9.2.1.1.31.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-1
Information Element	Value/remark	Comment	Condition
EPS network feature support	‘0000 0001 1111 1111’B	The third octet indicates that IMS voice over PS session in S1 mode is supported. The fourth octet is to be interpreted by the UE as additional bits that it does not comprehend.	Rel-8 to Rel-12

9.2.1.1.32 Attach / Success / MUSIM

9.2.1.1.32.1 Test Purpose (TP)

(1)

with { MUSIM UE is switched-off with two valid USIMs inserted}

ensure that {

when { UE is powered on }

then { the UE transmits ATTACH REQUEST message and sets one or more MUSIM feature bits in UE network capability IE to "supported" individually with cell A and cell G which belong to different PLMNs (i.e. NAS signalling connection release, paging indication for voice services, reject paging request, paging restriction the paging timing collision control) }

}

9.2.1.1.32.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clauses 4.10, 5.4.4.1 and 5.5.1.2.2 and in TS 36.331, clause 5.3.3.4.

[TS 24.301, clause 4.10]

…

A network and a MUSIM UE may support one or more of the MUSIM features (i.e. the NAS signalling connection release, the paging indication for voice services, the reject paging request, the paging restriction and the paging timing collision control).

If MUSIM UE supports one or more MUSIM features, the UE indicates support of one or more MUSIM features during the attach procedure and the normal tracking area updating procedure. If the UE has indicated support of the NAS signalling connection release or the reject paging request or both and the UE supports the paging restriction, the UE indicates support of the paging restriction.

If the UE indicates support of one or more MUSIM features and the network decides to accept one or more MUSIM features, the network indicates the support of one or more MUSIM features during the attach procedure and the normal tracking area updating procedure. The network only indicates the support of the paging restriction together with the support of either NAS signalling connection release or the reject paging request.

The network does not indicate support for any MUSIM feature to the UE during the attach for emergency bearer services.

…

[TS 24.301, clause 5.4.4.1]

…

If the UE is a MUSIM UE, the UE uses a separate IMEI for each USIM the UE operates.

…

[TS 24.301, clause 5.5.1.2.2]

…

If the MUSIM UE supports the NAS signalling connection release, then the UE shall set the NAS signalling connection release bit to "NAS signalling connection release supported" in the UE network capability IE of the ATTACH REQUEST message otherwise the UE shall not set the NAS signalling connection release bit to "NAS signalling connection release supported" in the UE network capability IE of the ATTACH REQUEST message.

If the MUSIM UE supports the paging indication for voice services, then the UE shall set the paging indication for voice services bit to "paging indication for voice services supported" in the UE network capability IE of the ATTACH REQUEST message otherwise the UE shall not set the paging indication for voice services bit to "paging indication for voice services supported" in the UE network capability IE of the ATTACH REQUEST message.

If the MUSIM UE supports the reject paging request, then the UE shall set the reject paging request bit to "reject paging request supported" in the UE network capability IE of the ATTACH REQUEST message otherwise the UE shall not set the reject paging request bit to "reject paging request supported" in the UE network capability IE of the ATTACH REQUEST message.

If the MUSIM UE sets:

– the reject paging request bit to "reject paging request supported";

– the NAS signalling connection release bit to "NAS signalling connection release supported"; or

– both of them;

and supports the paging restriction, then the UE shall set the paging restriction bit to "paging restriction supported" in the UE network capability IE of the ATTACH REQUEST message otherwise the UE shall not set the paging restriction bit to "paging restriction supported" in the UE network capability IE of the ATTACH REQUEST message.

If the MUSIM UE supports the paging timing collision control, then the UE shall set the paging timing collision control bit to "paging timing collision control supported" in the UE network capability IE of the ATTACH REQUEST message otherwise the UE shall not set the paging timing collision control bit to "paging timing collision control supported" in the UE network capability IE of the ATTACH REQUEST message.

…

9.2.1.1.32.3 Test description

9.2.1.1.32.3.1 Pre-test conditions

System Simulator:

– cell A(home PLMN1) and cell G(home PLMN2) are configured according to table 6.3.2.2-1 in TS 36.508 [18] and belong to the different frequency as specified in TS 36.523-3 [20].

– For cell A, (MCC, MNC, TAI) is (001, 01, TAI-1). For cell G, (MCC, MNC, TAI) is (001, 02, TAI-7).

UE:

– the UE is a MUSIM UE;

– each USIM of the UE is configured to initiate EPS attach;

– roaming is disabled

The UE is equipped with two USIMs containing values shown in Table 9.2.1.1.32.3.1-1 and Table 9.2.1.1.32.3.1-2.

Table 9.2.1.1.32.3.1-1: USIM A Configuration

USIM field	Value
EFIMSI	MCC = 001 and MNC = 01

Table 9.2.1.1.32.3.1-2: USIM B Configuration

USIM field	Value
EFIMSI	MCC = 001 and MNC = 02

Preamble:

– each USIM of the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.1.32.3.2 Test procedure sequence

Table 9.2.1.1.32.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	USIM A of the UE is switched on.	–	–	–	–
2	USIM A of the UE transmit an RRCConnectionRequest message not including S-TMSI and with establishmentCause set to ‘mo-Signalling’?	–	–	–	–
3	The SS of the cell A transmits an RRCConnectionSetup message.	–	–	–	–
4	Check: Does USIM A of the UE transmit an RRCConnectionSetupComplete message including UE network capability witch at least one MUSIM feature is set to “support”?	–>	ATTACH REQUEST	1	P
5 -13	Steps 5-13 of the generic procedure for USIM A of UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
14	The SS transmits an ATTACH ACCEPT.	<–	ATTACH ACCEPT
15 -18b1	Steps 15-18b1 of the generic procedure for USIM A of UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.
–	EXCEPTION: The following events step 16 to 33b1 are parallel to steps 1 to 18b1.	–	–
16	USIM B of the UE is switched on.	–	–	–	–
17	USIM B of the UE transmit an RRCConnectionRequest message not including S-TMSI and with establishmentCause set to ‘mo-Signalling’?	–	–	–	–
18	The SS of the cell G transmits an RRCConnectionSetup message.	–	–	–	–
19	Check: Does USIM B of the UE transmit an RRCConnectionSetupComplete message including UE network capability witch at least one MUSIM feature is set to “support”?	–>	ATTACH REQUEST	1	P
20 -28	Steps 20-28 of the generic procedure for USIM B of UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
29	The SS of the cell G transmits an ATTACH ACCEPT.	<–	ATTACH ACCEPT
30-33b1	Steps 30-33b1 of the generic procedure for USIM B of UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.

9.2.1.1.32.3.3 Specific message contents

Table 9.2.1.1.32.3.3-1: Message ATTACH REQUEST (step 4 and 19, Table 9.2.1.1.32.3.2-1)

Derivation path: TS 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
UE network capability			pc_EPC_MUSIM
All octets with the exception of octet 10, bit 6 to bit 8 and octet 11,bit 1 to 2	Any allowed value
NAS signalling connection release (NCR) (octet 10, bit 6)	‘1’B	NAS signalling connection release supported	pc_EPC_MUSIM_NCR
Paging indication for voice services (PIV) (octet 10, bit 7)	‘1’B	paging indication for voice services supported	pc_EPC_MUSIM_PIV
Reject paging request (RPR) (octet 10, bit 8)	‘1’B	reject paging request supported	pc_EPC_MUSIM_RPR
Paging restriction (PR) (octet 11, bit 1)	‘1’B	paging restriction supported	pc_EPC_MUSIM_PR
Paging timing collision control (PTCC) (octet 11, bit 2)	‘1’B	paging timing collision control supported	pc_EPC_MUSIM_PTCC

Table 9.2.1.1.32.3.3-2: Message ATTACH ACCEPT (step 14, Table 9.2.1.1.1a.3.2-1)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark	Comment	Condition
EPS network feature support(octet 3 to 4)			pc_EPC_MUSIM
All octets with the exception of octet 5, bit 1 to bit 5	Any allowed value
NAS signalling connection release (NCR) (octet 5, bit 1)	‘1’B	NAS signalling connection release supported	pc_EPC_MUSIM_NCR
Paging indication for voice services (PIV) (octet 5, bit 2)	‘1’B	Paging indication for voice services supported	pc_EPC_MUSIM_PIV
Reject paging request (RPR) (octet 5, bit 3)	‘1’B	Reject paging request supported	pc_EPC_MUSIM_RPR
Paging restriction (PR) (octet 5, bit 4)	‘1’B	Paging restriction supported	pc_EPC_MUSIM_PR
Paging timing collision control (PTCC) (octet 5, bit 5)	‘1’B	Paging timing collision control supported	pc_EPC_MUSIM_PTCC

9.2.1.2 Combined attach procedure for EPS services and non-EPS services

9.2.1.2.1 Combined attach procedure / Success / EPS and non-EPS services

9.2.1.2.1.1 Test Purpose (TP)

(1)

with { UE in state EMM-DEREGISTERED and is switched off }

ensure that {

when { UE is powered up or switched on}

then { UE sends ATTACH REQUEST message with EPS attach type IE ‘combined EPS/IMSI attach’ }

}

(2)

with { UE in state EMM-REGISTERED-INITIATED}

ensure that {

when { UE receives ATTACH ACCEPT message with EPS attach result ‘combined EPS/IMSI attach’ }

then { UE sends ATTACH COMPLETE message and enters EMM state EMM-REGISTERED and MM state MM-IDLE }

}

(3)

with { UE in state EMM-REGISTERED and EMM-IDLE mode}

ensure that {

when { UE enters a new tracking area already included in the TAI list }

then { UE does not send TRACKING AREA UPDATE REQUEST message }

}

(4)

with { UE in state EMM-REGISTERED and EMM-IDLE mode}

ensure that {

when { UE enters a new tracking area not included in the TAI list }

then { UE sends TRACKING AREA UPDATE REQUEST message with ‘EPS update type = combined TA/LA updated ‘}

}

(5)

with { UE in state EMM-DEREGISTERED and is switched off and has a valid TAI value in ‘Last visited registered TAI’ IE and a valid GUTI}

ensure that {

when { UE is powered up or switched on}

then { UE sends ATTACH REQUEST message with EPS attach type IE ‘combined EPS/IMSI attach’ and with the value in ‘Last visited registered TAI’ and the valid GUTI}

}

9.2.1.2.1.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 24.301 clauses 5.5.1.3.1, 5.5.1.3.4.1 and 5.5.1.3.4.2.

[TS 24.301 clause5.5.1.3.1]

The combined EPS attach procedure is used by a UE in CS/PS mode 1 or CS/PS mode 2 of operation to attach for both EPS and non-EPS services.

The combined EPS attach procedure is also used by a UE in CS/PS mode 1 or CS/PS mode 2 of operation to attach for EPS services if it is already attached for non-EPS services.

When the UE initiates a combined EPS attach procedure, the UE shall indicate "combined EPS/IMSI attach" in the EPS attach type IE.

The combined EPS attach procedure follows the attach procedure for EPS described in subclause 5.5.1.2.

[TS 24.301 clause5.5.1.3.2]

If the UE is in EMM state EMM-DEREGISTERED, the UE initiates the combined attach procedure by sending an ATTACH REQUEST message to the network, starting timer T3410 and entering state EMM-REGISTERED-INITIATED (see example in figure 5.5.1.2.2.1).

The UE shall include the TMSI status IE if no valid TMSI is available. Furthermore, if the UE has stored a valid location area identification, the UE shall include it in the Old location area identification IE in the ATTACH REQUEST message.

[TS 24.301 clause5.5.1.3.4.1]

Depending on the value of the EPS attach result IE received in the ATTACH ACCEPT message, two different cases can be distinguished:

1) The EPS attach result IE value indicates "combined EPS/IMSI attach": attach for EPS and non-EPS services have been successful.

…

[TS 24.301 clause5.5.1.3.4.2]

The description for attach for EPS services as specified in subclause 5.5.1.2.4 shall be followed. In addition, the following description for attach for non-EPS services applies.

The TMSI reallocation may be part of the combined attach procedure. The TMSI allocated is then included in the ATTACH ACCEPT message, together with the location area identification (LAI). In this case the MME shall start timer T3450 and enter state EMM-COMMON-PROCEDURE-INITIATED as described in subclause 5.4.1.

The UE, receiving an ATTACH ACCEPT message, stores the received location area identification, stops timer T3410, resets the location update attempt counter and sets the update status to U1 UPDATED. If the message contains an IMSI, the UE is not allocated any TMSI, and shall delete any TMSI accordingly. If the message contains a TMSI, the UE shall use this TMSI as the new temporary identity. The UE shall delete its old TMSI and shall store the new TMSI. If neither a TMSI nor an IMSI has been included by the network in the ATTACH ACCEPT message, the old TMSI, if any available, shall be kept. The UE, when receiving the ATTACH ACCEPT message combined with the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message, shall send an ATTACH COMPLETE message combined with an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message to the network after which it shall enter state EMM-REGISTERED and MM state MM-IDLE and set the EPS update status to EU1 UPDATED.

9.2.1.2.1.3 Test description

9.2.1.2.1.3.1 Pre-test conditions

System Simulator:

– Cell A, cell B and cell C are configured according to Table 6.3.2.2-1 in [18]:

– Cell A belongs to TAI-1 (home PLMN);

– Cell B belongs to TAI-2 (home PLMN, another TAC);

– Cell C belongs to TAI-3 (home PLMN, another TAC).

– The different cells may not be simultaneously activated (at most 2 cells are active simultaneously).

– System information combination 3 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells;

UE:

– The UE is configured to initiate combined EPS/IMSI attach;

– The UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

Preamble:

– The UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.2.1.3.2 Test procedure sequence

Table 9.2.1.2.1.3.2-1: Main Behaviour

St	Procedure		Message Sequence				TP		Verdict
			U – S		Message
1	The SS configures: – Cell A as the “Serving cell”. – Cell B as a “Non-Suitable cell”. – Cell C as a “Non-Suitable Off cell”.		–		–		–		–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.		–		–		–		–
2	The UE is powered up or switched on.						–		–
3	Check: Does the UE send an ATTACH REQUEST message with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN. EPS attach type = "combined EPS/IMSI attach"?		–>		ATTACH REQUEST		1		P
4-7a2	Steps 5-11 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–		–		–		–
8	The SS sends ATTACH ACCEPT message with the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message.		<–		ATTACH ACCEPT		–		–
8A	The UE transmits an RRCConnectionReconfigurationComplete message to confirm the establishment of default bearer.	–>		RRC: RRCConnectionReconfigurationComplete		–		–
9	Check: Does the UE send ATTACH COMPLETE message with the ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message?		–>		ATTACH COMPLETE		2		P
9A1a1-9A3b1	Steps 16a1-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.
10-15	Void
16	The SS configures: – Cell A as a “Non-Suitable cell”. – Cell B as the “Serving cell”. – Cell C as a “Non-Suitable Off cell”.		–		–		–		–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.		–		–		–		–
17	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message in the next 30 seconds?		–		–		3		F
18-19E	Void
20	The SS configures : – Cell A as a “Non-Suitable Off cell”. – Cell B as a “Non-Suitable cell”. – Cell C as the “Serving cell”.		–		–		–		–
–	The following messages are to be observed on Cell C unless explicitly stated otherwise.		–		–		–		–
21	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message?		–>		TRACKING AREA UPDATE REQUEST		4		P
22	The SS transmits a TRACKING AREA UPDATE ACCEPT message.		<–		TRACKING AREA UPDATE ACCEPT		–		–
23	The UE transmits a TRACKING AREA UPDATE COMPLETE message?		–>		TRACKING AREA UPDATE COMPLETE		–		–
24	The SS releases the RRC connection.		–		–		–		–
25	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.		–		–		–		–
–	EXCEPTION: Step 26 describes behaviour that depends on the UE capability.
26	If pc_SwitchOnOff or pc_USIM_Removal then the UE transmits a DETACH REQUEST.		–>		DETACH REQUEST		–		–
27	The UE is brought back to operation or the USIM is inserted.		–		–		–		–
28	Check: Does the UE send ATTACH REQUEST message with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN.		–>		ATTACH REQUEST		5		P
29-37	Steps 5 to 13 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.		–		–		–		–
38	The SS sends ATTACH ACCEPT message with the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message.		<–		ATTACH ACCEPT		–		–
38A	The UE transmits an RRCConnectionReconfigurationComplete message to confirm the establishment of default bearer.	–>		RRC: RRCConnectionReconfigurationComplete		–		–
39-41b1	Steps 16 to 18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–		–		–		–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.		–		–		–		–

9.2.1.2.1.3.3 Specific message contents

Table 9.2.1.2.1.3.3-1: Message ATTACH REQUEST (step 3, Table 9.2.1.2.1.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element		Value/Remark		Comment	Condition
EPS attach type	‘0010’B		”combined EPS/IMSI attach”
Old GUTI or IMSI	GUTI-1
Last visited registered TAI	TAI-1
Old location area identification	LAI-1
TMSI status	Not Present

Table 9.2.1.2.1.3.3-2: Message ATTACH ACCEPT (step 8, Table 9.2.1.2.1.3.2-1)

Derivation path: 36.508 table 4.7.2-1
Information Element		Value/Remark		Comment	Condition
EPS attach result	‘010’B		”Combined EPS/IMSI attach”
TAI list
Number of elements	‘00001’B
Type of list	’00’B		”list of TACs belonging to one PLMN, with non-consecutive TAC values”
MCC MNC TAC 1 TAC 2	PLMN= MCC/MNC TAC 1=1 TAC 2=2		”PLMN is set to the same MCC/MNC stored in EF_IMSI” ”TAI-1” ”TAI-2”
GUTI	GUTI-2
LAI	LAI-1
MS identity	TMSI-1

Table 9.2.1.2.1.3.3-3: Void

Table 9.2.1.2.1.3.3-4: Void

Table 9.2.1.2.1.3.3-5: Message TRACKING AREA UPDATE REQUEST (step 21, Table 9.2.1.2.1.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type
EPS update type value	‘001’B	”Combined TA/LA updating”
Old GUTI	GUTI-2	”Old GUTI is included by UE if valid, IMSI otherwise”
Old location area identification	LAI-1
TMSI status	Not Present

Table 9.2.1.2.1.3.3-6: Message TRACKING AREA UPDATE ACCEPT (step 22, Table 9.2.1.2.1.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EPS update result	‘001’B	”combined TA/LA updated”
GUTI	GUTI-3
TAI list
Length of tracking area identity list contents	‘00000110’B
Partial tracking area identity list
Number of elements	‘00000’B
Type of list	’00’B	”list of TACs belonging to one PLMN, with non-consecutive TAC values”
MCC MNC TAC 1	TAI-3
Location area identification	LAI-3
MS identity	TMSI-3

Table 9.2.1.2.1.3.3-7: Message ATTACH REQUEST (step 28, Table 9.2.1.2.1.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
EPS attach type	‘0010’B	”combined EPS/IMSI attach”
Old GUTI or IMSI	GUTI-3
Last visited registered TAI	TAI-3
Old location area identification	LAI-3
TMSI status	Not Present

Table 9.2.1.2.1.3.3-8: Message ATTACH ACCEPT (step 38, Table 9.2.1.2.1.3.2-1)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark	Comment	Condition
EPS attach result	‘010’B	”Combined EPS/IMSI attach”
TAI list
Length of tracking area identity list contents	‘00000110’B
Partial tracking area identity list
Number of elements	‘00000’B
Type of list	’00’B	”list of TACs belonging to one PLMN, with non-consecutive TAC values”
MCC MNC TAC 1	TAI-3
GUTI	GUTI-3

9.2.1.2.1b Combined attach procedure / Success / SMS only

9.2.1.2.1b.1 Test Purpose (TP)

(1)

with { UE operating in CS/PS mode 1, in state EMM-REGISTERED-INITIATED}

ensure that {

when { UE receives ATTACH ACCEPT message with EPS attach result ‘combined EPS/IMSI attach’ and Additional update result IE ‘SMS only’ and indicating that IMS voice over PS sessions is not supported }

then { UE automatically disables the E-UTRA capability and performs a registration to UTRAN cell or GERAN cell(depending on the UE capability)}

}

(2)

with { UE operating in CS/PS mode 2, in state EMM-REGISTERED and state MM-IDLE}

ensure that {

then { UE sends SERVICE REQUEST message }

}

(3)

with { UE operating in CS/PS mode 2 and configured to use IMS voice, in state EMM-REGISTERED and state MM-IDLE}

ensure that {

then { UE does not initiate an IMS voice call}

(4)

with { UE operating in CS/PS mode 1" }

ensure that {

when { receives ATTACH ACCEPT message with EPS attach result ‘combined EPS/IMSI attach’ and Additional update result IE ‘SMS only’ and indicating that IMS voice over PS sessions is not supported }

then { UE does not set the E-UTRA support bit in the relevant RRC messages}

9.2.1.2.1b.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 24.301 clauses 4.3.1, 4.5, 5.5.1.3.1, 5.5.1.3.4.1 5.5.1.3.4.2 and 5.6.2.4.

[TS 24.301 clause 4.3.1]

The behaviour of the UE in CS/PS mode 1 of operation, upon failure to access the CS domain or upon reception of a "CS fallback not preferred" or "SMS only" indication, will depend on the availability of voice over IMS. In the present document, "IMS voice not available" refers to one of the following conditions:

– the UE is not configured to use IMS;

– the UE is not configured to use IMS voice, i.e. when the voice domain preference for E-UTRAN, as defined in 3GPP TS 24.167 [13B], indicates that voice communication services are allowed to be invoked only over the CS domain;

– the UE is configured to use IMS voice, but the network indicates in the ATTACH ACCEPT message or the TRACKING AREA UPDATE ACCEPT message that IMS voice over PS sessions are not supported; or

– the UE is configured to use IMS voice, the network indicates in the ATTACH ACCEPT message or the TRACKING AREA UPDATE ACCEPT message that IMS voice over PS sessions are supported, but the upper layers indicate that the UE is not available for voice calls in the IMS.

[TS 24.301 clause 4.5]

When the UE supporting the A/Gb and/or Iu mode together with the S1 mode needs to stay in A/Gb or Iu mode, in order to prevent unwanted handover or cell reselection from UTRAN/GERAN to E-UTRAN, the UE shall disable the E-UTRA capability.

– The UE shall not set the E-UTRA support bits of the MS Radio Access capability IE (see 3GPP TS 24.008 [13], subclause 10.5.5.12a), the E-UTRA support bits of Mobile Station Classmark 3 IE (see 3GPP TS 24.008 [13], subclause 10.5.1.7) and the ISR support bit of the MS network capability IE (see 3GPP TS 24.008 [13], subclause 10.5.5.12) in the ATTACH REQUEST message and the ROUTING AREA UPDATE REQUEST message after it selects GERAN or UTRAN; and

– the UE NAS layer shall indicate the access stratum layer(s) of disabling of the E-UTRA capability.

NOTE: The UE can only disable the E-UTRAN capabilities when in EMM-IDLE mode.

The UE shall enable the E-UTRA capability again in the following cases:

– the UE mode of operation changes from CS/PS mode 1 of operation to CS/PS mode 2 of operation;

– the UE mode of operation changes from PS mode 1 of operation to PS mode 2 of operation;

– the UE powers off and powers on again; or

– for the PLMN selection purpose.

[TS 24.301 clause5.5.1.3.1]

The combined attach procedure is used by a UE in CS/PS mode 1 or CS/PS mode 2 of operation to attach for both EPS and non-EPS services, or both EPS services and "SMS only".

The combined attach procedure is also used by a UE in CS/PS mode 1 or CS/PS mode 2 of operation to attach for EPS services if it is already IMSI attached for non-EPS services.

When the UE initiates a combined attach procedure, the UE shall indicate "combined EPS/IMSI attach" in the EPS attach type IE.

The combined attach procedure follows the attach procedure for EPS described in subclause 5.5.1.2.

[TS 24.301 clause5.5.1.3.2]

If the UE initiates a combined attach procedure for EPS services and "SMS only", the UE shall indicate "SMS only" in the Additional update type IE.

[TS 24.301 clause5.5.1.3.4.1]

Depending on the value of the EPS attach result IE received in the ATTACH ACCEPT message, the following different cases can be distinguished:

1) The EPS attach result IE value indicates "combined EPS/IMSI attach": attach for EPS and non-EPS services, or for EPS services and "SMS only" have been successful.

…

[TS 24.301 clause5.5.1.3.4.2]

The description for attach for EPS services as specified in subclause 5.5.1.2.4 shall be followed. In addition, the following description for attach for non-EPS services or "SMS only" applies.

…

If the UE requested "SMS only" in the Additional update type IE, the network shall indicate "SMS only" in the Additional update result IE.

If the ATTACH ACCEPT message includes the Additional update result IE with value "SMS only" or "CS Fallback not preferred", a UE operating in CS/PS mode 1 with "IMS voice not available" shall attempt to select GERAN or UTRAN radio access technology rather than E-UTRAN for the selected PLMN or equivalent PLMN. The UE shall disable the E-UTRA capability (see subclause 4.5). If the UE is in the EMM-CONNECTED mode, the UE shall locally release the established NAS signalling connection and enter the EMM-IDLE mode before selecting GERAN or UTRAN radio access technology.

If the ATTACH ACCEPT message includes the Additional update result IE with value "SMS only", a UE operating in CS/PS mode 2 shall not attempt to use CS fallback for mobile originating services.

….

[TS 24.301 clause5.6.2.4]

The network shall initiate the paging procedure when it receives an incoming mobile terminating SMS to the UE that is IMSI attached for non-EPS services or for "SMS only", and no NAS signalling connection exists.

To initiate the procedure for SMS when no NAS signalling connection exists, the EMM entity in the network requests the lower layer to start paging (see 3GPP TS 36.413 [23]). The paging message shall include a CN domain indicator set to "PS". The paging procedure is performed according to subclause 5.6.2.2.1. The MME shall not start timer T3413 for this procedure.

9.2.1.2.1b.3 Test description

9.2.1.2.1b.3.1 Pre-test conditions

System Simulator:

– Cell A is configured according to Table 6.3.2.2-1 in [18].

– If pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, Cell 5;

– If pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN then, Cell 24;

– Cell 24 belongs to LAI-1 and RAI-1(home PLMN)

– System information combination 10 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

NOTE: Setting px_RATComb_Tested = EUTRA_Only is not allowed.

UE:

– The UE is configured to initiate combined EPS/IMSI attach and to be voice centric (UE operates in CS/PS mode 1). If the UE does not support to be configured voice centric initiate combined EPS/IMSI attach and to be data centric (UE operates in CS/PS mode 2).

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

Preamble:

– The UE is in state Switched OFF (state 1) according to [18].

9.2.1.2.1b.3.2 Test procedure sequence

Table 9.2.1.2.1b.3.2-1: Main Behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
	The following messages are sent and shall be received on cell A.
1	Set the cell type of cell A to the ”Serving cell”. Set the cell type of cell 5 or cell 24 to the ” Non-Suitable cell ”.	–	–	–	–
2	The UE is powered up or switched on.			–	–
2A1	UE sends RRCConnectionRequest message	–	–	–	–
2A2	SS sends RRCConnectionSetup message	–	–	–	–
2A3	Set the cell type of cell 5 or cell 24 to ”Suitable neighbour cell”.	–	–	–	–
3	UE sends ATTACH REQUEST message with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN. EPS attach type = "combined EPS/IMSI attach".	–>	ATTACH REQUEST	–	–
4-7Aa2	Void	–	–	–	–
7B-7H	Steps 5-11 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed	–	–	–	–
8	The SS sends ATTACH ACCEPT message with the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message.	<–	ATTACH ACCEPT	–	–
9	Void	–	–	–	–
10	Void	–	–	–	–
–	EXCEPTION: Steps 11a1 to 11b3a2 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported
11a1	IF the UE is configured in CS/PS mode 1 of operation THEN perform actions specified in Table 9.2.1.2.1b.3.2-2.
11a2a1-11a2a4	Void	–	–	–	–
11a3-11a6	Void	–	–	–	–
11b0	ELSE The UE transmits an ATTACH COMPLETE message.	–>	ATTACH COMPLETE	–	–
11b1a1-11b3b1	Steps 16a1-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed	–	–	–	–
11b2	Check: Does the UE respond to paging on cell A with S-TMSI in GUTI-2 for PS domain?(Generic Procedure TS 36.508 6.4.2.4)	–	–	2	P
–	EXCEPTION: Steps 11b3a1 to 11b3a2 describe behaviour that depends on the UE capability.
11b3 a1	IF pc_VoLTE THEN an IMS voice call is initiated	–	–	–	–
11b3a2	Check: Does the UE send RRC CONNECTION REQUEST message?	–>	RRC CONNECTION REQUEST	3	F
Note 1: Void

Table 9.2.1.2.1b.3.2-2: CS/PS mode 1 of operation with “IMS voice not available” behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
–	EXCEPTION: Steps 1a1 to 1c2 depend on UE release. IF UE is Release 8, Release 9 or Release 10steps 1a1 to 1b3 are considered. Steps 1a1 to 1b3 are optional and depend on UE implementation. They shall be executed if the UE sends an ATTACH COMPLETE with the ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message OR a DETACH REQUEST message during [2] seconds. The "lower case letter" identifies a step sequence that takes place if a particular condition specified in the first step is met. Note: UE may also locally release the established NAS signalling connection and start 2G/3G search immediately. ELSE IF UE is Release 11 onward, steps 1c1 and 1c2 are executed.	–	–	–	–
1a1	IF UE sent an ATTACH COMPLETE message with the ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message	–>	ATTACH COMPLETE	–	–
–	EXCEPTION: Steps 1a2a1 to 1a2a2 are optional and depend on UE implementation; the second "lower case letter" identifies a step sequence that takes place if the condition is met.	–	–	–	–
1a2a1	IF UE sends a DETACH REQUEST message during [2] seconds.	–>	DETACH REQUEST	–	–
1a2a2	SS sends a DETACH ACCEPT message.	<–	DETACH ACCEPT	–	–
1a3	SS releases the RRC connection	–	–	–	–
1b1	IF UE sent a DETACH REQUEST message.	–>	DETACH REQUEST	–	–
1b2	SS sends a DETACH ACCEPT message. Note: It is not explicitly defined what the network should do if the UE did not send ATTACH COMPLETE.	<–	DETACH ACCEPT	–	–
1b3	SS releases the RRC connection	–	–	–	–
e	EXCEPTION: In parallel to the event described in step 1c1 below, the generic procedure for IP address allocation in the U-plane specified in TS 36.508 subclause 4.5A.1 takes place performing IP address allocation in the U-plane.	–	–	–	–
1c1	The UE transmits an ATTACH COMPLETE message with the ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message	–>	ATTACH COMPLETE	–	–
1c2	SS releases the RRC connection	–	–	–	–
2	Void	–	–	–	–
–	The following messages shall be received on Cell 5 or Cell 24	–	–	–	–
–	EXCEPTION: Steps 3a1 to 3a3 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported	–	–	–	–
3a1	IF pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA THEN Check: Does the UE send RRC CONNECTION REQUEST on Cell 5?	–>	RRC CONNECTION REQUEST	4	P
3a2	The SS transmits an RRC CONNECTION SETUP message on Cell 5.	<–	RRC CONNECTION SETUP	–	–
3a3	Check: Does the UE transmit a RRC CONNECTION SETUP COMPLETE message on Cell 5?	–>	RRC CONNECTION SETUP COMPLETE	4	P
–	EXCEPTION: Steps 4a1 to 4b5 depend on UE implementation; the "lower case letter" identifies a step sequence that takes place if the condition is met.	–	–	–	–
4a1	IF UE did not sent DETACH REQUEST in step 1a2a1 or 1b1 AND UE transmits a ROUTING AREA UPDATE REQUEST message during [2] seconds THEN check contents of ROUTING AREA UPDATE REQUEST	–>	ROUTING AREA UPDATE REQUEST	1	P
–	EXCEPTION: Steps 4a1Aa1 to 4a2 Steps 4a1Aa1 to 4a2 A depend on the UE implementation. Step 4a1Aa1 to 4a1A a3 take place if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN		–	–	–
4a1Aa1	The SS transmits an AUTHENTICATION AND CIPHERING REQUEST message. from Cell 24	<–	AUTHENTICATION AND CIPHERING REQUEST	–	–
4a1Aa2	The UE transmits a AUTHENTICATION AND CIPHERING RESPONSE message on Cell 24	–>	AUTHENTICATION AND CIPHERING RESPONSE	–	–
4a1Aa3	The SS transmits a ROUTING AREA UPDATE ACCEPT message	<–	ROUTING AREA UPDATE ACCEPT	–	–
4a2	Void.	–	–	–	–
4a2A	If px_RATComb_Tested = EUTRA_UTRA the SS transmits a ROUTING AREA UPDATE ACCEPT message with “Follow-on proceed” set to 0 if UE set the “Follow-on request” to 1 in the RAU REQUEST at step 4a1.	<–	ROUTING AREA UPDATE ACCEPT	–	–
4a3	The UE transmits a ROUTING AREA UPDATE COMPLETE message.	–>	ROUTING AREA UPDATE COMPLETE	–	–
–	EXCEPTION: steps 4a4, 4a4A to 4a4C take place if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA AND UE set the “Follow-on request” to 1 in the RAU REQEST at step 4a1 (see NOTE 1)	–	–	–	–
4a4	The UE transmits a SERVICE REQUEST message on Cell 5	–>	SERVICE REQUEST	–	–
4a4A	The SS transmits a SERVICE ACCEPT message on Cell 5	<–	SERVICE ACCEPT	–	–
4a4B	The SS transmits RadioBearerSetup message to Setup PS RAB on Cell 5	<–	RadioBearerSetup	–	–
4a4C	The UE transmits RadioBearerSetupComplete message on Cell 5	–>	radioBearerSetupComplete	–	–
4b1	ELSE check: Does the UE transmit an ATTACH REQUEST message?.	–>	ATTACH REQUEST	1	P
4b2	The SS transmits an AUTHENTICATION AND CIPHERING REQUEST message.	<–	AUTHENTICATION AND CIPHERING REQUEST	–	–
4b3	The UE transmits a AUTHENTICATION AND CIPHERING RESPONSE message.	–>	AUTHENTICATION AND CIPHERING RESPONSE	–	–
4b4	The SS transmits an ATTACH ACCEPT message.	<–	ATTACH ACCEPT	–	–
4b5	The UE transmits an ATTACH COMPLETE message.	–>	ATTACH COMPLETE	–	–
4b6	The UE may attempt the generic procedures for IMS signalling defined in 36.508 4.5A.3A (for cell 5) or 4.5A.3B (for cell 24)
5	SS releases the RRC connection	–	–	–	–
NOTE 1: The SERVICE REQUEST procedure may be triggered by the need for the UE to send an UL IPv6 packet (e.g. for ICMPv6 Router Solicitation)

9.2.1.2.1b.3.3 Specific message contents

Table 9.2.1.2.1b.3.3-1: Message ATTACH REQUEST (step 3, Table 9.2.1.2.1b.3.2-1)

Derivation path: 36.508 table 4.7.2.-4
Information Element		Value/Remark		Comment	Condition
EPS attach type	‘0010’B		”combined EPS/IMSI attach”
Old GUTI or IMSI	GUTI-1
Last visited registered TAI	TAI-1
Old location area identification	LAI-1
TMSI status	Not Present

Table 9.2.1.2.1b.3.3-2: Message ATTACH ACCEPT (step 8, Table 9.2.1.2.1b.3.2-1)

Derivation path: 36.508 table 4.7.2-1
Information Element		Value/Remark		Comment	Condition
EPS attach result	‘010’B		”Combined EPS/IMSI attach”
GUTI	GUTI-2
EPS network feature support	‘0000 0000’B		IMS voice over PS session in S1 mode NOT supported
Additional update result	’10’B0000		SMS only

Table 9.2.1.2.1b.3.3-3: Message RRC Connection Request (step 3 a1, Table 9.2.1.2.1b.3.2-2)

Derivation path: 34.108 sub-clause 9.1.1
Information Element	Value/Remark	Comment	Condition
Pre-redirection info	Not present OR value as specified below
> Support of E-UTRA FDD	False	E-UTRA FDD not supported
> Support of E-UTRA TDD	False	E-UTRA TDD not supported

Table 9.2.1.2.1b.3.3-4: Message RRC Connection Setup Complete (step 3 a3, Table 9.2.1.2.1b.3.2-2)

Derivation path: 34.108 sub-clause 9.1.1
Information Element	Value/Remark	Comment	Condition
UE radio access capability		The UE shall not indicate support for E-UTRAN
>UE multi-mode/multi-RAT capability	Not present OR value as specified below
>> Multi-RAT capability
>>> Support of Inter-RAT PS Handover to E-UTRA FDD	Not present
>>> Support of E-UTRA TDD	Not present
>>> Support of Inter-RAT PS Handover to E-UTRA TDD	Not present
>>> EUTRA Feature Group Indicators	Not checked

Table 9.2.1.2.1b.3.3-5: Message ROUTING AREA UPDATE REQUEST (step4 a1, Table 9.2.1.2.1b.3.2-2)

Derivation path: 36.508 table 4.7B.2-1
Information Element	Value/Remark	Comment	Condition
MS Radio Access capability		The UE shall not indicate support for E-UTRAN
MS RA capability value part
Access capabilities
E-UTRA FDD support :	‘0’B
E-UTRA TDD support	‘0’B
GERAN to E-UTRA support in GERAN packet transfer mode	‘00’B
UE network capability	Not Present	UE does not support S1 mode any more

Table 9.2.1.2.1b.3.3-5A: ROUTING AREA UPDATE ACCEPT (step4a1Aa3, Table 9.2.1.2.1b.3.2-2)

Derivation path: 36.508, Table 4.7B.2-2
Information Element	Value/Remark	Comment	Condition
PDP context status	0000000000000000	NSAPI(0) – NSAPI(15) is set to 0, which means that the SM state of all PDP contexts is PDP-INACTIVE

Table 9.2.1.2.1b.3.3-6: Message ATTACH REQUEST (step4 b1, Table 9.2.1.2.1b.3.2-2)

Derivation path: 36.508 table 4.7B.2-6
Information Element	Value/Remark	Comment	Condition
MS Radio Access capability		The UE shall not indicate support for E-UTRAN
MS RA capability value part
Access capabilities
E-UTRA FDD support :	‘0’B
E-UTRA TDD support	‘0’B
GERAN to E-UTRA support in GERAN packet transfer mode	‘00’B
UE network capability	Not Present	UE does not support S1 mode any more

9.2.1.2.1c Combined attach procedure / Success / EPS and CS Fallback not preferred

9.2.1.2.1c.1 Test Purpose (TP)

(1)

with { UE operating in CS/PS mode 1 in state EMM-REGISTERED-INITIATED}

ensure that {

when { UE receives ATTACH ACCEPT message with “EPS network feature support” IE indicating that “IMS voice over PS session in S1 mode NOT supported” and “Additional update result” IE indicating “CS Fallback not preferred”}

then { UE attempts to register on UTRAN cell and automatically disables its E-UTRAN capability.}

}

(2)

with { UE operating in CS/PS mode 1 in OFF state after having its E-UTRAN capability disabled}

ensure that {

when { UE is switched on }

then { UE re-enables its E-UTRA capability and registers on the E-UTRAN cell}

}

(3)

with { UE operating in CS/PS mode 1 }

ensure that {

when { UE receives ATTACH ACCEPT message with EPS attach result ‘combined EPS/IMSI attach’ and Additional update result IE ‘CS Fallback not preferred’ and with “EPS network feature support” IE indicating that “IMS voice over PS session in S1 mode NOT supported”}

then { UE does not set the E-UTRA support bit in the relevant NAS and AS messages}

9.2.1.2.1c.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 24.301 clauses 4.3.1, 4.5 and 5.5.1.3.4.2.

[TS 24.301 clause 4.3.1]

The behaviour of the UE in CS/PS mode 1 of operation, upon failure to access the CS domain or upon reception of a “CS fallback not preferred” or “SMS only” indication, will depend on the availability of voice over IMS. In the present document, “IMS voice not available” refers to one of the following conditions:

– the UE is not configured to use IMS;

– the UE is configured to use IMS voice, but the network indicates in the ATTACH ACCEPT message or the TRACKING AREA UPDATE ACCEPT message that IMS voice over PS sessions are not supported; or

[TS 24.301 clause 4.5]

– the UE NAS layer shall indicate the access stratum layer(s) of disabling of the E-UTRA capability.

NOTE: The UE can only disable the E-UTRAN capabilities when in EMM-IDLE mode.

The UE shall enable the E-UTRA capability again in the following cases:

– the UE mode of operation changes from CS/PS mode 1 of operation to CS/PS mode 2 of operation;

– the UE mode of operation changes from PS mode 1 of operation to PS mode 2 of operation;

– the UE powers off and powers on again; or

– for the PLMN selection purpose.

[TS 24.301 clause 5.5.1.3.4.2]

If the UE requested "SMS only" in the Additional update type IE, the network shall indicate "SMS only" in the Additional update result IE.

If the ATTACH ACCEPT message includes the Additional update result IE with value "SMS only", a UE operating in CS/PS mode 2 shall not attempt to use CS fallback for mobile originating services.

If the ATTACH ACCEPT message includes the Additional update result IE with value "CS Fallback not preferred", this indicates to a UE operating in CS/PS mode 2 that it is attached for EPS and non-EPS services and that it can use CS fallback.

9.2.1.2.1c.3 Test description

9.2.1.2.1c.3.1 Pre-test conditions

System Simulator:

– cell A and cell 5 and both belong to PLMN1;

– System information combination 4 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

UE:

– the UE is configured to initiate combined EPS/IMSI attach;

– the UE is configured to be voice centric

The HPLMN is PLMN1

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.2.1c.3.2 Test procedure sequence

Table 9.2.1.2.1c.3.2-1: Main Behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
–	Cell A is set to “Serving cell” and Cell 5 is set to “Non suitable cell”	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
1	The UE is powered up or switched on.	–	–	–	–
2	UE sends RRCConnectionRequest message	–	–	–	–
3	SS sends RRCConnectionSetup message	–	–	–	–
4	Set the cell type of cell 5 to ”Suitable neighbour cell”.	–	–	–	–
5	UE sends ATTACH REQUEST message with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN. EPS attach type = "combined EPS/IMSI attach".	–>	ATTACH REQUEST	–	–
6	The SS starts an authentication procedure	<–	AUTHENTICATION REQUEST	–	–
7	The UE responds properly to the authentication procedure	–>	AUTHENTICATION RESPONSE	–	–
8	The SS starts a NAS security mode command procedure to perform NAS integrity protection.	<–	SECURITY MODE COMMAND	–	–
9	The UE responds properly to the NAS security mode command procedure	–>	SECURITY MODE COMPLETE	–	–
–	EXCEPTION: Steps 9a1 to 9a2 describe behaviour that depends on UE configuration; the "lower case letter" identifies a step sequence that take place if the UE has ESM information which needs to be transferred.	–	–	–	–
9a1	IF the UE sets the ESM information transfer flag in the last PDN CONNECTIVITY REQUEST message THEN the SS transmits an ESM INFORMATION REQUEST message to initiate exchange of protocol configuration options and/or APN.	<–	ESM INFORMATION REQUEST	–	–
9a2	The UE transmits an ESM INFORMATION RESPONSE message to transfer protocol configuration options and/or APN.	–>	ESM INFORMATION RESPONSE	–	–
10	The SS sends ATTACH ACCEPT message with the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message.	<–	ATTACH ACCEPT	–	–
11	Perform actions specified in Table 9.2.1.2.1c.3.2-2	–	–	–	–
–	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
–	EXCEPTION: Step 12 describes behaviour that depends on the UE capability.	–	–
12a	If pc_SwitchOnOff or pc_USIM_Removal then the UE transmits a DETACH REQUEST.	–>	DETACH REQUEST	–	–
13	Set the cell type of cell 5 to ”Non suitable”.
14	The UE is brought back to operation or the USIM is inserted.	–	–
15	Check: Does the UE send RRCConnectionRequest on Cell A?	–	–	2	P
16-30	Steps 3-17 of the registration procedure described in TS 36.508 table 4.5.2.3-1 are performed.	–	–	–	–

Table 9.2.1.2.1c.3.2-2: CS/PS mode 1 of operation with “IMS voice not available” behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
–	EXCEPTION: Step 1a1 to 1d6 are optional and depend on UE implementation. The "lower case letter" identifies a step sequence that takes place if a particular condition specified in the first step is met within [2] seconds.	–	–	–	–
1a1	IF UE is Release 8, 9 or 10 and sent an ATTACH COMPLETE message with the ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message	–>	ATTACH COMPLETE	–	–
–	EXCEPTION: Steps 1a2a1 to 1a2a2 are optional and depend on UE implementation; the second "lower case letter" identifies a step sequence that takes place if the condition is met..	–	–	–	–
1a2a1	IF UE sends a DETACH REQUEST message during [2] seconds.	–>	DETACH REQUEST	–	–
1a2a2	SS sends a DETACH ACCEPT message.	<–	DETACH ACCEPT	–	–
1a3	SS releases the RRC connection	–	–	–	–
1a4	Check: Does the UE send RRC CONNECTION REQUEST on Cell 5?	–	–	1,3	P
1a5	The SS sends RRC CONNECTION SETUP	–		–	–
1a6	The UE sends RRC CONNECTION SETUP COMPLETE	–		3	–
1a7	Perform actions specified in Table 9.2.1.2.1c.3.2-3
1b1	IF UE is Release 8, 9 or 10 and sent a DETACH REQUEST message.	–>	DETACH REQUEST	–	–
1b2	SS sends a DETACH ACCEPT message. Note: It is not explicitly defined what the network should do if the UE did not send ATTACH COMPLETE.	<–	DETACH ACCEPT	–	–
1b3	SS releases the RRC connection	–	–	–	–
1b4	Check: Does the UE send RRC CONNECTION REQUEST on Cell 5?	–	–	1,3	P
1b5	The SS sends RRC CONNECTION SETUP	–		–	–
1b6	The UE sends RRC CONNECTION SETUP COMPLETE	–		3	–
1b7	Perform actions specified in Table 9.2.1.2.1c.3.2-3
1c1	IF the UE is Release 8, 9 or 10 and moved straight to. Check: Does the UE send RRC CONNECTION REQUEST on Cell 5?	–	–	3	P
1c2	The SS sends RRC CONNECTION SETUP	–		–	–
1c3	The UE sends RRC CONNECTION SETUP COMPLETE	–		3	–
1c4	Perform actions specified in Table 9.2.1.2.1c.3.2-3
–	EXCEPTION: In parallel to the event described in step 1d1 below, the generic procedure for IP address allocation in the U-plane specified in TS 36.508 subclause 4.5A.1 takes place performing IP address allocation in the U-plane.	–	–	–	–
1d1	IF the UE is Release 11 onwards, it sends an ATTACH COMPLETE message with the ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message	–>	ATTACH COMPLETE	–	–
1d2	SS releases the RRC connection	–	–	–	–
1d3	Check: Does the UE send RRC CONNECTION REQUEST on Cell 5?	–	–	1,3	P
1d4	The SS sends RRC CONNECTION SETUP	–		–	–
1d5	The UE sends RRC CONNECTION SETUP COMPLETE	–		3	–
1d6	Perform actions specified in Table 9.2.1.2.1c.3.2-3

Table 9.2.1.2.1c.3.2-3: Registration on UTRAN cell behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
–	EXCEPTION: Steps 1a1 to 1b5 depend on UE implementation; the "lower case letter" identifies a step sequence that takes place if the condition is met..	–	–	–	–
1a1	IF UE did not sent DETACH REQUEST in step 1a2a1 or 1b1 in Table 9.2.1.2.1c.3.2-2 AND UE transmits a ROUTING AREA UPDATE REQUEST message during [2] seconds THEN check contents of ROUTING AREA UPDATE REQUEST	–>	ROUTING AREA UPDATE REQUEST	3	P
1a2	The SS transmits a ROUTING AREA UPDATE ACCEPT message.	<–	ROUTING AREA UPDATE ACCEPT	–	–
1a3	The UE transmits a ROUTING AREA UPDATE COMPLETE message.	–>	ROUTING AREA UPDATE COMPLETE	–	–
–	EXCEPTION: steps 1a4, 1a4A to 1a4C take place if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA AND UE set the “Follow-on request” to 1 in the RAU REQUEST at step 1a1 (see NOTE 1)	–	–	–	–
1a4	The UE transmits a SERVICE REQUEST message on Cell 5	–>	SERVICE REQUEST	–	–
1a4A	The SS transmits a SERVICE ACCEPT message on Cell 5	<–	SERVICE ACCEPT	–	–
1a4B	The SS transmits RadioBearerSetup message to Setup PS RAB on Cell 5	<–	RadioBearerSetup	–	–
1a4C	The UE transmits RadioBearerSetupComplete message on Cell 5	–>	radioBearerSetupComplete	–	–
1b1	ELSE check: Does the UE transmit an ATTACH REQUEST message?.	–>	ATTACH REQUEST	3	P
1b2	The SS transmits an AUTHENTICATION AND CIPHERING REQUEST message.	<–	AUTHENTICATION AND CIPHERING REQUEST	–	–
1b3	The UE transmits a AUTHENTICATION AND CIPHERING RESPONSE message.	–>	AUTHENTICATION AND CIPHERING RESPONSE	–	–
1b4	The SS transmits an ATTACH ACCEPT message.	<–	ATTACH ACCEPT	–	–
1b5	The UE transmits an ATTACH COMPLETE message.	–>	ATTACH COMPLETE	–	–
2	SS releases the RRC connection	–	–	–	–

NOTE 1: The SERVICE REQUEST procedure may be triggered by the need for the UE to send an UL IPv6 packet (e.g. for ICMPv6 Router Solicitation).

9.2.1.2.1c.3.3 Specific message contents

Table 9.2.1.2.1c.3.3-1: Message ATTACH ACCEPT (step 10, Table 9.2.1.2.1c.3.2-1)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark	Comment	Condition
EPS attach result	‘010’B	”Combined EPS/IMSI attach”
ESM message container	ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message to activate the default bearer	There is no message piggybacked in it.
EPS network feature support	‘0000 0000’B	IMS voice over PS session in S1 mode NOT supported
Additional update result	‘01’b	“CS Fallback not preferred”

Table 9.2.1.2.1c.3.3-2: Message RRC Connection Request (steps 1a4, 1b4, 1c1 and 1d3 Table 9.2.1.2.1c.3.2-2)

Derivation path: 34.108 sub-clause 9.1.1
Information Element	Value/Remark	Comment	Condition
Pre-redirection info		Optional IE, but if transmitted it should have the below values
> Support of E-UTRA FDD	False	E-UTRA FDD not supported
> Support of E-UTRA TDD	False	E-UTRA TDD not supported

Table 9.2.1.2.1c.3.3-3: Message RRC Connection Setup Complete (steps 1b6 , 1c3 and 1d5 Table 9.2.1.2.1c.3.2-2)

Derivation path: 34.108 sub-clause 9.1.1
Information Element	Value/Remark	Comment	Condition
UE radio access capability		The UE shall not indicate support for E-UTRAN
>UE multi-mode/multi-RAT capability
>> Multi-RAT capability
>>> Support of Inter-RAT PS Handover to E-UTRA FDD	Not present
>>> Support of E-UTRA TDD	Not present
>>> Support of Inter-RAT PS Handover to E-UTRA TDD	Not present
>>> EUTRA Feature Group Indicators	Not checked

Table 9.2.1.2.1c.3.3-4: Message ROUTING AREA UPDATE REQUEST (step 1a1, Table 9.2.1.2.1c.3.2-3)

Derivation path: 24.008 table 9.4.14
Information Element	Value/Remark	Comment	Condition
Update type	Any Value	The setting of Follow-on request (FOR) will have impact on the setting of ‘Update Results in Table 9.2.1.2.1c.3.3-6
MS Radio Access capability		The UE shall not indicate support for E-UTRAN
MS RA capability value part
Access capabilities
E-UTRA FDD support	‘0’B
E-UTRA TDD support	‘0’B
GERAN to E-UTRA support in GERAN packet transfer mode	‘00’B
UE network capability	Not Present	UE does not support S1 mode any more

Table 9.2.1.2.1c.3.3-5: Message ATTACH REQUEST (step 1b1, Table 9.2.1.2.1c.3.2-3)

Derivation path: 24.008 table 9.4.1
Information Element	Value/Remark	Comment	Condition
MS Radio Access capability		The UE shall not indicate support for E-UTRAN
MS RA capability value part
Access capabilities
E-UTRA FDD support	‘0’B
E-UTRA TDD support	‘0’B
UE network capability	Not Present	UE does not support S1 mode any more
GERAN to E-UTRA support in GERAN packet transfer mode	‘00’B

Table 9.2.1.2.1c.3.3-6: Message ROUTING AREA UPDATE ACCEPT (step 1a2, Table 9.2.1.2.1c.3.2-3)

Derivation path: 36.508, table 4.7B.2-2
Information Element	Value/remark	Comment	Condition
Update result	1 ‘No follow-on proceed’	If UE set the “Follow-on request” to 0 in the RAU REQUEST Table 9.2.1.2.1c.3.3-4 ( step 1a1 Table 9.2.1.2.1c.3.2-3)
Update result	0 ‘Follow-on proceed’	If UE set the “Follow-on request” to 1 in the RAU REQUEST Table 9.2.1.2.1c.3.3-4 ( step 1a1 Table 9.2.1.2.1c.3.2-3)

9.2.1.2.1d Combined attach procedure / Success / EPS and CS Fallback not preferred/data centric UE

9.2.1.2.1d.1 Test Purpose (TP)

(1)

with { UE operating in CS/PS mode 2 in state EMM-REGISTERED-INITIATED}

ensure that {

then { UE stays on the E-UTRAN cell}

}

(2)

with { UE operating in CS/PS mode 2}

ensure that {

when receives a TRACKING AREA UPDATE ACCEPT message with “EPS network feature support” IE indicating that “IMS voice over PS session in S1 mode NOT supported” and “Additional update result” IE indicating “CS Fallback not preferred” }

then { The UE is able to initiate an MO-CS fallback call}

}

(3)

with { UE operating in CS/PS mode 2}

ensure that {

when receives a ATTACH ACCEPT message with “EPS network feature support” IE indicating that “IMS voice over PS session in S1 mode NOT supported” and “Additional update result” IE indicating “CS Fallback not preferred” }

then { The UE is able to receive MT CS fallback call}

}

9.2.1.2.1d.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 24.301 clauses 4.3.1, 4.5 and 5.5.1.3.4.2.

[TS 24.301 clause 4.3.1]

– the UE is not configured to use IMS;

– the UE is configured to use IMS voice, but the network indicates in the ATTACH ACCEPT message or the TRACKING AREA UPDATE ACCEPT message that IMS voice over PS sessions are not supported; or

[TS 24.301 clause 4.5]

The UE shall enable the E-UTRA capability again in the following cases:

– the UE mode of operation changes from CS/PS mode 1 of operation to CS/PS mode 2 of operation;

– the UE mode of operation changes from PS mode 1 of operation to PS mode 2 of operation;

– the UE powers off and powers on again; or

– for the PLMN selection purpose.

[TS 24.301 clause 5.5.1.3.4.2]

If the UE requested "SMS only" in the Additional update type IE, the network shall indicate "SMS only" in the Additional update result IE.

If the ATTACH ACCEPT message includes the Additional update result IE with value "SMS only", a UE operating in CS/PS mode 2 shall not attempt to use CS fallback for mobile originating services.

9.2.1.2.1d.3 Test description

9.2.1.2.1d.3.1 Pre-test conditions

System Simulator:

– cell A and cell 5

UE:

– the UE is configured to initiate combined EPS/IMSI attach;

– the UE is configured to be data centric

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

Table 9.2.1.2.1d.3.1–1: Void

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.2.1d.3.2 Test procedure sequence

Table 9.2.1.2.1d.3.2-1: Void

Table 9.2.1.2.1d.3.2-2: Void

Table 9.2.1.2.1d.3.2-3: Main Behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
–	The following messages are to be observed on Cell A unless explicitly stated otherwise. Cell A is configured as the Serving Cell and Cell 5 is configured as a Non-Suitable Cell	–	–	–	–
1	The UE is powered up or switched on.			–	–
2-16	Steps 2-16 of the registration procedure described in TS 36.508 table 4.5.2.3-1 are performed.			–	–
16A	Cell 5 is configured as a Suitable Neighbour Cell	–	–	–	–
17	Check: Does the UE try to access the UTRAN cell (cell 5) in the next 90s?			1	F
18	The SS transmits a Paging message to the UE on Cell A using S-TMSI with CN domain indicator set to “CS”	–	–	–	–
–	EXCEPTION: Step 19a1 describes behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that takes place if a capability is supported.	–	–	–	–
19a1	IF the UE needs to request upper layer input before accepting the CS fallback, the incoming CS call is accepted at the UE through MMI or AT command.	–	–	–	–
20	The UE transmits an RRCConnectionRequest message on Cell A.	–	–	–	–
21	The SS transmits an RRCConnectionSetup message on Cell A.	–	–	–	–
22	Check: Does the UE transmit an RRCConnectionSetupComplete message containing an EXTENDED SERVICE REQUEST?	–>	EXTENDED SERVICE REQUEST	3	P
23	The SS transmits an RRCConnectionRelease message on Cell A with IE redirectionInformation including UTRA-CarrierFreq of Cell 5.	–	–	–	–
23A	Cell A is configured as the Non-Suitable Cell	–	–	–	–
24-42	Steps 1-19 of the procedure described in TS 36.508 table 6.4.3.7.1-1 TS 36.508. A CS call is set up in the UTRAN cell.	–		–	–
42A-42F	The CS call is terminated. CC Disconnect procedure described in TS 36.5.23-3 table 10.1.3.1-1	–	–	–	–
42G	Cell A is configured as the Serving Cell	–	–	–	–
43-48	Steps 2-7 of the tracking area updating procedure on cell A as described in TS 36.508 table 4.5A.2.1-1 are performed
–	A CS call is initiated.	–	–	–	–
49	The UE transmits an RRCConnectionRequest message on Cell A.	–	–	–	–
50	The SS transmits an RRCConnectionSetup message on Cell A.	–	–	–	–
51	Check: Does the UE transmit an RRCConnectionSetupComplete message containing an EXTENDED SERVICE REQUEST message?	–>	EXTENDED SERVICE REQUEST	2	P
52	The SS transmits an RRCConnectionRelease message on Cell A with IE redirectionInformation including UTRA-CarrierFreq of Cell 5.	–	–	–	–
53-71	Steps 1-19 of the procedure described in TS 36.508 table 6.4.3.7.2-1. A CS call is set up in the UTRAN cell.	–	–	–	–

9.2.1.2.1d.3.3 Specific message contents

Table 9.2.1.2.1d.3.3-1: Message ATTACH ACCEPT (step 14, Table 9.2.1.2.1d.3.2-3)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark	Comment	Condition
EPS attach result	‘010’B	”Combined EPS/IMSI attach”
ESM message container	Empty	There is no message piggybacked in it.
EPS network feature support	‘0000 0000’B	IMS voice over PS session in S1 mode NOT supported
Additional update result	‘01’b	“CS Fallback not preferred”

Table 9.2.1.2.1d.3.3-2: Message Paging (step 18, Table 9.2.1.2.1d.3.2-3)

Derivation Path: 36.508 clause 4.6.1-7
Information Element	Value/remark	Comment	Condition
Paging ::= SEQUENCE {
pagingRecordList SEQUENCE (SIZE (1..maxPageRec)) OF SEQUENCE {	1 entry
ue-Identity[1] CHOICE {
s-TMSI	Set to the value of the S-TMSI of the UE
}
cn-Domain[1]	cs
}
}

Table 9.2.1.2.1d.3.3-3: RRCConnectionRelease (steps 23 and 44 Table 9.2.1.2.1d.3.2-3)

Derivation Path: 36.508 Table 4.6.1-15
Information Element	Value/remark	Comment	Condition
RRCConnectionRelease ::= SEQUENCE {
criticalExtensions CHOICE {
c1 CHOICE {
rrcConnectionRelease-r8 SEQUENCE {
redirectedCarrierInfo ::= CHOICE {
utra-FDD	Downlink UARFCN of cell 5		UTRA-FDD
utra-TDD	Downlink UARFCN of cell 5		UTRA-TDD
}
}
}

Table 9.2.1.2.1d.3.3-4: Message TRACKING AREA UPDATE ACCEPT (step 45, Table 9.2.1.2.1d.3.2-3)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark	Comment	Condition
EPS update result	“001”B	“Combined TA/LA updating’”
EPS network feature support	‘0000 0000’B	IMS voice over PS session in S1 mode NOT supported
Additional update result	‘01’b	“CS Fallback not preferred”

Table 9.2.1.2.1d.3.3-5: Message TRACKING AREA UPDATE REQUEST (step 44, Table 9.2.1.2.1d.3.2-3)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type
EPS update type Value	‘010’B	"Combined TA/LA updating with IMSI attach”
Old P-TMSI Signature	Any Value
Additional GUTI	Any Value
Nonce	Any Value

9.2.1.2.2 Combined attach procedure / Success / EPS services only / IMSI unknown in HSS

9.2.1.2.2.1 Test Purpose (TP)

(1)

with { UE in state EMM-DEREGISTERED and is switched off }

ensure that {

when { the UE is powered up or switched on }

then { the UE transmits an ATTACH REQUEST message with the EPS attach type set to "combined EPS/IMSI attach" and enters EMM-REGISTERED-INITIATED state }

}

(2)

with { UE in state EMM-REGISTERED-INITIATED }

ensure that {

when { the UE receives an ATTACH ACCEPT message with EPS attach result set to "EPS only" and EMM cause set to "IMSI unknown in HSS" }

then { the UE transmits an ATTACH COMPLETE message, the UE sets the update status to U3 ROAMING NOT ALLOWED, shall delete any TMSI, LAI and ciphering key sequence number and enters EMM-REGISTERED.NORMAL-SERVICE state and MM IDLE state. The USIM shall be considered as invalid for non-EPS services until switching off or the UICC containing the USIM is removed }

}

(3)

with { UE in E-UTRA EMM-REGISTERED.NORMAL-SERVICE state and MM IDLE state and USIM is invalidated by network for non-EPS services }

ensure that {

when { SS sends DETACH REQUEST message with the Detach type IE "re-attach required" }

then { the UE sends DETACH ACCEPT message, and then the UE sends ATTACH REQUEST message with EPS attach type set to ‘EPS attach’, including the value in ‘Last visited registered TAI’ and the valid GUTI and initiates an attach procedure }

}

(4)

with { UE in EMM-REGISTERED.NORMAL-SERVICE state and MM IDLE state and USIM is invalidated by network for non-EPS services }

ensure that {

when { the UE is switch off and then powered up or switched on }

then { the UE sends ATTACH REQUEST message with EPS attach type IE ‘combined EPS/IMSI attach’ }

}

(5)

with { UE in EMM-REGISTERED-INITIATED state }

ensure that {

when { the UE receives ATTACH ACCEPT message with EPS attach result ‘combined EPS/IMSI attach’ }

then { UE sends ATTACH COMPLETE message and enters EMM-REGISTERED.NORMAL-SERVICE state and MM IDLE state }

}

9.2.1.2.2.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clauses 4.3, 5.5.1.2.2, 5.5.1.2.4, 5.5.1.3.1, 5.5.1.3.2, 5.5.1.3.4.1, 5.5.1.3.4.2, and 5.5.1.3.4.3.

[TS 24.301 clause 4.3]

A UE attached for EPS services may operate in one of the following operation modes:

…

– CS/PS mode 1 of operation: the UE registers to both EPS and non-EPS services, and UE’s usage setting is "voice centric"; and

– CS/PS mode 2 of operation: the UE registers to both EPS and non-EPS services, and UE’s usage setting is "data centric" or the UE has no CS voice capability.

A UE configured to use CS fallback, shall operate in CS/PS mode 1 or CS/PS mode 2. Such UE may also be configured to use IMS, in which case the voice domain preference as defined in 3GPP TS 24.167 [13B] shall be used for the selection of the domain for originating voice communication services.

…

[TS 24.301, clause 5.5.1.2.2]

…

[TS 24.301, clause 5.5.1.2.4]

…

Upon receiving the ATTACH ACCEPT message, the UE shall stop timer T3410.

The GUTI reallocation may be part of the attach procedure. When the ATTACH REQUEST message includes the IMSI, or the MME considers the GUTI provided by the UE is invalid, or the GUTI provided by the UE was assigned by another MME, the MME shall allocate a new GUTI to the UE. The MME shall include in the ATTACH ACCEPT message the new assigned GUTI together with the assigned TAI list. In this case the MME shall enter state EMM-COMMON-PROCEDURE-INITIATED as described in subclause 5.4.1.

…

If A/Gb mode or Iu mode is supported in the UE, the UE shall set its TIN to "GUTI" when receiving the ATTACH ACCEPT message.

…

Additionally, the UE shall reset the attach attempt counter and tracking area updating attempt counter, enter state EMM-REGISTERED and set the EPS update status to EU1 UPDATED.

…

Upon receiving an ATTACH COMPLETE message, the MME shall stop timer T3450, enter state EMM-REGISTERED and consider the GUTI sent in the ATTACH ACCEPT message as valid.

[TS 24.301, clause 5.5.1.3.1]

The combined attach procedure is used by a UE in CS/PS mode 1 or CS/PS mode 2 of operation to attach for both EPS and non-EPS services.

The combined attach procedure is also used by a UE in CS/PS mode 1 or CS/PS mode 2 of operation to attach for EPS services if it is already IMSI attached for non-EPS services.

When the UE initiates a combined attach procedure, the UE shall indicate "combined EPS/IMSI attach" in the EPS attach type IE.

The combined attach procedure follows the attach procedure for EPS described in subclause 5.5.1.2.

[TS 24.301, clause 5.5.1.3.2]

[TS 24.301, clause 5.5.1.3.4.1]

Depending on the value of the EPS attach result IE received in the ATTACH ACCEPT message, two different cases can be distinguished:

…

2) The EPS attach result IE value indicates "EPS only": attach for EPS services has been successful but attach for non-EPS services has failed.

[TS 24.301, clause 5.5.1.3.4.2]

The description for attach for EPS services as specified in subclause 5.5.1.2.4 shall be followed. In addition, the following description for attach for non-EPS services applies.

…

[TS 24.301, clause 5.5.1.3.4.3]

Apart from the actions on the tracking area updating attempt counter, the description for attach for EPS services as specified in subclause 5.5.1.2.4 shall be followed. In addition, the following description for attach for non-EPS services applies.

The UE receiving the ATTACH ACCEPT message takes one of the following actions depending on the EMM cause value:

#2 (IMSI unknown in HSS)

The UE shall stop T3410 if still running and shall reset the tracking area updating attempt counter. The UE shall set the update status to U3 ROAMING NOT ALLOWED and shall delete any TMSI, LAI and ciphering key sequence number. The UE shall enter state EMM-REGISTERED.NORMAL-SERVICE. The new MM state is MM IDLE. The USIM shall be considered as invalid for non-EPS services until switching off or the UICC containing the USIM is removed.

…

Other EMM cause values and the case that no EMM cause IE was received are considered as abnormal cases. The combined attach procedure shall be considered as failed for EPS and non-EPS services. The behaviour of the UE in those cases is specified in subclause 5.5.1.3.6.

[TS 24.301, clause 5.5.2.3.2]

When receiving the DETACH REQUEST message and the detach type indicates "re-attach required", the UE shall deactivate the EPS bearer context(s) including the default EPS bearer context locally without peer-to-peer signalling between the UE and the MME. The UE shall then send a DETACH ACCEPT message to the network and enter state EMM-DEREGISTERED. Furthermore, the UE shall, after the completion of the detach procedure, and the existing NAS signalling connection has been released, initiate an attach or combined attach or combined attach procedure

NOTE 1: When detach type indicates "re-attach required", user interaction is necessary in some cases when the UE cannot re-activate the EPS bearer(s) automatically.

A UE which receives a DETACH REQUEST message with detach type indicating "re-attach required" or "re-attach not required" and no EMM cause IE, is detached only for EPS services.

…

If the detach type indicates "IMSI detach" or "re-attach required", then the UE shall ignore the EMM cause IE if received.

9.2.1.2.2.3 Test description

9.2.1.2.2.3.1 Pre-test conditions

System Simulator:

– Cell A.

UE:

– The UE is configured to initiate combined EPS/IMSI attach;

– The UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

Preamble:

– The UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.2.2.3.2 Test procedure sequence

Table 9.2.1.2.2.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is powered up or switched on.	–	–	–	–
2	The UE transmits ATTACH REQUEST message with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN with EPS attach type set to "combined EPS/IMSI attach"	–>	ATTACH REQUEST	1	P
3-7D	Steps 5-13 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
7E	The SS transmits ATTACH ACCEPT message with EPS Attach result IE set to “EPS only” and EMM cause set to "IMSI unknown in HSS", including the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message as specified.	<–	ATTACH ACCEPT	–	–
7F	The UE transmits an RRCConnectionReconfigurationComplete message to confirm the establishment of default bearer.	–>	RRC: RRCConnectionReconfigurationComplete	–	–
–	EXCEPTION: In parallel to the event described in step 8 below the generic procedure for IP address allocation in the U-plane specified in TS 36.508 subclause 4.5A.1 takes place performing IP address allocation in the U-plane if requested by the UE. s	–	–	–	–
–	EXCEPTION: IF PDN1_IMS (Note) THEN in parallel to the event described in step 8 below the generic procedure for IMS signalling in the Uplane specified in TS 36.508 subclause 4.5A.3 takes place if requested by the UE	–	–	–	–
8	Check: Does the UE transmit an ATTACH COMPLETE message including an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message as specified?	–>	ATTACH COMPLETE	2	P
8A1a1-8A1c1	Steps 16a1-16c1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
8A2-12	Void	–	–	–	–
13	The SS sends DETACH REQUEST message with Detach Type set to "re-attach required"	<–	DETACH REQUEST	–	–
14	Check: Does the UE send DETACH ACCEPT message?	–>	DETACH ACCEPT	3	P
15	The SS releases the RRC connection.	–	–	–	–
–	EXCEPTION: Step 15a describes a behaviour which depends on the UE capability	–	–	–	–
15a	IF NOT pc_Automatic_Re_Attach, the user initiates an Attach by MMI or by AT command.	–	–	–	–
16	Check: Does the UE send ATTACH REQUEST message with EPS attach type set to “EPS attach”, including the PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	3	P
16Aa1-16Aa2	Void	–	–	–	–
16Ba1-16D	Steps 9a1-11 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
17	The SS sends ATTACH ACCEPT message including the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message	<–	ATTACH ACCEPT	–	–
–	EXCEPTION: In parallel to the event described in step 15 below the generic procedure for IP address allocation in the U-plane specified in TS 36.508 subclause 4.5A.1 takes place performing IP address allocation in the U-plane if requested by the UE.	–	–	–	–
–	EXCEPTION: IF PDN1_IMS (Note) THEN in parallel to the event described in step 16 below the generic procedure for IMS signalling in the Uplane specified in TS 36.508 subclause 4.5A.3 takes place if requested by the UE	–	–	–	–
18	Check: Does the UE send ATTACH COMPLETE message?	–>	ATTACH COMPLETE	3	P
18A1a1-18A3b1	Steps 16a1-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
19	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
–	EXCEPTION: Step 19a describes behaviour that depends on the UE capability.
19a	If pc_SwitchOnOff or pc_USIM_Removal then UE sends DETACH REQUEST message	–>	DETACH REQUEST
20	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
21	Check: Does the UE transmit ATTACH REQUEST message with EPS attach type set to "combined EPS/IMSI attach", including PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	4	P
22	The SS transmits ATTACH ACCEPT message with EPS Attach result IE set to “combined EPS/IMSI attach” , including the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message.	<–	ATTACH ACCEPT	–	–
–	EXCEPTION: In parallel to the event described in step 23 below the generic procedure for IP address allocation in the U-plane specified in TS 36.508 subclause 4.5A.1 takes place performing IP address allocation in the U-plane if requested by the UE.	–	–	–	–
–	EXCEPTION: IF PDN1_IMS (Note) THEN in parallel to the event described in step 16 below the generic procedure for IMS signalling in the Uplane specified in TS 36.508 subclause 4.5A.3 takes place if requested by the UE	–	–	–	–
23	Check: Does the UE transmit an ATTACH COMPLETE message including the ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message?	–>	ATTACH COMPLETE	5	P
24a1-26b1	Steps 16a1-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–
Note: PDN1_IMS as defined in TS 36.508 subclause 4.5.2.

NOTE: It is assumed in the test procedure sequence that the UE initially has a valid GUTI, hence it is included in ATTACH REQUEST message in step 2. However, it is not important for the test procedure sequence.

9.2.1.2.2.3.3 Specific message contents

Table 9.2.1.2.2.3.3-1: Message ATTACH REQUEST (step 2, Table 9.2.1.2.2.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	GUTI-1
EPS attach type	010	“combined EPS/IMSI attach”
ESM message container	PDN CONNECTIVITY REQUEST message
Last visited registered TAI	TAI-1
Old location area identification	LAI-1
TMSI status	Not present

Table 9.2.1.2.2.3.3-2: Message ATTACH ACCEPT (step 7, Table 9.2.1.2.2.3.2-1)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark	Comment	Condition
EPS attach result	001	"EPS only" The SS accepts Combined attach for EPS services only.
ESM message container	ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message
GUTI	GUTI-2	The SS assigns a new GUTI
LAI	Not present
MS identity	Not Present	No TMSI is assigned
EMM cause	00000010	#2 “IMSI unknown in HSS”

Table 9.2.1.2.2.3.3-3: Message DETACH REQUEST (step 13, Table 9.2.1.2.2.3.2-1)

Derivation path: 36.508 table 4.7.2-12
Information Element	Value/Remark	Comment	Condition
Detach type	001	"re-attach required"

Table 9.2.1.2.2.3.3-4: Message ATTACH REQUEST (step 16, Table 9.2.1.2.2.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	GUTI-2
EPS attach type	001	“EPS attach”
ESM message container	PDN CONNECTIVITY REQUEST message
Last visited registered TAI	TAI-1
Old location area identification	Not present
TMSI status	Not present

Table 9.2.1.2.2.3.3-5: Message ATTACH ACCEPT (step 17, Table 9.2.1.2.2.3.2-1)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark	Comment	Condition
EPS attach result	001	” EPS only ”
ESM message container	ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message
GUTI	Not present	The SS doesn’t assign a new GUTI

Table 9.2.1.2.2.3.3-6: Message ATTACH REQUEST (step 21, Table 9.2.1.2.2.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	GUTI-2
EPS attach type	010	“combined EPS/IMSI attach”
ESM message container	PDN CONNECTIVITY REQUEST message
Last visited registered TAI	TAI-1
Old location area identification	Not present
TMSI status	0	no valid TMSI available

Table 9.2.1.2.2.3.3-7: Message ATTACH ACCEPT (step 22, Table 9.2.1.2.2.3.2-1)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark	Comment	Condition
EPS attach result	010	”Combined EPS/IMSI attach”
ESM message container	ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message
GUTI	Not present	The SS doesn’t assign a new GUTI

9.2.1.2.3 Successful combined attach procedure / EPS service only / MSC temporarily not reachable

9.2.1.2.3.1 Test Purpose (TP)

(1)

with { the UE has sent a combined ATTACH REQUEST message }

ensure that {

when { the UE receives an ATTACH ACCEPT message with EPS attach result set to "EPS only" and EMM reject cause set to "MSC temporarily not reachable" or "Network failure" and including an ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message with IE EPS Bearer Identity matching the ATTACH REQUEST message and including a PDN address, an APN and an uplink TFT }

then { UE transmits an ATTACH COMPLETE message, containing the EPS bearer identity, together with ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message and the UE resets the attach attempt counter and the UE increments tracking area updating attempt counter and starts timer T3411 and enters EMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM state }

}

(2)

with { the UE is in E-UTRA EMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM state }

ensure that {

when { timer T3411 expires or timer T3402 expires }

then { the UE initiates a combined tracking area update procedure indicating "combined TA/LA updating with IMSI attach" }

}

(3)

with { the UE is in E-UTRA EMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM state }

ensure that {

when { UE receives a TRACKING AREA UPDATE ACCEPT with EPS update result set to "EPS only" and EMM reject cause set to "MSC temporarily not reachable" or "Network failure" }

then { UE increments tracking area updating attempt counter unless it was already set to 5 and starts timer T3411 if tracking area updating attempt counter is less than 5 or starts timer T3402 if tracking area updating attempt counter is equal to 5 }

}

9.2.1.2.3.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clauses 5.5.1.2.4, 5.5.1.3.1, 5.5.1.3.2, 5.5.1.3.4.1, 5.5.1.3.4.2, 5.5.1.3.4.3, and 5.5.3.3.4.3.

[TS 24.301, clause 5.5.1.2.4]

If the attach request is accepted by the network, the MME shall delete the stored UE radio capability information, if any.

NOTE: This information is forwarded to the new MME during inter-MME handover or to the new SGSN during inter-system handover to A/Gb mode or Iu mode.

Upon receiving the ATTACH ACCEPT message, the UE shall stop timer T3410.

…

If A/Gb mode or Iu mode is supported in the UE, the UE shall set its TIN to "GUTI" when receiving the ATTACH ACCEPT message.

…

Additionally, the UE shall reset the attach attempt counter and tracking area updating attempt counter, enter state EMM-REGISTERED and set the EPS update status to EU1 UPDATED.

…

Upon receiving an ATTACH COMPLETE message, the MME shall stop timer T3450, enter state EMM-REGISTERED and consider the GUTI sent in the ATTACH ACCEPT message as valid.

[TS 24.301, clause 5.5.1.3.1]

The combined attach procedure is used by a UE in CS/PS mode 1 or CS/PS mode 2 of operation to attach for both EPS and non-EPS services.

The combined attach procedure is also used by a UE in CS/PS mode 1 or CS/PS mode 2 of operation to attach for EPS services if it is already IMSI attached for non-EPS services.

When the UE initiates a combined attach procedure, the UE shall indicate "combined EPS/IMSI attach" in the EPS attach type IE.

The combined attach procedure follows the attach procedure for EPS described in subclause 5.5.1.2.

[TS 24.301, clause 5.5.1.3.2]

[TS 24.301, clause 5.5.1.3.4.1]

Depending on the value of the EPS attach result IE received in the ATTACH ACCEPT message, two different cases can be distinguished:

1) The EPS attach result IE value indicates "combined EPS/IMSI attach": attach for EPS and non-EPS services have been successful.

2) The EPS attach result IE value indicates "EPS only": attach for EPS services has been successful but attach for non-EPS services has failed.

[TS 24.301, clause 5.5.1.3.4.2]

The description for attach for EPS services as specified in subclause 5.5.1.2.4 shall be followed. In addition, the following description for attach for non-EPS services applies.

…

[TS 24.301, clause 5.5.1.3.4.3]

The UE receiving the ATTACH ACCEPT message takes one of the following actions depending on the EMM cause value:

…

#16 (MSC temporarily not reachable);

#17 (Network failure); or

The UE shall stop timer T3410 if still running. The tracking area updating attempt counter shall be incremented, unless it was already set to 5.

If the tracking area updating attempt counter is less than 5:

– the UE shall start timer T3411, shall set the EPS update status to EU1 UPDATED and shall enter state EMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM. When timer T3411 expires the combined tracking area updating procedure indicating "combined TA/LA updating with IMSI attach" is triggered.

If the tracking area updating attempt counter is equal to 5:

– a UE operating in CS/PS mode 2 of operation shall start timer T3402, shall set the EPS update status to EU1 UPDATED and shall enter state EMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM. When timer T3402 expires the combined tracking area updating procedure indicating "combined TA/LA updating with IMSI attach" is triggered;

– a UE operating in CS/PS mode 1 of operation with "IMS voice not available" shall attempt to select GERAN or UTRAN radio access technology and proceed with appropriate MM or GMM specific procedures. The UE shall disable the E-UTRA capability (see subclause 4.5).

NOTE 1: It is up to the UE implementation when to enable E-UTRAN radio access technology selection.

…

[TS 24.301, clause 5.5.3.3.4.3]

Apart from the actions on the tracking area updating attempt counter, the description for tracking area for EPS services as specified in subclause 5.5.3.2.4 shall be followed. In addition, the following description for location updating for non-EPS services applies.

The UE receiving the TRACKING AREA UPDATE ACCEPT message takes one of the following actions depending on the EMM cause value:

…

#16 (MSC temporarily not reachable);

#17 (Network failure); or

The UE shall stop timer T3430 if still running. The tracking area updating attempt counter shall be incremented, unless it was already set to 5.

If the tracking area updating attempt counter is less than 5:

If the tracking area updating attempt counter is equal to 5:

NOTE 1: It is up to the UE implementation when to enable E-UTRAN radio access technology selection.

…

9.2.1.2.3.3 Test description

9.2.1.2.3.3.1 Pre-test conditions

System Simulator:

– cell A.

NOTE: T3402 is set to default (12 min.).

UE:

– the UE is configured to initiate combined EPS/IMSI attach;

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.2.3.3.2 Test procedure sequence

The sequence is executed for execution counter k = 1, 2.

Table 9.2.1.2.3.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2	The UE transmits a combined ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message as specified.	–>	ATTACH REQUEST	–	–
3-6Aa2	Void	–	–	–	–
6B-6H	Steps 5-11 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed	–	–	–	–
7	The SS transmits an ATTACH ACCEPT message with EPS attach result indicating "EPS only" and EMM cause indicating according to specific message contents and with IE EPS Bearer Identity set to default EPS bearer context. The ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message is piggybacked in ATTACH ACCEPT. Note 1: SS allocates a PDN address of a PDN type which is compliant with from the PDN type requested by the UE.	<–	ATTACH ACCEPT	–	–
–	EXCEPTION: In parallel to the event described in step 8 below the generic procedure for IP address allocation in the U-plane specified in TS 36.508 subclause 4.5A.1 takes place performing IP address allocation in the U-plane if requested by the UE.	–	–	–	–
8	Check: Does the UE transmit an ATTACH COMPLETE message including a ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message as specified?	–>	ATTACH COMPLETE	1	P
–	EXCEPTION: Steps 8a1 to 8c1 describe behaviour that depends on UE configuration; the "lower case letter" identifies a step sequence that takes place when the UE is configured in a certain way.	–	–
8a1-8c1	Steps 16a1-16c1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
–	EXCEPTION: Steps 8Aa1 to 8Ab5 describe behaviour that depends on UE capabilities/configuration and test requirements; the "lower case letter" identifies a step sequence that takes place if one of those is supported/configured.
8Aa1-8Aa3	IF MULTI_PDN AND NOT pc_UE_supports_user_initiated_PDN_disconnect THEN the non-IMS PDN shall be released as specified in steps 10-12 of TS 36.508 subclause 4.5A.18	–	–	–	–
8Ab1	IF MULTI_PDN AND pc_UE_supports_user_initiated_PDN_disconnect THEN Cause the UE to request disconnection from the additional PDN(Note 1)	–	–	–	–
8Ab2-8Ab5	IF MULTI_PDN AND pc_UE_supports_user_initiated_PDN_disconnect THEN the non-IMS PDN shall be released as specified in steps 9-12 of TS 36.508 subclause 4.5A.17	–	–	–	–
9	Void	–	–	–	–
10	Check1: Does the UE transmit a TRACKING AREA UPDATE REQUEST message with "combined TA/LA updating with IMSI attach"? Check2: Is the time between the previous ATTACH ACCEPT and TRACKING AREA UPDATE REQUEST equal to T3411? Note: Tracking area updating attempt counter=1.	–>	TRACKING AREA UPDATE REQUEST	1,2	P
11	SS transmits a TRACKING AREA UPDATE ACCEPT message with EPS update result indicating "TA updated" and EMM cause indicating according to specific message contents.	<–	TRACKING AREA UPDATE ACCEPT	–	–
11A	The SS releases the RRC connection. Note: Tracking area updating attempt counter=2	–	–	–	–
12	Check1: Does the UE transmit a TRACKING AREA UPDATE REQUEST message with "combined TA/LA updating with IMSI attach"? Check2: Is the time between the previous TRACKING AREA UPDATE ACCEPT and TRACKING AREA UPDATE REQUEST equal to T3411?	–>	TRACKING AREA UPDATE REQUEST	2,3	P
13	SS transmits a TRACKING AREA UPDATE ACCEPT message with EPS update result indicating "TA updated" and EMM cause indicating according to specific message contents.	<–	TRACKING AREA UPDATE ACCEPT	–	–
13A	The SS releases the RRC connection. Note: Tracking area updating attempt counter=3	–	–	–	–
14	Check1: Does the UE transmit a TRACKING AREA UPDATE REQUEST message with "combined TA/LA updating with IMSI attach"? Check2: Is the time between the previous TRACKING AREA UPDATE ACCEPT and TRACKING AREA UPDATE REQUEST equal to T3411?	–>	TRACKING AREA UPDATE REQUEST	2,3	P
15	SS transmits a TRACKING AREA UPDATE ACCEPT message with EPS update result indicating "TA updated" and EMM cause indicating according to specific message contents	<–	TRACKING AREA UPDATE ACCEPT	–	–
15A	The SS releases the RRC connection. Note: Tracking area updating attempt counter=4	–	–	–	–
16	Check1: Does the UE transmit a TRACKING AREA UPDATE REQUEST message with "combined TA/LA updating with IMSI attach"? Check2: Is the time between the previous TRACKING AREA UPDATE ACCEPT and TRACKING AREA UPDATE REQUEST equal to T3411?	–>	TRACKING AREA UPDATE REQUEST	2,3	P
–	EXCEPTION: Steps 17a1 to 17b2 describe behaviour that depends on UE configuration; the "lower case letter" identifies a step sequence that takes place according to UE mode of operation	–	–	–	–
17 a1	IF the UE is configured to operate in CS/PS mode 2, then SS transmits a TRACKING AREA UPDATE ACCEPT message with EPS update result indicating "TA updated" and EMM cause indicating according to specific message contents.	<–	TRACKING AREA UPDATE ACCEPT	–	–
17a2	The SS releases the RRC connection. Note: Tracking area updating attempt counter=5	–	–	–	–
17a3	Check1: Does the UE send TRACKING AREA UPDATE REQUEST message with "combined TA/LA updating with IMSI attach"? Check2: Is the time between the previous TRACKING AREA UPDATE ACCEPT and TRACKING AREA UPDATE REQUEST equal to T3402? Note: Tracking area updating attempt counter is reset.	–>	TRACKING AREA UPDATE REQUEST	2,3	P
17a4	SS transmits a TRACKING AREA UPDATE ACCEPT message with EPS update result indicating "combined TA/LA updated " according to default message contents.	<–	TRACKING AREA UPDATE ACCEPT	–	–
17a5	The UE transmits a TRACKING AREA UPDATE COMPLETE message	–>	TRACKING AREA UPDATE COMPLETE	–	–
17a6	The SS releases the RRC connection.	–	–	–	–
17a7	Check: Does the result of test procedure in 36.508 clause 6.4.2.4 indicate that the UE answer to paging with S-TMSI-1 (associated with GUTI-1) for PS domain?	–	–	3	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–
17b1	ELSE SS transmits a TRACKING AREA UPDATE ACCEPT message with EPS update result indicating "combined TA/LA updated".	<–	TRACKING AREA UPDATE ACCEPT	–	–
17b2	The UE transmits a TRACKING AREA UPDATE COMPLETE message. Note: Tracking area updating attempt counter is reset.	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA connected (E2_T3440) according to TS 36.508.	–	–	–	–
18-20	Void	–	–	–	–
NOTE 1: The request to disconnect from a PDN may be performed by MMI or AT command; in any case the EPS bearer identity of the Default EPS Bearer of the PDN to be released needs to be handed over to the UE.

9.2.1.2.3.3.3 Specific message contents

Table 9.2.1.2.3.3.3-1: Message ATTACH REQUEST (step 2, Table 9.2.1.2.3.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
EPS attach type	010	"combined EPS/IMSI attach"
Old GUTI or IMSI	GUTI-1
Last visited registered TAI	TAI-1
Old location area identification	LAI-1
TMSI status	Not present

Table 9.2.1.2.3.3.3-2: Message ATTACH ACCEPT (step 7, Table 9.2.1.2.3.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-1
Information Element	Value/remark	Comment	Condition
EPS attach result	001	"EPS only"
GUTI	Not present
Location area identification	Not present	SS doesn’t provide LAI
MS identity	Not Present	SS doesn’t provide TMSI
EMM cause	00010000 for k=1 or 00010001 for k=2	#16 (MSC temporarily not reachable) for k=1 #17 (Network failure) for k=2

Table 9.2.1.2.3.3.3-3: Message TRACKING AREA UPDATE REQUEST (steps 10-12-14-16-17a3, Table 9.2.1.2.3.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-27
Information Element	Value/remark	Comment	Condition
EPS update type	010	"combined TA/LA updating with IMSI attach"
Old GUTI	GUTI-1
Old P-TMSI signature	Not present	This IE is included when the UE holds a valid P-TMSI signature.
Additional GUTI	Not present	TIN = ‘GUTI’
Last visited registered TAI	TAI-1
Old location area identification	LAI-1
TMSI status	Not present

Table 9.2.1.2.3.3.3-4: Message TRACKING AREA UPDATE ACCEPT (steps 11-13-15, Table 9.2.1.2.3.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-24
Information Element	Value/remark	Comment	Condition
EPS update result	000	"TA updated" SS accepts Combined TAU for EPS services only.
GUTI	Not present
Location area identification	Not present	SS doesn’t provide LAI
MS identity	Not Present	SS doesn’t provide TMSI
EMM cause	00010000 for k=1 or 00010001 for k=2	#16 (MSC temporarily not reachable) for k=1 #17 (Network failure) for k=2

Table 9.2.1.2.3.3.3-5: Message TRACKING AREA UPDATE ACCEPT (steps 17a1, Table 9.2.1.2.3.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-24
Information Element	Value/remark	Comment	Condition
EPS update result	000	"TA updated" SS accepts Combined TAU for EPS services only.
GUTI	Not present
Location area identification	Not present	SS doesn’t provide LAI
MS identity	Not Present	SS doesn’t provide TMSI
EMM cause	00010000 for k=1 or 00010001 for k=2	#16 (MSC temporarily not reachable) for k=1 #17 (Network failure) for k=2
T3402	‘000 01111’B	30 seconds

9.2.1.2.4 Successful combined attach procedure / EPS service only / CS domain not available

9.2.1.2.4.1 Test Purpose (TP)

(1)

with { UE is switched-off }

ensure that {

when { UE is powered on and a valid GUTI is available }

then { the UE transmits an ATTACH REQUEST message with the EPS attach type set to "combined EPS/IMSI attach", including GUTI, last visited registered TAI and a PDN CONNECTIVITY REQUEST message with the request type set to "initial attach" }

}

(2)

with { UE has sent a combined ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message }

ensure that {

when { UE receives an ATTACH ACCEPT message including EPS attach result set to "EPS only" and EMM reject cause set to "CS domain not available" and including an ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message with IE EPS Bearer Identity matching the PDN CONNECTIVITY REQUEST message }

then { UE transmits ATTACH COMPLETE message, containing the EPS bearer identity, including an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message and sets the update status to U2 NOT UPDATED and enters EMM-REGISTERED state }

}

(3)

with { The UE received an ATTACH ACCEPT message with EPS attach result set to "EPS only" and EMM cause set to "CS domain not available" }

ensure that {

when { UE enters a TA where it is not registered and which belongs to the PLMN where the UE received the EMM cause "CS domain not available" }

then { UE initiates a normal tracking area update procedure indicating "TA updating" without valid LAI, TMSI, GSM ciphering key, UMTS integrity key, UMTS ciphering key or ciphering key sequence number }

}

(4)

with { The UE received an ATTACH ACCEPT message with EPS attach result set to "EPS only" and EMM cause set to "CS domain not available" }

ensure that {

when { UE is powered up or switched on }

then { UE initiates a combined attach procedure indicating "combined EPS/IMSI attach" }

}

9.2.1.2.4.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clauses 5.5.1.2.4, 5.5.1.3.1, 5.5.1.3.2, 5.5.1.3.4.1, 5.5.1.3.4.2 and 5.5.1.3.4.3, and TS 24.008, clause 4.1.2.2. Unless otherwise stated these are Rel-8 requirements.

[TS 24.301, clause 5.5.1.2.4]

If the attach request is accepted by the network, the MME shall delete the stored UE radio capability information, if any.

NOTE: This information is forwarded to the new MME during inter-MME handover or to the new SGSN during inter-system handover to A/Gb mode or Iu mode.

Upon receiving the ATTACH ACCEPT message, the UE shall stop timer T3410.

…

If A/Gb mode or Iu mode is supported in the UE, the UE shall set its TIN to "GUTI" when receiving the ATTACH ACCEPT message.

…

Additionally, the UE shall reset the attach attempt counter and tracking area updating attempt counter, enter state EMM-REGISTERED and set the EPS update status to EU1 UPDATED.

…

Upon receiving an ATTACH COMPLETE message, the MME shall stop timer T3450, enter state EMM-REGISTERED and consider the GUTI sent in the ATTACH ACCEPT message as valid.

[TS 24.301, clause 5.5.1.3.1]

The combined attach procedure is used by a UE in CS/PS mode 1 or CS/PS mode 2 of operation to attach for both EPS and non-EPS services.

The combined attach procedure is also used by a UE in CS/PS mode 1 or CS/PS mode 2 of operation to attach for EPS services if it is already IMSI attached for non-EPS services.

When the UE initiates a combined attach procedure, the UE shall indicate "combined EPS/IMSI attach" in the EPS attach type IE.

The combined attach procedure follows the attach procedure for EPS described in subclause 5.5.1.2.

[TS 24.301, clause 5.5.1.3.2]

…

[TS 24.301, clause 5.5.1.3.4.1]

Depending on the value of the EPS attach result IE received in the ATTACH ACCEPT message, two different cases can be distinguished:

1) The EPS attach result IE value indicates "combined EPS/IMSI attach": attach for EPS and non-EPS services have been successful.

2) The EPS attach result IE value indicates "EPS only": attach for EPS services has been successful but attach for non-EPS services has failed.

[TS 24.301, clause 5.5.1.3.4.2]

The description for attach for EPS services as specified in subclause 5.5.1.2.4 shall be followed. In addition, the following description for attach for non-EPS services applies.

…

[TS 24.301, clause 5.5.1.3.4.3]

The UE receiving the ATTACH ACCEPT message takes one of the following actions depending on the EMM cause value:

…

#18 (CS domain not available)

The UE shall stop timer T3410 if still running, shall reset the tracking area updating attempt counter, shall set the EPS update status to EU1 UPDATED and shall enter state EMM-REGISTERED.NORMAL-SERVICE.

The UE shall set the update status to U2 NOT UPDATED.

A UE in CS/PS mode 1 of operation with "IMS voice not available" shall attempt to select GERAN or UTRAN radio access technology rather than E-UTRAN for the selected PLMN or equivalent PLMN. The UE shall disable the E-UTRA capability (see subclause 4.5). If the UE is in the EMM-CONNECTED mode, the UE shall locally release the established NAS signalling connection and enter the EMM-IDLE mode before selecting GERAN or UTRAN radio access technology.

A UE in CS/PS mode 2 of operation may provide a notification to the user or the upper layers that the CS domain is not available.

…

The UE shall not attempt combined attach or combined tracking area update procedure with current PLMN until switching off the UE or the UICC containing the USIM is removed.

[TS 24.008, clause 4.1.2.2]

In parallel with the sublayer states described in subclause 4.1.2.1 and which control the MM sublayer protocol, an update status exists.

The update status pertains to a specific subscriber embodied by a SIM/USIM. This status is defined even when the subscriber is not activated (SIM/USIM removed or connected to a switched-off ME). It is stored in a non volatile memory in the SIM/USIM. The update status is changed only as a result of a location updating procedure attempt (with the exception of an authentication failure and of some cases of CM service rejection). In some cases, the update status is changed as a result of a GPRS attach, GPRS routing area update, service request or network initiated GPRS detach procedure.

…

U2 NOT UPDATED

The last location updating attempt made failed procedurally (no significant answer was received from the network, including the cases of failures or congestion inside the network).

[Rel-8]

– For this status, the SIM/USIM does not contain any valid LAI, TMSI, GSM ciphering key, UMTS integrity key, UMTS ciphering key or ciphering key sequence number. For compatibility reasons, all these fields must be set to the "deleted" value at the moment the status is set to NOT UPDATED. However the presence of other values shall not be considered an error by the mobile station. The "Location update status" stored on the SIM/USIM shall be "not updated".

[Rel-11]

– For this status, the SIM/USIM can contain a valid LAI of the location area to which the subscriber was registered, and possibly also a valid TMSI, GSM ciphering key, UMTS integrity key, UMTS ciphering key and ciphering key sequence number. For compatibility reasons, all these fields shall be set to the "deleted" value if the LAI is deleted. However the presence of other values shall not be considered an error by the mobile station. Furthermore, if the ME supports any A5 ciphering algorithm that requires a 128-bit ciphering key and a USIM is in use, then the ME shall delete the GSM Kc128 stored if the LAI is deleted. The "Location update status" stored on the SIM/USIM shall be "not updated".

…

9.2.1.2.4.3 Test description

9.2.1.2.4.3.1 Pre-test conditions

System Simulator:

– Cell A (TAI-1, home PLMN) and cell B (TAI-2, home PLMN).

– System information combination 3 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells;

UE:

– The UE is configured to initiate combined EPS/IMSI attach;

– The UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

Preamble:

– The UE is in state Switched OFF (state 1) according to TS.36.508 [18].

9.2.1.2.4.3.2 Test procedure sequence

Table 9.2.1.2.4.3.2-1: Main Behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of cell A to the "Serving cell" Set the cell type of cell B to the "Non-suitable cell"	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
2	The UE is switched on.	–	–	–	–
3	Check: Does the UE transmit a combined ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	1	P
4- 7E	Steps 5-13 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
8	SS responds with ATTACH ACCEPT message with IE EPS Bearer Identity set to default EPS bearer context. The ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message is piggybacked in ATTACH ACCEPT.	<–	ATTACH ACCEPT	–	–
8A	The UE transmits an RRCConnectionReconfigurationComplete message to confirm the establishment of default bearer.	–>	RRC: RRCConnectionReconfigurationComplete	–	–
–	EXCEPTION: In parallel to the event described in step 9 below the generic procedure for IP address allocation in the U-plane specified in TS 36.508 subclause 4.5A.1 takes place performing IP address allocation in the U-plane if requested by the UE.	–	–	–	–
–	EXCEPTION: IF PDN1_IMS (Note) THEN in parallel to the event described in step 9 below the generic procedure for IMS signalling in the U-plane specified in TS 36.508 subclause 4.5A.3 takes place if requested by the UE	–	–	–	–
9	Check: Does the UE transmit an ATTACH COMPLETE message including a ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message as specified?	–>	ATTACH COMPLETE	2	P
9Aa1-9 Cb1	Steps 16a1-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
10	Void	–	–	–	–
10A	Wait 15 seconds for UE to camp on Cell A (UE might attempt to select GERAN or UTRAN cells)	–	–	–	–
11	Check: Does the test result of generic test procedure in TS 36.508 subclause 6.4.2.2 indicate that the UE is in E-UTRA RRC_IDLE state on Cell A?	–	–	2	–
12	Set the cell type of cell B to the "Serving cell" Set the cell type of cell A to the "Non-suitable cell"	–	–	–	–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
13	Check: Does the UE transmit TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	3	P
14	SS responds with TRACKING AREA UPDATE ACCEPT message	<–	TRACKING AREA UPDATE ACCEPT	–	–
15	UE sends TRACKING AREA UPDATE COMPLETE	–>	TRACKING AREA UPDATE COMPLETE	–	–
16	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
–	EXCEPTION: Step 16a describes behaviour that depends on the UE capability.
16a	If pc_SwitchOnOff or pc_USIM_Removal then UE sends DETACH REQUEST message	–>	DETACH REQUEST
17	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
18	Check: Does the UE transmit a combined ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	4	P
18Aa1-18C	Steps 9a1-11 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
19	SS responds with ATTACH ACCEPT message with IE EPS Bearer Identity set to default EPS bearer context. The ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message is piggybacked in ATTACH ACCEPT.	<–	ATTACH ACCEPT	–	–
–	EXCEPTION: In parallel to the event described in step 20 below the generic procedure for IP address allocation in the U-plane specified in TS 36.508 subclause 4.5A.1 takes place performing IP address allocation in the U-plane if requested by the UE.	–	–	–	–
–	EXCEPTION: IF PDN1_IMS (Note) THEN in parallel to the event described in step 20 below the generic procedure for IMS signalling in the Uplane specified in TS 36.508 subclause 4.5A.3 takes place if requested by the UE	–	–	–	–
20	Check: Does the UE transmit an ATTACH COMPLETE message including a ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message as specified?	–>	ATTACH COMPLETE	–	–
20A1a1-20A3b1	Steps 16a1-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508 but attached for EPS services only.	–	–	–	–
Note: PDN1_IMS as defined in TS 36.508 subclause 4.5.2.

9.2.1.2.4.3.3 Specific message contents

Table 9.2.1.2.4.3.3-1: Message ATTACH REQUEST (step 3, Table 9.2.1.2.4.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
EPS attach type	010	"combined EPS/IMSI attach"
Old GUTI or IMSI	GUTI-1
Last visited registered TAI	TAI-1
Old location area identification	LAI-1
TMSI status	Not present

Table 9.2.1.2.4.3.3-2: Message ATTACH ACCEPT (step 8, Table 9.2.1.2.4.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-1
Information Element	Value/remark	Comment	Condition
EPS attach result	001	"EPS only"
GUTI	Not Present
Location area identification	Not present	SS doesn’t provide LAI
MS identity	Not Present	SS doesn’t provide TMSI
EMM cause	00010010	#18 "CS domain not available"

Table 9.2.1.2.4.3.3-3: Message TRACKING AREA UPDATE REQUEST (step 13, Table 9.2.1.2.4.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-27
Information Element	Value/remark	Comment	Condition
EPS update type	000	TA updating
Old GUTI	GUTI-1
Last visited registered TAI	TAI-1	If available, the last TAI is included by UE and will be used to establish a good list of TAIs in subsequent ATTACH ACCEPT message.
Old location area identification	Not present	Not present as this is not a combined TAU.
TMSI status	Not present	Not present as this in not a combined TAU

Table 9.2.1.2.4.3.3-4: Message TRACKING AREA UPDATE ACCEPT (step 14, Table 9.2.1.2.4.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-24
Information Element	Value/remark	Comment	Condition
EPS update result	000	"TA only"
GUTI	GUTI-2
Location area identification	Not present	SS doesn’t provide LAI
MS identity	Not Present	SS doesn’t provide TMSI
EMM cause	Not Present	Not present as this is not a combined TAU

Table 9.2.1.2.4.3.3-5: Message ATTACH REQUEST (step 18, Table 9.2.1.2.4.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
EPS attach type	010	"combined EPS/IMSI attach"
Old GUTI or IMSI	GUTI-2
Last visited registered TAI	TAI-2
Old location area identification	Not present		Rel-8 to Rel-10
Old location area identification	Not present or any allowed value		Rel-11 onwards
TMSI status	0	“no valid TMSI available”	Rel-8 to Rel-10
TMSI status	Set to 0 or not present	“0: no valid TMSI available” “ Not present: valid TMSI available”	Rel-11 onwards

Table 9.2.1.2.4.3.3-6: Message ATTACH ACCEPT (step 19, Table 9.2.1.2.4.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-1
Information Element	Value/remark	Comment	Condition
EPS attach result	010	”Combined EPS/IMSI attach”
GUTI	GUTI-2
Location area identification	LAI-2
MS identity	TMSI-2

9.2.1.2.4a Successful combined attach procedure / EPS service only / Congestion

9.2.1.2.4a.1 Test Purpose (TP)

(1)

with { UE having initiated a Combined attach procedure by sending an ATTACH REQUEST message }

ensure that {

when { UE receives an ATTACH ACCEPT message with EPS attach result set to ‘EPS only’ and EMM cause set to #22 ‘Congestion’ }

then { the UE initiates a Combined tracking area procedure indicating ‘combined TA/LA updating with IMSI attach’ after time=T3402 }

}

9.2.1.2.4a.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clauses 5.5.1.3.4.3 and 5.2.3.2.7. Unless otherwise stated these are Rel-11 requirements.

[TS 24.301, clause 5.5.1.3.4.3]

The UE receiving the ATTACH ACCEPT message takes one of the following actions depending on the EMM cause value:

…

#22 (Congestion)

The UE shall stop the timer T3410 if still running. The tracking area updating attempt counter shall be set to 5. The UE shall start the timer T3402, shall set the EPS update status to EU1 UPDATED, shall enter state EMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM, and shall enter state MM IDLE.

[TS 24.301, clause 5.2.3.2.7]

The UE:

…

– shall initiate combined tracking area updating procedure indicating "combined TA/LA updating with IMSI attach" on the expiry of timers T3411 or T3402 or when the UE enters a tracking area not in the list of registered tracking areas.

9.2.1.2.4a.3 Test description

9.2.1.2.4a.3.1 Pre-test conditions

System Simulator:

– Cell A.

UE:

– The UE is configured to initiate combined EPS/IMSI attach

– The UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

Preamble:

– The UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.2.4a.3.2 Test procedure sequence

Table 9.2.1.2.4a.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2	The UE transmits a combined ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
3-8 C	Steps 5-13 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
8D	SS responds with ATTACH ACCEPT message with EPS attach result set to ‘EPS only’ and EMM cause set to #22 (Congestion). The ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message is piggybacked in ATTACH ACCEPT.	<–	ATTACH ACCEPT	–	–
8E	The UE transmits an RRCConnectionReconfigurationComplete message to confirm the establishment of default bearer.	–>	RRC: RRCConnectionReconfigurationComplete	–	–
9	Void	–	–	–	–
9A-10Ab1	Steps 16-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
11	Wait for time=T3402. Note: The value of T3402 is provided in ATTACH ACCEPT message in step 8.	–	–	–	–
12	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message indicating ‘combined TA/LA updating with IMSI attach’?	–>	TRACKING AREA UPDATE REQUEST	1	P
13	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
14	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	At the end of the test procedure sequence, the UE is in end state E-UTRA connected (E2_T3440) according to TS 36.508.	–	–	–	–

9.2.1.2.4a.3.3 Specific message contents

Table 9.2.1.2.4a.3.3-1: Message ATTACH REQUEST (step 2, Table 9.2.1.2.4a.3.2-1)

Derivation Path: 36.508, table 4.7.2-4
Information Element	Value/remark	Comment	Condition
EPS attach type	‘010’B	"combined EPS/IMSI attach"
Old GUTI or IMSI	GUTI-1
Last visited registered TAI	TAI-1
Old location area identification	LAI-1
TMSI status	Not present

Table 9.2.1.2.4a.3.3-2: Message ATTACH ACCEPT (step 8D, Table 9.2.1.2.4a.3.2-1)

Derivation Path: 36.508, table 4.7.2-1
Information Element	Value/remark	Comment	Condition
EPS attach result	‘001’B	"EPS only"
GUTI	Not Present
Location area identification	Not present	SS doesn’t provide LAI
MS identity	Not Present	SS doesn’t provide TMSI
EMM cause	‘00010110’B	"Congestion"
T3402	‘00001111’B	30 seconds

Table 9.2.1.2.4a.3.3-3: Message TRACKING AREA UPDATE REQUEST (step 12, Table 9.2.1.2.4a.3.2-1)

Derivation Path: 36.508, table 4.7.2-27
Information Element	Value/remark	Comment	Condition
EPS update type
EPS update type Value	‘010’B	"combined TA/LA updating with IMSI attach"

Table 9.2.1.2.4a.3.3-4: TRACKING AREA UPDATE ACCEPT (step 13, Table 9.2.1.2.4a.3.2-1)

Derivation Path: 36.508, table 4.7.2-24 with condition combined TA/LA updated

9.2.1.2.5 Combined attach / Rejected / IMSI invalid

9.2.1.2.5.1 Test Purpose (TP)

(1)

with { UE has sent an ATTACH REQUEST message }

ensure that {
when { UE receives an ATTACH REJECT message with the EMM cause set to ‘Illegal UE’ }

then { UE deletes GUTI, last visited registered TAI and KSI and considers the USIM as invalid for EPS services and non-EPS services and enters state EMM-DEREGISTERED }

}

(2)

with { UE has sent an ATTACH REQUEST message }

ensure that {
when { UE receives an ATTACH REJECT message with the EMM cause set to ‘Illegal UE’ }

then { UE deletes P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number, TMSI, LAI and ciphering key sequence number }

}

9.2.1.2.5.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.1.3.5 and TS 24.008, clause 4.7.3.2.4.

[TS 24.301, clause 5.5.1.3.5]

Upon receiving the ATTACH REJECT message, the UE shall stop timer T3410, enter MM state MM IDLE, and take the following actions depending on the EMM cause value received.

#3 (Illegal UE);

…

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause5.1.3.3) and shall delete any GUTI, last visited registered TAI and eKSI.

The UE shall consider the USIM as invalid for EPS and non-EPS services until switching off or the UICC containing the USIM is removed. Additionally, the UE shall delete the list of equivalent PLMNs and shall enter the state EMM-DEREGISTERED.

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the MM parameters update status, TMSI, LAI and ciphering key sequence number, and the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number as specified in 3GPP TS 24.008 [13] for the case when the combined attach procedure is rejected with the GMM cause with the same value.

[TS 24.008, clause 4.7.3.2.4]

The MS shall then take one of the following actions depending upon the reject cause:

# 3 (Illegal MS);

…

9.2.1.2.5.3 Test description

9.2.1.2.5.3.1 Pre-test conditions

System Simulator:

– cell A and cell B;

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 5 (, LAI-1 and RAI-1;home PLMN) ;

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, Cell 24 (, LAI-1 and RAI-1.home PLMN);

– System information combination 10a as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

NOTE: Setting px_RATComb_Tested = EUTRA_Only is not allowed.

UE:

– the UE is configured to initiate combined EPS/IMSI attach;

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18];

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, the UE is previously registered on UTRAN cell 5 using default message contents according to TS 36.508 [18].

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, the UE is previously registered on GERAN cell 24 using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.2.5.3.2 Test procedure sequence

Table 9.2.1.2.5.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – Cell A as the "Serving cell", – Cell B as a "Non-Suitable cell", – Cell 5 or Cell 24 as a "Non-Suitable cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
2	The UE is switched on.	–	–	–	–
3	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
3A-3D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
4	The SS transmits an ATTACH REJECT message with the EMM cause set to ‘Illegal UE’.	<–	ATTACH REJECT	–	–
5	The SS releases the RRC connection.	–	–	–	–
6	The SS configures: – Cell A as a "Non-Suitable cell". – Cell B as the "Serving cell".	–	–	–	–
7	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on Cell B or on Cell A?	–>	ATTACH REQUEST	1	F
–	EXCEPTION: Steps 8a1 to 8a6 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported	–	–	–	–
8a1	The SS configures: – Cell B as a "Non-Suitable cell", – Cell 5 (px_RATComb_Tested = EUTRA_UTRA) or Cell 24 (px_RATComb_Tested = EUTRA_GERAN) as the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell 5 or Cell 24 unless explicitly stated otherwise.	–	–	–	–
8a2	Void	–	–	–	–
8a3	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	1	F
8a4	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
8a5	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
–	EXCEPTION: Steps 8a5a1, 8a5a2 describe behaviour that depends on the UE capability; the “lower case letter” identifies a step sequence that take place if pc_AutomaticAttachSwitchON is NOT supported	–	–	–	–
8a5Aa1	IF NOT pc_AutomaticAttachSwitchON	–	Registration on CS	–	–
8a5Aa2	IF NOT pc_AutomaticAttachSwitchON the user initiates an attach by MMI or by AT command.	–	–	–	–
8a6	Check: Does the UE transmit an ATTACH REQUEST message?	–>	ATTACH REQUEST	2	P
8b1	Void	–	–	–	–
9	Void	–	–	–	–
10	The SS configures: – Cell A as the "Serving cell", – Cell B as a "Non-Suitable cell", – Cell 5 or Cell 24 as a " Cell Off ".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
–	Void
11	Void	–	–	–	–
11a1	Void	–	–	–	–
12	Check: Does the UE transmit an ATTACH REQUEST message?	–>	ATTACH REQUEST	1	P
13-14	Void	–	–	–	–
15a1-15a9	Void	–	–	–	–
16-29b1	The attach procedure is completed by executing steps 5 to 18b1 of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–
Note 1: Void. Note 2: Switching off, USIM removal, or power removal shall be done before T3310 and T3311 expire (30 seconds) so that the UE does not retransmit ATTACH REQUEST message.

9.2.1.2.5.3.3 Specific message contents

Table 9.2.1.2.5.3.3-1: Message ATTACH REJECT (step 4, Table 9.2.1.2.5.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-3
Information Element	Value/remark	Comment	Condition
EMM cause	‘0000 0011’B	Illegal UE

Table 9.2.1.2.5.3.3-2: Message ATTACH REQUEST (step 12, Table 9.2.1.2.5.3.2-1)

Derivation Path: TS 36.508, Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
NAS key set identifier
NAS key set identifier	‘111’B	no key is available
TSC	Any allowed value	TSC does not apply for NAS key set identifier value "111".
Old GUTI or IMSI	IMSI-1
Last visited registered TAI	Not present
Old location area identification	Not present
TMSI status	‘0’B	no valid TMSI available

Table 9.2.1.2.5.3.3-3: Message ATTACH REQUEST (step 8a6, Table 9.2.1.2.5.3.2-1)

Derivation Path: TS 24.008 , Table 9.4.1
Information Element	Value/remark	Comment	Condition
MS network capability	Any allowed value
Attach type	‘011’B	Combined GPRS/IMSI attach
GPRS ciphering key sequence number	‘111’B	No key is available (MS to network)
DRX parameter	Any allowed value
P-TMSI or IMSI	IMSI-1
Old routing area identification	All bits of octets 5 and 6 are set to 1, except bit 1 of octet 6 which is set to 0. Other bits are not checked.
MS Radio Access capability	Any allowed value
Old P-TMSI signature	Not present
Requested READY timer value	Not present or any allowed value
TMSI status	‘0’B	no valid TMSI available
PS LCS Capability	Not present or any allowed value
Mobile station classmark 2	Not present or any allowed value
Mobile station classmark 3	Not present or any allowed value
Supported Codecs	Not present or any allowed value
UE network capability	Not present or any allowed value
Additional mobile identity	Not present
Additional old routing area identification	Not present

9.2.1.2.6 Combined attach / Rejected / Illegal ME

9.2.1.2.6.1 Test Purpose (TP)

(1)

with { UE has sent an ATTACH REQUEST message }

ensure that {
when { UE receives an ATTACH REJECT message with the EMM cause set to ‘Illegal ME’ }

then { UE deletes GUTI, last visited registered TAI and KSI and considers the USIM as invalid for EPS services and non-EPS services and enters state EMM-DEREGISTERED }

}

(2)

with { UE has sent an ATTACH REQUEST message }

ensure that {
when { UE receives an ATTACH REJECT message with the EMM cause set to ‘Illegal ME’ }

then { UE deletes P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number, TMSI, LAI and ciphering key sequence number }

}

9.2.1.2.6.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.1.3.5 and TS 24.008, clause 4.7.3.2.4.

[TS 24.301, clause 5.5.1.3.5]

Upon receiving the ATTACH REJECT message, the UE shall stop timer T3410, enter MM state MM IDLE, and take the following actions depending on the EMM cause value received.

…

#6 (Illegal ME); or

…

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause5.1.3.3) and shall delete any GUTI, last visited registered TAI and eKSI.

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the MM parameters update status, TMSI, LAI and ciphering key sequence number, and the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number as specified in 3GPP TS 24.008 [13] for the case when the combined attach procedure is rejected with the GMM cause with the same value.

[TS 24.008, clause 4.7.3.2.4]

The MS shall then take one of the following actions depending upon the reject cause:

…

# 6 (Illegal ME), or

…

9.2.1.2.6.3 Test description

The test description is identical to the one of subclause 9.2.1.2.5 except that the reject cause #3 “illegal UE” is replaced with reject cause #6 “Illegal ME”

9.2.1.2.7 Combined attach / Rejected / EPS services and non-EPS services not allowed

9.2.1.2.7.1 Test Purpose (TP)

(1)

with { UE has sent an ATTACH REQUEST message }

ensure that {
when { UE receives an ATTACH REJECT message with the EMM cause set to ‘EPS services and non-EPS services not allowed’ }

then { UE deletes GUTI, last visited registered TAI and KSI and considers the USIM as invalid for EPS services and non-EPS services and enters state EMM-DEREGISTERED }

}

(2)

with { UE has sent an ATTACH REQUEST }

ensure that {
when { UE receives an ATTACH REJECT message with the EMM cause set to ‘EPS services and non-EPS services not allowed’ }

then { UE deletes P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number, TMSI, LAI and ciphering key sequence number }

}

9.2.1.2.7.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.1.3.5 and TS 24.008, clause 4.7.3.2.4.

[TS 24.301, clause 5.5.1.3.5]

Upon receiving the ATTACH REJECT message, the UE shall stop timer T3410, enter MM state MM IDLE, and take the following actions depending on the EMM cause value received.

…

#8 (EPS services and non-EPS services not allowed);

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause5.1.3.3) and shall delete any GUTI, last visited registered TAI and eKSI.

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the MM parameters update status, TMSI, LAI and ciphering key sequence number, and the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number as specified in 3GPP TS 24.008 [13] for the case when the combined attach procedure is rejected with the GMM cause with the same value.

[TS 24.008, clause 4.7.3.2.4]

The MS shall then take one of the following actions depending upon the reject cause:

…

# 8 (GPRS services and non-GPRS services not allowed);

9.2.1.2.7.3 Test description

The test description is identical to the one of subclause 9.2.1.2.5 except that the reject cause #3 “illegal UE” is replaced with reject cause #8 “EPS services and non-EPS services not allowed”

9.2.1.2.8 Combined attach / Rejected / EPS services not allowed

9.2.1.2.8.1 Test Purpose (TP)

(1)

with { UE has sent an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message }

ensure that {
when { UE receives an ATTACH REJECT message with the reject cause set to "EPS services not allowed" }

then { UE considers the USIM as invalid for EPS services and enters state EMM-DEREGISTERED and UE does not attempt to attach on any other cell }

}

9.2.1.2.8.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.1.3.5.

[TS 24.301, clause 5.5.1.3.5]

Upon receiving the ATTACH REJECT message, the UE shall stop timer T3410, enter MM state MM IDLE, and take the following actions depending on the EMM cause value received.

…

#7 (EPS services not allowed);

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI and eKSI. The UE shall consider the USIM as invalid for EPS services until switching off or the UICC containing the USIM is removed. Additionally, the UE shall delete the list of equivalent PLMNs and shall enter the state EMM-DEREGISTERED.

A UE which is not yet IMSI attached for non-EPS services shall select GERAN or UTRAN radio access technology and perform an IMSI attach for non-EPS services, using the MM IMSI attach procedure as described in 3GPP TS 24.008 [13]. The UE shall not reselect E-UTRAN radio access technology until switching off or the UICC containing the USIM is removed.

A UE which is already IMSI attached for non-EPS services is still IMSI attached for non-EPS services in the network. The UE shall select GERAN or UTRAN radio access technology and shall proceed with the appropriate MM specific procedure according to the MM service state. The UE shall not reselect E-UTRAN radio access technology until switching off or the UICC containing the USIM is removed.

NOTE: Some interaction is required with the access stratum to disable E-UTRAN cell reselection.

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number as specified in 3GPP TS 24.008 [13] for the case when the combined attach procedure is rejected with the GMM cause with the same value.

9.2.1.2.8.3 Test description

9.2.1.2.8.3.1 Pre-test conditions

System Simulator:

– cell A and cell B;

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 5 (home PLMN);

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, cell 24 (home PLMN);

– System information combination 10a as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

NOTE: Setting px_RATComb_Tested = EUTRA_Only is not allowed.

UE:

– the UE is configured to initiate combined EPS/IMSI attach.

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18];

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, the UE is previously registered on UTRAN cell 5 using default message contents according to TS 36.508 [18].

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, the UE is previously registered on GERAN cell 24 using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.2.8.3.2 Test procedure sequence

Table 9.2.1.2.8.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – Cell A as the "Serving cell". – Cell B as a "Suitable neighbour cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
2	The UE is switched on.	–	–	–	–
3	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
3A-3D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
4	The SS transmits an ATTACH REJECT message with EMM cause = "EPS services not allowed" as specified.	<–	ATTACH REJECT	–	–
5	The SS releases the RRC connection.	–	–	–	–
5A	The SS configures Cell 5 or Cell 24 as a "Suitable neighbour cell".	–	–	–	–
–	EXCEPTION: Steps 6a1 to 6a5 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported	–	–	–	–
6a1	The following messages are sent and shall be received on cell 5 or Cell 24.	–	–	–	–
6a2	Check: Does the UE transmit a LOCATION UPDATING REQUEST message with Location updating type set to "IMSI attach" on Cell 5 or Cell 24?	–>	LOCATION UPDATING REQUEST	1	P
–	EXCEPTION: The messages in the next two steps are sent only on Cell 24	–	–	–	–
6a2Aa1	The UE transmits a Classmark Change message	–>	CLASSMARK CHANGE
–	EXCEPTION: The next step describes behaviour that depends on UE capability.	–	–	–	–
6a2Aa2	IF pc_UTRA THEN the UE transmits a Utran Classmark Change message.	–>	UTRAN CLASSMARK CHANGE.
6a3	The SS transmits an AUTHENTICATION REQUEST message to initiate the authentication and AKA procedure.	<–	AUTHENTICATION REQUEST	–	–
6a4	The UE transmits an AUTHENTICATION RESPONSE message.	–>	AUTHENTICATION RESPONSE	–	–
6a5	The SS transmits a LOCATION UPDATING ACCEPT message.	<–	LOCATION UPDATING ACCEPT	–	–
7	The SS configures: – Cell 5 or Cell 24 as a "Non-Suitable cell". – Cell A as the "Suitable neighbour cell". – Cell B as the "Suitable neighbour cell".	–	–	–	–
8	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on Cell A or on Cell B?	–>	ATTACH REQUEST	1	F
–	At the end of this test procedure sequence, the UE is in end state E-UTRA deregistered (E4) according to TS 36.508.	–	–	–	–

9.2.1.2.8.3.3 Specific message contents

Table 9.2.1.2.8.3.3-1: Message ATTACH REJECT (step 4, Table 9.2.1.2.8.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-3
Information Element	Value/remark	Comment	Condition
EMM cause	‘0000 0111’B	EPS services not allowed

Table 9.2.1.2.8.3.3-2: LOCATION UPDATING REQUEST (step 6a2, Table 9.2.1.2.8.3.2-1)

Derivation Path: TS 36.508 Table 4.7B.2-4
Information Element	Value/remark	Comment	Condition
Location updating type	IMSI attach Note 1	Rel8, Rel9, Rel10
Location updating type	Normal attach	Note 1
Note 1: Depending on the Release, one or any of these values is allowed.

Table 9.2.1.2.8.3.3-3: LOCATION UPDATING ACCEPT (step 6a5, Table 9.2.1.2.8.3.2-1)

Derivation Path: TS 36.508 Table 4.7B.2-5
Information Element	Value/remark	Comment	Condition
Mobile identity	Not present

9.2.1.2.9 Combined attach / Rejected / PLMN not allowed

9.2.1.2.9.1 Test Purpose (TP)

(1)

with { UE has sent an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message }

ensure that {
when { UE receives an ATTACH REJECT message with the reject cause set to "PLMN not allowed" }

then { UE deletes the GUTI, the last visited registered TAI and KSI and UE deletes the list of equivalent PLMNs and UE enters state EMM-DEREGISTERED.PLMN-SEARCH and UE stores the PLMN in the "forbidden PLMN list" }

}

(2)

with { UE is switched off and a PLMN is stored in the "forbidden PLMN list" }

ensure that {
when { UE is powered on this PLMN }

then { UE does not attempt to attach on the cell }

}

(3)

with { UE in E-UTRA EMM-DEREGISTERED.PLMN-SEARCH state and a PLMN is stored in the "forbidden PLMN list" }

ensure that {
when { UE enters a PLMN which is not in the "forbidden PLMN list" }

then { UE attempts to attach on the cell }

}

(4)

with { UE in E-UTRA EMM-DEREGISTERED.PLMN-SEARCH state and a PLMN is stored in the "forbidden PLMN list" }

ensure that {

when { the forbidden PLMN is selected manually }

then { UE attaches to the forbidden PLMN and deletes this PLMN from the forbidden PLMN list on the USIM}

}

9.2.1.2.9.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.1.3.5.

[TS 24.301, clause 5.5.1.3.5]

…

Upon receiving the ATTACH REJECT message, the UE shall stop timer T3410, enter MM state MM IDLE, and take the following actions depending on the EMM cause value received.

…

#11 (PLMN not allowed);

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, and KSI, and reset the attach attempt counter. The UE shall delete the list of equivalent PLMNs and enter the state EMM-DEREGISTERED.PLMN-SEARCH.

The UE shall store the PLMN identity in the "forbidden PLMN list".

The UE shall perform a PLMN selection according to 3GPP TS 23.122 [6].

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the MM parameters update status, TMSI, LAI, ciphering key sequence number and location update attempt counter, and the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and GPRS attach attempt counter as specified in 3GPP TS 24.008 [13] for the case when the combined attach procedure is rejected with the GMM cause with the same value and no RR connection exists.

…

9.2.1.2.9.3 Test description

9.2.1.2.9.3.1 Pre-test conditions

System Simulator:

– cell G, cell H (VPLMN, same MCC like HPLMN, different TAs) and cell I (VPLMN, different MCC from HPLMN);

– the cells are configured according to Table 6.3.2.2-1 and Table 6.3.2.2-3 in36.508[18], except replacing f3 with f1;

– if pc_UTRA AND , px_RATComb_Tested = EUTRA_UTRA N, cell 9 (belongs to RAI-1, same PLMN as cell G, Non-suitable off);

– if pc_GERAN px_RATComb_Tested = EUTRA_GERAN, cell 24 (belongs to RAI-1, same PLMN as cell G, Non-suitable off); – the cells may not be simultaneously activated.

– System information combination 10 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

NOTE: Setting px_RATComb_Tested = EUTRA_Only is not allowed.

UE:

– the UE is configured to initiate combined EPS/IMSI attach;

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell G using default message contents according to TS 36.508 [18];

– the "forbidden PLMN list" is empty.

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.2.9.3.2 Test procedure sequence

Table 9.2.1.2.9.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – Cell G as the "Serving cell". – Cell H as a " Suitable Neighbour cell". – Cell I as a "Non-Suitable Off cell". Note: Cell G and Cell H are in the different TAI – same PLMN.	–	–	–	–
–	The following messages are to be observed on Cell G unless explicitly stated otherwise.	–	–	–	–
2	The UE is switched on.	–	–	–	–
3	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
3A-3D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
4	The SS transmits an ATTACH REJECT message with EMM cause = "PLMN not allowed".	<–	ATTACH REJECT	–	–
5	The SS releases the RRC connection.	–	–	–	–
6	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds?	–	ATTACH REQUEST	1	F
7	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
8	The UE is brought back to operation or the USIM is inserted. The UE is powered on or switched on.	–	–	–	–
8A	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	2	F
–	EXCEPTION: Steps 9a1 to 9a3 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported	–	–	–	–
9a1	The SS configures: – Cell H as a "Non-Suitable off cell". – Cell G as a "Non-Suitable cell". – Cell 9 (px_RATComb_Tested = EUTRA_UTRA) or Cell 24 (px_RATComb_Tested = EUTRA_GERAN) as the "Serving cell". Note: Cell G, Cell 9 and Cell 24 are in the same PLMN.	–	–	–	–
–	The following messages are to be observed on Cell 9 or Cell 24 unless explicitly stated otherwise.	–	–	–	–
9a2	Void	–	–	–	–
9a3	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	2	F
10	The SS configures: Cell 9 or Cell 24 as a "Non-Suitable off cell". Cell I as a " Serving cell". Note: Cell G belongs to PLMN different from PLMN belonging to Cell I.	–	–	–	–
–	The following messages are to be observed on Cell I unless explicitly stated otherwise.	–	–	–	–
11	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message as specified?	–>	ATTACH REQUEST	1,3	P
12-23, 23A	The attach procedure is completed by executing steps 5 to 17 of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
24	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
–	EXCEPTION: Step 25 describes behaviour that depends on the UE capability.
25	If pc_SwitchOnOff or pc_USIM_Removal then the UE transmits a DETACH REQUEST message.	–>	DETACH REQUEST	–	–
26	The SS configures: – Cell G as the "Serving cell" – Cell I as a "Non-suitable cell". Note: Cell G belongs to the forbidden PLMN.	–	–	–	–
27	The UE is brought back to operation or the USIM is inserted	–	–	–	–
28	The following messages are to be observed on Cell G unless explicitly stated otherwise.	–	–	–	–
29	The user sets the UE in manual PLMN selection mode or requests a PLMN search.	–	–	–	–
30	The user selects PLMN of cell G.	–	–	–	–
31	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message as specified?	–>	ATTACH REQUEST	4	P
32-44	The attach procedure is completed and the RRC connection is released by executing steps 5 to 17 of the UE registration procedure in TS 36.508 clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.2.9.3.3 Specific message contents

Table 9.2.1.2.9.3.3-1: Message ATTACH REJECT (step 4, Table 9.2.1.2.9.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-3
Information Element	Value/remark	Comment	Condition
EMM cause	‘0000 1011’B	PLMN not allowed

Table 9.2.1.2.9.3.3-2: Message ATTACH REQUEST (step 11, Table 9.2.1.2.9.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
NAS key set identifier
NAS key set identifier	‘111’B	no key is available
TSC	Any allowed value	TSC does not apply for NAS key set identifier value "111".
Old GUTI or IMSI	IMSI1
Last visited registered TAI	Not present

Table 9.2.1.2.9.3.3-3: Message ATTACH REQUEST (step 31, Table 9.2.1.1.13.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	GUTI allocated in step 21
Last visited registered TAI	TAI allocated in step 21

9.2.1.2.10 Combined attach / Rejected / Tracking area not allowed

9.2.1.2.10.1 Test Purpose (TP)

(1)

with { UE has sent an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message }

ensure that {
when { UE receives an ATTACH REJECT message with the reject cause set to "Tracking area not allowed" }

then { UE deletes the GUTI, last visited registered TAI and KSI, UE enters the state EMM-DEREGISTERED.LIMITED-SERVICE and UE stores the current TAI in the list of "forbidden tracking areas for regional provision of service" }

}

(2)

with { UE is in EMM-DEREGISTERED.LIMITED-SERVICE state and the current TAI in the list of "forbidden tracking areas for regional provision of service" }

ensure that {
when { serving cell belongs to TAI where UE was rejected }

then { UE does not attempt to attach on any cell }

}

(3)

with { UE is in EMM-DEREGISTERED.LIMITED-SERVICE state and the current TAI in the list of "forbidden tracking areas for regional provision of service" }

ensure that {
when { UE re-selects a new cell in the same TAI it was rejected }

then { UE does not attempt to attach on the cell }

}

(4)

with { UE is switched off }

ensure that {
when { UE is powered on in the cell belonging to the TAI which was in the list of "forbidden tracking areas for regional provision of service" before the UE was switched off }

then { UE attempts to attach on the cell }

}

9.2.1.2.10.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.1.3.5.

[TS 24.301, clause 5.5.1.3.5]

Upon receiving the ATTACH REJECT message, the UE shall stop timer T3410, enter MM state MM IDLE, and take the following actions depending on the EMM cause value received.

…

#12 (Tracking area not allowed);

The UE shall store the current TAI in the list of "forbidden tracking areas for regional provision of service".

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the MM parameters update status, TMSI, LAI, ciphering key sequence number and location update attempt counter, and the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and GPRS attach attempt counter as specified in 3GPP TS 24.008 [13] for the case when the combined attach procedure is rejected with the GMM cause with the same value.

9.2.1.2.10.3 Test description

9.2.1.2.10.3.1 Pre-test conditions

System Simulator:

– Cell A, Cell B and Cell M.

– System information combination 3 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

UE:

– the UE is configured to initiate combined EPS/IMSI attach;

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.2.10.3.2 Test procedure sequence

Table 9.2.1.2.10.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – Cell A as the "Serving cell". – Cell B as a "Suitable neighbour cell". – Cell M as a "Non-Suitable cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
2	The UE is switched on.	–	–	–	–
3	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
3A-3D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
4	The SS transmits an ATTACH REJECT message with EMM cause = "Tracking area not allowed".	<–	ATTACH REJECT	–	–
5	The SS releases the RRC connection.	–	–	–	–
6	Check: Does the UE transmit the ATTACH REQUEST message in the next 30 seconds on Cell A or Cell B?	–	ATTACH REQUEST	1,2	F
7	The SS configures: – Cell A as the "Non-Suitable cell". – Cell B as a "Non-Suitable cell". – Cell M as a "Serving cell".	–	–	–	–
8	Check: Does the UE transmit the ATTACH REQUEST message in the next 30 seconds on Cell M?	–	ATTACH REQUEST	3	F
–	The following messages are to be observed on Cell M unless explicitly stated otherwise.	–	–	–	–
9	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
10	The UE is brought back to operation or the USIM is inserted	–	–	–	–
11	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message as specified?	–>	ATTACH REQUEST	1,4	P
12-25b1	The attach procedure is completed by executing steps 5 to 18b1 of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.2.10.3.3 Specific message contents

Table 9.2.1.2.10.3.3-0: SystemInformationBlockType1 of Cell A (all steps, Table 9.2.1.2.10.3.2-1)

Derivation Path: 36.508 Table 4.4.3.2-3
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType1 ::= SEQUENCE {
cellAccessRelatedInfo SEQUENCE {
intraFreqReselection	allowed
}
}

Table 9.2.1.2.10.3.3-1: Message ATTACH REJECT (step 4, Table 9.2.1.2.10.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-3
Information Element	Value/remark	Comment	Condition
EMM cause	‘0000 1100’B	Tracking Area not allowed

Table 9.2.1.2.10.3.3-2: Message ATTACH REQUEST (step 11, Table 9.2.1.2.10.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
NAS key set identifier
NAS key set identifier	‘111’B	no key is available
TSC	Any allowed value	TSC does not apply for NAS key set identifier value "111".
Old GUTI or IMSI	IMSI1
Last visited registered TAI	Not present

9.2.1.2.11 Combined attach / Rejected / Roaming not allowed in this tracking area

9.2.1.2.11.1 Test Purpose (TP)

(1)

with { UE has sent an ATTACH REQUEST message }

ensure that {
when { UE receives an ATTACH REJECT message with the EMM cause set to "Roaming not allowed in this tracking area" }

then { UE sets the EPS update status to EU3 ROAMING NOT ALLOWED and UE deletes the GUTI, the last visited registered TAI and KSI and UE enters the state EMM-DEREGISTERED.LIMITED-SERVICE or optionally EMM-DEREGISTERED.PLMN-SEARCH and UE stores the current TAI in the list of "forbidden tracking areas for roaming" and deletes the TMSI, the LAI and the ciphering key sequence number }

}

(2)

with { UE is in EMM-DEREGISTERED.LIMITED-SERVICE or EMM-DEREGISTERED.PLMN-SEARCH state and the current TAI is in the list of "forbidden tracking areas for roaming" }

ensure that {
when { UE re-selects a new cell in the same TA where it was rejected }

then { UE does not attempt to attach }

}

(3)

with { UE is in EMM-DEREGISTERED.LIMITED-SERVICE or EMM-DEREGISTERED.PLMN-SEARCH state and the TAI of the current cell belongs to the list of "forbidden tracking areas for roaming" }

ensure that {
when { UE enters a cell belonging to a tracking area not in the list of "forbidden tracking areas for roaming" }

then { UE attempts to attach with IMSI }

}

(4)

with { UE is in EMM-DEREGISTERED.LIMITED-SERVICE or EMM-DEREGISTERED.PLMN-SEARCH state and the list of "forbidden tracking areas for roaming" contains more than one TAI }

ensure that {
when { UE selects a cell belonging to one of the TAIs in the list of "forbidden tracking areas for roaming" }

then { UE does not attempt to attach }

}

(5)

with { UE has sent an ATTACH REQUEST message }

ensure that {
when { UE receives an ATTACH REJECT message with the EMM cause set to "Roaming not allowed in this tracking area" }

then { UE deletes RAI, P-TMSI, P-TMSI signature and GPRS ciphering key sequence number and sets the GPRS update status to GU3 ROAMING NOT ALLOWED }

}

(6)

with { UE is switched off or the UICC containing the USIM is removed }

ensure that {
when { UE is powered on in the cell belonging to the TAI which was in the list of "forbidden tracking areas for roaming" before UE was switched off or the USIM is inserted again on that cell }

then { UE performs registration on that cell }

}

(7)

with { a cell of the HPLMN is available }

ensure that {
when { UE performs a PLMN selection }

then { UE returns to a cell of the HPLMN }

}

9.2.1.2.11.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.3.2 and 5.5.1.3.5 and TS 24.008, clause 4.7.3.2.4.

[TS 24.301, clause 5.3.2]

The UE shall store a list of "forbidden tracking areas for roaming", as well as a list of "forbidden tracking areas for regional provision of service". These lists shall be erased when the UE is switched off or when the UICC containing the USIM is removed, and periodically (with a period in the range 12 to 24 hours). One or more tracking areas is removed from the list of "forbidden tracking areas for roaming" in the UE, as well as the list of "forbidden tracking areas for regional provision of service" if, after a subsequent procedure e.g. attach procedure, tracking area updating procedure and GUTI reallocation procedure, one or more tracking areas in the lists is received from the network.

Each list shall accommodate 40 or more TAIs. When the list is full and a new entry has to be inserted, the oldest entry shall be deleted.

[TS 24.301, clause 5.5.1.3.5]

If the attach request can neither be accepted by the network for EPS nor for non-EPS services, the MME shall send an ATTACH REJECT message to the UE including an appropriate EMM cause value. If the attach procedure fails due to a default EPS bearer setup failure or an ESM procedure failure, the MME shall combine the ATTACH REJECT message with a PDN CONNECTIVITY REJECT message. In this case the EMM cause value in the ATTACH REJECT message shall be set to #19, "ESM failure".

Upon receiving the ATTACH REJECT message, the UE shall stop timer T3410, enter MM state MM IDLE, and take the following actions depending on the EMM cause value received.

…

#13 (Roaming not allowed in this tracking area);

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI and KSI. The UE shall delete the list of equivalent PLMNs and reset the attach attempt counter. Additionally the UE enter the state EMM-DEREGISTERED.LIMITED-SERVICE or optionally EMM-DEREGISTERED.PLMN-SEARCH.

The UE shall store the current TAI in the list of "forbidden tracking areas for roaming".

The UE shall perform a PLMN selection according to 3GPP TS 23.122 [6].

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the MM parameters update status, TMSI, LAI, ciphering key sequence number and location update attempt counter, and the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and GPRS attach attempt counter as specified in 3GPP TS 24.008 [13] for the case when the combined attach procedure is rejected with the GMM cause with the same value.

…

[TS 24.008, clause 4.7.3.2.4]

If the attach request can neither be accepted by the network for GPRS nor for non-GPRS services, an ATTACH REJECT message is transferred to the MS. The MS receiving the ATTACH REJECT message stops timer T3310, and for all causes except #12, #14, #15 and #25 deletes the list of "equivalent PLMNs".

The MS shall then take one of the following actions depending upon the reject cause:

…

# 13 (Roaming not allowed in this location area);

The MS shall delete any RAI, P-TMSI, P-TMSI signature and GPRS ciphering key sequence number, shall set the GPRS update status to GU3 ROAMING NOT ALLOWED(and shall store it according to clause 4.1.3.2) and shall reset the GPRS attach attempt counter. The state is changed to GMM-DEREGISTERED.LIMITED-SERVICE or optionally to GMM-DEREGISTERED.PLMN-SEARCH.

The MS shall set the update status to U3 ROAMING NOT ALLOWED, reset the location update attempt counter and shall delete any TMSI, LAI and ciphering key sequence number. The new MM state is MM IDLE.

…

9.2.1.2.11.3 Test description

9.2.1.2.11.3.1 Pre-test conditions

System Simulator:

– cell I and cell K (visited PLMN, same TA);

– cell L (same visited PLMN, another TA);

– cell C (home PLMN);

– the cells are configured according to Table 6.3.2.2-1 and Table 6.3.2.2-3 in36.508[18], except replacing f3 with f2;

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 9 (only active when stated):

– same PLMN like visited PLMN above;

– RAI-1 (RAC & LAC values chosen by SS);

– System information indicate that NMO 1 is used;

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, cell 24 (only active when stated):

– same PLMN like visited PLMN above;

– RAC-1 (RAC & LAC values chosen by SS);

– System information combination 10 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

NOTE 1: Setting px_RATComb_Tested = EUTRA_Only is not allowed.

NOTE 2: Cell K is present to confirm that UE does not attempt attach to the cell in same TAI after reject from the SS.

NOTE 3: Cell C is present to confirm that UE does attempt attach to the cell in HPLMN after reject from the SS.

NOTE 4: The requirement in 3GPP TS 24.301 to store at least 40 entries in the list of "forbidden tracking areas for roaming" is not fully tested.

NOTE 5: Different types of UE may use different methods to periodically clear the list of forbidden areas (e.g. every day at 12 am) for roaming. If the list is cleared while the test is being run, it may be necessary to re-run the test.

UE:

– the UE is configured to initiate combined EPS/IMSI attach;

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell I using default message contents according to TS 36.508 [18];

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, the UE is previously registered on UTRAN cell 9 using default message contents according to TS 36.508 [18].

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, the UE is previously registered on GERAN cell 24 using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.2.11.3.2 Test procedure sequence

Table 9.2.1.2.11.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: Cell I as the "Serving cell". Cell K as a "Non-Suitable cell", Cell L as a "Non-Suitable “off” cell", Cell C as a "Non-Suitable cell".	–	–	–	–
–	The following messages are to be observed on Cell I unless explicitly stated otherwise.	–	–	–	–
2	The UE is switched on.	–	–	–	–
3	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
3A-3D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
4	The SS transmits an ATTACH REJECT message with the EMM cause set to "Roaming not allowed in this tracking area" on Cell I. (The list of "forbidden tracking areas for roaming" in the UE should now contain TAI-9)	<–	ATTACH REJECT	–	–
5	The SS releases the RRC connection.	–	–	–	–
6	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on Cell I?	–>	ATTACH REQUEST	1,4	F
7	The SS reconfigures: Cell I as a "Suitable cell", Cell K as the "Serving cell", Cell L as a "Non-Suitable “off” cell", Cell C as a "Non-Suitable cell".	–	–	–	–
8	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on any cell?	–>	ATTACH REQUEST	2	F
9	The SS reconfigures: Cell I as a "Non-Suitable “off” cell", Cell K as a "Suitable cell", Cell L as the "Serving cell", Cell C as a "Non-Suitable cell".	–	–	–	–
10	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message on Cell L?	–>	ATTACH REQUEST	3	P
10A-10D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
11	The SS transmits an ATTACH REJECT message with the EMM cause set to "Roaming not allowed in this tracking area" on Cell L. (The list of "forbidden tracking areas for roaming" in the UE should now contain TAI-9 and TAI-11)	<–	ATTACH REJECT	–	–
12	The SS releases the RRC connection.	–	–	–	–
13	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on Cell L or Cell K?	–>	ATTACH REQUEST	1,4	F
14	The SS reconfigures: Cell I as a "Serving cell", Cell K as a " Non-Suitable “off” cell", Cell L as a "Suitable cell", Cell C as the "Non-Suitable cell".	–	–	–	–
15	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on any cell?	–>	ATTACH REQUEST	2,4	F
–	EXCEPTION: Steps 16a1 to 16a2 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported	–	–	–	–
16a1	The SS reconfigures: Cell I as "Serving cell", Cell L as "Non-suitable “off" cell", Cell 9 (px_RATComb_Tested = EUTRA_UTRA) or Cell 24 (px_RATComb_Tested = EUTRA_GERAN) as "Suitable cell".	–	–	–	–
16a2	Check: Does the UE transmit an ATTACH REQUEST message without P-TMSI, P-TMSI signature, RAI, TMSI on Cell 9 or Cell 24?	–>	ATTACH REQUEST	5	P
16a3	The SS transmits an ATTACH REJECT message with the GMM cause set to "Roaming not allowed in this location area" on Cell 9 or Cell 24.	<–	ATTACH REJECT	–	–
17	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
18	The SS reconfigures: Cell I as the "Serving cell", Cell K as a "Non-Suitable cell", Cell 9 or Cell 24 as a "Non-Suitable “off” cell", Cell C as a "Non-Suitable cell".	–	–	–	–
19	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
20	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message on Cell I?	–>	ATTACH REQUEST	6	P
20A-20D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
21	The SS transmits an ATTACH REJECT message with the EMM cause set to "Roaming not allowed in this tracking area" on Cell I. (The list of "forbidden tracking areas for roaming" in the UE should now contain TAI-9)	<–	ATTACH REJECT	–	–
21A	The SS releases the RRC connection.	–	–	–	–
22	The SS reconfigures: Cell I as the "Serving cell", Cell K as a "Non-Suitable cell", Cell C as a "Suitable cell".	–	–	–	–
–	The following messages are to be observed on Cell C unless explicitly stated otherwise.	–	–	–	–
23	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	7	P
24-37b1	The attach procedure is completed by executing steps 5 to 18b1 of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.2.11.3.3 Specific message contents

Table 9.2.1.2.11.3.3-1: Message ATTACH REJECT (step 4, step 11 and step 21, Table 9.2.1.2.11.3.2-1)

Derivation Path: TS 36.508, Table 4.7.2-3
Information Element	Value/remark	Comment	Condition
EMM cause	‘0000 1101’B	Roaming not allowed in this tracking area

Table 9.2.1.2.11.3.3-2: Message ATTACH REQUEST (step 10, step 20 and step23, Table 9.2.1.2.11.3.2-1)

Derivation Path: TS 36.508, Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
NAS key set identifier
NAS key set identifier	‘111’B	no key is available
TSC	Any allowed value	TSC does not apply for NAS key set identifier value "111".
Old GUTI or IMSI	IMSI-1
Last visited registered TAI	Not present
Old location area identification	Not present
TMSI status	‘0’B	no valid TMSI available

Table 9.2.1.2.11.3.3-3: Message ATTACH REQUEST (step 16a2, Table 9.2.1.2.11.3.2-1)

Derivation Path: TS 24.008 , Table 9.4.1
Information Element	Value/remark	Comment	Condition
MS network capability	Any allowed value
Attach type	‘011’B	Combined GPRS/IMSI attach
GPRS ciphering key sequence number	‘111’B	No key is available (MS to network)
DRX parameter	Any allowed value
P-TMSI or IMSI	IMSI-1
Old routing area identification	All bits of octets 5 and 6 are set to 1, except bit 1 of octet 6 which is set to 0. Other bits are not checked.
MS Radio Access capability	Any allowed value
Old P-TMSI signature	Not present
Requested READY timer value	Not present or any allowed value
TMSI status	‘0’B	no valid TMSI available
PS LCS Capability	Not present or any allowed value
Mobile station classmark 2	Not present or any allowed value
Mobile station classmark 3	Not present or any allowed value
Supported Codecs	Not present or any allowed value
UE network capability	Not present or any allowed value
Additional mobile identity	Not present
Additional old routing area identification	Not present

Table 9.2.1.2.11.3.3-4: Message ATTACH REJECT (step 16a3, Table 9.2.1.2.11.3.2-1)

Derivation Path: TS 24.008 , Table 9.4.4
Information Element	Value/remark	Comment	Condition
GMM cause	‘0000 1101’B	Roaming not allowed in this location area
T3302 value	Not present

9.2.1.2.12 Combined attach / Rejected / EPS services not allowed in this PLMN

9.2.1.2.12.1 Test Purpose (TP)

(1)

with { UE has sent an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message }

ensure that {

when { UE receives an ATTACH REJECT message with the reject cause set to "EPS services not allowed in this PLMN" }

then { UE deletes any GUTI, last visited registered TAI, KSI and enters EMM-DEREGISTERED.PLMN-SEARCH state}

}

(2)

with { UE in E-UTRA EMM-DEREGISTERED.PLMN-SEARCH state, and a PLMN is stored in the "forbidden PLMNs for GPRS service list" }

ensure that {

when { UE detects a cell which belongs to a PLMN which is in the "forbidden PLMNs for GPRS service list" }

then { UE doesn’t perform an attach procedure }

}

(3)

with { UE in E-UTRA EMM-DEREGISTERED.PLMN-SEARCH state, and a PLMN is stored in the "forbidden PLMNs for GPRS service list" }

ensure that {

when { UE detects a cell which belongs to a PLMN which is not in the "forbidden PLMNs for GPRS service list" }

then { UE performs an attach procedure }

}

(4)

with { UE is switched off when a PLMN is stored in the "forbidden PLMNs for GPRS service list" }

ensure that {

when { UE is powered on a cell which belongs to this PLMN }

then { UE performs an attach procedure }

}

(5)

with { UE in E-UTRA EMM-DEREGISTERED.PLMN-SEARCH state, and a PLMN is stored in the "forbidden PLMNs for GPRS service list" }

ensure that {

when { UE is in the cell which belongs to the rejected PLMN and when that PLMN is selected manually }

then { UE performs an attach procedure }

9.2.1.2.12.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clause 5.4.4.3.

[TS 24.301, clause5.5.1.3.5]

Upon receiving the ATTACH REJECT message, the UE shall stop timer T3410, enter MM state MM IDLE, and take the following actions depending on the EMM cause value received.

…

#14 (EPS services not allowed in this PLMN);

The UE shall store the PLMN identity in the "forbidden PLMNs for GPRS service" list.

A UE operating in CS/PS mode 1 which is not yet IMSI attached for non-EPS services may select GERAN or UTRAN radio access technology and perform an IMSI attach for non-EPS services, using the MM IMSI attach procedure as described in 3GPP TS 24.008 [13]. In this case the UE shall not reselect E-UTRAN radio access technology for the duration the UE is on the PLMN or an equivalent PLMN.

A UE operating in CS/PS mode 1 which is already IMSI attached for non-EPS services in the network is still IMSI attached for non-EPS services in the network. The UE may select GERAN or UTRAN radio access technology and proceed with the appropriate MM specific procedure according to the MM service state. In this case the UE shall not reselect E-UTRAN radio access technology for the duration the UE is on the PLMN or an equivalent PLMN.

A UE in CS/PS mode 1 of operation may perform a PLMN selection according to 3GPP TS 23.122 [6].

A UE operating in CS/PS mode 2 which is already IMSI attached for non-EPS services in the network is still IMSI attached for non-EPS services in the network.

A UE operating in CS/PS mode 2 of operation shall perform a PLMN selection according to 3GPP TS 23.122 [6].

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and GPRS attach attempt counter as specified in 3GPP TS 24.008 [13] for the case when the combined attach procedure is rejected with the GMM cause with the same value.

9.2.1.2.12.3 Test description

9.2.1.2.12.3.1 Pre-test conditions

System Simulator:

– cell G, Cell H and cell I are configured according to Table 6.3.2.2-1 in; [18].

– cell G and Cell H with MCC-1/MNC-2 (visited PLMN, different TAs)

– Cell I with MCC-2/MNC-101 (visited PLMN);

– the cells are configured according to Table 6.3.2.2-1 and Table 6.3.2.2-3 in 36.508 [18], except replacing f3 with f1

– the cells may not be simultaneously activated.

UE:

– the UE is configured to initiate Combined attach;

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell G using default message contents according to TS 36.508 [18];

– the "forbidden PLMNs for GPRS service list" is empty.

– the different cells may not be simultaneously activated (at most 2 cells are active simultaneously).

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.2.12.3.2 Test procedure sequence

Table 9.2.1.2.12.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – Cell G as the "Serving cell". – Cell H as a "Non-Suitable cell". – Cell I as a "Non-Suitable off cell".	–	–	–	–
–	The following messages are to be observed on Cell G unless explicitly stated otherwise.	–	–	–	–
2	The UE is switched on.	–	–	–	–
3	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
3A-3D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
4	The SS transmits an ATTACH REJECT message including EMM cause = "EPS services not allowed in this PLMN".	<–	ATTACH REJECT	–	–
5	The SS releases the RRC connection.	–	–	–	–
6	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds?	–>	ATTACH REQUEST	1	F
7	The SS configures: Cell G as a "Non-Suitable cell". Cell H as the "Serving cell". Note: Cell G and Cell H are in the different TAI – same PLMN.	–	–	–	–
–	The following messages are to be observed on Cell H unless explicitly stated otherwise.	–	–	–	–
8	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds?	–>	ATTACH REQUEST	2	F
9	The SS configures: Cell H as a "Non-Suitable off cell". Cell I as the "Serving cell". Note: Cell G and Cell I are different PLMNs.	–	–	–	–
–	The following messages are to be observed on Cell I unless explicitly stated otherwise.	–	–	–	–
10	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message as specified?	–>	ATTACH REQUEST	1,3	P
11-23	The SS completes the attach procedure successfully and then releases the RRC -connection by executing steps 5 to 17 of UE registration procedure in TS 36.508 clause 4.5.2.3.
24	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
25	The SS configures – Cell I as a "Non-Suitable cell". – Cell G as the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell G unless explicitly stated otherwise.	–	–	–	–
26	The UE is brought back to operation or the USIM is inserted.
27	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	4	P
27A-27D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
28	The SS transmits an ATTACH REJECT message including EMM cause = "EPS services not allowed in this PLMN".	<–	ATTACH REJECT	–	–
29	SS releases the RRC connection.	–	–	–	–
30	The user sets the UE in manual PLMN selection mode or requests a PLMN search. The user selects PLMN (MCC-1/MNC-2)
31	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message as specified?	–>	ATTACH REQUEST	5	P
32-44	The attach procedure is completed and the RRC connection released by executing steps 5 to 17 of the UE registration procedure in TS 36.508 clause 4.5.2.3.	–	–	–	–
45	At the end of this test procedure sequence, the UE is in end state E-UTRA manual selection (E5) according to TS 36.508.	–	–	–	–

9.2.1.2.12.3.3 Specific message contents

Table 9.2.1.2.12.3.3-1: Message ATTACH REQUEST (step 3, Table 9.2.1.2.12.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element		Value/Remark	Comment	Condition
Old GUTI or IMSI	GUTI-1
Last visited registered TAI	TAI-1
Old location area identification	LAI-1
TMSI status	Not Present

Table 9.2.1.2.12.3.3-2: Message ATTACH REJECT (step 4 and 28, Table 9.2.1.2.12.3.2-1)

Derivation path: 36.508 table 4.7.2-3 (Plain NAS message)
Information Element	Value/Remark	Comment	Condition
EMM cause	00001110	#14 "EPS services not allowed in this PLMN "
ESM message container	Not present

Table 9.2.1.2.12.3.3-3: Message ATTACH REQUEST (step 10 and step 31, Table 9.2.1.2.12.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
NAS key set identifier
NAS key set identifier	‘111’B	no key is available
TSC	Any allowed value	TSC does not apply for NAS key set identifier value "111".
Old GUTI or IMSI	IMSI-1	GUTI has been deleted after receiving ATTACH REJECT at step 5 and step28; only IMSI is available.
Last visited registered TAI	Not present	TAI has been deleted after receiving ATTACH REJECT at step 5 and step29.

9.2.1.2.13 Combined attach / Rejected / No suitable cells in tracking area

9.2.1.2.13.1 Test Purpose (TP)

(1)

with { UE has sent an ATTACH REQUEST message }

ensure that {
when { UE receives an ATTACH REJECT message with the EMM cause set to ‘No Suitable Cells In tracking area’ }

then { UE sets the EPS update status to EU3 ROAMING NOT ALLOWED, deletes any GUTI, last visited registered TAI and KSI, resets the attach attempt counter, enters the state EMM-DEREGISTERED.LIMITED-SERVICE and stores the current TAI in the list of "forbidden tracking areas for roaming" }

}

(2)

with { UE is in EMM-DEREGISTERED.LIMITED-SERVICE state and the current TAI is in the list of "forbidden tracking areas for roaming" }

ensure that {
when { UE re-selects a cell that belongs to the TAI where UE was rejected }

then { UE does not attempt to attach }

}

(3)

with { UE is in EMM-DEREGISTERED.LIMITED-SERVICE state and the current TAI is in the list of "forbidden tracking areas for roaming" and KSI was deleted }

ensure that {
when { in the same PLMN, UE enters a cell which provides normal service and belongs to the tracking area not in the list of "forbidden tracking areas for roaming" }

then { UE attempts to attach with IMSI indicated that no key is available }

}

(4)

with { UE is in EMM-DEREGISTERED.LIMITED-SERVICE state and the current TAI is in the list of "forbidden tracking areas for roaming" }

ensure that {
when { there are cells in the same PLMN and other PLMN that provide normal service and belong to the tracking area not in the list of "forbidden tracking areas for roaming" }

then { UE attempts to attach to the cell in the same PLMN }

}

(5)

with { UE is in EMM-DEREGISTERED.LIMITED-SERVICE state and the list of "forbidden tracking areas for roaming" contains more than one TAI }

ensure that {
when { UE re-selects a cell that belongs to one of the TAIs in the list of "forbidden tracking areas for roaming" }

then { UE does not attempt to attach }

}

(6)

with { UE has sent an ATTACH REQUEST message }

ensure that {
when { UE receives an ATTACH REJECT message with the EMM cause set to ‘No Suitable Cells In tracking area’ }

then { UE deletes RAI, P-TMSI, P-TMSI signature, GPRS ciphering key sequence number, TMSI, LAI and ciphering key sequence number }

}

(7)

with { UE is switched off }

ensure that {
when { UE is powered on in the cell belonging to the TAI which was in the list of "forbidden tracking areas for roaming" before UE was switched off }

then { UE attempts to attach }

}

9.2.1.2.13.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.3.2 and 5.5.1.3.5 and TS 24.008, clause 4.7.3.2.4.

[TS 24.301, clause 5.3.2]

Each list shall accommodate 40 or more TAIs. When the list is full and a new entry has to be inserted, the oldest entry shall be deleted.

[TS 24.301, clause 5.5.1.3.5]

Upon receiving the ATTACH REJECT message, the UE shall stop timer T3410, enter MM state MM IDLE, and take the following actions depending on the EMM cause value received.

…

#15 (No suitable cells in tracking area);

The UE shall store the current TAI in the list of "forbidden tracking areas for roaming".

The UE shall search for a suitable cell in another tracking area or in another location area in the same PLMN according to 3GPP TS 36.304 [21].

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the MM parameters update status, TMSI, LAI, ciphering key sequence number and location update attempt counter, and the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and GPRS attach attempt counter as specified in 3GPP TS 24.008 [13] for the case when the combined attach procedure is rejected with the GMM cause with the same value.

…

[TS 24.008, clause 4.7.3.2.4]

…

The MS shall then take one of the following actions depending upon the reject cause:

…

# 15 (No Suitable Cells In Location Area);

The MS shall set the update status to U3 ROAMING NOT ALLOWED, reset the location update attempt counter and shall delete any TMSI, LAI and ciphering key sequence number. The new MM state is MM IDLE.

…

9.2.1.2.13.3 Test description

9.2.1.2.13.3.1 Pre-test conditions

System Simulator:

– cell I and cell K (visited PLMN, same TA);

– cell E (same visited PLMN, another TA);

– cell J (another VPLMN);

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 8 (only active when stated):

– same PLMN like visited PLMN above;

– RAI-1 (RAC & LAC values chosen by SS);

– system information indicates that NMO 1 is used;

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, cell 24 (only active when stated:

– same PLMN like visited PLMN above;

– RAC-1 (RAC & LAC values chosen by SS);

– system information indicates that NMO 1 is used;

– maximum 3 cells are simultaneously active.

– System information combination 10 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

– the cells are configured according to Table 6.3.2.2-1 and Table 6.3.2.2-3 in 36.508 [18], except replacing f4 with f1.

NOTE 1: Setting px_RATComb_Tested = EUTRA_Only is not allowed.

NOTE 2: Cell E is present to confirm that UE searches in the same PLMN after reject from the SS.

NOTE 3: Cell K is present to confirm that UE shall not attempt attach to the cell in same TAI it was once rejected from.

NOTE 4: The requirement in 3GPP TS 24.301 to store at least 40 entries in the list of "forbidden tracking areas for roaming" is not fully tested.

UE:

– the UE is configured to initiate combined EPS/IMSI attach;

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell I using default message contents according to TS 36.508 [18];

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, the UE is previously registered on UTRAN cell 8 using default message contents according to TS 36.508 [18].

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, the UE is previously registered on GERAN cell 24 using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.2.13.3.2 Test procedure sequence

Table 9.2.1.2.13.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: Cell I as the "Serving cell", Cell K as a "Suitable cell", Cell E as a "Non-Suitable cell", Cell J as a "Non-Suitable" off” cell".	–	–	–	–
–	The following messages are to be observed on Cell I unless explicitly stated otherwise.	–	–	–	–
2	The UE is switched on.	–	–	–	–
3	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
3A-3D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
4	The SS transmits an ATTACH REJECT message with the EMM cause set to ‘No suitable cells in tracking area’ on Cell I. (The list of “forbidden tracking areas for roaming” in the UE should now contain TAI-9)	<–	ATTACH REJECT	–	–
5	The SS releases the RRC connection.	–	–	–	–
6	The SS reconfigures: Cell I as a "Suitable cell", Cell K as the "Serving cell", Cell E as a "Non-Suitable cell", Cell J as a "Non-Suitable" off” cell".	–	–	–	–
7	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on Cell K or Cell I?	–>	ATTACH REQUEST	2	F
7A	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
7B	The SS configures: Cell I as the "Serving cell", Cell K as a "Suitable cell",	–	–	–	–
7C	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
–	The following messages are to be observed on Cell I unless explicitly stated otherwise.	–	–	–	–
7D	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
7DA-7DD	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
7E	The SS transmits an ATTACH REJECT message with the EMM cause set to ‘No suitable cells in tracking area’ on Cell I. (The list of “forbidden tracking areas for roaming” in the UE should now contain TAI-9)	<–	ATTACH REJECT	–	–
8	The SS reconfigures: Cell K as a “Non-Suitable “off” cell”, Cell E as a "Suitable cell", Cell J as a "Suitable cell".	–	–	–	–
8A	The SS releases the RRC connection. (IE redirectedCarrierInfo includes eutra CarrierFreq of Cell E)	–	–	–	–
9	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message on Cell E? Note: Cell J is present to ensure the UE doesn’t attempt to attach in a cell with a different PLMN	–>	ATTACH REQUEST	1, 3, 4, 6	P
9A-9D	Steps 5 to 8 from procedure 4.5.2.3 in TS 36.508.
9A	The SS reconfigures: Cell J as a "Non-Suitable “off” cell".	–	–	–	–
10	The SS transmits an ATTACH REJECT message with the EMM cause set to ‘No suitable cells in tracking area’ on Cell E. (The list of “forbidden tracking areas for roaming” in the UE should now contain TAI-9 and TAI-12)	<–	ATTACH REJECT	–	–
11	The SS releases the RRC connection	–	–	–	–
12	The SS reconfigures: Cell I as the "Serving cell". Cell K as a “Non-Suitable cell”, Cell E as a "Suitable cell".	–	–	–	–
13	Check: Does the UE transmit the ATTACH REQUEST message in the next 30 seconds on Cell I?	–>	ATTACH REQUEST	5	F
–	EXCEPTION: Steps 14a1 to 14a4 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported	–	–	–	–
14a1	The SS configures: Cell I as a "Non-Suitable cell", Cell E as a "Non-Suitable cell", Cell K as a "Non-Suitable “off” cell". Cell 8 (px_RATComb_Tested = EUTRA_UTRA) or Cell 24 (px_RATComb_Tested = EUTRA_GERAN) as the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell 8 or Cell 24 unless explicitly stated otherwise.	–	–	–	–
14a2	Void	–	–	–	–
14a3	Check: Does the UE transmit an ATTACH REQUEST message?	–>	ATTACH REQUEST	6	P
14a4	The SS transmits an ATTACH REJECT message with the GMM cause set to ‘No Suitable Cells In Location Area’.	<–	ATTACH REJECT	–	–
14a5	The SS releases the RRC connection	–	–	–	–
14A	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
15	The SS reconfigures: Cell I as the "Serving cell". Cell K as a “Non-Suitable “off” cell”, Cell E as a "Non-Suitable cell", Cell 8 or Cell 24 as the "Non-Suitable cell".	–	–	–	–
–	The following messages are to be observed on Cell I unless explicitly stated otherwise.	–	–	–	–
16	Void	–	–	–	–
17	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
18	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	7	P
19-32b1	The attach procedure is completed by executing steps 5 to 18b1 of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.2.13.3.3 Specific message contents

Table 9.2.1.2.13.3.3-1: Message ATTACH REJECT (step 4 and step 10, Table 9.2.1.2.13.3.2-1)

Derivation Path: TS 36.508, Table 4.7.2-3
Information Element	Value/remark	Comment	Condition
EMM cause	‘0000 1111’B	No Suitable Cells In tracking area

Table 9.2.1.2.13.3.3-2: Message ATTACH REQUEST (step 9 and step 18, Table 9.2.1.2.13.3.2-1)

Derivation Path: TS 36.508, Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
NAS key set identifier
NAS key set identifier	‘111’B	no key is available
TSC	Any allowed value	TSC does not apply for NAS key set identifier value "111".
Old GUTI or IMSI	IMSI-1
Last visited registered TAI	Not present
Old location area identification	Not present
TMSI status	‘0’B	no valid TMSI available

Table 9.2.1.2.13.3.3-3: Message ATTACH REQUEST (step 14a3, Table 9.2.1.2.13.3.2-1)

Derivation Path: TS 24.008 , Table 9.4.1
Information Element	Value/remark	Comment	Condition
MS network capability	Any allowed value
Attach type	‘011’B	Combined GPRS/IMSI attach
GPRS ciphering key sequence number	‘111’B	No key is available (MS to network)
DRX parameter	Any allowed value
P-TMSI or IMSI	IMSI-1
Old routing area identification	All bits of octets 5 and 6 are set to 1, except bit 1 of octet 6 which is set to 0. Other bits are not checked.
MS Radio Access capability	Any allowed value
Old P-TMSI signature	Not present
Requested READY timer value	Not present or any allowed value
TMSI status	‘0’B	no valid TMSI available
PS LCS Capability	Not present or any allowed value
Mobile station classmark 2	Not present or any allowed value
Mobile station classmark 3	Not present or any allowed value
Supported Codecs	Not present or any allowed value
UE network capability	Not present or any allowed value
Additional mobile identity	Not present
Additional old routing area identification	Not present

Table 9.2.1.2.13.3.3-4: Message ATTACH REJECT (step 14a4, Table 9.2.1.2.13.3.2-1)

Derivation Path: TS 24.008 , Table 9.4.4
Information Element	Value/remark	Comment	Condition
GMM cause	‘0000 1111’B	No Suitable Cells In Location Area
T3302 value	Not present

Table 9.2.1.2.13.3.3-5: Message RRCConnectionRelease (step 8A, Table 9.2.1.2.13.3.2-1)

Derivation Path: 36.508 table 4.6.1-15
Information Element	Value/remark	Comment	Condition
RRCConnectionRelease ::= SEQUENCE {
criticalExtensions CHOICE {
c1 CHOICE {
rrcConnectionRelease-r8 SEQUENCE {
redirectedCarrierInfo ::= CHOICE {
eutra	Downlink EARFCN of cell E
}
redirectedCarrierInfo	Not present		Band > 64
nonCriticalExtension SEQUENCE {			Band > 64
redirectedCarrierInfo-v9e0 SEQUENCE {
eutra-v9e0	Downlink EARFCN of cell E
}
}
}
}
}
}

Condition	Explanation
Band > 64	If band > 64 is selected

9.2.1.2.14 Combined attach / Rejected / Not authorized for this CSG

9.2.1.2.14.1 Test Purpose (TP)

(1)

with { UE has sent an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message on a CSG cell }

ensure that {

when { UE receives an ATTACH REJECT message with the reject cause set to "Not authorized for this CSG" and without integrity protection }

then { UE discards this message }

}

(2)

with { UE has sent an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message on a CSG cell which is contained in the Allowed CSG list }

ensure that {

when { UE receives an ATTACH REJECT message with the reject cause set to "Not authorized for this CSG" and with integrity protection }

then { UE removes the CSG ID from the Allowed CSG list }

(3)

with { UE has sent an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message on a CSG cell }

ensure that {

when { UE receives an ATTACH REJECT message with the reject cause set to "Not authorized for this CSG" and with integrity protection }

then { UE searches for a suitable cell }

9.2.1.2.14.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clause 5.5.1.2.5 , and TS 36.304, clause 4.3.

[TS 24.301, clause 5.5.1.2.5]

[Rel-8]#25 (Not authorized for this CSG);

Cause #25 is only applicable when received from a CSG cell. Cause #25 received from a non-CSG cell is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.5.1.2.6.

If the ATTACH REJECT message with cause #25 was received without integrity protection, then the UE shall discard the message.

The UE shall remove the CSG ID of the cell where the UE has sent the ATTACH REQUEST message from the Allowed CSG list.

The UE shall search for a suitable cell in the same PLMN according to 3GPP TS 36.304 [21].

[Rel-12]

If the ATTACH REJECT message with EMM cause #25 was received without integrity protection, then the UE shall discard the message.

…

#25 (Not authorized for this CSG);

EMM cause #25 is only applicable when received from a CSG cell. EMM cause #25 received from a non-CSG cell is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.5.1.2.6.

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and store it according to subclause 5.1.3.3). Additionally, the UE shall reset the attach attempt counter and shall enter the state EMM-DEREGISTERED.LIMITED-SERVICE.

If the CSG ID and associated PLMN identity of the cell where the UE has sent the ATTACH REQUEST message are contained in the Allowed CSG list, the UE shall remove the entry corresponding to this CSG ID and associated PLMN identity from the Allowed CSG list.

If the CSG ID and associated PLMN identity of the cell where the UE has sent the ATTACH REQUEST message are contained in the Operator CSG list, the UE shall apply the procedures defined in 3GPP TS 23.122 [6] subclause 3.1A.

The UE shall search for a suitable cell according to 3GPP TS 36.304 [21].

[TS 36.304, clause 4.3]

suitable cell:

A "suitable cell" is a cell on which the UE may camp on to obtain normal service. The UE shall have a valid USIM and such a cell shall fulfil all the following requirements.

– The cell is part of either:

– the selected PLMN, or:

– the registered PLMN, or:

– a PLMN of the Equivalent PLMN list

9.2.1.2.14.3 Test description

9.2.1.2.14.3.1 Pre-test conditions

System Simulator:

– cell A (TAC-1, frequency 1, not a CSG cell);

– cell B (TAC-2, frequency 1, a CSG cell whose CSG Identity is included in Allowed CSG list);

– cell G (another PLMN, frequency 2 and not a CSG cell).

– System information combination 7 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

UE:

– the UE is configured to initiate combined EPS/IMSI attach;

– the UE is previously registered on cell B using either manual CSG selection or a USIM with field EFACSGL preconfigured (so the allowed CSG list includes CSG ID of cell B);

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.2.14.3.2 Test procedure sequence

Table 9.2.1.2.14.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – Cell A as a "Not Suitable cell". – Cell B as a "Serving cell". – Cell G as a "Not Suitable cell".	–	–	–	–
2	The UE is switched on.	–	–	–	–
3	UE initiates attach procedure and sends ATTACH REQUEST including a PDN CONNECTIVITY REQUEST message on cell B.	–>	ATTACH REQUEST	–	–
4	The SS transmits an ATTACH REJECT message with EMM cause = "Not authorized for this CSG" without integrity protection.	<–	ATTACH REJECT	–	–
5	Void	–	–	–	–
6	Check: Does the UE transmit an ATTACH REQUEST message on Cell B after the expiry of timer T3410 and T3411? Note 1: IF UE initiate ATTACH procedure again, it can prove that this UE has discard the unprotected ATTACH REJECT message. Note 2: Default value of T3410 is 15s; default value of T3411 is 10s. In this TC, the network will wait for total 30 seconds.	–>	ATTACH REQUEST	1	P
7	The SS transmits an ATTACH REJECT message with EMM cause = "Not authorized for this CSG" with integrity protection.	<–	ATTACH REJECT	–	–
8	The SS releases the RRC connection.	–	–	–	–
9	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed. The UE is brought back to operation or the USIM is inserted.	–	–	–	–
10	Check: Does the UE transmit an ATTACH REQUEST message on Cell B in the next 90 seconds?	–>	ATTACH REQUEST	2	F
11	The SS configures: – Cell B as a "Not Suitable cell". – Cell G as a "Serving cell". – Cell A as a "Suitable cell".
12	Check: Does the UE transmit an ATTACH REQUEST message on Cell A?	–>	ATTACH REQUEST	3	P
13-26b1	The attach procedure is completed by executing steps 5 to 18b1 of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.2.14.3.3 Specific message contents

Table 9.2.1.2.14.3.3-1: Message ATTACH REQUEST (step 3, step 6, step 12, Table 9.2.1.2.14.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
Old GUTI or IMSI	GUTI-1
Last visited registered TAI	TAI-1
Old location area identification	LAI-1
TMSI status	Not present

Table 9.2.1.2.14.3.3-2: Message ATTACH REJECT (step 4, Table 9.2.1.2.14.3.2-1)

Derivation path: 36.508 table 4.7.2-3
Information Element	Value/Remark	Comment	Condition
Security header type	‘0000’B	" Plain NAS message, not security protected "
EMM cause	‘00011001’B	#25 " Not authorized for this CSG"

Table 9.2.1.2.14.3.3-3: Message ATTACH REJECT (step 7, Table 9.2.1.2.14.3.2-1)

Derivation path: 36.508 table 4.7.2-3
Information Element	Value/Remark	Comment	Condition
EMM cause	‘00011001’B	#25 " Not authorized for this CSG"

Table 9.2.1.2.14.3.3-4: SystemInformationBlockType1 for Cell A, B, G (Pre-test conditions and all steps in Table 9.2.1.2.14.3.2-1)

Derivation Path: 36.508 clause 4.4.3.2
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType1 ::= SEQUENCE {
cellAccessRelatedInfo SEQUENCE {
csg-Indication	TRUE		Cell B
	FALSE		Cell G
	FALSE		Cell A
csg-Identity	Not present		Cell A
	‘000 0000 0000 0000 0000 0000 0010’B		Cell B
	Not present		Cell G

9.2.1.2.15 Combined attach / Abnormal case / Handling of the EPS attach attempt counter

9.2.1.2.15.1 Test Purpose (TP)

(1)

with { UE has detected T3410 expiry after sending an ATTACH REQUEST message and has the attach attempt counter set to the value less than five }

ensure that {
when { UE detects T3411 expiry }

then { UE restarts the attach procedure }

}

(2)

with { UE has sent an ATTACH REQUEST message and has the attach attempt counter set to five }

ensure that {
when { UE detects T3410 expiry }

then { UE deletes GUTI, TAI list, last visited registered TAI and KSI }

}

(3)

with { UE has sent an ATTACH REQUEST message and has the attach attempt counter set to five }

ensure that {
when { UE detects T3410 expiry }

then { UE deletes LAI, TMSI, ciphering key sequence number, RAI, P-TMSI, P-TMSI signature, and GPRS ciphering key sequence number }

}

9.2.1.2.15.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.1.1, 5.5.1.2.6 and 5.5.1.3.6 and TS 24.008, clause 4.7.3.1.5.

[TS 24.301, clause 5.5.1.1]

…

An attach attempt counter is used to limit the number of subsequently rejected attach attempts. The attach attempt counter shall be incremented as specified in subclause 5.5.1.2.6. Depending on the value of the attach attempt counter, specific actions shall be performed. The attach attempt counter shall be reset when:

– the UE is powered on;

– a USIM is inserted;

– an attach or combined attach procedure is successfully completed;

– a combined attach procedure is completed for EPS services only with cause #2, #16, #17, #18 or #22;

– an attach or combined attach procedure is rejected with cause #11, #12, #13, #14, #15 or #25; or

– a network initiated detach procedure is completed with cause #11, #12, #13, #14, #15 or #25.

Additionally the attach attempt counter shall be reset when the UE is in sub state EMM-DEREGISTERED.ATTEMPTING-TO-ATTACH and:

– a new tracking area is entered; or

– T3402 expires.

[TS 24.301, clause 5.5.1.3.2]

If the UE initiates a combined attach procedure for EPS services and "SMS only", the UE shall indicate "SMS only" in the Additional update type IE.

[TS 24.301, clause 5.5.1.3.6]

…

If the attach attempt counter is incremented according to subclause 5.5.1.2.6 the next actions depend on the value of the attach attempt counter:

– if the update status is U1 UPDATED and the attach attempt counter is less than 5, then the UE shall keep the update status to U1 UPDATED, the new MM state is MM IDLE sub state NORMAL SERVICE;

– if the attach attempt counter is less than 5 and, additionally, the update status is different from U1 UPDATED, then the UE shall delete any LAI, TMSI, ciphering key sequence number and list of equivalent PLMNs and set the update status to U2 NOT UPDATED. The MM state remains MM LOCATION UPDATING PENDING; or

– if the attach attempt counter is equal to 5, then the UE shall delete any LAI, TMSI, ciphering key sequence number and list of equivalent PLMNs and set the update status to U2 NOT UPDATED. A UE operating in CS/PS mode 1 of operation shall select GERAN or UTRAN radio access technology and proceed with appropriate MM or GMM specific procedures.

NOTE: It is up to the UE implementation when to enable E-UTRAN radio access technology selection.

[TS 24.008, clause 4.7.3.1.5]

…

If the GPRS attach attempt counter is greater than or equal to 5:

– the MS shall delete any RAI, P-TMSI, P-TMSI signature, list of equivalent PLMNs, and GPRS ciphering key sequence number, shall set the GPRS update status to GU2 NOT UPDATED, shall start timer T3302. The state is changed to GMM-DEREGISTERED. ATTEMPTING-TO-ATTACH or optionally to GMM-DEREGISTERED.PLMN-SEARCH (see subclause 4.2.4.1.2) in order to perform a PLMN selection according to 3GPP TS 23.122 [14].

…

9.2.1.2.15.3 Test description

9.2.1.2.15.3.1 Pre-test conditions

System Simulator:

– cell A;

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 5 (only active when stated):

– same PLMN like visited PLMN above;

– RAI-1 (RAC & LAC values chosen by SS);

– System information indicates that NMO 1 is used;

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, cell 24 (only active when stated;

– same PLMN like visited PLMN above;

– RAC-1 (RAC & LAC values chosen by SS);

– System information indicates that NMO 1 is used;

– System information combination 10 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

NOTE: Setting px_RATComb_Tested = EUTRA_Only is not allowed.

UE:

– the UE is configured to initiate combined EPS/IMSI attach.

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18];

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, the UE is previously registered on UTRAN cell 5 using default message contents according to TS 36.508 [18].

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, the UE is previously registered on GERAN cell 24 using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.1.2.15.3.2 Test procedure sequence

Table 9.2.1.2.15.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS reconfigures: Cell A as "Serving cell", Cell 5 or Cell 24 as "Non-Suitable cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
2	The UE is powered on or switched on.	–	–	–	–
3	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
4	Wait for 25s to ensure that T3410 and T3411 expire and the UE releases locally the NAS signalling connection. NOTE 1: The attach attempt counter is 1.	–	–	–	–
5	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	1	P
6	Wait for 25s to ensure that T3410 and T3411 expire and the UE releases locally the NAS signalling connection. NOTE 2: The attach attempt counter is 2.	–	–	–	–
7	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
8	Wait for 25s to ensure that T3410 and T3411 expire and the UE releases locally the NAS signalling connection. NOTE 3: The attach attempt counter is 3.	–	–	–	–
9	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
10	Wait for 25s to ensure that T3410 and T3411 expire and the UE releases locally the NAS signalling connection. NOTE 4: The attach attempt counter is 4.	–	–	–	–
11	The UE transmits an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message.	–>	ATTACH REQUEST	–	–
12	Wait for 15s to ensure that T3410 expire and the UE releases locally the NAS signalling connection. NOTE 5: The attach attempt counter is 5.	–	–	–	–
–	EXCEPTION: Steps 13a1 to 13a2 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported	–	–	–	–
13a1	The SS reconfigures: Cell A as "Non-suitable cell", Cell 5 (px_RATComb_Tested = EUTRA_UTRA) or Cell 24 (px_RATComb_Tested = EUTRA_GERAN) as "Serving cell".	–	–	–	–
13a2	Check: Does the UE transmit an ATTACH REQUEST message without P-TMSI, P-TMSI signature, RAI, TMSI on Cell 5 or Cell 24?	–>	ATTACH REQUEST	3	P
13A1	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
	EXCEPTION: Step 13Aa1 describes behaviour that depends on the UE capability.
13Aa1	If pc_SwitchOnOff or pc_USIM_Removal then the UE transmits a DETACH REQUEST message	–>	DETACH REQUEST	–	–
14	The SS reconfigures: Cell A as "Serving cell", Cell 5 or Cell 24 as "Non-Suitable Off cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
15	Void	–	–	–	–
16	The UE is brought back to operation or the USIM is inserted. NOTE 6: The attach attempt counter is reset.	–	–	–	–
17-26	Void	–	–	–	–
27	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST?	–>	ATTACH REQUEST	2	P
28-41b1	The attach procedure is completed by executing steps 5 to 18b1 of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.1.2.15.3.3 Specific message contents

Table 9.2.1.2.15.3.3-1: Message ATTACH REQUEST (step 13a2, Table 9.2.1.2.15.3.2-1)

Derivation Path: TS 24.008 , Table 9.4.1
Information Element	Value/remark	Comment	Condition
MS network capability	Any allowed value
Attach type	‘011’B	Combined GPRS/IMSI attach
GPRS ciphering key sequence number	‘111’B	No key is available (MS to network)
DRX parameter	Any allowed value
P-TMSI or IMSI	IMSI-1
Old routing area identification	All bits of octets 5 and 6 are set to 1, except bit 1 of octet 6 which is set to 0. Other bits are not checked.
MS Radio Access capability	Any allowed value
Old P-TMSI signature	Not present
Requested READY timer value	Not present or any allowed value
TMSI status	‘0’B	no valid TMSI available
PS LCS Capability	Not present or any allowed value
Mobile station classmark 2	Not present or any allowed value
Mobile station classmark 3	Not present or any allowed value
Supported Codecs	Not present or any allowed value
UE network capability	Not present or any allowed value
Additional mobile identity	Not present
Additional old routing area identification	Not present

Table 9.2.1.2.15.3.3-2: Message ATTACH REQUEST (step 27, Table 9.2.1.2.15.3.2-1)

Derivation Path: TS 36.508, Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
NAS key set identifier
NAS key set identifier	‘111’B	no key is available
TSC	Any allowed value	TSC does not apply for NAS key set identifier value "111".
Old GUTI or IMSI	IMSI-1
Last visited registered TAI	Not present
Old location area identification	Not present
TMSI status	‘0’B	no valid TMSI available