9.2.3 Tracking area updating procedure (S1 mode only)

36.523-13GPPEvolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Packet Core (EPC)Part 1: Protocol conformance specificationRelease 17TSUser Equipment (UE) conformance specification

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

9.2.3.1 Normal and periodic tracking area updating

9.2.3.1.1 Normal tracking area update / Accepted

9.2.3.1.1.1 Test Purpose (TP)

(1)

with { UE in state EMM-REGISTERED and EMM-IDLE mode}

ensure that {

when { UE detects entering a new tracking area already included in the TAI list }

then { UE does not send TRACKING AREA UPDATE REQUEST message }

}

(2)

with { UE in state EMM-REGISTERED and EMM-IDLE mode}

ensure that {

when { UE detects entering a new tracking area not included in the TAI list }

then { UE sends TRACKING AREA UPDATE REQUEST message with ‘EPS update type = TA updating’}

}

(3)

with { UE in state EMM-REGISTERED and EMM-IDLE mode and has a valid TAI value }

ensure that {

when { UE detects entering a new tracking area not included in the TAI list }

then { UE sends TRACKING AREA UPDATE REQUEST message with the TAI value in ‘Last visited registered TAI’ IE }

}

9.2.3.1.1.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 24.301 clauses 5.5.3.1, 5.5.3.2.2 and 5.5.3.2.4.

[TS 24.301 clause5.5.3.1]

The tracking area updating procedure is always initiated by the UE and is used for the following purposes:

– normal tracking area updating to update the registration of the actual tracking area of a UE in the network;

…

[TS 24.301 clause5.5.3.2.2]

The UE in state EMM-REGISTERED shall initiate the tracking area updating procedure by sending a TRACKING AREA UPDATE REQUEST message to the MME,

a) when the UE detects entering a tracking area that is not in the list of tracking areas that the UE previously registered in the MME;

…

After sending the TRACKING AREA UPDATE REQUEST message to the MME, the UE shall start timer T3430 and enter state EMM-TRACKING-AREA-UPDATING-INITIATED (see example in figure 5.5.3.2.2). If timer T3402 is currently running, the UE shall stop timer T3402. If timer T3411 is currently running, the UE shall stop timer T3411. If timer T3442 is currently running, the UE shall stop timer T3442.

If the UE supports A/Gb mode or Iu mode, the UE shall handle the Old GUTI IE as follows:

– If the TIN indicates "P-TMSI" and the UE holds a valid P-TMSI and RAI, the UE shall map the P-TMSI and RAI into the Old GUTI IE. Additionally, if the UE holds a valid GUTI, the UE shall indicate the GUTI in the Additional GUTI IE.

NOTE: The mapping of the P-TMSI and RAI to the GUTI is specified in 3GPP TS 23.003 [2].

– If the TIN indicates "GUTI" or "RAT-related TMSI" and the UE holds a valid GUTI, the UE shall indicate the GUTI in the Old GUTI IE.

…

[TS 24.301 clause5.5.3.2.4]

…

Upon receiving a TRACKING AREA UPDATE ACCEPT message, the UE shall stop timer T3430, reset the routing area updating attempt counter, enter state EMM-REGISTERED and set the EPS update status to EU1 UPDATED. If the message contains a GUTI, the UE shall use this GUTI as new temporary identity for EPS services and shall store the new GUTI. If no GUTI was included by the MME in the TRACKING AREA UPDATE ACCEPT message, the old GUTI shall be used. If the UE receives a new TAI list in the TRACKING AREA UPDATE ACCEPT message, the UE shall consider the new TAI list as valid and the old TAI list as invalid; otherwise, the UE shall consider the old TAI list as valid.

…

If the TRACKING AREA UPDATE ACCEPT message contained a GUTI, the UE shall return a TRACKING AREA UPDATE COMPLETE message to the MME to acknowledge the received GUTI.

9.2.3.1.1.3 Test description

9.2.3.1.1.3.1 Pre-test conditions

System Simulator:

– cell A (belongs to TAI-1, home PLMN) is set to ”Serving cell”;

– cell B (belongs to TAI-2, home PLMN) is set to ”Non- Suitable cell”;

– cell D (belongs to TAI-4, home PLMN) is set to ”Non- Suitable cell”.

UE:

– the UE is configured to initiate EPS attach.

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.1.1.3.2 Test procedure sequence

Table 9.2.3.1.1.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
	The following messages are sent and shall be received on cell B.	–	–	–	–
1	Set the cell type of cell A to the "Non-Suitable cell". Set the cell type of cell B to the " Serving cell"	–	–	–	–
2	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	2, 3	P
3	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
4	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
5	The SS releases the RRC connection.			–	–
6	Check: Does the test result of generic test procedure in TS 36.508 subclause 6.4.2.4 indicate that the UE is in EMM-REGISTERED state on cell B with Paging UE-Identity =S-TMSI2 and with CN domain indicator set to "PS"?	–	–	2	–
7	Set the cell type of cell B to the "Non-Suitable cell ". Set the cell type of cell D to the " Serving cell"	–	–	–	–
8	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message in the next 30 seconds?	–	–	1	F
9	Check: Does the test result of generic test procedure in TS 36.508 subclause 6.4.2.4 indicate that the UE is in EMM-REGISTERED state on cell D with Paging UE-Identity =S-TMSI1 and with CN domain indicator set to "PS"?	–	–	1	–
	The following messages are sent and shall be received on cell A.	–	–	–	–
10	Set the cell type of cell D to the "Non-Suitable cell". Set the cell type of cell A to the " Serving cell"	–	–	–	–
11	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	2, 3	P
12	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
13	The UE transmits a TRACKING AREA UPDATE COMPLETE message?	–>	TRACKING AREA UPDATE COMPLETE	–	–
14	The SS releases the RRC connection.	–	–	–	–

9.2.3.1.1.3.3 Specific message contents

Table 9.2.3.1.1.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 2, Table 9.2.3.1.1.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type	000	TA updating
Old GUTI	GUTI-1	”Old GUTI is included by UE if valid, IMSI otherwise”
Last visited registered TAI	TAI-1

Table 9.2.3.1.1.3.3-2: Message TRACKING AREA UPDATE ACCEPT (step 3, Table 9.2.3.1.1.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EPS update result	000	"TA only"
GUTI	GUTI-2
TAI list
Length of tracking area identity list contents	‘00001000’B
Partial tracking area identity list
Number of elements	‘00001’B
Type of list	’00’B	”list of TACs belonging to one PLMN, with non-consecutive TAC values”
MCC MNC TAC 1 TAC 2	PLMN= MCC/MNC TAC 1=2 TAC 2=4	”PLMN is set to the same MCC/MNC stored in EF_IMSI” ”TAI-2” ”TAI-4”

Table 9.2.3.1.1.3.3-3: Message TRACKING AREA UPDATE REQUEST (step 11, Table 9.2.3.1.1.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type	000	TA updating
Old GUTI	GUTI-2
Last visited registered TAI	TAI-4

Table 9.2.3.1.1.3.3-4: Message TRACKING AREA UPDATE ACCEPT (step 12, Table 9.2.3.1.1.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EPS update result	000	"TA only"
GUTI	GUTI-3
TAI list
Length of tracking area identity list contents	‘00001000’B
Partial tracking area identity list
Number of elements	’00001’B
Type of list	’00’B	”list of TACs belonging to one PLMN, with non-consecutive TAC values”
MCC MNC TAC 1 TAC 2	PLMN= MCC/MNC TAC 1=1 TAC 2=2	”PLMN is set to the same MCC/MNC stored in EF_IMSI” ”TAI-1” ”TAI-2”

9.2.3.1.1a Normal tracking area update / Accepted / PSM

9.2.3.1.1a.1 Test Purpose (TP)

(1)

with { UE in state EMM-REGISTERED and EMM-IDLE mode}

ensure that {

when { PSM is activated }

then { UE send TRACKING AREA UPDATE REQUEST message with the T3324 value set to 2 minutes }

}

(2)

with { UE in state EMM-REGISTERED.NO-CELL-AVAILABLE }

ensure that {

when { the SS sends a Paging message }

then { the UE does not answer the Paging message }

}

(3)

with { UE in state EMM-REGISTERED.NO-CELL-AVAILABLE }

ensure that {

when { PSM is deactivated }

then { UE sends TRACKING AREA UPDATE REQUEST message }

}

9.2.3.1.1a.2 Conformance requirements

[TS 24.301, clause 5.3.11]

The UE can request the use of power saving mode (PSM) during an attach or tracking area updating procedure (see 3GPP TS 23.682 [11A] and 3GPP TS 23.401 [10]). The UE shall not request the use of PSM during:

– an attach for emergency bearer services procedure;

– an attach procedure for initiating a PDN connection for emergency bearer services with attach type not set to "EPS emergency attach";

– a tracking area updating procedure for initiating a PDN connection for emergency bearer services; or

– a tracking area updating procedure when the UE has a PDN connection established for emergency bearer services.

The network accepts the use of PSM by providing a specific value for timer T3324 when accepting the attach or tracking area updating procedure. The UE may use PSM only if the network has provided the T3324 value IE during the last attach or tracking area updating procedure with a value different from "deactivated".

NOTE: Timer T3324 is specified in 3GPP TS 24.008 [13].

Upon expiry of the timer T3324 or if the T3324 value provided by the network is zero, the UE may deactivate the AS layer and activate PSM by entering the state EMM-REGISTERED.NO-CELL-AVAILABLE if:

a) the UE is not attached for emergency bearer services;

b) the UE has no PDN connection for emergency bearer services;

c) the UE is in EMM-IDLE mode; and

d) in the EMM-REGISTERED.NORMAL-SERVICE state.

If conditions a, b and c are fulfilled, but the UE is in a state other than EMM-REGISTERED.NORMAL-SERVICE when timer T3324 expires, the UE may activate PSM when the MS returns to state EMM-REGISTERED.NORMAL-SERVICE.

A UE that has already been allocated timer T3324 with a value different from "deactivated" and the timer T3324 has expired, may activate PSM if it receives an "Extended wait time" from lower layers.

If the UE is attached for emergency bearer services or has a PDN connection for emergency bearer services, the UE shall not activate PSM.

The UE may deactivate PSM at any time (e.g. for the transfer of mobile originated signalling or user data), by activating the AS layer before initiating the necessary EMM procedures. When PSM is activated all NAS timers are stopped and associated procedures aborted except for T3412, T3346 and T3396.

[TS 24.301, clause 5.5.1.2.2]

If the UE supports PSM and requests the use of PSM, then the UE shall include the T3324 value IE with a requested timer value in the ATTACH REQUEST message. When the UE includes the T3324 value IE and the UE indicates support for extended periodic timer value in the MS network feature support IE, it may also include the T3412 extended value IE to request a particular T3412 value to be allocated.

[TS 24.301, clause 5.5.3.2.2]

The UE in state EMM-REGISTERED shall initiate the tracking area updating procedure by sending a TRACKING AREA UPDATE REQUEST message to the MME,

……..

t) when the UE needs to request the use of PSM or needs to stop the use of PSM; or

9.2.3.1.1a.3 Test description

9.2.3.1.1a.3.1 Pre-test conditions

System Simulator:

– cell A.

UE:

– the UE is configured to initiate EPS attach.

– The UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

– The UE is configured to use Power Saving Mode

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.1.1a.3.2 Test procedure sequence

Table 9.2.3.1.1a.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The user requests PSM by MMI or by AT command. The requested value of T3324 is 2 minutes.	–	–	–	–
2	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	1	P
3	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
4	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
5	The SS releases the RRC connection.			–	–
6	When the T3324 timer expires the SS send Paging message including a matched identity	<–	Paging	–	–
7	Check: Does the UE respond to the paging message?			2	F
8	The user requests to deactivate PSM. This can be initiated by MMI or AT command.	–	–	–	–
9	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	3	P
10	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
11	The UE transmits a TRACKING AREA UPDATE COMPLETE message?	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA connected (E2_T3440) according to TS 36.508.	–	–	–	–

9.2.3.1.1a.3.3 Specific message contents

Table 9.2.3.1.1a.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 2, Table 9.2.3.1.1a.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type	000	TA updating
Old GUTI	GUTI-1	”Old GUTI is included by UE if valid, IMSI otherwise”
T3324 value	’0010 0010’B	2 minutes
T3412 extended value	Not present
T3412 extended value	Any allowed value		IF the UE indicates support for extended periodic timer value in the MS network feature support IE

Table 9.2.3.1.1a.3.3-2: Message TRACKING AREA UPDATE ACCEPT (step 3, Table 9.2.3.1.1a.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EPS update result	000	“TA only”
GUTI	GUTI-2
T3324 value	’0010 0010’B	2 minutes
T3412 extended value	Value received in TRACKING UPDATE REQUEST	Included only if the IE ‘T3412 extended value’ was provided in the TRACKING UPDATE REQUEST

Table 9.2.3.1.1a.3.3-3: Message TRACKING AREA UPDATE REQUEST (step 9, Table 9.2.3.1.1a.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type	000	TA updating
Old GUTI	GUTI-2	”Old GUTI is included by UE if valid, IMSI otherwise”

Table 9.2.3.1.1a.3.3-4: Message TRACKING AREA UPDATE ACCEPT (step 10, Table 9.2.3.1.1a.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EPS update result	000	"TA only"
GUTI	GUTI-3

9.2.3.1.1b Normal tracking area update / Accepted / DCN

9.2.3.1.1b.1 Test Purpose (TP)

(1)

with { UE in state EMM-REGISTERED and EMM-IDLE mode and the UE is pre-configured with a Default DCN-ID }

ensure that {

when { UE detects entering a new tracking area already included in the TAI list }

then { the UE transmits an RRCConnectionSetupComplete message including the dcn-ID IE set to the Default DCN-ID }

}

(2)

with { UE in state EMM-REGISTERED and EMM-IDLE mode and having received a DCN-ID in a previous GUTI REALLOCATION message }

ensure that {

when { UE detects entering a new tracking area already included in the TAI list }

then { the UE transmits an RRCConnectionSetupComplete message including the dcn-ID IE set to the received DCN-ID }

}

9.2.3.1.1b.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clauses 5.3.1.1, 5.5.3.2.4 and 5.4.1 and in TS 36.331, clause 5.3.3.4.

[TS 24.301, clause 5.3.1.1]

…

When an ATTACH REQUEST message, or a TRACKING AREA UPDATE REQUEST message when the TAI of the current cell is not included in the TAI list, is sent to establish a signalling connection, the UE NAS also provides the lower layers with the DCN-ID according to the following rules:

a) if a DCN-ID for the PLMN code of the selected PLMN is available in the UE, the UE NAS shall provide this DCN-ID to the lower layers; or

b) if no DCN-ID for the PLMN code of the selected PLMN is available but a Default_DCN_ID value is available in the UE, as specified in 3GPP TS 24.368 [15A] or in USIM file NAS_CONFIG as specified in 3GPP TS 31.102 [17], the UE NAS shall provide this DCN-ID to the lower layers.

…

[TS 24.301, clause 5.5.3.2.4]

…

If the TRACKING AREA UPDATE ACCEPT message contains the DCN-ID IE, then the UE shall store the included DCN-ID value together with the PLMN code of the registered PLMN in a DCN-ID list in a non-volatile memory in the ME as specified in annex C.

…

[TS 24.301, clause 5.4.1]

Upon receipt of the GUTI REALLOCATION COMMAND message, the UE shall store the GUTI and the TAI list and the DCN-ID, if provided, and send a GUTI REALLOCATION COMPLETE message to the MME. The UE considers the new GUTI as valid and the old GUTI as invalid. If the UE receives a new TAI list in the GUTI REALLOCATION COMMAND message, the UE shall consider the new TAI list as valid and the old TAI list as invalid; otherwise, the UE shall consider the old TAI list as valid.

If the GUTI REALLOCATION COMMAND message contains the DCN-ID IE, then the UE shall store the included DCN-ID value together with the PLMN code of the registered PLMN in a DCN-ID list in a non-volatile memory in the ME as specified in annex C.

[TS 36.331, clause 5.3.3.4]

The UE shall:

1> if the RRCConnectionSetup is received in response to an RRCConnectionResumeRequest:

2> discard the stored UE AS context and resumeIdentity;

2> indicate to upper layers that the RRC connection resume has been fallbacked;

1> perform the radio resource configuration procedure in accordance with the received radioResourceConfigDedicated and as specified in 5.3.10;

1> if stored, discard the cell reselection priority information provided by the idleModeMobilityControlInfo or inherited from another RAT;

1> for NB-IoT, if stored, discard the dedicated frequency offset provided by the redirectedCarrierOffsetDedicated;

1> stop timer T300;

1> stop timer T302, if running;

1> stop timer T303, if running;

1> stop timer T305, if running;

1> stop timer T306, if running;

1> stop timer T308, if running;

1> perform the actions as specified in 5.3.3.7;

1> stop timer T320, if running;

1> stop timer T350, if running;

1> perform the actions as specified in 5.6.12.4;

1> release rclwi-Configuration, if configured, as specified in 5.6.16.2;

1> stop timer T360, if running;

1> stop timer T322, if running;

1> enter RRC_CONNECTED;

1> stop the cell re-selection procedure;

1> consider the current cell to be the PCell;

1> set the content of RRCConnectionSetupComplete message as follows:

2> if the RRCConnectionSetup is received in response to an RRCConnectionResumeRequest:

3> if upper layers provide an S-TMSI:

4> set the s-TMSI to the value received from upper layers;

2> set the selectedPLMN-Identity to the PLMN selected by upper layers (see TS 23.122 [11], TS 24.301 [35]) from the PLMN(s) included in the plmn-IdentityList in SystemInformationBlockType1 (or SystemInformationBlockType1-NB in NB-IoT);

2> if upper layers provide the ‘Registered MME’, include and set the registeredMME as follows:

3> if the PLMN identity of the ‘Registered MME’ is different from the PLMN selected by the upper layers:

4> include the plmnIdentity in the registeredMME and set it to the value of the PLMN identity in the ‘Registered MME’ received from upper layers;

3> set the mmegi and the mmec to the value received from upper layers;

2> if upper layers provided the ‘Registered MME’:

3> include and set the gummei-Type to the value provided by the upper layers;

2> if the UE supports CIoT EPS optimisation(s):

3> include attachWithoutPDN-Connectivity if received from upper layers;

3> include up-CIoT-EPS-Optimisation if received from upper layers;

3> except for NB-IoT, include cp-CIoT-EPS-Optimisation if received from upper layers;

2> if connecting as an RN:

3> include the rn-SubframeConfigReq;

2> set the dedicatedInfoNAS to include the information received from upper layers;

2> except for NB-IoT:

3> if the UE has radio link failure or handover failure information available in VarRLF-Report and if the RPLMN is included in plmn-IdentityList stored in VarRLF-Report:

4> include rlf-InfoAvailable;

3> if the UE has MBSFN logged measurements available for E-UTRA and if the RPLMN is included in plmn-IdentityList stored in VarLogMeasReport:

4> include logMeasAvailableMBSFN;

3> else if the UE has logged measurements available for E-UTRA and if the RPLMN is included in plmn-IdentityList stored in VarLogMeasReport:

4> include logMeasAvailable;

3> if the UE has connection establishment failure information available in VarConnEstFailReport and if the RPLMN is equal to plmn-Identity stored in VarConnEstFailReport:

4> include connEstFailInfoAvailable;

3> include the mobilityState and set it to the mobility state (as specified in TS 36.304 [4]) of the UE just prior to entering RRC_CONNECTED state;

3> if the UE supports storage of mobility history information and the UE has mobility history information available in VarMobilityHistoryReport:

4> include the mobilityHistoryAvail;

2> include dcn-id if a DCN value (see TS 23.401 [41]) is received from upper layers;

2> if UE needs UL gaps during continuous uplink transmission:

3> include ue-CE-NeedULGaps;

2> submit the RRCConnectionSetupComplete message to lower layers for transmission, upon which the procedure ends;

9.2.3.1.1b.3 Test description

9.2.3.1.1b.3.1 Pre-test conditions

System Simulator:

– cell A (belongs to TAI-1, home PLMN) is set to ”Serving cell”;

– cell B (belongs to TAI-2, home PLMN) is set to ”Non- Suitable cell”;

UE:

– the UE is configured to initiate EPS attach;

– The UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

The UE is equipped with a USIM containing values shown in Table 9.2.3.1.1b.3.1-1.

Table 9.2.3.1.1b.3.1: USIM Configuration

USIM field	Value
EF_UST	Services 96 is supported.
EF_NASCONFIG	“Default_DCN_ID value” provisioned the value 0, as defined in TS 24.368, clause 5.10e.

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.1.1b.3.2 Test procedure sequence

Table 9.2.3.1.1b.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
	The following messages are sent and shall be received on cell B.	–	–	–	–
1	Set the cell type of cell A to the "Non-Suitable cell". Set the cell type of cell B to the " Serving cell"	–	–	–	–
2	The UE transmits a TRACKING AREA REQUEST COMPLETE message. Check: Does the UE transmit an RRCConnectionSetupComplete message including the dcn-ID IE set to the default DCN ID provisioned in the UE?	–>	TRACKING AREA UPDATE REQUEST	1	P
3	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
4	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
5	Void			–	–
6	The SS transmits a GUTI REALLOCATION COMMAND message including the DCN-ID IE.	<–	GUTI REALLOCATION COMMAND	–	–
7	The UE transmit a GUTI REALLOCATION COMPLETE message	–>	GUTI REALLOCATION COMPLETE	–	–
7A	The SS releases the RRC connection	–	–	–	–
	The following messages are sent and shall be received on cell A.	–	–	–	–
8	Set the cell type of cell B to the "Non-Suitable cell". Set the cell type of cell A to the " Serving cell"	–	–	–	–
9	The UE transmits a TRACKING AREA REQUEST COMPLETE message. Check: Does the UE transmit an RRCConnectionSetupComplete message including the dcn-ID IE set to the DCN ID received in step 6?	–>	TRACKING AREA UPDATE REQUEST	2	P
10	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
11	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
12	The SS releases the RRC connection.	–	–	–	–

9.2.3.1.1b.3.3 Specific message contents

Table 9.2.3.1.1b.3.3-1: Message RRCConnectionSetupComplete (step 2, Table 9.2.3.1.1b.3.2-1)

Derivation path: 36.508 table 4.6.1-18
Information Element	Value/Remark	Comment	Condition
RRCConnectionSetupComplete ::= SEQUENCE {
criticalExtensions CHOICE {
rrcConnectionSetupComplete-r8 SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
dcn-ID-r14	Integer value	The Default DCN-ID as defined in the USIM
}
}
}
}
}
}
}
}
}
}

Table 9.2.3.1.1b.3.3-2:: GUTI REALLOCATION COMMAND (step 6, Table 9.2.2.1.8.3.2-1)

Derivation Path: 36.508, Table 4.7.2-15
Information Element	Value/remark	Comment	Condition
GUTI	GUTI-2
DCN-ID	Integer value	Any allowed value different from the Default DCN-ID in the USIM

Table 9.2.3.1.1b.3.3-3: Message RRCConnectionSetupComplete (step 9, Table 9.2.3.1.1b.3.2-1)

Derivation path: 36.508 table 4.6.1-18
Information Element	Value/Remark	Comment	Condition
RRCConnectionSetupComplete ::= SEQUENCE {
criticalExtensions CHOICE {
rrcConnectionSetupComplete-r8 SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
dcn-ID-r14	Integer value	The same DCN-ID value as used in Table 9.2.3.1.1b.3.3-2
}
}
}
}
}
}
}
}
}
}

9.2.3.1.2 Void

9.2.3.1.3 Void

9.2.3.1.4 Normal tracking area update / List of equivalent PLMNs in the TRACKING AREA UPDATE ACCEPT message

9.2.3.1.4.1 Test Purpose (TP)

(1)

with { UE in EMM-TRACKING-AREA-UPDATING-INITIATED state }

ensure that {

when { the UE receives TRACKING AREA UPDATE ACCEPT message including a list of equivalent PLMNs }

then { the UE stores correctly the list and considers a forbidden PLMN if the forbidden PLMN is included in the equivalent list }

}

(2)

with { UE in EMM-TRACKING-AREA-UPDATING-INITIATED state }

ensure that {

when { the UE receives TRACKING AREA UPDATE ACCEPT message without a list of equivalent PLMNs }

then { the UE deletes the stored list and applies a normal PLMN selection process }

}

9.2.3.1.4.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clause 5.5.3.2.4.

[TS 24.301, clause 5.5.3.2.4]

The MME may also include of list of equivalent PLMNs in the TRACKING AREA UPDATE ACCEPT message. Each entry in the list contains a PLMN code (MCC+MNC). The UE shall store the list as provided by the network, after having removed from the list any PLMN code that is already in the list of forbidden PLMNs. In addition, the UE shall add to the stored list the PLMN code of the registered PLMN that sent the list. The UE shall replace the stored list on each receipt of the TRACKING AREA UPDATE ACCEPT message. If the TRACKING AREA UPDATE ACCEPT message does not contain a list, then the UE shall delete the stored list.

9.2.3.1.4.3 Test description

9.2.3.1.4.3.1 Pre-test conditions

System Simulator:

– cell A (belongs to TAI-1, PLMN1);

– cell B (belongs to TAI-2, PLMN1);

– cell C (belongs to TAI-3, PLMN2);

– cell D (belongs to TAI-4, PLMN3);

– system information combination 2 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cell B and C.

UE:

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE last attempted to register on cell D and received reject cause "forbidden PLMN" (so the "forbidden PLMN list" contains PLMN3).

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell A according to TS 36.508[18].

9.2.3.1.4.3.2 Test procedure sequence

Table 9.2.3.1.4.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of cell A to the ”Non-Suitable cell”. Set the cell type of cell B to the ”Serving cell”. Set the cell type of cell C to the ” Non-Suitable off cell”. Set the cell type of cell D to the ” Non-Suitable off cell”.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST message.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	Void	–	–	–	–
4	Void	–	–	–	–
5	SS responds with a TRACKING AREA UPDATE ACCEPT message including PLMN2 and PLMN3 in the list of equivalent PLMNs.	<–	TRACKING AREA UPDATE ACCEPT	–	–
6	The UE transmits a TRACKING AREA UPDATE COMPLETE message	–>	TRACKING AREA UPDATE COMPLETE	–	–
6A	SS Releases the RRC Connection.	–	–	–	–
7	Set the cell type of cell A to the ”Non-Suitable off cell”. Set the cell type of cell B to the ”Non-Suitable cell”. Set the cell type of cell C to the ” Suitable cell”.	–	–	–	–
8	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message on cell C (PLMN2)?	–>	TRACKING AREA UPDATE REQUEST	1	P
9	Void	–	–	–	–
10	Void	–	–	–	–
11	The SS transmits a TRACKING AREA UPDATE ACCEPT message including PLMN1 and PLMN3 in the list of equivalent PLMNs.	<–	TRACKING AREA UPDATE ACCEPT	–	–
12	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
12A	SS Releases the RRC Connection.	–	–	–	–
	EXCEPTION: Step 12a1 describes optional behaviour that depends on the UE capability.	–	–	–	–
12Aa1	The UE may attempt the generic test procedure for IMS Re-registration on EPS VPLMN as specified in TS 36.508 [18] subclause 4.5A.30.	–	–	–	–
13	Set the cell type of cell C to the ”Non-Suitable cell”. Set the cell type of cell D to the ” Serving cell”. Note: Cell D (PLMN3) belongs to the forbidden PLMN.	–	–	–	–
14	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message on cell D (PLMN3) in next 30 seconds?	–>	TRACKING AREA UPDATE REQUEST	1	F
15	The UE is switched to manual PLMN selection mode and is made to select PLMN3 in order to remove PLMN3 in the forbidden PLMN list in the UE.	–	–	–	–
16	The UE transmits a TRACKING AREA UPDATE REQUEST message on cell D (PLMN3).	–>	TRACKING AREA UPDATE REQUEST	–	–
17	Void	–	–	–	–
18	Void	–	–	–	–
19	The SS transmits a TRACKING AREA UPDATE ACCEPT message without the list of equivalent PLMNs.	<–	TRACKING AREA UPDATE ACCEPT	–	–
20	Check: Does the UE transmit a TRACKING AREA UPDATE COMPLETE message?	–>	TRACKING AREA UPDATE COMPLETE	1	P
20A	SS releases the RRC connection	–	–	–	–
21	The UE is switched back to automatic PLMN selection mode.	–	–	–	–
21A	SS waits for 5 minutes to allow UE to complete automatic PLMN search
22	Set the cell type of cell D to ”Non-Suitable cell”. Set the cell type of cell B to ”Serving cell”. Set the cell type of cell C to ”Suitable neighbour intra-frequency cell”.	–	–	–	–
23	Void	–	–	–	–
24	Void	–	–	–	–
24A	Void	–	–	–	–
25	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message on Cell B (PLMN1)?	–>	TRACKING AREA UPDATE REQUEST	2	P
26	Void	–	–	–	–
27	SS responds with TRACKING AREA UPDATE ACCEPT message	<–	TRACKING AREA UPDATE ACCEPT	–	–
28	The UE transmits a TRACKING AREA UPDATE COMPLETE message	–>	TRACKING AREA UPDATE COMPLETE	–	–
29	SS Releases the RRC Connection.	–	–	–	–
	EXCEPTION: Step 29a1 describes optional behaviour that depends on the UE capability.	–	–	–	–
29a1	The UE may attempt the generic test procedure for IMS Re-registration on EPS HPLMN as specified in TS 36.508 [18] subclause 4.5A.30.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA Idle ( E1) according to TS 36.508.	–	–	–	–

9.2.3.1.4.3.3 Specific message contents

Table 9.2.3.1.4.3.3-1: Void

Table 9.2.3.1.4.3.3-2: Void

Table 9.2.3.1.4.3.3-3: Message TRACKING AREA UPDATE ACCEPT (step 5, Table 9.2.3.1.4.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
Equivalent PLMNs	–	Includes MCC and MNC digits for PLMN2 and PLMN3.

Table 9.2.3.1.4.3.3-4: Message TRACKING AREA UPDATE ACCEPT (step 11, Table 9.2.3.1.4.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
Equivalent PLMNs	–	Includes MCC and MNC digits for PLMN1 and PLMN3.

Table 9.2.3.1.4.3.3-5: Void

Table 9.2.3.1.4.3.3-6: Void

9.2.3.1.5 Periodic tracking area update / Accepted

9.2.3.1.5.1 Test Purpose (TP)

(1)

with { UE in state EMM-REGISTERED and EMM-IDLE mode}

ensure that {

when { the periodic tracking area updating timer T3412 expires }

then { UE sends TRACKING AREA UPDATE REQUEST message with EPS update type = ’Periodic updating ‘}

}

(2)

with { UE in ‘out of E-UTRAN coverage’ and the periodic tracking area updating timer T3412 expires }

ensure that {

when { the UE enters E-UTRAN coverage }

then { UE configured for EPS attach sends TRACKING AREA UPDATE REQUEST message with EPS update type = ‘Periodic updating’ and the UE configured for combined EPS / IMSI attach sends TRACKING AREA UPDATE REQUEST message with EPS update type = ‘combined TA/LA updating with IMSI attach’}

}

9.2.3.1.5.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 23.401 clause 4.3.5.2 and TS 24.301 clauses 5.3.5, 5.5.3.2.1, 5.5.3.2.2 and 5.5.3.2.4.

[TS 23.401 clause 4.3.5.2]

…

An EMM-REGISTERED UE performs periodic Tracking Area Updates with the network after the expiry of the periodic TAU timer.

If the UE is out of E-UTRAN coverage (including the cases when the UE is camped on 2G/3G cells) when its periodic TAU update timer expires, and ISR is activated the UE shall start the E-UTRAN Deactivate ISR timer. After the E-UTRAN Deactivate ISR timer expires the UE shall deactivate ISR by setting its TIN to "P-TMSI". The EMM-REGISTERED UE shall remember it has to perform a Tracking Area Update when it next returns to E‑UTRAN coverage.

[TS 24.301 clause5.3.5]

Periodic tracking area updating is used to periodically notify the availability of the UE to the network. The procedure is controlled in the UE by the periodic tracking area update timer (timer T3412). The value of timer T3412 is sent by the network to the UE in the ATTACH ACCEPT message and can be sent in the TRACKING AREA UPDATE ACCEPT message. The UE shall apply this value in all tracking areas of the list of tracking areas assigned to the UE, until a new value is received.

The timer T3412 is reset and started with its initial value, when the UE goes from EMM-CONNECTED to EMM-IDLE mode. The timer T3412 is stopped when the UE enters EMM-CONNECTED mode or EMM-DEREGISTERED state.

When timer T3412 expires, the periodic tracking area updating procedure shall be started and the timer shall be set to its initial value for the next start.

…

If the UE is attached to both EPS and non-EPS services, and if timer T3412 expires or timer T3423 expires when the UE is in EMM-REGISTERED.NO-CELL-AVAILABLE state, then the UE shall initiate the combined tracking area updating procedure indicating "combined TA/LA updating with IMSI attach" when the UE returns to EMM-REGISTERED.NORMAL-SERVICE state.

…

If the UE is in another state than EMM-REGISTERED.NORMAL-SERVICE when the timer expires the periodic tracking area updating procedure is delayed until the UE returns to EMM-REGISTERED.NORMAL-SERVICE.

…

The mobile reachable timer shall be reset and started with its initial value, when the MME releases the NAS signalling connection for the UE. The mobile reachable timer shall be stopped when a NAS signalling connection is established for the UE.

….

[TS 24.301 clause5.5.3.2.1]

The periodic tracking area updating procedure is controlled in the UE by timer T3412. When timer T3412 expires, the periodic tracking area updating procedure is started. Start and reset of timer T3412 is described in subclause 5.5.3.2.

[TS 24.301 clause5.5.3.2.2]

The UE in state EMM-REGISTERED shall initiate the tracking area updating procedure by sending a TRACKING AREA UPDATE REQUEST message to the MME,

…

b) when the periodic tracking area updating timer T3412 expires;

…

If the UE supports A/Gb mode or Iu mode, the UE shall handle the Old GUTI IE as follows:

NOTE: The mapping of the P-TMSI and RAI to the GUTI is specified in 3GPP TS 23.003 [2].

– If the TIN indicates "GUTI" or "RAT-related TMSI" and the UE holds a valid GUTI, the UE shall indicate the GUTI in the Old GUTI IE.

…

When the tracking area updating procedure is initiated in EMM-IDLE mode, the UE may also include an EPS bearer context status IE in the TRACKING AREA UPDATE REQUEST message, indicating which EPS bearer contexts are active in the UE.

[TS 24.301 clause5.5.3.2.4]

…

If the TRACKING AREA UPDATE ACCEPT message contained a GUTI, the UE shall return a TRACKING AREA UPDATE COMPLETE message to the MME to acknowledge the received GUTI.

9.2.3.1.5.3 Test description

9.2.3.1.5.3.1 Pre-test conditions

System Simulator:

– cell A.

UE:

none.

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.3.1.5.3.2 Test procedure sequence

Table 9.2.3.1.5.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is powered up or switched on.	–		–	–
2	The UE transmits an ATTACH REQUEST message with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN	–>	ATTACH REQUEST	–	–
3-6Aa2	Void	–	–	–	–
6B-6J	Steps 5-13 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed	–	–	–	–
7	The SS transmits an ATTACH ACCEPT message with GUTI-1 and with the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message.	<–	ATTACH ACCEPT	–	–
8-9	Void	–	–	–	–
9A-9Cb1	Steps 16-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.			–	–
10	The SS waits 6minutes. (Expire of T3412)	–
11	Check: Does the UE send TRACKING AREA UPDATE REQUEST message.	–>	TRACKING AREA UPDATE REQUEST	1	P
12	The SS sends TRACKING AREA UPDATE ACCEPT.	<–	TRACKING AREA UPDATE ACCEPT	–	–
13	The UE sends TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
14	The SS releases the RRC connection.			–	–
15	Check: Does the test result of generic test procedure in TS 36.508 subclause 6.4.2.4 indicate that the UE is in EMM-REGISTERED state on cell A with PagingUE-Identity = S-TMSI2 and with CN domain indicator set to "PS"?	–		1	–
16	Set the cell type of cell A to the ”non-Suitable cell”.	–		–	–
17	The SS waits 8minutes.	–		–	–
18	Set the cell type of cell A to the ”Serving cell”.	–		–	–
19	Check: Does the UE send TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	2	P
20	The SS sends TRACKING AREA UPDATE ACCEPT.	<–	TRACKING AREA UPDATE ACCEPT	–	–
21	The UE sends TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
22	The SS releases the RRC connection.	–	–	–	–
23	Check: Does the test result of generic test procedure in TS 36.508 subclause 6.4.2.4 indicate that the UE is in EMM-REGISTERED state in cell A with PagingUE-Identity = S-TMSI3 and with CN domain indicator set to "PS"?	–	–	2	–

9.2.3.1.5.3.3 Specific message contents

Table 9.2.3.1.5.3.3-1: Message ATTACH ACCEPT (step 7, Table 9.2.3.1.5.3.2-1)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark	Comment	Condition
T3412 value
Unit	‘010’	”value is incremented in multiples of decihours”
Timer value	‘00001’	”6 minutes”
TAI list
Length of tracking area identity list contents	‘00000110’B
Partial tracking area identity list
Number of elements	‘00000’B
Type of list	’00’B	”list of TACs belonging to one PLMN, with non-consecutive TAC values”
MCC MNC TAC 1	TAI-1
GUTI	GUTI-1

Table 9.2.3.1.5.3.3-2: Message TRACKING AREA UPDATE REQUEST (step 11, Table 9.2.3.1.5.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type
EPS update type value	‘011’B	”Periodic updating”
Old GUTI	GUTI-1

Table 9.2.3.1.5.3.3-3: Message TRACKING AREA UPDATE ACCEPT (step 12, Table 9.2.3.1.5.3.2-1)

Derivation path: 36.508 table 4.7.2-24 with condition TA_only.
Information Element	Value/Remark	Comment		Condition
T3412 value
Unit	‘010’	”value is incremented in multiples of decihours”
Timer value	‘00001’	”6 minutes”
GUTI	GUTI-2
TAI list
Length of tracking area identity list contents	‘00000110’B
Partial tracking area identity list
Number of elements	‘00000’B
Type of list	’00’B		”list of TACs belonging to one PLMN, with non-consecutive TAC values”
MCC MNC TAC 1	TAI-1

Table 9.2.3.1.5.3.3-4: Message TRACKING AREA UPDATE REQUEST (step 19, Table 9.2.3.1.5.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type
EPS update type value	‘011’B	”Periodic updating”	TA_only
EPS update type value	‘010’B	“combined TA/LA updating with IMSI attach”	combined_TA_LA
Old GUTI	GUTI-2

Table 9.2.3.1.5.3.3-5: Message TRACKING AREA UPDATE ACCEPT (step 20, Table 9.2.3.1.5.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element		Value/Remark		Comment	Condition
GUTI		GUTI-3
TAI list
Length of tracking area identity list contents		‘00000110’B
Partial tracking area identity list
Number of elements	‘00000’B
Type of list	’00’B		”list of TACs belonging to one PLMN, with non-consecutive TAC values”
MCC MNC TAC 1	TAI-1

9.2.3.1.5a Periodic tracking area update / Accepted / Per-device timer

9.2.3.1.5a.1 Test Purpose (TP)

(1)

with { UE in state EMM-REGISTERED and EMM-IDLE mode with timer T3412 “normal” and extended values being allocated by the SS during attach procedure }

ensure that {

when { timer T3412 extended value expires }

then { UE sends TRACKING AREA UPDATE REQUEST message with EPS update type = “Periodic updating” }

}

(2)

with { UE in state EMM-REGISTERED and EMM-IDLE mode with timer T3412 “normal” and extended values being allocated by the SS during TAU procedure }

ensure that {

when { timer T3412 extended value expires }

then { UE sends TRACKING AREA UPDATE REQUEST message with EPS update type = “Periodic updating” }

}

9.2.3.1.5a.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 24.301 clauses 5.3.5, 5.5.1.2.4 and 5.5.3.2.4.

[TS 24.301 clause 5.3.5]

The UE indicates in the MS network feature support IE whether it supports the T3412 extended value.

…

When a UE is not attached for emergency bearer services, and timer T3412 expires, the periodic tracking area updating procedure shall be started and the timer shall be set to its initial value for the next start.

…

If the network includes T3412 extended value IE in the ATTACH ACCEPT message or TRACKING AREA UPDATE ACCEPT message, the network shall use T3412 extended value IE as the value of timer T3412.

[TS 24.301 clause 5.5.1.2.4]

If the attach request is accepted by the network, the MME shall send an ATTACH ACCEPT message to the UE and start timer T3450. The MME shall send the ATTACH ACCEPT message together with an ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message contained in the ESM message container information element to activate the default bearer (see subclause 6.4.1). The network may also initiate the activation of dedicated bearers towards the UE by invoking the dedicated EPS bearer context activation procedure (see subclause 6.4.2).

…

If the ATTACH ACCEPT message contains a T3412 extended value IE, then the UE shall use the value in T3412 extended value IE as periodic tracking area update timer (T3412). If the ATTACH ACCEPT message does not contain T3412 extended value IE, then the UE shall use the value in T3412 value IE as periodic tracking area update timer (T3412).

[TS 24.301 clause 5.5.3.2.4]

If the tracking area update request has been accepted by the network, the MME shall send a TRACKING AREA UPDATE ACCEPT message to the UE. If the MME assigns a new GUTI for the UE, a GUTI shall be included in the TRACKING AREA UPDATE ACCEPT message. In this case, the MME shall start timer T3450 and enter state EMM-COMMON-PROCEDURE-INITIATED as described in subclause 5.4.1. The MME may include a new TAI list for the UE in the TRACKING AREA UPDATE ACCEPT message.

…

If the TRACKING AREA UPDATE ACCEPT message contains T3412 extended value IE, then the UE shall use the T3412 extended value IE as periodic tracking area update timer (T3412). If the TRACKING AREA UPDATE ACCEPT contains T3412 value IE, but not T3412 extended value IE, then the UE shall use value in T3412 value IE as periodic tracking area update timer (T3412). If neither T3412 value IE nor T3412 extended value IE is included, the UE shall use the value currently stored, e.g. from a prior ATTACH ACCEPT or TRACKING AREA UPDATE ACCEPT message.

9.2.3.1.5a.3 Test description

9.2.3.1.5a.3.1 Pre-test conditions

System Simulator:

– cell A.

UE:

The UE indicates in the MS network feature support IE that it supports the T3412 extended value..

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.3.1.5a.3.2 Test procedure sequence

Table 9.2.3.1.5a.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is powered up or switched on.	–	–	–	–
2	The UE transmits an ATTACH REQUEST message with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN	–>	ATTACH REQUEST	–	–
3-6Aa2	Void	–	–	–	–
6B-6J	Steps 5-13 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed	–	–	–	–
7	The SS transmits an ATTACH ACCEPT message with GUTI-1 and with the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message. SS assigns both a "normal" and an extended value for the T3412 timer.	<–	ATTACH ACCEPT	–	–
8-9	Void	–	–	–	–
9A-9Cb1	Steps 16-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
10	The SS waits 6minutes. (Expiry of T3412 extended value)	–	–	–	–
11	Check: Does the UE send TRACKING AREA UPDATE REQUEST message.	–>	TRACKING AREA UPDATE REQUEST	1	P
12	The SS sends TRACKING AREA UPDATE ACCEPT. SS assigns both a "normal" and an extended value for the T3412 timer.	<–	TRACKING AREA UPDATE ACCEPT	–	–
13	The UE sends TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
14	The SS releases the RRC connection.	–	–	–	–
15	The SS waits 8 minutes. (Expiry of T3412 extended value)	–	–	–	–
16	Check: Does the UE send TRACKING AREA UPDATE REQUEST message.	–>	TRACKING AREA UPDATE REQUEST	2	P
17	The SS sends TRACKING AREA UPDATE ACCEPT. The SS assigns T3412 ”normal” and extended values. The extended value is different from the one assigned in the ATTACH ACCEPT message in step 7.	<–	TRACKING AREA UPDATE ACCEPT	–	–
18	The UE sends TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
19	The SS releases the RRC connection.	–	–	–	–

9.2.3.1.5a.3.3 Specific message contents

Table 9.2.3.1.5a.3.3-0: Message ATTACH REQUEST (steps 2, Table 9.2.3.1.5a.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
MS network feature support	1	MS supports the extended periodic timer in this domain

Table 9.2.3.1.5a.3.3-1: Message ATTACH ACCEPT (step 7, Table 9.2.3.1.5a.3.2-1)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark	Comment	Condition
T3412 value
Unit	‘001’B	value is incremented in multiples of 1 minute
Timer value	‘00100’B	”4 minutes”
TAI list
Length of tracking area identity list contents	‘00000110’B
Partial tracking area identity list
Number of elements	‘00000’B
Type of list	’00’B	”list of TACs belonging to one PLMN, with non-consecutive TAC values”
MCC MNC TAC 1	TAI-1
GUTI	GUTI-1
T3412 extended value
Unit	‘101’B	value is incremented in multiples of 1 minute
Timer value	‘00110’B	”6 minutes”

Table 9.2.3.1.5a.3.3-2: Message TRACKING AREA UPDATE REQUEST (step 11, Table 9.2.3.1.5a.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type
EPS update type value	‘011’B	”Periodic updating”
Old GUTI	GUTI-1
MS network feature support	1	MS supports the extended periodic timer in this domain

Table 9.2.3.1.5a.3.3-3: Message TRACKING AREA UPDATE ACCEPT (steps 12 and 17, Table 9.2.3.1.5a.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment		Condition
T3412 value
Unit	‘001’B	value is incremented in multiples of 1 minute
Timer value	‘00100’B	”4 minutes”
GUTI	GUTI-2
TAI list
Length of tracking area identity list contents	‘00000110’B
Partial tracking area identity list
Number of elements	‘00000’B
Type of list	’00’B		”list of TACs belonging to one PLMN, with non-consecutive TAC values”
MCC MNC TAC 1	TAI-1
T3412 extended value
Unit	‘101’B		value is incremented in multiples of 1 minute
Timer value	‘01000’B		”8 minutes”

Table 9.2.3.1.5a.3.3-4: Message TRACKING AREA UPDATE REQUEST (step 16, Table 9.2.3.1.5a.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type
EPS update type value	‘011’B	”Periodic updating”
Old GUTI	GUTI-2
MS network feature support	1	MS supports the extended periodic timer in this domain

9.2.3.1.5b Periodic tracking area update / Accepted / PSM / T3412 Extended Value

9.2.3.1.5b.1 Test Purpose (TP)

(1)

with { UE in state EMM-REGISTERED and EMM-IDLE mode}

ensure that {

when { PSM is activated }

then { UE send TRACKING AREA UPDATE REQUEST message with the T3324 value set to 2 minutes and T3412 extended value set to 4 minutes }

}

(2)

with { UE in state EMM-REGISTERED and EMM-IDLE mode with timer T3412 extended value active }

ensure that {

when { timer T3412 extended value expires }

then { UE sends TRACKING AREA UPDATE REQUEST message with EPS update type = “Periodic updating” }

}

9.2.3.1.5b.2 Conformance requirements

[TS 24.301, clause 5.3.11]

– an attach for emergency bearer services procedure;

– an attach procedure for initiating a PDN connection for emergency bearer services with attach type not set to "EPS emergency attach";

– a tracking area updating procedure for initiating a PDN connection for emergency bearer services; or

– a tracking area updating procedure when the UE has a PDN connection established for emergency bearer services.

NOTE: Timer T3324 is specified in 3GPP TS 24.008 [13].

Upon expiry of the timer T3324 or if the T3324 value provided by the network is zero, the UE may deactivate the AS layer and activate PSM by entering the state EMM-REGISTERED.NO-CELL-AVAILABLE if:

a) the UE is not attached for emergency bearer services;

b) the UE has no PDN connection for emergency bearer services;

c) the UE is in EMM-IDLE mode; and

d) in the EMM-REGISTERED.NORMAL-SERVICE state.

A UE that has already been allocated timer T3324 with a value different from "deactivated" and the timer T3324 has expired, may activate PSM if it receives an "Extended wait time" from lower layers.

If the UE is attached for emergency bearer services or has a PDN connection for emergency bearer services, the UE shall not activate PSM.

[TS 24.301, clause 5.5.1.2.2]

9.2.3.1.5b.3 Test description

9.2.3.1.5b.3.1 Pre-test conditions

System Simulator:

– cell A.

UE:

– the UE is configured to initiate EPS attach.

– The UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

– The UE is configured to use Power Saving Mode

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.1.5b.3.2 Test procedure sequence

Table 9.2.3.1.5b.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The user requests PSM by MMI or by AT command. The requested value of T3324 is 2 minutes and T3412 extended value is 4 minutes.	–	–	–	–
2	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	1	P
3	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
4	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
5	The SS releases the RRC connection.			–	–
6	The SS waits 4 minutes. (Expiry of T3412 extended value)	–	–	–	–
7	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	2	P
8	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
9	The UE transmits a TRACKING AREA UPDATE COMPLETE message?	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA connected (E2_T3440) according to TS 36.508.	–	–	–	–

9.2.3.1.5b.3.3 Specific message contents

Table 9.2.3.1.5b.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 2, Table 9.2.3.1.5b.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type	000	TA updating
Old GUTI	GUTI-1	”Old GUTI is included by UE if valid, IMSI otherwise”
T3324 value	’0010 0010’B	2 minutes
MS network feature support	1	MS supports the extended periodic timer in this domain
T3412 extended value	‘1010 0100’B or ‘1000 1000’B	4 minutes or 240 seconds

Table 9.2.3.1.5b.3.3-2: Message TRACKING AREA UPDATE ACCEPT (step 3, Table 9.2.3.1.5b.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EPS update result	000	"TA only"
GUTI	GUTI-2
T3324 value	’0010 0010’B	2 minutes
T3412 extended value	‘1010 0100’B or ‘1000 1000’B (same value as received in TAU REQUEST message at Step 2)	4 minutes or 240 seconds

Table 9.2.3.1.5b.3.3-3: Message TRACKING AREA UPDATE REQUEST (step 7, Table 9.2.3.1.5b.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type	011	periodic updating’
Old GUTI	GUTI-2	”Old GUTI is included by UE if valid, IMSI otherwise”
T3324 value	’0010 0010’B	2 minutes
T3412 extended value	Not present
	Any allowed value		IF the UE indicates support for extended periodic timer value in the MS network feature support IE

Table 9.2.3.1.5b.3.3-4: Message TRACKING AREA UPDATE ACCEPT (step 8, Table 9.2.3.1.5b.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EPS update result	000	"TA only"
GUTI	GUTI-3
T3324 value	’0010 0100’B	4 minutes
T3412 extended value	Value received in TRACKING AREA UPDATE REQUEST (Step 7)	Included only if the IE ‘T3412 extended value’ was provided in the TRACKING AREA UPDATE REQUEST

9.2.3.1.6 Normal tracking area update / UE with ISR active moves to E-UTRAN

9.2.3.1.6.1 Test Purpose (TP)

(1)

with { ISR activated UE in state EMM-REGISTERED and ECM_IDLE mode}

ensure that {

when { ISR activated UE reselects from E-UTRAN to UTRAN/GERAN cell belonging to the RA where the UE is registered }

then { UE does not send ROUTING AREA UPDATE REQUEST message }

}

(2)

with { ISR activated UE in state EMM-REGISTERED and ECM_IDLE mode }

ensure that {

when { ISR activated UE reselects from E-UTRAN to UTRAN/GERAN cell belonging to a RA which is not the RA where the UE is registered }

then { UE sends ROUTING AREA UPDATE REQUEST message }

}

(3)

with { ISR activated UE in state GMM-REGISTERED and PMM_IDLE mode }

ensure that {

when { ISR activated UE reselects from UTRAN/GERAN to E-UTRAN cell belonging to one of the TAs of the list of TAs where the UE is registered }

then { UE does not send TRACKING AREA UPDATE REQUEST message }

}

(4)

with { ISR activated UE in state GMM-REGISTERED and PMM_IDLE mode }

ensure that {

when { ISR activated UE reselects from UTRAN/GERAN to E-UTRAN cell belonging to a TA which is not in the list of TAs where the UE is registered }

then { UE sends TRACKING AREA UPDATE REQUEST message }

}

(5)

with { ISR activated UE has a stored TIN value = "RAT-related TMSI" }

ensure that {

when { SS sends a Paging with "P-TMSI" to ISR activated UE on UTRAN/GERAN cell }

then { UE responds to the paging message }

}

(6)

with { ISR activated UE has a stored TIN value = "RAT-related TMSI" }

ensure that {

when { SS sends a Paging with "GUTI" to ISR activated UE on E-UTRAN cell }

then { UE responds to the paging message }

}

9.2.3.1.6.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 23.401 clause 4.3.5.6, 3GPP TS 24.008 clauses 4.7.5.1.1 and 4.7.5.1.3 and 3GPP TS 24.301 clauses 5.5.3.2.2, 5.5.3.2.4 and clause 5.5.3.3.2. Unless otherwise stated these are Rel-8 requirements.

[TS 23.401 clause 4.3.5.6]

The Idle mode Signalling Reduction (ISR) function provides a mechanism to limit signalling during inter-RAT cell-reselection in idle mode (ECM-IDLE, PMM-IDLE, GPRS STANDBY states).

NOTE: The Idle mode Signalling Reduction function is mandatory for E-UTRAN UEs that support GERAN and/or UTRAN and optional for core network. The UE’s ISR capability in the UE Network Capability element is for test purpose.

ISR is activated by decision of the CN nodes and shall be explicitly signalled to the UE as "ISR activation" in the RAU and TAU signalling. The UE may have valid MM parameters both from MME and from SGSN. The "Temporary Identity used in Next update" (TIN) is a parameter of the UE’s MM context, which identifies the UE identity that the UE shall indicate in the next RAU Request or TAU Request message. The TIN also identifies the status of ISR activation in the UE.

The TIN can take one of the three values, "P‑TMSI", "GUTI" or "RAT-related TMSI". The UE shall set the TIN when receiving an Attach Accept, a TAU Accept or RAU Accept message according to the rules in table 4.3.5.6-1.

Table 4.3.5.6-1: Setting of the TIN

Message received by UE	Current TIN value stored by UE	TIN value to be set by the UE when receiving message
Attach Accept via E-UTRAN (never indicates ISR activation)	Any value	GUTI
Attach Accept via GERAN/UTRAN (never indicates ISR activation)	Any value	P-TMSI
TAU Accept not indicating ISR	Any value	GUTI
TAU Accept indicating ISR	GUTI P‑TMSI or RAT-related TMSI	GUTI RAT-related TMSI
RAU Accept not indicating ISR	Any value	P‑TMSI
RAU Accept indicating ISR	P‑TMSI GUTI or RAT-related TMSI	P‑TMSI RAT-related TMSI

When ISR activation is indicated by the RAU/TAU Accept message but the UE shall not set the TIN to "RAT-related TMSI" is a special situation. Here the UE has deactivated ISR due to special situation handling. By maintaining the old TIN value the UE remembers to use the RAT specific TMSI indicated by the TIN when updating with the CN node of the other RAT.

Only if the TIN is set to "RAT-related TMSI" ISR behaviour is enabled for the UE, i.e. the UE can change between all registered areas and RATs without any update signalling and it listens for paging on the RAT it is camped on. If the TIN is set to "RAT-related TMSI", the UE’s P‑TMSI and RAI as well as its GUTI and TAI(s) shall remain registered with the network and shall remain valid in the UE.

Table 4.3.5.6-2: Old temporary UE Identity that the UE shall indicate in TAU/RAU Request (as old GUTI or as old P‑TMSI/RAI)

Message to be sent by UE	TIN value: P-TMSI	TIN value: GUTI	TIN value: RAT-related TMSI
TAU Request	GUTI mapped from P‑TMSI/RAI	GUTI	GUTI
RAU Request	P-TMSI/RAI	P‑TMSI/RAI mapped from GUTI	P‑TMSI/RAI
Attach Request via E-UTRAN	GUTI mapped from P‑TMSI/RAI	GUTI	GUTI
Attach Request via GERAN/UTRAN	P‑TMSI/RAI	P‑TMSI/RAI mapped from GUTI	P‑TMSI/RAI

Table 4.3.5.6-2 shows which temporary identity the UE shall indicate in a Tracking or Routing Area Update Request of in an Attach Request message, when the UE stores these as valid parameters.

Situations may occur that cause unsynchronized state information in the UE, MME and SGSN. Such special situations trigger a deactivation of ISR locally in the UE.

…

[TS 24.008 clause 4.7.5.1.1]

…

If the MS supports S1 mode, the MS shall handle the P-TMSI IE as follows:

– If the TIN indicates "GUTI" and the MS holds a valid GUTI, the MS shall map the GUTI into a P-TMSI, P‑TMSI signature and RAI as specified in 3GPP TS 23.003 [4]. The MS shall include the mapped RAI in the Old routing area identification IE and the mapped P-TMSI signature in the P-TMSI signature IE. When the routing area updating procedure is initiated in Iu mode, the MS shall also include the mapped P-TMSI in the P‑TMSI IE. Additionally, in Iu mode and A/Gb mode, if the MS holds a valid P-TMSI and RAI, the MS shall indicate the P-TMSI in the Additional mobile identity IE and the RAI in the Additional old routing area identification IE.

– If the TIN indicates "P-TMSI" or "RAT‑related TMSI" and the MS holds a valid P-TMSI and RAI, the MS shall indicate the RAI in the Old routing area identification IE. When the routing area updating procedure is initiated in Iu mode, the MS shall also include the P-TMSI in the P‑TMSI IE.

…

[TS 24.008 clause 4.7.5.1.3]

…

In order to indicate to the MS that the GUTI and TAI list assigned to the MS remain registered with the network and are valid in the MS, the network shall indicate in the Update result IE in the ROUTING AREA UPDATE ACCEPT message that ISR is activated.

If the ROUTING AREA UPDATE ACCEPT message contains

i) no indication that ISR is activated, an MS supporting S1 mode shall set the TIN to "P-TMSI"; or

ii) an indication that ISR is activated, the MS shall regard the available GUTI and TAI list as valid and registered with the network. If the TIN currently indicates "GUTI", the MS shall set the TIN to "RAT-related TMSI".

[TS 24.301 clause 5.5.3.2.2]

The UE in state EMM-REGISTERED shall initiate the tracking area updating procedure by sending a TRACKING AREA UPDATE REQUEST message to the MME,

…

If the UE supports neither A/Gb mode nor Iu mode, the UE shall include a valid GUTI in the Old GUTI IE in the TRACKING AREA UPDATE REQUEST message.

If the UE supports A/Gb mode or Iu mode, the UE shall handle the Old GUTI IE as follows:

NOTE: The mapping of the P-TMSI and RAI to the GUTI is specified in 3GPP TS 23.003 [2].

– If the TIN indicates "GUTI" or "RAT-related TMSI" and the UE holds a valid GUTI, the UE shall indicate the GUTI in the Old GUTI IE.

…

[TS 24.301 clause5.5.3.2.4]

The network may also indicate in the EPS update result IE in the TRACKING AREA UPDATE ACCEPT message that ISR is active. If the TRACKING AREA UPDATE ACCEPT message contains:

i) no indication that ISR is activated, the UE shall set the TIN to "GUTI";

ii) an indication that ISR is activated, the UE shall regard a previously assigned P-TMSI and RAI as valid and registered with the network. If the TIN currently indicates "P-TMSI", the UE shall set the TIN to "RAT-related TMSI".

9.2.3.1.6.3 Test description

9.2.3.1.6.3.1 Pre-test conditions

System Simulator:

– cell A (belongs to TAI-1, home PLMN) is set to ”Serving cell”;

– cell B (belongs to TAI-2, home PLMN) is set to ”Non- Suitable cell”;

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 5 and cell 7 are configured;

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, cell 24 and cell 25 are configured;

– cell 5 / cell 24 belong to RAI-1 (home PLMN) as specified in TS 34.123-1 clause 12 and are set to ” Non-Suitable cell”;

– cell 7 / cell 25 belong to RAI-2 (home PLMN) as specified in TS 34.123-1 clause 12 and are set to ”Non- Suitable “off" cell”;

– system information indicate that NMO 1 is used.

– System information combination 10a as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

NOTE: Setting px_RATComb_Tested = EUTRA_Only is not allowed.

UE:

none.

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.1.6.3.2 Test procedure sequence

Table 9.2.3.1.6.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Void	–	–	–	–
1A	Set the cell type of cell A to the ”Non-Suitable cell”. Set the cell type of cell 5 or 24 to the ”Serving cell”.	–	–	–	–
–	The following messages are sent on Cell 5 or 24	–	–	–	–
2-8	Void	–	–	–	–
8A	Check: Does the UE transmit a ROUTING AREA UPDATE REQUEST message with P-TMSI and RAI on cell 5 or 24?	–>	ROUTING AREA UPDATE REQUEST
–	EXCEPTION: Steps 8AAa1 to 8AAa2 describe the behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported.	–	–	–	–
8AAa1	IF pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN THEN the SS transmits an AUTHENTICATION AND CIPHERING REQUEST message on Cell 24.	<–	AUTHENTICATION AND CIPHERING REQUEST	–	–
8AAa2	The UE transmits an AUTHENTICATION AND CIPHERING RESPONSE message on Cell 24.	–>	AUTHENTICATION AND CIPHERING RESPONSE	–	–
8B	The SS sends ROUTING AREA UPDATE ACCEPT message with P-TMSI-1 and RAI-1.	<–	ROUTING AREA UPDATE ACCEPT	–	–
8C	The UE sends ROUTING AREA UPDATE COMPLETE message.	–>	ROUTING AREA UPDATE COMPLETE	–	–
9	Set the cell type of cell 5 or 24 to the ”Non-Suitable cell”. Set the cell type of cell A to the ”Serving cell”.	–	–	–	–
10	The UE sends TRACKING AREA UPDATE REQUEST message.	–>	TRACKING AREA UPDATE REQUEST	–	–
11	The SS sends TRACKING AREA UPDATE ACCEPT including GUTI-1(TIN set to RAT-related TMSI) and TAI-1.	<–	TRACKING AREA UPDATE ACCEPT	–	–
12	The UE sends TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
12A	The SS releases the RRC connection.	–	–	–	–
12A1-12A1b1	Void	–	–	–	–
13	Set the cell type of cell A to the ”Non-Suitable cell”. Set the cell type of cell 5 or 24 to the ”Serving cell”.	–	–	–	–
14	Check: Does the UE transmit a ROUTING AREA UPDATE REQUEST message in the next 90 seconds on cell 5 or 24?	–>	ROUTING AREA UPDATE REQUEST	1	F
15	SS transmits Paging for PS domain on Cell 5/24.	<–	Paging	–	–
	EXCEPTION: Steps 15Ca1 to 15Cb2 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that takes place if a capability is supported.	–	–	–	–
15A-15b2	Void	–	–	–	–
15Ca1	IF pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA THEN Check: Does the UE respond to the Paging request?	–>	RRCConnectionRequest	5	P
15Ca2	SS sends RRCConnectionReject	<–	RRCConnectionReject	–	–
15Cb1	ELSE IF pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN THEN Check: Does the UE respond to the Paging request?	–>	CHANNEL REQUEST	5	P
15Cb2	SS sends Immediate Assignment Reject	<–	IMMEDIATE ASSIGNMENT REJECT	–	–
16	Set the cell type of cell 5 or 24 to the ”Non-Suitable cell”. Set the cell type of cell A to the ”Serving cell”.	–	–	–	–
17	Check: Does the UE send TRACKING AREA UPDATE REQUEST message in the next 90 seconds.	–>	TRACKING AREA UPDATE REQUEST	3	F
18	Check: Does the test result of generic test procedure in TS 36.508 subclause 6.4.2.4 indicate that the UE is in EMM-REGISTERED state on cell A with PagingUE-Identity = S-TMSI1 and with CN domain indicator set to "PS"?	–	–	6	P
18A	Set the cell type of cell A to the ”Non-Suitable cell”. Set the cell type of cell 5 or 24 to the ”Serving cell”.	–	–	–	–
18B	Check: Does the UE transmit a ROUTING AREA UPDATE REQUEST message in the next 90 seconds on cell 5 or 24?	–>	ROUTING AREA UPDATE REQUEST	1	F
19	Set the cell type of cell 5 or 24 to the ”Non-Suitable off cell”. Set the cell type of cell B to the ”Serving cell”.	–	–	–	–
20	Check: Does the UE send TRACKING AREA UPDATE REQUEST message.	–>	TRACKING AREA UPDATE REQUEST	4	P
21	The SS sends TRACKING AREA UPDATE ACCEPT including GUTI-2 and TAI-2.	<–	TRACKING AREA UPDATE ACCEPT	–	–
22	The UE sends TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
22A	The SS releases the RRC connection.	–	–	–	–
23	Check: Does the test result of generic test procedure in TS 36.508 subclause 6.4.2.4 indicate that the UE is in EMM-REGISTERED state on cell B with PagingUE-Identity = S-TMSI2 and with CN domain indicator set to "PS"?	–	–	6	–
24	Set the cell type of cell A to the ”Non-Suitable “off" cell”. Set the cell type of cell B to the ”Non-Suitable cell”. Set the cell type of cell 7 or 25 to the ”Serving cell”.	–	–	–	–
25	Check: Does the UE transmit a ROUTING AREA UPDATE REQUEST message with P-TMSI and RAI on cell 7 or 25?	–>	ROUTING AREA UPDATE REQUEST	2	P
26	The SS sends ROUTING AREA UPDATE ACCEPT message with P-TMSI-2 and RAI-2.	<–	ROUTING AREA UPDATE ACCEPT	–	–
27	The UE sends ROUTING AREA UPDATE COMPLETE message.	–>	ROUTING AREA UPDATE COMPLETE	–	–

9.2.3.1.6.3.3 Specific message contents

Table 9.2.3.1.6.3.3-1A: Message ROUTING AREA UPDATE ACCEPT (step 8B, Table 9.2.3.1.6.3.2-1)

Derivation path: 36.508, table 4.7B.2-2
Information Element	Value/remark	Comment	Condition
Periodic RA update timer	‘01001001’B	Activated with default T3312 value of 54 min as TS 24.008, Table 11.3a (Note)
PDP Context Status	Same value as in ROUTING AREA UPDATE REQUEST message
Note: The timer is specified to avoid Rel-10 and higher releases impact on the UE behaviour which is not part of the TPs.

Table 9.2.3.1.6.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 10, Table 9.2.3.1.6.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type
EPS update type Value	‘000’B	TA updating	TA_only
	‘001’B or ‘010’B	Combined TA/LA updating or combined TA/LA updating with IMSI attach	No_LAU_CombinedRAU_GERAN_UTRA
	‘010’B	Combined TA/LA updating with IMSI attach	LAU_CombinedRAU_GERAN_UTRA
GPRS ciphering key sequence number	Any allowed value
Old GUTI	Mapped from the P-TMSI and RAI allocated in step 5
Old P-TMSI signature	Any allowed value
Nonce_UE	Any allowed value
EPS bearer context status	(octet 3 = ‘00100000’B and octet 4 = ‘00000000’B) OR (octet 3 = ‘01100000’B and octet 4 = ‘00000000’B

Table 9.2.3.1.6.3.3-1A: Message TRACKING AREA UPDATE REQUEST Conditions (Table 9.2.3.1.6.3.3-1)

Condition	Explanation
TA_only	See the definition below 36.508 table 4.7.2-24.
No_LAU_CombinedRAU_GERAN_UTRA	UE has not performed location area update procedure or a combined routing area update procedure in A/Gb or Iu mode
LAU_CombinedRAU_GERAN_UTRA	UE has performed location area update procedure or a combined routing area update procedure in A/Gb or Iu mode

Table 9.2.3.1.6.3.3-2: Message TRACKING AREA UPDATE ACCEPT (step 11, Table 9.2.3.1.6.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EPS update result	‘100’B	”TA updated and ISR activated”	TA_only
	‘101’B	”combined TA/LA updated and ISR activated”	combined_TA_LA
T3412 value	Not present	(Note)
GUTI	GUTI-1
TAI list
Length of tracking area identity list contents	‘00000110’B
Partial tracking area identity list
Number of elements	‘00000’B
Type of list	’00’B	”list of TACs belonging to one PLMN, with non-consecutive TAC values”
MCC MNC TAC 1	TAI-1
Note: This is to allow the UE to apply the default timer, and avoid Rel-10 and higher releases impact on the UE behaviour which is not part of the TPs.

Table 9.2.3.1.6.3.3-3: Message TRACKING AREA UPDATE REQUEST (step 20, Table 9.2.3.1.6.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Old GUTI	GUTI-1

Table 9.2.3.1.6.3.3-4: Message TRACKING AREA UPDATE ACCEPT (step 21, Table 9.2.3.1.6.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EPS update result	‘100’B	”TA updated and ISR activated”	TA_only
	‘101’B	”combined TA/LA updated and ISR activated”	combined_TA_LA
T3412 value	Not present	(Note)
GUTI	GUTI-2
TAI list
Length of tracking area identity list contents	‘00000110’B
Partial tracking area identity list
Number of elements	‘00000’B
Type of list	’00’B	”list of TACs belonging to one PLMN, with non-consecutive TAC values”
MCC MNC TAC 2	TAI-2
Note: This is to allow the UE to apply the default timer, and avoid Rel-10 and higher releases impact on the UE behaviour which is not part of the TPs.

Table 9.2.3.1.6.3.3-4A: Message ROUTING AREA UPDATE REQUEST (step 25, Table 9.2.3.1.6.3.2-1)

Derivation path: 36.508, table 4.7B.2-2
Information Element	Value/remark	Comment	Condition
Update type	‘000’B	“RA updating”
Update type	‘001’B	“combined RA/LA updating”
P-TMSI	P-TMSI-1

Table 9.2.3.1.6.3.3-5: Message ROUTING AREA UPDATE ACCEPT (step 26, Table 9.2.3.1.6.3.2-1)

Derivation path: 36.508, table 4.7B.2-2
Information Element	Value/remark	Comment	Condition
Update result	100	“RA updated and ISR activated”
Update result	101	“combined RA/LA updated and ISR activated”
Periodic RA update timer	‘01001001’B	Activated with default T3312 value of 54 min as TS 24.008, Table 11.3a (Note)
Note: The timer is specified to avoid Rel-10 and higher releases impact on the UE behaviour which is not part of the TPs.

Table 9.2.3.1.6.3.3-6: Void

9.2.3.1.7 Void

9.2.3.1.8 UE receives an indication that the RRC connection was released with cause "load balancing TAU required"

9.2.3.1.8.1 Test Purpose (TP)

(1)

with { UE in state EMM-REGISTERED and EMM-CONNECTED mode}

ensure that {

when { UE receives RRC CONNECTION RELEASE message with cause "load balancing TAU required" and enters EMM-REGISTERED and EMM-IDLE mode}

then { UE sends TRACKING AREA UPDATE REQUEST message with EPS update type = "TA updating"}

}

(2)

with { UE in state EMM-REGISTERED and EMM-CONNECTED mode}

ensure that {

when { UE receives RRC CONNECTION RELEASE message with cause "load balancing TAU required" and enters EMM-REGISTERED and EMM-IDLE mode}

then { the UE encodes the RRC parameters in the RRC Connection Establishment messages correctly (i.e. in the RRCConnectionRequest message, the ue-Identity is set random-Value; and, in the RRCConnectionSetupComplete message the registeredMME is not included) }

}

9.2.3.1.8.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 23.401 clause 4.3.7.3, 3GPP TS 24.301 clauses 5.3.1.1, 5.5.3.1, 5.5.3.2.2 and 5.5.3.2.4, and 3G PP TS 36.331 clauses and 5.3.3.3 and 5.3.3.4].

[TS 23.401 clause 4.3.7.3]

…

To off-load ECM-CONNECTED mode UEs, the MME initiates the S1 Release procedure with release cause "load balancing TAU required" (clause 5.3.5). The S1 and RRC connections are released and the UE initiates a TAU but provides neither the S-TMSI nor the GUMMEI to eNodeB in the RRC establishment.

…

[TS 24.301 clause 5.3.1.1]

…

When the UE is registered in the tracking area of the current cell during the NAS signalling connection establishment, the UE NAS shall provide the lower layers with the S-TMSI, but shall not provide the registered MME identifier to the lower layers. Exceptionally, when the UE in EMM-IDLE mode initiates a tracking area updating or combined tracking area updating procedure for load balancing purposes, the UE NAS shall provide the lower layers with neither S-TMSI nor registered MME identifier.

…

[TS 24.301 clause5.5.3.1]

The tracking area updating procedure is always initiated by the UE and is used for the following purposes:

…

– MME load balancing;

…

[TS 24.301 clause 5.5.3.2.2]

The UE in state EMM-REGISTERED shall initiate the tracking area updating procedure by sending a TRACKING AREA UPDATE REQUEST message to the MME,

…

e) when the UE receives an indication from the lower layers that the RRC connection was released with cause "load balancing TAU required";

…

[TS 24.301 clause 5.5.3.2.4]

…

Upon receiving a TRACKING AREA UPDATE ACCEPT message, the UE shall stop timer T3430, reset the tracking area updating attempt counter, enter state EMM-REGISTERED and set the EPS update status to EU1 UPDATED. If the message contains a GUTI, the UE shall use this GUTI as new temporary identity for EPS services and shall store the new GUTI. If no GUTI was included by the MME in the TRACKING AREA UPDATE ACCEPT message, the old GUTI shall be used. If the UE receives a new TAI list in the TRACKING AREA UPDATE ACCEPT message, the UE shall consider the new TAI list as valid and the old TAI list as invalid; otherwise, the UE shall consider the old TAI list as valid.

…

If the TRACKING AREA UPDATE ACCEPT message contained a GUTI, the UE shall return a TRACKING AREA UPDATE COMPLETE message to the MME to acknowledge the received GUTI.

[TS 36.331 clause 5.3.3.3]

The UE shall set the contents of RRCConnectionRequest message as follows:

1> set the ue-Identity as follows:

2> if upper layers provide an S-TMSI:

3> set the ue-Identity to the value received from upper layers;

2> else:

3> draw a random value in the range 0 .. 2⁴⁰-1 and set the ue-Identity to this value;

…

[TS 36.331 clause 5.3.3.4]

…

1> set the content of RRCConnectionSetupComplete message as follows:

…

2> if upper layers provide the ‘Registered MME’, include and set the registeredMME as follows:

3> if the PLMN identity of the ‘Registered MME’ is different from the PLMN selected by the upper layers:

4> include the plmnIdentity in the registeredMME and set it to the value of the PLMN identity in the ‘Registered MME’ received from upper layers;

3> set the mmegi and the mmec to the value received from upper layers;

2> if upper layers provided the ‘Registered MME’:

3> include and set the gummei-Type to the value provided by the upper layers;

…

9.2.3.1.8.3 Test description

9.2.3.1.8.3.1 Pre-test conditions

System Simulator:

– cell A.

UE:

none.

Preamble:

– the UE is in state Generic RB established (state 3) on cell A according to TS 36.508 [18].

9.2.3.1.8.3.2 Test procedure sequence

Table 9.2.3.1.8.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS transmits RRCConnectionRelease with cause "load balancing TAU required".	–	–	–	–
1A	Check: Does the UE send an RRCConnectionRequest with the ue-Identity set to “random-Value”?	–>	RRCConnectionRequest	1	P
1B	The SS responds with RRCConnectionSetup.	<–	RRCConnectionSetup	–	–
1C	Check: Does the UE send an RRCConnectionSetupComplete without the registeredMME IE?	–>	RRCConnectionSetupComplete	1	P
2	Check: Does the UE send TRACKING AREA UPDATE REQUEST message.	–>	TRACKING AREA UPDATE REQUEST	1	P
3	The SS sends TRACKING AREA UPDATE ACCEPT. (Note 1)	<–	TRACKING AREA UPDATE ACCEPT	–	–
4	The UE sends TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA connected (E2_T3440) according to TS 36.508.	–	–	–	–
Note 1: The SS assigns a different MME Identifier (MMEI) value in a GUTI.

9.2.3.1.8.3.3 Specific message contents

Table 9.2.3.1.8.3.3-1: Message TRACKING AREA UPDATE ACCEPT (step 3, Table 9.2.3.1.8.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
GUTI	GUTI-2

Table 9.2.3.1.8.3.3-2: Message RRCConnectionRequest (step 1A, Table 9.2.3.1.8.3.2-1)

Derivation path: 36.508 table 4.6.1-16
Information Element	Value/Remark	Comment	Condition
RRCConnectionRequest ::= SEQUENCE {
criticalExtensions CHOICE {
rrcConnectionRequest-r8 SEQUENCE {
ue-Identity CHOICE {
random-Value	Any allowed value
}
establishmentCause	Mo-Signalling
}
}
}

Table 9.2.3.1.8.3.3-3: Message RRCConnectionSetupComplete (step 1C, Table 9.2.3.1.8.3.2-1)

Derivation path: 36.508 table 4.6.1-18
Information Element	Value/Remark	Comment	Condition
RRCConnectionSetupComplete ::= SEQUENCE {
criticalExtensions CHOICE {
c1 CHOICE {
rrcConnectionSetupComplete-r8 SEQUENCE {
selectedPLMN-Identity	1
registeredMME	Not present
dedicatedInfoNAS	See table 9.2.3.1.8.3.3-3
nonCriticalExtension SEQUENCE {}
}
}
}
}

9.2.3.1.8a Normal tracking area update / low priority override

9.2.3.1.8a.1 Test Purpose (TP)

(1)

with { UE in state EMM-REGISTERED and EMM-IDLE mode and UE configured for low priority NAS signalling and low priority NAS signalling override }

ensure that {

when { UE detects entering a new tracking area not included in the TAI list }

then { UE sends TRACKING AREA UPDATE REQUEST message with the low priority indicator set to "MS is not configured for NAS signalling low priority"}

}

9.2.3.1.8a.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 24.301 clauses 4.2A

[TS 24.301 clause 4.2A]

…

A UE configured for NAS signalling low priority (see 3GPP TS 24.368 [15A], 3GPP TS 31.102 [17]) indicates this by including the Device properties IE in the appropriate NAS message and setting the low priority indicator to "MS is configured for NAS signalling low priority", except for the following cases in which the UE shall set the low priority indicator to "MS is not configured for NAS signalling low priority":

…

– the UE configured for dual priority is requested by the upper layers to establish a PDN connection with the low priority indicator set to "MS is not configured for NAS signalling low priority";

– the UE configured for dual priority is performing EPS session management procedures related to the PDN connection established with low priority indicator set to "MS is not configured for NAS signalling low priority";

– the UE configured for dual priority has a PDN connection established by setting the low priority indicator to "MS is not configured for NAS signalling low priority" and is performing EPS mobility management procedures;

– the UE is accessing the network with access class 11 – 15; or

– the UE is responding to paging.

The network may use the NAS signalling low priority indication for NAS level mobility management congestion control and APN based congestion control.

If the NAS signalling low priority indication is provided in a PDN CONNECTIVITY REQUEST message, the MME stores the NAS signalling low priority indication within the default EPS bearer context activated due to the PDN connectivity request procedure.

9.2.3.1.8a.3 Test description

9.2.3.1.8a.3.1 Pre-test conditions

System Simulator:

– cell A (belongs to TAI-1, home PLMN) is set to ”Serving cell”;

– cell B (belongs to TAI-2, home PLMN) is set to ”Non- Suitable cell”;

UE:

– the UE is configured to initiate EPS attach.

– the UE is configured for low priority NAS signalling

– the UE is configured for low priority NAS signalling override

The UE is equipped with a USIM containing values shown in Table 9.2.3.1.8a.3.1-1.

Table 9.2.3.1.8a.3.1-1: USIM Configuration

USIM field	Value
EF_UST	Service 96 is supported.
EF_NASCONFIG	“NAS_SignallingPriority is set to NAS signalling low priority” as defined in TS 24.368, clause 5.3.
EF_NASCONFIG	“Override_NAS_SignallingLowPriority is set to UE can override the NAS signalling low priority indicator” as defined in TS 24.368, clause 5.9.
EF_NASCONFIG	“ExtendedAccessBarring is set to extended access barring is applied for the UE” as defined in TS 24.368, clause 5.8
EF_NASCONFIG	“Override_ExtendedAccessBarring is set to UE can override extended access barring” as defined in TS 24.368, clause 5.10.
Note: As per TS 23.401 [22] clause 4.3.17.4, UE’s configuration of low access priority and Extended Access Barring shall match each other and so do their corresponding override configuration.

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.1.8a.3.2 Test procedure sequence

Table 9.2.3.1.8a.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
0A	Cause the UE to request connectivity to an additional PDN with the Device properties IE set to “MS is not configured for NAS signalling low priority” (see Note)	–	–
0B	The UE transmits an RRCConnectionRequest message with establishmentCause set to ‘mo-Data’ followed by a SERVICE REQUEST message.	–>	SERVICE REQUEST	–	–
0C	The SS establishes SRB2 and DRB associated with default EPS bearer context (a first PDN obtained during the attach procedure).	–	–	–	–
0D	UE should include the Device properties IE set to “MS is not configured for NAS signalling low priority”	–>	PDN CONNECTIVITY REQUEST	–	–
0E	The SS transmits an ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message with IE EPS Bearer Identity set to new EPS bearer context.	<–	ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST	–	–
–	EXCEPTION: In parallel to the event described in step 0F below, the generic procedure for IP address allocation in the U-plane specified in TS 36.508 subclause 4.5A.1 takes place performing IP address allocation in the U-plane.	–	–	–	–
0F	The UE transmits an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message for the additional default EPS Bearer.	–>	ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT	–	–
	The following messages are sent and shall be received on cell B.	–	–	–	–
1	Set the cell type of cell A to the "Non-Suitable cell". Set the cell type of cell B to the " Serving cell"	–	–	–	–
2	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	1	P
3	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
4	The UE transmits a TRACKING AREA UPDATE COMPLETE message	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA connected (E2_T3440) according to TS 36.508.	–	–		–
Note: The trigger in step 0A is the same as in the generic procedure in 36.508 clause 6.4.3.2. The request of connectivity to an additional PDN may be performed by MMI or AT command.

9.2.3.1.8a.3.3 Specific message contents

Table 9.2.3.1.8a.3.3-1: Message PDN CONNECTIVITY REQUEST (step 0D, Table 9.2.3.1.8a.3.2-1)

Derivation Path: TS 36.508 Table 4.7.3-20
Information Element	Value/remark	Comment	Condition
Procedure transaction identity	PTI-1	UE assigns a particular PTI not yet used between 1 and 254
ESM information transfer flag	Not present	This IE is only needed during an attach procedure.
Access point name	APN-1	The requested PDN is different from default PDN
Device properties	0	‘MS is not configured for NAS signalling low priority’

Table 9.2.3.1.8a.3.3-2: Message TRACKING AREA UPDATE REQUEST (step 2, Table 9.2.3.1.8a.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Device properties	0	MS is not configured for NAS signalling low priority
Last visited registered TAI	TAI-1

9.2.3.1.8b Normal tracking area update / EAB broadcast handling / ExtendedAccessBarring configured in the UE / ExtendedAccessBarring and Override_ExtendedAccessBarring configured in the UE

9.2.3.1.8b.1 Test Purpose (TP)

(1)

with { UE in state EMM-REGISTERED and EMM-IDLE mode and UE being configured for ExtendedAccessBarring (EAB) and not configured for Override_ExtendedAccessBarring and accessing the network with an access class different to classes 11 – 15 }

ensure that {

when { UE detects entering a new tracking area, and, the cell is broadcasting EAB information effectively barring the cell for the UE }

then { the UE does not initiate Normal tracking area update on the cell }

}

(2)

with { UE is switched off and powered off and UE being configured for ExtendedAccessBarring (EAB) and configured for Override_ExtendedAccessBarring and accessing the network with an access class different to classes 11 – 15 }

ensure that {

when { UE is powered; then switched on and the cell is broadcasting EAB information effectively barring the cell for the UE and an indication from the upper layers to override EAB is received }

then { the UE initiates Attach procedure on the cell }

}

9.2.3.1.8b.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clause 5.3.10 and D.1, TS 24.368 clauses 4, 5.8 and 5.10, and, TS 36.331, clauses 5.2.2.4, 5.3.3.2 and 5.3.3.12. Unless otherwise stated these are Rel-11 requirements.

[TS 24.301, clause 5.3.10]

The network can restrict the access for certain groups of UEs by means of barring their access class.

The UE shall evaluate the access control information for Access Class Barring, Access Control for CSFB and Extended Access Barring (EAB) as specified in 3GPP TS 36.331 [22].

[TS 24.301, clause D.1]

When EMM requests the establishment of a NAS-signalling connection, the RRC establishment cause used by the UE shall be selected according to the NAS procedure as specified in table D.1.1. The EMM shall also indicate to the lower layer for the purpose of access control, the call type associated with the RRC establishment cause as specified in table D.1.1. If the UE is configured for EAB (see the "ExtendedAccessBarring" leaf of NAS configuration MO in 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17]), the EMM shall indicate to the lower layer for the purpose of access control that EAB applies for this request except for the following cases:

– the UE is accessing the network with one of the access classes 11 – 15;

– the UE is answering to paging;

– the RRC Establishment cause is set to "Emergency call"; or

– the UE is configured to allow overriding EAB (see the "Override_ExtendedAccessBarring" leaf of the NAS configuration MO as specified in 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17]) and receives an indication from the upper layers to override EAB.

[TS 24.368, clause 4]

The NAS configuration MO is used to manage configuration parameters related to NAS functionality for a UE supporting provisioning of such information. The presence and format of the non-access stratum configuration file on the USIM is specified in 3GPP TS 31.102 [6].

The MO identifier is: urn:oma:mo:ext-3gpp-nas-config:1.0.

The OMA DM Access Control List (ACL) property mechanism (see OMA-ERELD-DM-V1_2 [2]) may be used to grant or deny access rights to OMA DM servers in order to modify nodes and leaf objects of the NAS configuration MO.

The following nodes and leaf objects are possible in the NAS configuration MO as described in figure 4-1:

Figure 4-1: The NAS configuration Management Object

[TS 24.368, clause 5.8]

The ExtendedAccessBarring leaf indicates whether the extended access barring is applicable for the UE as specified in 3GPP TS 24.008 [4] and 3GPP TS 24.301 [5].

– Occurrence: ZeroOrOne

– Format: bool

– Access Types: Get, Replace

– Values: 0, 1

0 Indicates that the extended access barring is not applied for the UE.

1 Indicates that the extended access barring is applied for the UE.

The default value 0 applies if this leaf is not provisioned.

[TS 24.368, clause 5.10]

The Override_ExtendedAccessBarring leaf indicates whether the UE can override ExtendedAccessBarring leaf node configured to extended access barring.

The handling of extended access barring for the UE when the Override_ExtendedAccessBarring leaf exists is specified in 3GPP TS 24.008 [4] and 3GPP TS 24.301 [5].

– Occurrence: ZeroOrOne

– Format: bool

– Access Types: Get, Replace

– Values: 0, 1

0 Indicates that the UE cannot override extended access barring

1 Indicates that the UE can override extended access barring

The default value 0 applies if this leaf is not provisioned.

[TS 36.331, clause 5.2.2.4]

The UE shall:

…

1> not initiate the RRC connection establishment subject to EAB until the UE has a valid version of SystemInformationBlockType14, if broadcast;

…

1> if the UE is EAB capable:

2> when the UE does not have stored a valid version of SystemInformationBlockType14 upon entering RRC_IDLE, or when the UE acquires SystemInformationBlockType1 following EAB parameters change notification or upon entering a cell during RRC_IDLE:

3> if schedulingInfoList indicates that SystemInformationBlockType14 is present:

4> start acquiring SystemInformationBlockType14 immediately;

3> else:

4> discard SystemInformationBlockType14, if previously received;

NOTE 4: EAB capable UEs start acquiring SystemInformationBlockType14 as described above even when systemInfoValueTag in SystemInformationBlockType1 has not changed.

NOTE 5: EAB capable UEs maintain an up to date SystemInformationBlockType14 in RRC_IDLE.

[TS 36.331, clause 5.3.3.2]

The UE initiates the procedure when upper layers request establishment of an RRC connection while the UE is in RRC_IDLE.

Upon initiation of the procedure, the UE shall:

1> if upper layers indicate that the RRC connection is subject to EAB (see TS 24.301 [35]):

2> if the result of the EAB check, as specified in 5.3.3.12, is that access to the cell is barred:

3> inform upper layers about the failure to establish the RRC connection and that EAB is applicable, upon which the procedure ends;

[TS 36.331, clause 5.3.3.12]

The UE shall:

1> if SystemInformationBlockType14 is present and includes the eab-Param:

2> if the eab-Common is included in the eab-Param:

3> if the UE belongs to the category of UEs as indicated in the eab-Category contained in eab-Common; and

3> if for the Access Class of the UE, as stored on the USIM and with a value in the range 0..9, the corresponding bit in the eab-BarringBitmap contained in eab-Common is set to one:

4> consider access to the cell as barred;

3> else:

4> consider access to the cell as not barred due to EAB;

9.2.3.1.8b.3 Test description

9.2.3.1.8b.3.1 Pre-test conditions

System Simulator:

– Cell A (belongs to TAI-1, home PLMN) is set to ”Serving cell”;

– Cell B (belongs to TAI-2, home PLMN) is set to ”Non- Suitable cell”; When active, the SS is transmitting SystemInformationBlockType14 Extended access barring activated on this cell. System information combination 21 as defined in TS 36.508[18] clause 4.4.3.1.2 is used in E-UTRA cell B.

UE:

– The UE is configured to respect "ExtendedAccessBarring" as per TS 24.368 [49]. This is achieved by equipping the UE with a USIM containing values shown in Table 9.2.3.1.8b.3.1-1.

Table 9.2.3.1.8b.3.1-1: USIM A Configuration

USIM field	Value
EF_UST	Services 96 ‘Non-Access Stratum configuration by USIM’ is supported.
EF_NASCONFIG	– Extended access barring activated: UE shall apply extended access barring – Override Extended access barring not activated
EF_NASCONFIG	– “NAS_SignallingPriority is set to NAS signalling low priority” as defined in TS 24.368, clause 5.3. – Override_NAS_SignallingLowPriority not activated

– The UE is configured to initiate EPS attach.

– The UE is capable to be configured for Override Extended access barring as described in TS 24.368 [49]. This is achieved by equipping the UE with a USIM containing values shown in Table 9.2.3.1.8b.3.1-2.

Table 9.2.3.1.8b.3.1-2: USIM B Configuration

USIM field	Value
EF_UST	Services 96 ‘Non-Access Stratum configuration by USIM’ is supported.
EF_NASCONFIG	– Extended access barring activated: UE shall apply extended access barring – Override Extended access barring activated
EF_NASCONFIG	– “NAS_SignallingPriority is set to NAS signalling low priority” as defined in TS 24.368, clause 5.3. – Override_NAS_SignallingLowPriority activated
Note: As per TS 23.401 [22] clause 4.3.17.4, UE’s configurations of low access priority and Extended Access Barring shall match each other.

Preamble:

– The UE is equipped with USIM A, and is in state Registered, Idle Mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.1.8b.3.2 Test procedure sequence

Table 9.2.3.1.8b.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – Cell A as a "Non-Suitable cell". – Cell B as "Serving cell" (the cell is transmitting SystemInformationBlockType14 Extended access barring activated)	–	–	–	–
–	The following messages are sent and shall be received on cell B	–	–	–	–
2	Check: Does the UE send a TRACKING AREA UPDATE REQUEST message in the next 60 sec?	->	TRACKING AREA UPDATE REQUEST	1	F
3	Void	–	–	–	–
3A	The UE is switched off and powered off.	–	–	–	–
3B	The UE is equipped with USIM B containing values shown in Table 9.2.3.1.8b.3.1-2.	–	–	–	–
3C	The UE is powered on and switched on.	–	–	–	–
3D	Cause the UE to initiate Attach procedure with the Device properties IE set to “MS is not configured for NAS signalling low priority” by MMI or AT command.
4	Check: Does the UE transmit an ATTACH REQUEST message?	–>	ATTACH REQUEST	2	P
5	Void	–	–	–	–
6	Void	–	–	–	–
7-11	The attach procedure is completed by executing steps 5 to 8 of the UE registration procedure in TS 36.508 subclause 4.5.2.3.	–	–	–	–
12-20b1	Void	–	–	–	–
21	The SS transmits an ATTACH REJECT message, EMM cause = EPS services and non-EPS services not allowed (#8)	<–	ATTACH REJECT	–	–
22	The SS releases the RRC connection.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA deregistered (E4) according to TS 36.508.	–	–	–	–

9.2.3.1.8b.3.3 Specific message contents

Table 9.2.3.1.8b.3.3-1: Message ATTACH REQUEST (preamble)

Derivation path: TS 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Device properties	1	“MS is configured for NAS signalling low priority”

Table 9.2.3.1.8b.3.3-2: Message ATTACH REQUEST (Step4)

Derivation path: TS 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Device properties	0	“MS is not configured for NAS signalling low priority”

9.2.3.1.9 Normal tracking area update / Correct handling of CSG list

9.2.3.1.9.1 Test Purpose (TP)

(1)

with { UE in state EMM-REGISTERED and EMM-IDLE mode}

ensure that {

when { Manual CSG ID selection is requested }

then { UE sends TRACKING AREA UPDATE REQUEST message with ‘EPS update type = TA updating’}

}

(2)

with { UE in state EMM-REGISTERED and EMM-IDLE mode; and UE’s Allowed CSG list is not empty }

ensure that {

when { UE detects suitable E-UTRAN CSG cell previously visited }

then { UE reselects the suitable previously visited E-UTRAN CSG cell and sends TRACKING AREA UPDATE REQUEST message with ‘EPS update type = TA updating’}

}

9.2.3.1.9.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clauses 5.5.3.1, 5.5.3.2.2 and 5.5.3.2.4.

[TS 24.301, clause 5.5.3.1]

The tracking area updating procedure is always initiated by the UE and is used for the following purposes:

– normal tracking area updating to update the registration of the actual tracking area of a UE in the network;

…

– to indicate to the network that the UE has selected a CSG cell whose CSG identity is not included in the UE’s Allowed CSG list.

[TS 24.301, clause 5.5.3.2.2]

The UE in state EMM-REGISTERED shall initiate the tracking area updating procedure by sending a TRACKING AREA UPDATE REQUEST message to the MME,

a) when the UE detects entering a tracking area that is not in the list of tracking areas that the UE previously registered in the MME;

…

k) when due to manual CSG selection the UE has selected a CSG cell whose CSG identity is not included in the UE’s Allowed CSG list;

…

If the UE supports neither A/Gb mode nor Iu mode, the UE shall include a valid GUTI in the Old GUTI IE in the TRACKING AREA UPDATE REQUEST message.

If the UE supports A/Gb mode or Iu mode, the UE shall handle the Old GUTI IE as follows:

– If the TIN indicates "P-TMSI" and the UE holds a valid P-TMSI and RAI, the UE shall map the P-TMSI and RAI into the Old GUTI IE. If a P-TMSI signature is associated with the P-TMSI, the UE shall include it in the Old P-TMSI signature IE. Additionally, if the UE holds a valid GUTI, the UE shall indicate the GUTI in the Additional GUTI IE.

NOTE: The mapping of the P-TMSI and RAI to the GUTI is specified in 3GPP TS 23.003 [2].

– If the TIN indicates "GUTI" or "RAT-related TMSI" and the UE holds a valid GUTI, the UE shall indicate the GUTI in the Old GUTI IE.

…..

[TS 24.301, clause 5.5.3.2.4]

…

If the UE has initiated the tracking area updating procedure due to manual CSG selection and receives a TRACKING AREA UPDATE ACCEPT message, the UE shall check if the CSG ID of the cell where the UE has sent the TRACKING AREA UPDATE REQUEST message is contained in the Allowed CSG list. If not, the UE shall add that CSD ID to the Allowed CSG list.

If the TRACKING AREA UPDATE ACCEPT message contained a GUTI, the UE shall return a TRACKING AREA UPDATE COMPLETE message to the MME to acknowledge the received GUTI.

Upon receiving a TRACKING AREA UPDATE COMPLETE message, the MME shall stop timer T3450, and shall consider the GUTI sent in the TRACKING AREA UPDATE ACCEPT message as valid.

…

9.2.3.1.9.3 Test description

9.2.3.1.9.3.1 Pre-test conditions

System Simulator:

– Cell A (belongs to TAI-1, home PLMN, not a CSG cell) is set to ”Serving cell”;

– Cell B (belongs to TAI-3, home PLMN, is a CSG cell) is set to ”Non- Suitable cell”;

– Cell D (belongs to TAI-4, home PLMN, not a CSG cell) is set to ”Non- Suitable cell”.

– System information combination 2 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells A and D

– System information combination 7 as defined in TS 36.508[18] clause 4.4.3.1 is used in cell B;

UE:

the UE is configured to initiate EPS attach;
pc_Allowed_CSG_list, The UE’s allowed CSG li st shall not contain CSG ID 2.

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on Cell A according to TS 36.508 [18].

9.2.3.1.9.3.2 Test procedure sequence

Table 9.2.3.1.9.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – Cell A as a "Not Suitable cell". – Cell B as a "Serving cell". – Cell D as a "Not Suitable “Off” cell".	–	–	–	–
2	The UE performs manual CSG ID selection and CSG Identity (‘000 0000 0000 0000 0000 0000 0010’B) is selected manually.	–	–	–	–
3	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message on Cell B?	–>	TRACKING AREA UPDATE REQUEST	1	P
4	The SS transmits a TRACKING AREA UPDATE ACCEPT message. NOTE: UE shall add the selected CSG ID as indicate in step 2 to UE’s Allowed CSG list.	<–	TRACKING AREA UPDATE ACCEPT	–	–
5	Check: Does the UE transmit a TRACKING AREA UPDATE COMPLETE message on Cell B?	–>	TRACKING AREA UPDATE COMPLETE	1	P
6	The SS releases the RRC connection.	–	–	–	–
7	The SS configures: – Cell A as a "Not Suitable “Off” cell". – Cell B as a "Not Suitable cell". – Cell D as a "Serving cell".	–	–	–	–
8	The UE transmits a TRACKING AREA UPDATE REQUEST message on Cell D.	–>	TRACKING AREA UPDATE REQUEST	–	–
9	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
10	The UE transmits a TRACKING AREA UPDATE COMPLETE message on Cell D.	–>	TRACKING AREA UPDATE COMPLETE	–	–
11	The SS releases the RRC connection.	–	–	–	–
12	The SS configures: – Cell B as a "Serving cell". – Cell D as a "Not Suitable cell".	–	–	–	–
13	Check: Does the UE camped on Cell B within 6 min and transmits a TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	2	P
14	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
15	Check: Does the UE transmit a TRACKING AREA UPDATE COMPLETE message on Cell B?	–>	TRACKING AREA UPDATE COMPLETE	2	P

9.2.3.1.9.3.3 Specific message contents

Table 9.2.3.1.9.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 3, Table 9.2.3.1.9.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Old GUTI	GUTI-1	”Old GUTI is included by UE if valid, IMSI otherwise”
Last visited registered TAI	TAI-1

Table 9.2.3.1.9.3.3-2: Message TRACKING AREA UPDATE ACCEPT (step 4, Table 9.2.3.1.9.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
GUTI	GUTI-2
TAI list
Length of tracking area identity list contents	‘00000110’B
Partial tracking area identity list
Number of elements	‘00000’B
Type of list	’00’B	”list of TACs belonging to one PLMN, with non-consecutive TAC values”
MCC MNC TAC 1	PLMN= MCC/MNC TAC 1=2	”PLMN is set to the same MCC/MNC stored in EF_IMSI” ”TAI-2”

Table 9.2.3.1.9.3.3-3: Message TRACKING AREA UPDATE REQUEST (step 8, Table 9.2.3.1.9.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Old GUTI	GUTI-2	”Old GUTI is included by UE if valid, IMSI otherwise”
Last visited registered TAI	TAI-2

Table 9.2.3.1.9.3.3-4: Message TRACKING AREA UPDATE ACCEPT (step 9, Table 9.2.3.1.9.3.2-1)

Derivation Path: TS 36.508, Table 4.7.2-24
Information Element	Value/remark	Comment	Condition
GUTI	GUTI-3
TAI list
Length of tracking area identity list contents	‘00000110’B
Partial tracking area identity list
Number of elements	‘00000’B
Type of list	’00’B	”list of TACs belonging to one PLMN, with non-consecutive TAC values”
MCC MNC TAC 1	PLMN= MCC/MNC TAC 1=4	”PLMN is set to the same MCC/MNC stored in EFIMSI” ”TAI-4”

Table 9.2.3.1.9.3.3-5: Message TRACKING AREA UPDATE REQUEST (step 13, Table 9.2.3.1.9.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Old GUTI	GUTI-3
Last visited registered TAI	TAI-4

Table 9.2.3.1.9.3.3-6: Message TRACKING AREA UPDATE ACCEPT (step 14, Table 9.2.3.1.9.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
GUTI	GUTI-2
TAI list
Length of tracking area identity list contents	‘00000110’B
Partial tracking area identity list
Number of elements	’00000’B
Type of list	’00’B	”list of TACs belonging to one PLMN, with non-consecutive TAC values”
MCC MNC TAC 1	PLMN= MCC/MNC TAC 1=2	”PLMN is set to the same MCC/MNC stored in EF_IMSI” ”TAI-2”

9.2.3.1.9a Normal tracking area update / NAS signalling connection recovery

9.2.3.1.9a.1 Test Purpose (TP)

(1)

with { UE in state EMM-REGISTERED and EMM-CONNECTED }

ensure that {
when { UE receives an indication of "RRC Connection failure" from the lower layers }

then { UE initiates the tracking area updating procedure }

}

9.2.3.1.9a.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.3.1, 5.5.3.2.2 and 5.5.3.3.2 and TS 36.331, clause 5.3.7.8 and 5.3.12.

[TS 24.301, clause 5.5.3.1]

The tracking area updating procedure is always initiated by the UE and is used for the following purposes:

…

– recovery from certain error cases (for details see subclauses 5.5.3.2.2 and subclause 5.5.3.3.2);

[TS 24.301, clause 5.5.3.2.2]

The UE in state EMM-REGISTERED shall initiate the tracking area updating procedure by sending a TRACKING AREA UPDATE REQUEST message to the MME,

…

i) when the UE receives an indication of "RRC Connection failure" from the lower layers and has no signalling or user uplink data pending (i.e. when the lower layer requests NAS signalling connection recovery);

…

For all cases except case b, the UE shall set the EPS update type IE to "TA updating". For case b, the UE shall set the EPS update type IE to "periodic updating".

[TS 24.301, clause 5.5.3.3.2]

The UE operating in CS/PS mode 1 or CS/PS mode 2, in state EMM-REGISTERED, shall initiate the combined tracking area updating procedure:

…

j) when the UE receives an indication of "RRC Connection failure" from the lower layers and has no signalling or user uplink data pending (i.e. when the lower layer requests NAS signalling connection recovery);

…

To initiate a combined tracking area updating procedure the UE sends the message TRACKING AREA UPDATE REQUEST to the network, starts timer T3430 and changes to state EMM-TRACKING-AREA-UPDATING-INITIATED. The value of the EPS update type IE in the message shall indicate "combined TA/LA updating" unless explicitly specified otherwise.

[TS 36.331, clause 5.3.7.8]

Upon receiving the RRCConnectionReestablishmentReject message, the UE shall:

1> perform the actions upon leaving RRC_CONNECTED as specified in 5.3.12, with release cause ‘RRC connection failure’;

[TS 36.331, clause 5.3.12]

Upon leaving RRC_CONNECTED, the UE shall:

…

1> indicate the release of the RRC connection to upper layers together with the release cause;

9.2.3.1.9a.3 Test description

9.2.3.1.9a.3.1 Pre-test conditions

System Simulator:

– cell A and cell B (same TA); Cell B is configured to belong to TAI-1;

– cell A is "Serving cell" and cell B is "non-Suitable cell".

UE:

none.

Preamble:

– the UE is in state Generic RB Established (state 3) on cell A according to TS 36.508 [18].

9.2.3.1.9a.3.2 Test procedure sequence

Table 9.2.3.1.9a.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of Cell A to the “Non-Suitable "Off” cell”. Set the cell type of Cell B to the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
2	The UE transmits an RRCConnectionReestablishmentRequest.	–	–	–	–
3	The SS transmits an RRCConnectionReestablishmentReject.	–	–	–	–
4	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST with the EPS update type set to ‘TA updating’ or ‘combined TA/LA updating’ in the next 10 seconds?	–>	TRACKING AREA UPDATE REQUEST	1	P
5	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA connected (E2_T3440) according to TS 36.508.	–	–	–	–

9.2.3.1.9a.3.3 Specific message contents

Table 9.2.3.1.9a.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 4, Table 9.2.3.1.9a.3.2-1)

Derivation Path: TS 36.508, Table 4.7.2-27
Information Element	Value/remark	Comment	Condition
Old GUTI	GUTI-1
Last visited registered TAI	TAI-1

Table 9.2.3.1.9a.3.3-2: Message TRACKING AREA UPDATE ACCEPT (step 5, Table 9.2.3.1.9a.3.2-1)

Derivation Path: TS 36.508, Table 4.7.2-24
Information Element	Value/remark	Comment	Condition
GUTI	Not present
MS identity	Not present

9.2.3.1.10 Normal tracking area update / Rejected / IMSI invalid

9.2.3.1.10.1 Test Purpose (TP)

(1)

with { UE has sent a TRACKING AREA UPDATE REQUEST message}

ensure that {

when { UE receives a TRACKING AREA UPDATE REJECT message with the reject cause set to ”Illegal UE” }

then { UE considers the USIM as invalid for EPS services and non-EPS services and enters state EMM-DEREGISTERED }

(2)

with { The UE is in the state EMM-DEREGISTERED }

ensure that {

when { UE is powered up }

then { UE send ATTACH REQUEST message with Old GUTI or IMSI IE = ”IMSI”}

9.2.3.1.10.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 24.301 clauses 5.5.3.2.5.

[TS 24.301 clause5.5.3.2.5]

If the tracking area updating cannot be accepted by the network, the MME sends a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value.

Upon receiving the TRACKING AREA UPDATE REJECT message, the UE shall stop timer T3430, stop any transmission of user data, and take the following actions depending on the EMM cause value received.

#3 (Illegal UE); or

….

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and KSI. The UE shall consider the USIM as invalid for EPS services until switching off or the UICC containing the USIM is removed. The UE shall delete the list of equivalent PLMNs and shall enter the state EMM-DEREGISTERED.

If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number and the MM parameters update status, TMSI, LAI and ciphering key sequence number as specified in 3GPP TS 24.008 [13] for the case when the normal routing area updating procedure is rejected with the GMM cause with the same value. The USIM shall be considered as invalid also for non-EPS services until switching off or the UICC containing the USIM is removed.

9.2.3.1.10.3 Test description

9.2.3.1.10.3.1 Pre-test conditions

System Simulator:

– cell A (belongs to TAI-1, home PLMN) is set to ”Serving cell”;

– cell B (belongs to TAI-2, home PLMN) is set to ”Non-suitable cell”;

– If (px_SinglePLMN_Tested = Multi PLMN) cell G (belongs to TAI-7 ,visited PLMN) is set to ”Non-suitable cell”;

– If (px_RATComb_Tested = EUTRA_UTRA OR px_RATComb_Tested = EUTRA_GERAN);

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 9 (UTRAN, belong to RAI-1) is set to "Non-suitable “off” cell";

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, cell 24 (GERAN, belong to RAI-1) is set to "Non-suitable “off” cell;

– system information combination 10 as defined in TS 36.508[18] clause 4.4.3.1 is applied in E-UTRA cells;

– If (px_RATComb_Tested = EUTRA_Only):

– neither cell 9 nor cell 24 is configured;

– system information combination 1 as defined in TS 36.508[18] clause 4.4.3.1 is applied in E-UTRA cells.

UE:

– the UE is configured to initiate EPS attach;

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, the UE is previously registered on UTRAN cell 5 using default message contents according to TS 36.508 [18].

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, the UE is previously registered on GERAN cell 24 using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.1.10.3.2 Test procedure sequence

Table 9.2.3.1.10.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of cell A to the ”Non-Suitable cell”. Set the cell type of cell B to the ”Serving cell”.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST on Cell B.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE REJECT message with EMM cause = "Illegal UE" as specified.	<–	TRACKING AREA UPDATE REJECT	–	–
4	The SS releases the RRC connection.	–	–	–	–
5	Set the cell type of cell A to the ”Serving cell”. Set the cell type of cell B to the ”Non-Suitable cell”.	–	–	–	–
6	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds on cell A? Note: Cell A belongs to the same PLMN where the UE was rejected but a different TAC	–>	ATTACH REQUEST	1	F
7	The user initiates an attach by MMI or by AT command.	–	–	–	–
8	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds on cell A?	–>	ATTACH REQUEST	1	F
–	EXCEPTION: Steps 9a to 12a describe behaviour that depends on the network capability / preference; the "lower case letter" identifies a step sequence that takes place if the network is capable or prefers.	–	–	–	–
9a	Set the cell type of cell A to the ” Non-Suitable cell”. Set the cell type of cell G to the ”Serving cell”.	–	–	–	–
10a	If (px_SinglePLMN_Tested = Multi PLMN) Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds on cell G? Note: Cell G belongs to a PLMN which is not the same like the one on which the UE was rejected.	–>	ATTACH REQUEST	1	F
11a	The user initiates an attach by MMI or by AT command.	–	–	–	–
12a	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds on cell G?	–>	ATTACH REQUEST	1	F
13	If present, set the cell type of cell G to the ”Non-Suitable “off” cell”. If present, set the cell type of cell 9 or 24 to the ”Serving cell”.
	EXCEPTION: Steps 14a1 to 14a2 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported
14a1	IF pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA OR pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN THEN the user initiates an attach by MMI or by AT command.	–	–	–	–
14a2	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds on cell 9 or 24?	–>	ATTACH REQUEST	1	F
15	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
16	Set the cell type of cell A to the ”Serving cell”. If present, set the cell type of cell G to the ”Non-Suitable cell”. If present, set the cell type of cell 9 or 24 to the ”Non-Suitable “off” cell”.	–	–	–	–
17	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
18	Check: Does the UE transmit an ATTACH REQUEST message on cell A?	–>	ATTACH REQUEST	2	P
19-32b1	The attach procedure is completed by executing steps 5 to 18b1 of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.3.1.10.3.3 Specific message contents

Table 9.2.3.1.10.3.3-1: Void

Table 9.2.3.1.10.3.3-2: Message TRACKING AREA UPDATE REJECT (step 3, Table 9.2.3.1.10.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EMM cause	00000011	#3 "Illegal UE"

Table 9.2.3.1.10.3.3-3: Message ATTACH REQUEST (step 18, Table 9.2.3.1.10.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	IMSI

9.2.3.1.11 Normal tracking area update / Rejected / Illegal ME

9.2.3.1.11.1 Test Purpose (TP)

(1)

with { UE has sent a TRACKING AREA UPDATE REQUEST message}

ensure that {

when { UE receives a TRACKING AREA UPDATE REJECT message with the reject cause set to "Illegal ME" }

then { UE considers the USIM as invalid for EPS services and non-EPS services and enters state EMM-DEREGISTERED }

(2)

with { The UE is in the state EMM-DEREGISTERED }

ensure that {

when { UE is powered up }

then { UE send ATTACH REQUEST message with Old GUTI or IMSI IE = ”IMSI”}

9.2.3.1.11.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 24.301 clauses 5.5.3.2.5.

[TS 24.301 clause5.5.3.2.5]

If the tracking area updating cannot be accepted by the network, the MME sends a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value.

Upon receiving the TRACKING AREA UPDATE REJECT message, the UE shall stop timer T3430, stop any transmission of user data, and take the following actions depending on the EMM cause value received.

…

#6 (Illegal ME);

9.2.3.1.11.3 Test description

The test description is identical to the one of subclause 9.2.3.1.10 except that the reject cause #3 "Illegal UE" is replaced with the reject cause #6 "Illegal ME".

9.2.3.1.12 Normal tracking area update / Rejected / EPS service not allowed

9.2.3.1.12.1 Test Purpose (TP)

(1)

with { UE has sent a TRACKING AREA UPDATE REQUEST message}

ensure that {

when { UE receives a TRACKING AREA UPDATE REJECT message with the reject cause set to ”EPS service not allowed” }

then { UE considers the USIM as invalid for EPS services and enters state EMM-DEREGISTERED }

(2)

with { The UE is in the state EMM-DEREGISTERED }

ensure that {

when { UE is powered up or switched on }

then { UE sends ATTACH REQUEST message with ‘Old GUTI or IMSI IE = ‘IMSI”}

9.2.3.1.12.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 24.301 clauses 5.5.3.2.5.

[TS 24.301 clause5.5.3.2.5]

If the tracking area updating cannot be accepted by the network, the MME sends a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value.

Upon receiving the TRACKING AREA UPDATE REJECT message, the UE shall stop timer T3430, stop any transmission of user data, and take the following actions depending on the EMM cause value received.

…

#7 (EPS services not allowed);

If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number as specified in 3GPP TS 24.008 [13] for the case when the normal routing area updating procedure is rejected with the GMM cause with the same value.

9.2.3.1.12.3 Test description

The test description is identical to the one of subclause 9.2.3.1.10 except that the reject cause #3 “illegal UE” is replaced with reject cause #7 “EPS services not allowed”.

9.2.3.1.12.3.2 Test procedure sequence

Same test procedure as in clause 9.2.3.1.10.3.2 with the following exceptions:

Depending on UE capabilities the behaviour in table 9.2.3.1.12.3.2-1 occurs in parallel with step 14a2

Table 9.2.3.1.12.3.2-1: Parallel behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
–	EXCEPTION: Steps 1a1-1a 5 describe a behaviour which depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported.	–	–	–	–
1a1	IF pc_CS THEN the UE transmits a LOCATION UPDATING REQUEST message.	–>	LOCATION UPDATING REQUEST	–	–
–	EXCEPTION: The messages in the next two steps are sent only IF pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN	–	–	–	–
1a2a1	The UE transmits a Classmark Change message	–>	CLASSMARK CHANGE	–	–
1a2a2	IF pc_UTRA THEN the UE transmits a Utran Classmark Change message.	–>	UTRAN CLASSMARK CHANGE.	–	–
1a3	The SS transmits an AUTHENTICATION REQUEST message to initiate the authentication and AKA procedure.	<–	AUTHENTICATION REQUEST	–	–
1a4	The UE transmits an AUTHENTICATION RESPONSE message.	–>	AUTHENTICATION RESPONSE	–	–
1a5	The SS transmits a LOCATION UPDATING ACCEPT message including IMSI-1	<–	LOCATION UPDATING ACCEPT	–	–

Depending on UE capabilities the behaviour in table 9.2.3.1.12.3.2-2 occurs between step 15 and 16

Table 9.2.3.1.12.3.2-2: IMSI detach behaviour

IF pc_CS THEN the UE optionally transmits an IMSI DETACH INDICATION message

–>

IMSI DETACH INDICATION

–

9.2.3.1.12.3.3 Specific message contents

Table 9.2.3.1.12.3.3-1: LOCATION UPDATING ACCEPT (step 5, Table 9.2.3.1.12.3.2-1)

Derivation Path: TS 36.508 Table 4.7B.2-5
Information Element	Value/remark	Comment	Condition
Mobile identity
IMSI	IMSI-1

9.2.3.1.13 Normal tracking area update / Rejected / UE identity cannot be derived by the network

9.2.3.1.13.1 Test Purpose (TP)

(1)

with { UE has sent a TRACKING AREA UPDATE REQUEST message}

ensure that {

when { UE receives a TRACKING AREA UPDATE REJECT message with the reject cause set to ”UE identity cannot be derived by the network” }

then { UE deletes any GUTI, last visited registered TAI, TAI list and KSI and enters the state EMM-DEREGISTERED and subsequently, UE automatically initiates the attach procedure}

9.2.3.1.13.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 24.301 clauses 5.5.3.2.5.

[TS 24.301 clause5.5.3.2.5]

If the tracking area updating cannot be accepted by the network, the MME sends a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value.

Upon receiving the TRACKING AREA UPDATE REJECT message, the UE shall stop timer T3430, stop any transmission of user data, and take the following actions depending on the EMM cause value received.

…

#9 (UE identity cannot be derived by the network);

The UE shall set the EPS update status to EU2 NOT UPDATED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and KSI. The UE shall delete the list of equivalent PLMNs and shall enter the state EMM-DEREGISTERED.

Subsequently, the UE shall automatically initiate the attach procedure.

NOTE 2: User interaction is necessary in some cases when the UE cannot re-activate the EPS bearer(s) automatically.

If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number as specified in 3GPP TS 24.008 [13] for the case when the normal routing area updating procedure is rejected with the GMM cause with the same value.

9.2.3.1.13.3 Test description

9.2.3.1.13.3.1 Pre-test conditions

System Simulator:

– cell A (belongs to TAI-1, home PLMN) is set to ”Serving cell”;

– cell B (belongs to TAI-2, home PLMN) is set to ”Non-suitable cell”;

– System information combination 3 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

UE:

– the UE is configured to initiate EPS attach.

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.1.13.3.2 Test procedure sequence

Table 9.2.3.1.13.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of cell A to the ”Non-Suitable cell”. Set the cell type of cell B to the ”Serving cell”.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST on Cell B.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE REJECT message with EMM cause = ” UE identity cannot be derived by the network ” as specified.	<–	TRACKING AREA UPDATE REJECT	–	–
–	EXCEPTION: Steps 4-19a2-4a1 describes the behaviour that depends on UE behaviour (Note 1).	–	–	–	–
4	The SS releases the RRC connection.	–	–	–	–
–	EXCEPTION: Step 4a1 describes a behaviour which depends on the UE capability	–	–	–	–
4a1	IF NOT pc_Automatic_EPS_Re_Attach , the user initiates an attach by MMI or by AT command.	–	–	–	–
5	Check: Does the UE transmit an ATTACH REQUEST message on cell B?	–>	ATTACH REQUEST	1	P
6-19b1	The attach procedure is completed by executing steps 5 to 18b1 of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–
Note 1: SS waits for 1.5 second to receive the Attach Request on the existing RRC Connection. In case Attach Request is not received within 1.5 second then the existing RRC Connection is released.

9.2.3.1.13.3.3 Specific message contents

Table 9.2.3.1.13.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 2, Table 9.2.3.1.13.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Old GUTI	GUTI-1
Old P-TMSI signature	Absent or any allowed value

Table 9.2.3.1.13.3.3-2: Message TRACKING AREA UPDATE REJECT (step 3, Table 9.2.3.1.13.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EMM cause	‘00001001’B	#9 ”UE identity cannot be derived by the network”

Table 9.2.3.1.13.3.3-3: Message ATTACH REQUEST (step 5, Table 9.2.3.1.13.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	IMSI
Old P-TMSI signature	Not present
Last visited registered TAI	Not present

Table 9.2.3.1.13.3.3-4: Message ATTACH REJECT (step 6, Table 9.2.3.1.13.3.2-1)

Derivation Path: 36.508 table 4.7.2-3
Information Element	Value/remark	Comment	Condition
EMM cause	‘0000 1111’B	#15 ”No suitable cells in tracking area”

9.2.3.1.14 Normal tracking area update / Rejected / UE implicitly detached

9.2.3.1.14.1 Test Purpose (TP)

(1)

with { UE has sent a TRACKING AREA UPDATE REQUEST message}

ensure that {

when { UE receives a TRACKING AREA UPDATE REJECT message with the reject cause set to ”UE implicitly detached” }

then { UE enters the state EMM-DEREGISTERED.NORMAL-SERVICE and sends ATTACH REQUEST message}

9.2.3.1.14.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 24.301 clauses 5.5.3.2.5.

[TS 24.301 clause5.5.3.2.5]

If the tracking area updating cannot be accepted by the network, the MME sends a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value.

Upon receiving the TRACKING AREA UPDATE REJECT message, the UE shall stop timer T3430, stop any transmission of user data, and take the following actions depending on the EMM cause value received.

…

#10 (Implicitly detached);

The UE shall delete the list of equivalent PLMNs and shall enter the state EMM-DEREGISTERED.NORMAL-SERVICE. The UE shall delete any mapped EPS security context or partial native EPS security context. The UE shall perform a new attach procedure.

NOTE 3: User interaction is necessary in some cases when the UE cannot re-activate the EPS bearer(s) automatically.

If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM state as specified in 3GPP TS 24.008 [13] for the case when the normal routing area updating procedure is rejected with the GMM cause with the same value.

9.2.3.1.14.3 Test description

9.2.3.1.14.3.1 Pre-test conditions

System Simulator:

– cell A belongs to TAI-1, home PLMN) is set to ”Serving cell”;

– cell B belongs to TAI-2, home PLMN is set to ”Non- Suitable cell”;

– System information combination 3 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

UE:

– the UE is configured to initiate EPS attach.

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.1.14.3.2 Test procedure sequence

Table 9.2.3.1.14.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of cell A to the ”Non-Suitable cell”. Set the cell type of cell B to the ”Serving cell”.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST on Cell B.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE REJECT message with EMM cause = ”UE implicitly detached” as specified.	<–	TRACKING AREA UPDATE REJECT	–	–
–	EXCEPTION: Steps 3a1-3a2 describes the behaviour that depends on UE behaviour (Note 1).	–	–	–	–
3a1	The SS releases the RRC connection.	–	–	–	–
–	EXCEPTION: Step 3a2 describes a behaviour which depends on the UE capability	–	–	–	–
3a2	IF NOT pc_Automatic_EPS_Re_Attach , the user initiates an attach by MMI or by AT command.	–	–	–	–
4	Check: Does the UE transmit an ATTACH REQUEST message on cell B?	–>	ATTACH REQUEST	1	P
5-18b1	The attach procedure is completed by executing steps 5 to 18b1 of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–
Note 1: SS waits for 1.5 second to receive the Attach Request on the existing RRC Connection. In case Attach Request is not received within 1.5 second, existing RRC Connection is released.

9.2.3.1.14.3.3 Specific message contents

Table 9.2.3.1.14.3.3-1: Void

Table 9.2.3.1.14.3.3-2: Message TRACKING AREA UPDATE REJECT (step 3, Table 9.2.3.1.14.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EMM cause	‘00001010’B	#10 ”UE implicitly detached”

Table 9.2.3.1.14.3.3-3: Message ATTACH REQUEST (step 4, Table 9.2.3.1.14.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	GUTI-1
Last visited registered TAI	TAI-1

9.2.3.1.15 Normal tracking area update / Rejected / PLMN not allowed

9.2.3.1.15.1 Test Purpose (TP)

(1)

with { UE has sent a TRACKING AREA UPDATE REQUEST message }

ensure that {

when { UE receives a TRACKING AREA UPDATE REJECT message with the reject cause set to "PLMN not allowed" }

then { UE deletes the GUTI, the last visited registered TAI and KSI and UE deletes the list of equivalent PLMNs and UE enters state EMM-DEREGISTERED.PLMN-SEARCH and UE stores the PLMN in the "forbidden PLMN list" }

}

(2)

with { UE is switched off having a PLMN stored in the "forbidden PLMN list" }

ensure that {

when { UE is powered up on this PLMN }

then { UE doesn’t perform an attach procedure }

}

(3)

with { UE in EMM-DEREGISTERED.PLMN-SEARCH state having a PLMN stored in the "forbidden PLMN list" }

ensure that {

when { UE enters a cell which is not in the "forbidden PLMN list" }

then { UE initiates an attach procedure }

}

(4)

with { UE in E-UTRA EMM-DEREGISTERED.PLMN-SEARCH state having a PLMN stored in the "forbidden PLMN list" }

ensure that {

when { UE is in a forbidden PLMN cells and when the PLMN is selected manually }

then { UE initiates an attach procedure }

}

9.2.3.1.15.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 24.301 clauses 5.5.3.2.5.

[TS 24.301 clause5.5.3.2.5]

If the tracking area updating cannot be accepted by the network, the MME sends a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value.

Upon receiving the TRACKING AREA UPDATE REJECT message, the UE shall stop timer T3430, stop any transmission of user data, and take the following actions depending on the EMM cause value received.

…

#11 (PLMN not allowed);

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and KSI. The UE shall reset the tracking area updating attempt counter, delete the list of equivalent PLMNs and enter the state EMM-DEREGISTERED.PLMN-SEARCH.

The UE shall store the PLMN identity in the "forbidden PLMN list".

The UE shall perform a PLMN selection according to 3GPP TS 23.122 [6].

If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and routing area updating attempt counter and the MM parameters update status, TMSI, LAI, ciphering key sequence number and the location update attempt counter as specified in 3GPP TS 24.008 [13] for the case when the normal routing area updating procedure is rejected with the GMM cause with the same value and no RR connection exists.

9.2.3.1.15.3 Test description

9.2.3.1.15.3.1 Pre-test conditions

System Simulator:

– cell G (belongs to TAI-7, visited PLMN) and is set to ”Serving cell”;

– cell H (belongs to TAI-8, visited PLMN) is set to ”Non-suitable cell";

– cell I (belongs to TAI-9, visited PLMN) is set to ”Non-suitable “off” cell”;

– the cells are configured according to Table 6.3.2.2-1 and Table 6.3.2.2-3 in36.508[18], except replacing f3 with f1;

– If (px_RATComb_Tested = EUTRA_UTRA OR px_RATComb_Tested = EUTRA_GERAN);

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 9 (UTRAN, belongs to RAI-1) is set to "Non-suitable “off” cell";

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, cell 24 (GERAN, belongs to RAI-1) is set to "Non-suitable “off” cell".

– system information combination 10 as defined in TS 36.508[18] clause 4.4.3.1 is applied in E-UTRA cells;

– If (px_RATComb_Tested = EUTRA_Only):

– neither cell 9 nor cell 24 is configured;

– system information combination 1 as defined in TS 36.508[18] clause 4.4.3.1 is applied in E-UTRA cells;

UE:

– the UE is configured to initiate EPS attach.

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell G according to TS 36.508 [18].

9.2.3.1.15.3.2 Test procedure sequence

Table 9.2.3.1.15.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of cell G to the ”Non-Suitable cell”. Set the cell type of cell H to the ”Serving cell”. Note: cell G and cell H are in the same PLMN.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST on Cell H.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE REJECT message with EMM cause = ”PLMN not allowed”.	<–	TRACKING AREA UPDATE REJECT	–	–
4	The SS releases the RRC connection.	–	–	–	–
5	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on cell H?	–>	ATTACH REQUEST	1	F
6	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
7	Set the cell type of cell G to the ”Serving cell”. Set the cell type of cell H to the ”Non-Suitable cell”. Note: cell G and cell H are in the same PLMN.	–	–	–	–
8	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
9	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds on cell G?	–>	ATTACH REQUEST	2	F
10	The user initiates an attach by MMI or by AT command.	–	–	–	–
11	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on cell G?	–>	ATTACH REQUEST	2	F
12	Set the cell type of cell G to the ”Non-Suitable cell”. If px_RATComb_Tested = EUTRA_UTRA set the cell type of cell 9 to the ”Serving cell” or if px_RATComb_Tested = EUTRA_GERAN set cell 24 to the ”Serving cell”. Note: Cell G and Cell 9 or 24 are in the same PLMN.	–	–	–	–
–	EXCEPTION: Steps 13a1 to 13a2 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported	–	–	–	–
13a1	IF pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA OR pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN THEN the user initiates an attach by MMI or by AT command.	–	–	–	–
13a2	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on cell 9 or 24?	–>	ATTACH REQUEST	1	F
14	The following messages are sent and shall be received on cell I.	–	–	–	–
15	If px_RATComb_Tested = EUTRA_UTRA set the cell type of cell 9 to the ”Non-Suitable cell” or if px_RATComb_Tested = EUTRA_GERAN set cell 24 to the ”Non-Suitable cell”. Set the cell type of cell I to the ”Serving cell”, Set the cell type of cell H to the ”Non-Suitable “off” cell”. Note: cell 9 or 24 and cell I are in different PLMNs.	–	–	–	–
16	Check: Does the UE transmit ATTACH REQUEST message with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN?	–>	ATTACH REQUEST	3	P
16A-16Nb1	The attach procedure is completed by executing steps 5 to 18b1 the UE registration procedure in TS 36.508 sub clause 4.5.2.3	–	–	–	–
17-23	Void	–	–	–	–
24	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
–	EXCEPTION: Step 25 describes behaviour that depends on the UE capability.
25	If pc_SwitchOnOff or pc_USIM_Removal then the UE transmits a DETACH REQUEST.	–>	DETACH REQUEST	–	–
26	The following messages are sent and shall be received on cell G.	–	–	–	–
27	Set the cell type of cell G to the ” Serving cell”. Set the cell type of cell I to the ” Non-Suitable cell”. Note: Cell G belongs to the forbidden PLMN.	–	–	–	–
28	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
29	The UE is switched to manual PLMN selection mode and is made to select the forbidden PLMN.	–	–	–	–
30	Check: Does the UE transmit ATTACH REQUEST message with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN?	–>	ATTACH REQUEST	4	P
31-43	The attach procedure is completed by executing steps 5 to 17 of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.3.1.15.3.3 Specific message contents

Table 9.2.3.1.15.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 2, Table 9.2.3.1.15.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Old GUTI	GUTI-7

Table 9.2.3.1.15.3.3-2: Message TRACKING AREA UPDATE REJECT (step 3, Table 9.2.3.1.15.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EMM cause	‘00001011’B	#11 ” PLMN not allowed ”

Table 9.2.3.1.15.3.3-3: Message ATTACH REQUEST (step 16, Table 9.2.3.1.15.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	IMSI
Old P-TMSI signature	Not present
Last visited registered TAI	Not present

Table 9.2.3.1.15.3.3-4: Message ATTACH ACCEPT (step 21, Table 9.2.3.1.15.3.2-1)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark		Comment	Condition
TAI list
Number of elements	‘00000’B
Type of list	’00’B	”list of TACs belonging to one PLMN, with non-consecutive TAC values”
MCC	‘002’B	”TAI-9”
MNC	‘101’B	”TAI-9”
TAC 1	‘1’B	”TAI-9”
GUTI	GUTI-9

Table 9.2.3.1.15.3.3-5: Message ATTACH REQUEST (step 30, Table 9.2.3.1.15.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	GUTI-9
Last visited registered TAI	TAI-9

9.2.3.1.15a Normal tracking area update / Rejected / PLMN not allowed / Single Frequency operation

9.2.3.1.15a.1 Test Purpose (TP)

Same test purpose as in clause 9.2.3.1.15.1

9.2.3.1.15a.2 Conformance requirements

Same conformance requirements as in clause 9.2.3.1.15.2

9.2.3.1.15a.3 Test description

9.2.3.1.15a.3.1 Pre-test conditions

System Simulator:

– Three intra-frequency E-UTRA cells Cell A, Cell B, and Cell C;

– cell A (belongs to TAI-7, visited PLMN, MCC = MCC in USIM MNC=02) and is set to ”Serving cell”;

– cell B (belongs to TAI-8, visited PLMN, MCC = MCC in USIM MNC=02) is set to ”Non-suitable cell";

– cell C (belongs to TAI-9, visited PLMN, MCC=002 MNC=101) is set to ”Non-suitable “off” cell”;

– If (px_RATComb_Tested = EUTRA_UTRA OR px_RATComb_Tested = EUTRA_GERAN);

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 5 (UTRAN, belongs to RAI-1) is set to "Non-suitable “off” cell";

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, cell 24 (GERAN, belongs to RAI-1) is set to "Non-suitable “off” cell".

– system information combination 10 as defined in TS 36.508[18] clause 4.4.3.1 is applied in E-UTRA cells;

– If (px_RATComb_Tested = EUTRA_Only):

– neither cell 5 nor cell 24 is configured;

– system information combination 1 as defined in TS 36.508[18] clause 4.4.3.1 is applied in E-UTRA cells;

UE:

– the UE is configured to initiate EPS attach.

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.1.15a.3.2 Test procedure sequence

Table 9.2.3.1.15a.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of cell A to the ”Non-Suitable cell”. Set the cell type of cell B to the ”Serving cell”. Note: cell A and cell B are in the same PLMN.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST on Cell B.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE REJECT message with EMM cause = ”PLMN not allowed”.	<–	TRACKING AREA UPDATE REJECT	–	–
4	The SS releases the RRC connection.	–	–	–	–
5	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds on cell B?	–>	ATTACH REQUEST	1	F
6	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
7	Set the cell type of cell A to the ”Serving cell”. Set the cell type of cell B to the ”Non-Suitable cell”. Note: cell A and cell B are in the same PLMN.	–	–	–	–
8	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
9	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds on cell A?	–>	ATTACH REQUEST	2	F
10	The user initiates an attach by MMI or by AT command.	–	–	–	–
11	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds on cell A?	–>	ATTACH REQUEST	2	F
12	Set the cell type of cell A to the ”Non-Suitable cell”. If px_RATComb_Tested = EUTRA_UTRA set the cell type of cell 5 to the ”Serving cell” or if px_RATComb_Tested = EUTRA_GERAN set cell 24 to the ”Serving cell”. Note: Cell A and Cell 5 or 24 are in the same PLMN.	–	–	–	–
–	EXCEPTION: Steps 13a1 to 13a2 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported	–	–	–	–
13a1	IF pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA OR pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN THEN the user initiates an attach by MMI or by AT command.	–	–	–	–
13a2	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on cell 5 or 24?	–>	ATTACH REQUEST	1	F
14	The following messages are sent and shall be received on cell C.	–	–	–	–
15	If px_RATComb_Tested = EUTRA_UTRA set the cell type of cell 5 to the ”Non-Suitable cell” or if px_RATComb_Tested = EUTRA_GERAN set cell 24 to the ”Non-Suitable cell”. Set the cell type of cell C to the ”Serving cell”, Set the cell type of cell B to the ”Non-Suitable “off” cell”. Note: cell 5 or 24 and cell C are in different PLMNs.	–	–	–	–
16	Check: Does the UE transmit ATTACH REQUEST message with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN?	–>	ATTACH REQUEST	3	P
16A-16Nb1	The attach procedure is completed by executing steps 5 to 18b1 the UE registration procedure in TS 36.508 sub clause 4.5.2.3	–	–	–	–
17-23	Void	–	–	–	–
24	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
–	EXCEPTION: Step 25 describes behaviour that depends on the UE capability.
25	If pc_SwitchOnOff or pc_USIM_Removal then the UE transmits a DETACH REQUEST.	–>	DETACH REQUEST	–	–
26	The following messages are sent and shall be received on cell A.	–	–	–	–
27	Set the cell type of cell A to the ” Serving cell”. Set the cell type of cell C to the ” Non-Suitable cell”. Note: Cell A belongs to the forbidden PLMN.	–	–	–	–
28	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
29	The UE is switched to manual PLMN selection mode and is made to select the forbidden PLMN.	–	–	–	–
30	Check: Does the UE transmit ATTACH REQUEST message with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN?	–>	ATTACH REQUEST	4	P
31-42	The attach procedure is completed by executing steps 5 to 17 of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.3.1.15a.3.3 Specific message contents

Same specific message contents as in clause 9.2.3.1.15.3.3

9.2.3.1.16 Normal tracking area update / Rejected / Tracking area not allowed

9.2.3.1.16.1 Test Purpose (TP)

(1)

with { UE has sent a TRACKING AREA UPDATE REQUEST message}

ensure that {

when { UE receives a TRACKING AREA UPDATE REJECT message with the reject cause set to ”Tracking area not allowed ” }

then { shall delete any GUTI, last visited registered TAI, TAI list and KSI. The UE shall reset the tracking area updating attempt counter and shall enter the state EMM-DEREGISTERED.LIMITED-SERVICE and store the current TAI in the list of "forbidden tracking areas for regional provision of service" }

(2)

with { UE is in EMM-DEREGISTERED.LIMITED-SERVICE state and has a TAI in the list of "forbidden tracking areas for regional provision of service"}

ensure that {

when { UE is in the serving cell which the UE is rejected }

then { UE does not attempt an attach procedure on any other cell}

}

(3)

with { UE is in EMM-DEREGISTERED.LIMITED-SERVICE state and the current TAI in the list of "forbidden tracking areas for regional provision of service"}

ensure that {

when { UE enters a new cell in the same TAI it was rejected }

then { UE does not initiate an attach procedure}

}

(4)

with { UE is in EMM-DEREGISTERED.LIMITED-SERVICE state and the current TAI in the list of "forbidden tracking areas for regional provision of service"}

ensure that {

when { UE enters a new cell with different TAI without in the list of "forbidden tracking areas for regional provision of service"}

then { UE initiates attach procedure with IMSI }

}

(5)

with { UE is switched off }

ensure that {

when { UE is powered on and enters the cell with "forbidden tracking areas for regional provision of service" before the UE was switched off }

then { UE initiates attach procedure on the cell }

9.2.3.1.16.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 24.301 clauses 5.5.3.2.5.

[TS 24.301 clause5.5.3.2.5]

If the tracking area updating cannot be accepted by the network, the MME sends a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value.

Upon receiving the TRACKING AREA UPDATE REJECT message, the UE shall stop timer T3430, stop any transmission of user data, and take the following actions depending on the EMM cause value received.

…

#12 (Tracking area not allowed);

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and KSI. The UE shall reset the tracking area updating attempt counter and shall enter the state EMM-DEREGISTERED.LIMITED-SERVICE.

The UE shall store the current TAI in the list of "forbidden tracking areas for regional provision of service".

If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and routing area updating attempt counter as specified in 3GPP TS 24.008 [13] for the case when the normal routing area updating procedure is rejected with the GMM cause with the same value.

9.2.3.1.16.3 Test description

9.2.3.1.16.3.1 Pre-test conditions

System Simulator:

– cell A (belong to TAI-1, home PLMN) are set to ”Non-suitable cell’;’

– cell B (belongs to TAI-2, home PLMN) is set to ”Serving cell”;

– cell C (belongs to TAI-3, visited PLMN) is set to ”Non-suitable cell”;

– cell M (belongs to TAI-1, home PLMN) are set to ”Non-suitable “off" cell”

UE:

– The UE is configured to initiate EPS attach.

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell B according to TS 36.508 [18].

9.2.3.1.16.3.2 Test procedure sequence

Table 9.2.3.1.16.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of cell A to ”Serving cell”. Set the cell type of cell B to ”Non-Suitable cell”. Set the cell type of cell C to ”Suitable neighbour intra-frequency cell”.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST on Cell A.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE REJECT message with EMM cause = ”Tracking area not allowed” as specified.	<–	TRACKING AREA UPDATE REJECT	–	–
4	The SS releases the RRC connection.	–	–	–	–
5	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds on cell C?	–>	ATTACH REQUEST	2	F
5A	Set the cell type of cell B to the ”Non-Suitable “off" cell”. Set the cell type of cell M to the ” Non-Suitable cell ”. Set the cell type of cell C to the ” Non-Suitable cell ”.
6	The user initiates an attach by MMI or by AT command.	–	–	–	–
7	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds on cell A?	–>	ATTACH REQUEST	1	F
8	Set the cell type of cell A to the ” Non-Suitable cell ”. Set the cell type of cell M to the ”Serving cell”.	–	–	–	–
9	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds on cell M?	–>	ATTACH REQUEST	3	F
10	Set the cell type of cell C to the ”Serving cell”. Set the cell type of cell M to the ”Non-Suitable cell ”.	–	–	–	–
11	Check: Does the UE transmit an ATTACH REQUEST on cell C including a PDN CONNECTIVITY REQUEST message including a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	4	P
11A-11Nb1	The attach procedure is completed by executing steps 5 to 18b1 the UE registration procedure in TS 36.508 sub clause 4.5.2.3	–	–	–	–
12-18	Void
19	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
–	EXCEPTION: Step 20 describes behaviour that depends on the UE capability.
20	If pc_SwitchOnOff or pc_USIM_Removal then the UE transmits a DETACH REQUEST.	–>	DETACH REQUEST	–	–
21	The following messages are sent and shall be received on cell A.	–	–	–	–
22	Set the cell type of cell A to the ” Serving cell”. Set the cell type of cell C to the ” Non-Suitable cell”.	–	–	–	–
23	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
24	The UE transmits ATTACH REQUEST message with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN.	–>	ATTACH REQUEST	5	P
25-38b1	The attach procedure is completed executing steps 5 to 18b1 of the UE registration procedure in TS 36.508 clause 4.5.2.3	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.3.1.16.3.3 Specific message contents

Table 9.2.3.1.16.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 2, Table 9.2.3.1.16.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Old GUTI	GUTI-7

Table 9.2.3.1.16.3.3-2: Message TRACKING AREA UPDATE REJECT (step 3, Table 9.2.3.1.16.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EMM cause	‘00001100’B	#12 ”Tracking area not allowed”

Table 9.2.3.1.16.3.3-3: Message ATTACH REQUEST (step 11, Table 9.2.3.1.16.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	IMSI
Last visited registered TAI	Not present

Table 9.2.3.1.16.3.3-4: Message ATTACH ACCEPT (step 16, Table 9.2.3.1.16.3.2-1)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark		Comment	Condition
TAI list
Number of elements	‘00000’B
Type of list	’00’B	”list of TACs belonging to one PLMN, with non-consecutive TAC values”
MCC MNC TAC 1	PLMN= MCC/02 TAC 1=1	”MCC is set to the same MCC stored in EF_IMSI” ”TAI-7”
GUTI	GUTI-7

Table 9.2.3.1.16.3.3-5: Message ATTACH REQUEST (step 24, Table 9.2.3.1.16.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	GUTI-7
Last visited registered TAI	TAI-7

9.2.3.1.17 Normal tracking area update / Rejected / Roaming not allowed in this tracking area

9.2.3.1.17.1 Test Purpose (TP)

(1)

with { the UE has sent TRACKING AREA UPDATE REQUEST message }

ensure that {

when { the UE receives TRACKING AREA UPDATE REJECT message with the reject cause set to "roaming not allowed in this tracking area" }

then { the UE sets the EPS update status to EU3 ROAMING NOT ALLOWED and the UE deletes the last visited registered TAI and the UE enters the state EMM-REGISTERED.PLMN-SEARCH and the UE stores the current TAI in the list of "forbidden tracking areas for roaming" }

}

(2)

with { the UE is in EMM-REGISTERED.PLMN-SEARCH state and the current TAI in the list of "forbidden tracking areas for roaming"}

ensure that {

when { the serving cell belongs to TAI where UE was rejected }

then { the UE does not attempt to send TRACKING AREA UPDATE REQUEST message }

}

(3)

with { the UE is in EMM-REGISTERED.PLMN-SEARCH state and the TAI of the current cell belongs to the list of "forbidden tracking areas for roaming"}

ensure that {

when { the UE enters a cell belonging to same PLMN and TAI not in the list of "forbidden tracking areas for roaming"}

then { the UE sends TRACKING AREA UPDATE REQUEST message }

}

(4)

with { the UE is in EMM-REGISTERED.PLMN-SEARCH state and the TAI of the current cell belongs to the list of "forbidden tracking areas for roaming"}

ensure that {

when { the UE enters a cell belonging to another PLMN }

then { the UE sends TRACKING AREA UPDATE REQUEST message }

}

(5)

with { the UE, which A/Gb mode or Iu mode is supported by the UE, in EMM-DEREGISTERED.PLMN-SEARCH state and the list of "forbidden tracking areas for roaming" contains more than one TAI }

ensure that {

when { the UE move to UTRAN or GERAN cell }

then { the UE sends ROUTING AREA UPDATE REQUEST message }

9.2.3.1.17.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.3.2.5.

[TS 24.301, clause 5.5.3.2.5]

If the tracking area updating cannot be accepted by the network, the MME sends a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value.

Upon receiving the TRACKING AREA UPDATE REJECT message, the UE shall stop timer T3430, stop any transmission of user data, and take the following actions depending on the EMM cause value received.

…

#13 (Roaming not allowed in this tracking area);

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete the list of equivalent PLMNs. The UE shall reset the tracking area updating attempt counter and shall change to state EMM-REGISTERED.PLMN-SEARCH.

The UE shall store the current TAI in the list of "forbidden tracking areas for roaming" and shall remove the current TAI from the stored TAI list if present.

The UE shall perform a PLMN selection according to 3GPP TS 23.122 [6].

If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM parameters GMM state, GPRS update status and routing area updating attempt counter as specified in 3GPP TS 24.008 [13] for the case when the normal routing area updating procedure is rejected with the GMM cause with the same value.

…

9.2.3.1.17.3 Test description

9.2.3.1.17.3.1 Pre-test conditions

System Simulator:

– cell K(belongs to TAI-9, visited PLMN) is set to ”Serving cell”;

– cell L(belongs to TAI-11, same visited PLMN) is set to ”Non-suitable cell”;

– If (px_SinglePLMN_Tested = Multi PLMN) cell J (belongs to TAI-10, another visited PLMN) is set to ”Non-suitable “off” cell”;

– If (px_RATComb_Tested = EUTRA_UTRA OR px_RATComb_Tested = EUTRA_GERAN) ;

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 9 (belongs to RAI-8, visited PLMN) is set to "Non-suitable “off” cell";

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, cell 24 (belongs to RAI-8, visited PLMN) is set to "Non-suitable “off” cell";

– system information indicate that NMO 1 is used;

– system information combination 10 as defined in TS 36.508[18] clause 4.4.3.1 is applied in E-UTRA cells;

– If (px_RATComb_Tested = EUTRA_Only):

– neither cell 9 nor cell 24 is configured;

– system information combination 1 as defined in TS 36.508[18] clause 4.4.3.1 is applied in E-UTRA cells;

UE:

– the UE is configured to initiate EPS attach.

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell K according to TS 36.508 [18].

9.2.3.1.17.3.2 Test procedure sequence

Table 9.2.3.1.17.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of cell K to the ” Suitable neighbour intra-frequency cell ”. Set the cell type of cell L to the ”Serving cell”.	–	–	–	–
2	The UE transmits TRACKING AREA UPDATE REQUEST on Cell L.	–>	TRACKING AREA UPDATE REQUEST	–	–
2A	Set the cell type of cell K to the ”Serving cell”. Set the cell type of cell L to the “Suitable neighbour intra-frequency cell”.
3	The SS transmits a TRACKING AREA UPDATE REJECT message with EMM cause = ”Roaming not allowed in this tracking area” as specified.	<–	TRACKING AREA UPDATE REJECT	–	–
4	The SS releases the RRC connection.
5	Void	–	–	–	–
6	Void	–	–	–	–
7	Check: Does the UE transmit TRACKING AREA UPDATE REQUEST message on cell K?	–>	TRACKING AREA UPDATE REQUEST	1, 3	P
8	The SS transmits TRACKING AREA UPDATE REJECT message with EMM cause = ”Roaming not allowed in this tracking area” as specified.	<–	TRACKING AREA UPDATE REJECT	–	–
9	The SS releases the RRC connection.
10	Set the cell type of cell K to the ”Non-Suitable cell”. If present, set the cell type of cell 9 or 24 to the ”Serving cell”. Note: Cell K and cell 9 or 24 are in the same PLMN.	–	–	–	–
	EXCEPTION: Steps 11a1 to 11a3 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported
11a1	Check: Does the UE transmit ROUTING AREA UPDATE REQUEST message on cell 9 or 24?	–>	ROUTING AREA UPDATE REQUEST	5	P
11a2	The SS transmits a ROUTING AREA UPDATE REJECT message with cause = ” Roaming not allowed in this tracking area ” as specified.	<–	ROUTING AREA UPDATE REJECT	–	–
11a3	The SS releases the RRC connection.	–	–	–	–
–	EXCEPTION: Steps 12a1 to 12a4 describe behaviour that depends on the network capability / preference; the "lower case letter" identifies a step sequence that takes place if the network is capable or prefers.	–	–	–	–
12 a1	If (px_SinglePLMN_Tested = Multi PLMN) If present, set the cell type of cell 9 or 24 to the ” Non-Suitable cell”. Set the cell type of cell L to the ”Non-Suitable “off” cell”. Set the cell type of cell J to the ”Serving cell”. Note: cell 9 or 24 and cell J are in different PLMNs.	–	–	–	–
12a2	Check: Does the UE transmit TRACKING AREA REQUEST message on cell J?	–>	TRACKING AREA UPDATE REQUEST	1, 4	P
12a3	The SS sends TRACKING AREA ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
12a4	The UE transmits TRACKING AREA COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	If (px_SinglePLMN_Tested = Multi PLMN): At the end of this test procedure sequence, the UE is in end state E-UTRA connected (E2_T3440) according to TS 36.508. Else: At the end of this test procedure sequence, the UE is in end state E-UTRA deregistered (E4) according to TS 36.508.	–	–	–	–

9.2.3.1.17.3.3 Specific message contents

Table 9.2.3.1.17.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 2, 7 and 12a2, Table 9.2.3.1.17.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Old GUTI	GUTI-9

Table 9.2.3.1.17.3.3-2: TRACKING AREA UPDATE REJECT (step 3 and 8, Table 9.2.3.1.17.3.2-1)

Derivation Path: 36.508, Table 4.7.2-26
Information Element	Value/remark	Comment	Condition
EMM cause	‘0000 1101’B	Roaming not allowed in this tracking area

9.2.3.1.18 Normal tracking area update / Rejected / EPS services not allowed in this PLMN

9.2.3.1.18.1 Test Purpose (TP)

(1)

with { UE has sent a TRACKING AREA UPDATE REQUEST message}

ensure that {

when { UE receives a TRACKING AREA UPDATE REJECT message with the reject cause set to ‘EPS services not allowed in this PLMN’ }

then { UE deletes the GUTI, the last visited registered TAI and KSI and UE deletes the list of equivalent PLMNs and UE enters state EMM-DEREGISTERED.PLMN-SEARCH and UE stores the PLMN in the "forbidden PLMNs for GPRS service" }

(2)

with { UE in E-UTRA EMM-DEREGISTERED.PLMN-SEARCH state and a PLMN is stored in the "forbidden PLMNs for GPRS service" }

ensure that {

when { UE enters a cell which is in the "forbidden PLMNs for GPRS service" }

then { UE doesn’t perform an attach procedure }

}

(3)

with { UE in EMM-DEREGISTERED.PLMN-SEARCH state and a PLMN is stored in the "forbidden PLMNs for GPRS service" }

ensure that {

when { UE enters a cell which is not in the "forbidden PLMNs for GPRS service" }

then { UE initiates an attach procedure }

}

(4)

with { UE is switched off and a PLMN is stored in the ‘forbidden PLMNs for GPRS service’ }

ensure that {

when { UE is power ON in a cell with forbidden PLMNs for GPRS service }

then { UE initiates an attach procedure }

9.2.3.1.18.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.3.2.5.

[TS 24.301, clause 5.5.3.2.5]

If the tracking area updating cannot be accepted by the network, the MME sends a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value.

Upon receiving the TRACKING AREA UPDATE REJECT message, the UE shall stop timer T3430, stop any transmission of user data, and take the following actions depending on the EMM cause value received.

…

#14 (EPS services not allowed in this PLMN);

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3). Furthermore the UE shall delete any GUTI, last visited registered TAI, TAI list and KSI. The UE shall reset the tracking area updating attempt counter and shall enter the state EMM-DEREGISTERED.PLMN-SEARCH.

The UE shall store the PLMN identity in the "forbidden PLMNs for GPRS service" list.

The UE shall perform a PLMN selection according to 3GPP TS 23.122 [6].

If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and routing area updating attempt counter as specified in 3GPP TS 24.008 [13] for the case when the normal routing area updating procedure is rejected with the GMM cause with the same value.

…

9.2.3.1.18.3 Test description

9.2.3.1.18.3.1 Pre-test conditions

System Simulator:

– cell G belongs to TAI-7(visited PLMN) and is set to ”Serving cell”;

– cell H belongs to TAI-8(visited PLMN, another TAC) and is set to ”Non-suitable cell”;

– cell I belongs to TAI-9(visited PLMN, another PLMN) and is set to ”Non-suitable “off” cell”;

– the cells are configured according to Table 6.3.2.2-1 and Table 6.3.2.2-3 in36.508[18], except replacing f3 with f1;

– If (px_RATComb_Tested = EUTRA_UTRA OR px_RATComb_Tested = EUTRA_GERAN);

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 9 (belongs to RAI-8, visited PLMN) is set to "Non-suitable “off” cell";

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, cell 24 (belongs to RAI-8, visited PLMN) is set to "Non-suitable “off” cell";

– system information combination 10 as defined in TS 36.508[18] clause 4.4.3.1 is applied in E-UTRA cells;

– system information indicate that NMO 1 is used;

– If (px_RATComb_Tested = EUTRA_Only):

– neither cell 9 nor cell 24 is configured;

– system information combination 1 as defined in TS 36.508[18] clause 4.4.3.1 is applied in E-UTRA cells;

UE:

– the UE is configured to initiate EPS attach.

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell G according to TS 36.508 [18].

9.2.3.1.18.3.2 Test procedure sequence

Table 9.2.3.1.18.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of cell G to the ”Non-Suitable cell”. Set the cell type of cell H to the ”Serving cell”.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST on Cell H.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE REJECT message with EMM cause = ”EPS services not allowed in this PLMN” as specified.	<–	TRACKING AREA UPDATE REJECT	–	–
4	The SS releases the RRC connection.	–	–	–	–
5	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on cell H?	–>	ATTACH REQUEST	1	F
6	Set the cell type of cell G to the ”Serving cell”. Set the cell type of cell H to the ”Non-Suitable cell”. Note: cell G and cell H are in the same PLMN.	–	–	–	–
7	The user initiates an attach by MMI or by AT command.	–	–	–	–
8	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on cell G?	–>	ATTACH REQUEST	2	F
9	Set the cell type of cell G to the ”Non-Suitable cell”. Set the cell type of cell H to the ”Non-Suitable “off” cell”. If px_RATComb_Tested = EUTRA_UTRA set the cell type of cell 9 to the ”Serving cell” or if px_RATComb_Tested = EUTRA_GERAN set cell 24 to the ”Serving cell”. Note: Cell G and Cell 9 or 24 are in the same PLMN.	–	–	–	–
–	EXCEPTION: Steps 10a1 to 10a2 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported	–	–	–	–
10a1	IF pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA OR pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN THEN the user initiates an attach by MMI or by AT command.	–	–	–	–
–	EXCEPTION: Depending on UE capabilities the behaviour in table 9.2.3.1.18.3.2-2 occurs in parallel with step 10a2.	–	–	–	–
10a2	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on cell 9 or 24?	–>	ATTACH REQUEST	1	F
–	The following messages are sent and shall be received on cell I.	–	–	–	–
11	If px_RATComb_Tested = EUTRA_UTRA set the cell type of cell 9 to the ”Non-Suitable cell’ or if px_RATComb_Tested = EUTRA_GERAN set cell 24 to the ”Non-Suitable cell”. Set the cell type of cell I to the ”Serving cell”. Note: cell 9 or 24 and cell I are in different PLMNs.	–	–	–	–
12	Check: Does the UE send ATTACH REQUEST message with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN?	–>	ATTACH REQUEST	3	P
12A-12Nb1	The attach procedure is completed by executing steps 5 to 18b1 the UE registration procedure in TS 36.508 sub clause 4.5.2.3	–	–	–	–
13-20	Void	–	–	–	–
21	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
–	EXCEPTION: Step 22 describes behaviour that depends on the UE capability.	–	–	–	–
22	If pc_SwitchOnOff or pc_USIM_Removal then the UE transmits a DETACH REQUEST.	–>	DETACH REQUEST	–	–
–	The following messages are sent and shall be received on cell G.	–	–	–	–
23	Set the cell type of cell G to the ” Serving cell”. Set the cell type of cell I to the ” Non-Suitable cell”. Note: Cell G belongs to the forbidden PLMNs for GPRS service.	–	–	–	–
24	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
25	Check: Does the UE send ATTACH REQUEST message with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN?	–>	ATTACH REQUEST	4	P
26-39b137	The attach procedure is completed by executing steps 5 to 18b1 of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

Table 9.2.3.1.18.3.2-2: Parallel behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
–	EXCEPTION: Steps 1a1-1a 5 describe a behaviour which depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported.	–	–	–	–
1a1	IF pc_CS THEN the UE transmits a LOCATION UPDATING REQUEST message.	–>	LOCATION UPDATING REQUEST	–	–
–	EXCEPTION: The messages in the next two steps are sent only IF pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN	–	–	–	–
1a2a1	The UE transmits a Classmark Change message	–>	CLASSMARK CHANGE	–	–
1a2a2	IF pc_UTRA THEN the UE transmits a Utran Classmark Change message.	–>	UTRAN CLASSMARK CHANGE.	–	–
1a3	The SS transmits an AUTHENTICATION REQUEST message to initiate the authentication and AKA procedure.	<–	AUTHENTICATION REQUEST	–	–
1a4	The UE transmits an AUTHENTICATION RESPONSE message.	–>	AUTHENTICATION RESPONSE	–	–
1a5	The SS transmits a LOCATION UPDATING ACCEPT message including IMSI-1	<–	LOCATION UPDATING ACCEPT	–	–

9.2.3.1.18.3.3 Specific message contents

Table 9.2.3.1.18.3.3-1: Void

Table 9.2.3.1.18.3.3-2: Message TRACKING AREA UPDATE REJECT (step 3, Table 9.2.3.1.18.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EMM cause	‘0000 1110’B	#14 ”EPS services not allowed in this PLMN”

Table 9.2.3.1.18.3.3-3: Message ATTACH REQUEST (step 12, Table 9.2.3.1.18.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	IMSI
Last visited registered TAI	Not present

Table 9.2.3.1.18.3.3-4: Message ATTACH ACCEPT (step 18, Table 9.2.3.1.18.3.2-1)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark		Comment	Condition
TAI list
Number of elements	‘00000’B
Type of list	’00’B	”list of TACs belonging to one PLMN, with non-consecutive TAC values”
MCC MNC TAC 1	PLMN= 002/101 TAC 1=1	”TAI-9”
GUTI	GUTI-9

Table 9.2.3.1.18.3.3-5: Message ATTACH REQUEST (step 25, Table 9.2.3.1.18.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	GUTI-9
Last visited registered TAI	TAI-9

Table 9.2.3.1.18.3.3-6: LOCATION UPDATING ACCEPT (step 5, Table 9.2.3.1.18.3.2-2)

Derivation Path: TS 36.508 Table 4.7B.2-5
Information Element	Value/remark	Comment	Condition
Mobile identity
IMSI	IMSI-1

9.2.3.1.18a Normal tracking area update / Rejected / EPS services not allowed in this PLMN / Single Frequency operation

9.2.3.1.18a.1 Test Purpose (TP)

Same test purpose as in clause 9.2.3.1.18.1

9.2.3.1.18a.2 Conformance requirements

Same conformance requirements as in clause 9.2.3.1.18.2

9.2.3.1.18a.3 Test description

9.2.3.1.18a.3.1 Pre-test conditions

System Simulator:

– Three intra-frequency E-UTRA cells Cell A, Cell B, and Cell C;

– cell A belongs to TAI-7(visited PLMN, MCC = MCC in USIM MNC=02) and is set to ”Serving cell”;

– cell B belongs to TAI-8(visited PLMN, MCC = MCC in USIM MNC=02 another TAC) and is set to ”Non-suitable cell”;

– cell C belongs to TAI-9(visited PLMN, MCC=002 MNC=101) and is set to ”Non-suitable “off” cell”;

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 5 (belongs to RAI-8, visited PLMN) is set to "Non-suitable “off” cell";

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, cell 24 (belongs to RAI-8, visited PLMN) is set to "Non-suitable “off” cell";

– system information combination 10 as defined in TS 36.508[18] clause 4.4.3.1 is applied in E-UTRA cells;

– system information indicate that NMO 1 is used;

– If (px_RATComb_Tested = EUTRA_Only):

– neither cell 5 nor cell 24 is configured;

– system information combination 1 as defined in TS 36.508[18] clause 4.4.3.1 is applied in E-UTRA cells;

UE:

– the UE is configured to initiate EPS attach.

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.1.18a.3.2 Test procedure sequence

Table 9.2.3.1.18a.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of cell A to the ”Non-Suitable cell”. Set the cell type of cell B to the ”Serving cell”.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST on Cell B.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE REJECT message with EMM cause = ”EPS services not allowed in this PLMN” as specified.	<–	TRACKING AREA UPDATE REJECT	–	–
4	The SS releases the RRC connection.
5	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds on cell B?	–>	ATTACH REQUEST	1	F
6	Set the cell type of cell A to the ”Serving cell”. Set the cell type of cell B to the ”Non-Suitable cell”. Note: cell A and cell B are in the same PLMN.	–	–	–	–
7	The user initiates an attach by MMI or by AT command.	–	–	–	–
8	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds on cell A?	–>	ATTACH REQUEST	2	F
9	Set the cell type of cell A to the ”Non-Suitable cell”. Set the cell type of cell B to the ”Non-Suitable “off” cell”. If px_RATComb_Tested = EUTRA_UTRA set the cell type of cell 5 to the ”Serving cell” or if px_RATComb_Tested = EUTRA_GERAN set cell 24 to the ”Serving cell”. Note: Cell A and Cell 5 or 24 are in the same PLMN.	–	–	–	–
	EXCEPTION: Steps 10a1 to 10a2 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported
10a1	IF pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA OR pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN THEN the user initiates an attach by MMI or by AT command.	–	–	–	–
–	EXCEPTION: Depending on UE capabilities the behaviour in table 9.2.3.1.18a.3.2-2 occurs in parallel with step 10a2
10a2	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on cell 5 or 24?	–>	ATTACH REQUEST	1	F
	The following messages are sent and shall be received on cell C.	–	–	–	–
11	If px_RATComb_Tested = EUTRA_UTRA set the cell type of cell 5 to the ”Non-Suitable cell’ or if px_RATComb_Tested = EUTRA_GERAN set cell 24 to the ”Non-Suitable cell”. Set the cell type of cell C to the ”Serving cell”. Note: cell 5 or 24 and cell C are in different PLMNs.	–	–	–	–
12	Check: Does the UE send ATTACH REQUEST message with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN?	–>	ATTACH REQUEST	3	P
12A-12Nb1	The attach procedure is completed by executing steps 5 to 18b1 the UE registration procedure in TS 36.508 sub clause 4.5.2.3	–	–	–	–
13-20	Void	–	–	–	–
21	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
–	EXCEPTION: Step 22 describes behaviour that depends on the UE capability.
22	If pc_SwitchOnOff or pc_USIM_Removal then the UE transmits a DETACH REQUEST.	–>	DETACH REQUEST	–	–
	The following messages are sent and shall be received on cell A.
23	Set the cell type of cell A to the ” Serving cell”. Set the cell type of cell C to the ” Non-Suitable cell”. Note: Cell A belongs to the forbidden PLMNs for GPRS service.
24	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
25	Check: Does the UE send ATTACH REQUEST message with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN?	–>	ATTACH REQUEST	4	P
26-39b1	The attach procedure is completed by executing steps 5 to 18b1 of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

Table 9.2.3.1.18a.3.2-2: Parallel behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
–	EXCEPTION: Steps 1a1-1a 5 describe a behaviour which depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported.	–	–	–	–
1a1	IF pc_CS THEN the UE transmits a LOCATION UPDATING REQUEST message.	–>	LOCATION UPDATING REQUEST	–	–
–	EXCEPTION: Steps 1a2a1 to 1a2a2 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported	–	–	–	–
1a2a1	IF pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN THEN the UE transmits a Classmark Change message	–>	CLASSMARK CHANGE	–	–
–	EXCEPTION: Step 1a2a2 describes behaviour that depends on the UE capability.	–	–	–	–
1a2a2	IF pc_UTRA THEN the UE transmits a Utran Classmark Change message.	–>	UTRAN CLASSMARK CHANGE.	–	–
1a3	The SS transmits an AUTHENTICATION REQUEST message to initiate the authentication and AKA procedure.	<–	AUTHENTICATION REQUEST	–	–
1a4	The UE transmits an AUTHENTICATION RESPONSE message.	–>	AUTHENTICATION RESPONSE	–	–
1a5	The SS transmits a LOCATION UPDATING ACCEPT message including IMSI-1	<–	LOCATION UPDATING ACCEPT	–	–

9.2.3.1.18a.3.3 Specific message contents

Same specific message contents as in clause 9.2.3.1.18.3.3

Table 9.2.3.1.18a.3.3-1: LOCATION UPDATING ACCEPT (step 1a5, Table 9.2.3.1.18.3.2-2)

Derivation Path: TS 36.508 Table 4.7B.2-5
Information Element	Value/remark	Comment	Condition
Mobile identity
IMSI	IMSI-1

9.2.3.1.19 Normal tracking area update / Rejected / No suitable cells in tracking Area

9.2.3.1.19.1 Test Purpose (TP)

(1)

with { UE is sending a TRACKING AREA UPDATE REQUEST message}

ensure that {
when { UE receives a TRACKING AREA UPDATE REJECT message with the EMM cause set to ‘No Suitable Cells In tracking area’ }

then { UE selects a suitable cell in another tracking area in the same PLMN and performs the tracking area updating procedure and UE does not select a suitable cell in another PLMN}

}

9.2.3.1.19.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.3.2.5.

[TS 24.301, clause 5.5.3.2.5]

If the tracking area updating cannot be accepted by the network, the MME sends a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value.

Upon receiving the TRACKING AREA UPDATE REJECT message, the UE shall stop timer T3430, stop any transmission of user data, and take the following actions depending on the EMM cause value received.

…

#15 (No suitable cells in tracking area);

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3). The UE shall reset the tracking area updating attempt counter and shall enter the state EMM-REGISTERED.LIMITED-SERVICE.

The UE shall store the current TAI in the list of "forbidden tracking areas for roaming" and shall remove the current TAI from the stored TAI list if present.

The UE shall search for a suitable cell in another tracking area or in another location area in the same PLMN according to 3GPP TS 36.304 [21].

…

9.2.3.1.19.3 Test description

9.2.3.1.19.3.1 Pre-test conditions

System Simulator:

– cell A (belongs to TAI-1, home PLMN) is set to ”Serving cell”;

– cell B (belongs to TAI-2, home PLMN) is set to ”Non-suitable cell”;

– If (px_SinglePLMN_Tested = Multi PLMN) cell G (belongs to TAI-7, visited PLMN) is set to ”Non-suitable cell”.

UE:

– the UE is configured to initiate EPS attach.

Preamble:

– the UE is in state Registered, Idle mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.1.19.3.2 Test procedure sequence

Table 9.2.3.1.19.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of Cell A to the "non-Suitable cell". Set the cell type of Cell B to the "Serving cell". If present, set the cell type of Cell G to the "Serving cell".	–	–	–	–
–	The following messages are sent and shall be received on Cell B.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST message.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE REJECT message with the EMM cause set to ‘No Suitable Cells In tracking area’.	<–	TRACKING AREA UPDATE REJECT	–	–
3A	Set the cell type of Cell A to the " Serving cell ". Set the cell type of Cell B to the "Suitable neighbour Intra Frequency cell".
4	The SS releases the RRC connection.	–	–	–	–
4A	Void
–	The following messages are sent and shall be received on Cell A.	–	–	–	–
5	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	1	P
6	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
7	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA connected (E2_T3440) according to TS 36.508.	–	–	–	–

9.2.3.1.19.3.3 Specific message contents

Table 9.2.3.1.19.3.3-1: TRACKING AREA UPDATE REJECT (step 3, Table 9.2.3.1.19.3.2-1)

Derivation Path: 36.508, Table 4.7.2-26
Information Element	Value/remark	Comment	Condition
EMM cause	‘0000 1111’B	No Suitable Cells In tracking area

Table 9.2.3.1.19.3.3-2: Message TRACKING AREA UPDATE REQUEST (step 5, Table 9.2.3.1.19.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Old GUTI	GUTI-1

9.2.3.1.20 Normal tracking area update / Rejected / Not authorized for this CSG

9.2.3.1.20.1 Test Purpose (TP)

(1)

with { UE has sent a TRACKING AREA UPDATE REQUEST message }

ensure that {

when { UE receives a TRACKING AREA UPDATE REJECT message with the reject cause set to "Not authorized for this CSG" and with integrity protection }

then { UE removes the CSG ID from the Allowed CSG list }

}

(2)

with { UE has sent a TRACKING AREA UPDATE REQUEST message }

ensure that {

when { UE receives a TRACKING AREA UPDATE REJECT message with the reject cause set to "Not authorized for this CSG" and with integrity protection }

then { UE searches for a suitable cell in the same PLMN and sent a TRACKING AREA UPDATE REQUEST message }

}

9.2.3.1.20.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clause 5.5.3.3.5.

[TS 24.301, clause 5.5.3.2.5]

#25 (Not authorized for this CSG);

EMM cause #25 is only applicable when received from a CSG cell. EMM cause #25 received from a non-CSG cell is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.5.3.2.6.

If the TRACKING AREA UPDATE REJECT message with EMM cause #25 was received without integrity protection, then the UE shall discard the message.

If the CSG ID of the cell where the UE has sent the TRACKING AREA UPDATE REQUEST message is contained in the Allowed CSG list, the UE shall remove the entry corresponding to this CSG ID from the Allowed CSG list.

If the CSG ID of the cell where the UE has sent the TRACKING AREA UPDATE REQUEST message is contained in the Operator CSG list, the UE shall apply the procedures defined in 3GPP TS 23.122 [6] subclause 3.1A.

The UE shall search for a suitable cell in the same PLMN according to 3GPP TS 36.304 [21].

9.2.3.1.20.3 Test description

9.2.3.1.20.3.1 Pre-test conditions

System Simulator:

– cell A (TAI-1, frequency 1, HPLMN, not a CSG cell) is set to ”Serving cell”;

– cell B (TAI-2, frequency 1, HPLMN, is a CSG cell) is set to ”Non-suitable off cell”;

– cell D (TAI-4, frequency 1, HPLMN, not a CSG cell) is set to ”Non-suitable off cell”.

– System information combination 1 as defined in TS 36.508[18] clause 4.4.3.1 is used in Cell A and Cell D.

– System information combination 7 as defined in TS 36.508[18] clause 4.4.3.1 is used in Cell B.

UE:

– the UE is previously registered on cell B using either manual CSG selection or a USIM with field EFACSGL preconfigured (so the allowed CSG list includes CSG ID of cell B).

Preamble:

– the UE is in state Registered, Idle mode (state 2) on cell A according to TS 36.508 [18]

9.2.3.1.20.3.2 Test procedure sequence

Table 9.2.3.1.20.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – Cell A as a "Not Suitable cell". – Cell B as a "Serving cell".	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST message.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits an TRACKING AREA UPDATE REJECT message with EMM cause = "Not authorized for this CSG".	<–	TRACKING AREA UPDATE REJECT	–	–
4	The SS releases the RRC connection.	–	–	–	–
5	Check: Does the UE transmit an TRACKING AREA UPDATE REQUEST message on Cell B in the next 30 seconds?	–>	TRACKING AREA UPDATE REQUEST	1	F
6	The SS configures: – Cell A as a "Not Suitable off cell". – Cell B as a "Not Suitable cell". – Cell D as a "Suitable cell".	–	–	–	–
7	Check: Does the UE transmit an TRACKING AREA UPDATE REQUEST message in the next 30 seconds on Cell D?	–>	TRACKING AREA UPDATE REQUEST	2	P
8	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
9	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
9A	The SS releases the RRC connection.	–	–	–	–
10	The SS configures: – Cell A as a "Not Suitable off cell". – Cell B as a " Serving cell". – Cell D as a " Not Suitable cell".	–	–	–	–
11	Check: Does the UE transmit an TRACKING AREA UPDATE REQUEST message in the next 30 seconds on Cell B?	–>	TRACKING AREA UPDATE REQUEST	1	F

9.2.3.1.20.3.3 Specific message contents

Table 9.2.3.1.20.3.3-1: TRACKING AREA UPDATE REQUEST (step 2, Table 9.2.3.1.20.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Old GUTI	GUTI-1
Old P-TMSI signature	P-TMSI Signature-1

Table 9.2.3.1.20.3.3-2: Message TRACKING AREA UPDATE REJECT (step 3, Table 9.2.3.1.20.3.2-1)

Derivation Path: 36.508, Table 4.7.2-26
Information Element	Value/remark	Comment	Condition
EMM cause	‘00011001’B	#25 " Not authorized for this CSG"

Table 9.2.3.1.20.3.3-3: Message TRACKING AREA UPDATE REQUEST (step 7, Table 9.2.3.1.20.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Old GUTI	GUTI-1
Old P-TMSI signature	P-TMSI Signature-1

Table 9.2.3.1.20.3.3-4: SystemInformationBlockType1 for Cell A, B, CD (Pre-test conditions and all steps in Table 9.2.3.1.20.3.2-1)

Derivation Path: 36.508 clause 4.4.3.2
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType1 ::= SEQUENCE {
cellAccessRelatedInfo SEQUENCE {
csg-Indication	TRUE		Cell B
	FALSE		Cell A
	FALSE		Cell CD
csg-Identity	Not present		Cell A
	‘000 0000 0000 0000 0000 0000 0010’B		Cell B
	Not present		Cell CD
}
}

Table 9.2.3.1.20.3.3-4A: SystemInformationBlockType1-BR-r13 for Cell A, B, CD (Pre-test conditions and all steps in Table 9.2.3.1.20.3.2-1 when UE under test is CAT M1)

Derivation Path: 36.508 clause 4.4.3.2, Table 4.4.3.2-3A
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType1-BR-r13 ::= SEQUENCE {
cellAccessRelatedInfo SEQUENCE {
csg-Indication	TRUE		Cell B
	FALSE		Cell A
	FALSE		Cell CD
csg-Identity	Not present		Cell A
	‘000 0000 0000 0000 0000 0000 0010’B		Cell B
	Not present		Cell CD
}
}

Table 9.2.3.1.20.3.3-5: Message TRACKING AREA UPDATE ACCEPT (step 8, Table 9.2.3.1.20.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
GUTI	GUTI-2

Table 9.2.3.1.20.3.3-6: SystemInformationBlockType4 for cell B (Pre-test conditions and all steps, Table 9.2.3.1.20.3.2-1)

Derivation Path: 36.508 clause 4.4.3.3, Table 4.4.3.3-3
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType4 ::= SEQUENCE {
csg-PhysCellIdRange ::= SEQUENCE {
Start	2
Range	Not present	The UE shall apply value 1 in case the field is absent, in which case only the physical cell identity value indicated by start applies.
}
}

9.2.3.1.20a Normal tracking area update / Rejected / Congestion

9.2.3.1.20a.1 Test Purpose (TP)

(1)

with { UE has sent a TRACKING AREA UPDATE REQUEST message}

ensure that {

when { UE receives an integrity protected TRACKING AREA UPDATE REJECT message with the reject cause set to ”Congestion” and the T3346 value IE present }

then { The UE shall abort the tracking area updating procedure, reset the tracking area updating attempt counter and set the EPS update status to EU2 NOT UPDATED. The UE shall also start timer T3346 with the value provided in the T3346 IE as received in the TRACKING AREA UPDATE REJECT message, UE initiates the tracking area updating procedure when timer T3346 expires}

9.2.3.1.20a.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 24.301 clauses 5.5.3.2.5.

[TS 24.301 clause 5.5.3.2.5]

If the tracking area updating cannot be accepted by the network, the MME sends a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value.

If the tracking area update request is rejected due to general NAS level mobility management congestion control, the network shall set the EMM cause value to #22 "congestion" and assign a back-off timer T3346.

Upon receiving the TRACKING AREA UPDATE REJECT message, the UE shall stop timer T3430, stop any transmission of user data, and take the following actions depending on the EMM cause value received.

…

#22 (Congestion);

If the T3346 value IE is present in the TRACKING AREA UPDATE REJECT message and the value indicates that this timer is neither zero nor deactivated, the UE shall proceed as described below, otherwise it shall be considered as an abnormal case and the behaviour of the UE for this case is specified in subclause 5.5.3.2.6.

The UE shall abort the tracking area updating procedure, reset the tracking area updating attempt counter and set the EPS update status to EU2 NOT UPDATED. If the rejected request was not for initiating a PDN connection for emergency bearer services, the UE shall change to state EMM-REGISTERED.ATTEMPTING-TO-UPDATE.

The UE shall stop timer T3346 if it is running.

If the TRACKING AREA UPDATE REJECT message is integrity protected, the UE shall start timer with the value provided in the T3346 value IE.

If the TRACKING AREA UPDATE REJECT message is not integrity protected, the UE shall start timer T3346 with a random value from the default range specified in 3GPP TS 24.008 [13].

The UE stays in the current serving cell and applies the normal cell reselection process. The tracking area updating procedure is started, if still necessary, when timer T3346 expires or is stopped.

9.2.3.1.20a.3 Test description

9.2.3.1.20a.3.1 Pre-test conditions

System Simulator:

– cell A (belongs to TAI-1, home PLMN) is set to ”Serving cell”;

– cell B (belongs to TAI-2, home PLMN) is set to ”Non-suitable cell”;

– System information combination 3 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

UE:

– none

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.1.20a.3.2 Test procedure sequence

Table 9.2.3.1.20a.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of cell A to the ”Non-Suitable cell”. Set the cell type of cell B to the ”Serving cell”.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST on Cell B.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE REJECT message with EMM cause = ” Congestion ” and T3346 IE set to 5 minutes. The UE starts timer T3346 with the value provided in the T3346 value IE	<–	TRACKING AREA UPDATE REJECT	–	–
4	The SS releases the RRC connection.	–	–	–	–
–	The following messages are sent and shall be received on Cell B.	–	–	–	–
5	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message before timer T3346 has expired?	–	–	1	F
6	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message after timer T3346 has expired?	–>	TRACKING AREA UPDATE REQUEST	1	P
7	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
8	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA connected (E2_T3440) according to TS 36.508.	–	–	–	–

9.2.3.1.20a.3.3 Specific message contents

Table 9.2.3.1.20a.3.3-1: Message TRACKING AREA UPDATE REJECT (step 3, Table 9.2.3.1.20a.3.2-1)

Derivation path: 36.508 table 4.7.2-26
Information Element	Value/Remark	Comment	Condition
EMM cause	‘00010110’B	#22 ”Congestion”
T3346 value	00100101’B	5 min

NOTE: This message is sent within SECURITY PROTECTED NAS MESSAGE message.

9.2.3.1.21 Void

9.2.3.1.22 Normal tracking area update / Abnormal case / access barred due to access class control or NAS signalling connection establishment rejected by the network

9.2.3.1.22.1 Test Purpose (TP)

(1)

with { The UE is in the state EMM-REGISTERED }

ensure that {

when { Access is barred for signalling in the cell UE is camping [Access Class barred in System information] }

then { the UE will not initiate the tracking area updating procedure on the current cell }

}

(2)

with { The UE is in the state EMM-REGISTERED }

ensure that {

when { Access is barred for signalling in the cell UE is camping [T302 running due to RRCConnectionReject message reception] }

then { the UE will not initiate the tracking area updating procedure on the current cell }

}

(3)

with { The UE is in the state EMM-REGISTERED }

ensure that {

when { Access is not barred for signalling in the cell UE is camping }

then { the UE will initiate the tracking area updating procedure on the current cell }

}

(4)

with { The UE is in the state EMM-REGISTERED }

ensure that {

when { Access was barred for signalling in the cell and UE has reselected an new cell where access for "signalling" is granted }

then { the UE will initiate the tracking area updating procedure on the new cell }

}

9.2.3.1.22.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clause 5.5.3.2.6 and TS 36.331, clause 5.3.3.2

[TS 24.301, clause 5.5.3.2.6]

The following abnormal cases can be identified:

a) Access barred because of access class barring or NAS signalling connection establishment rejected by the network

If access is barred for "signalling" (see 3GPP TS 36.331 [22]), the tracking area updating procedure shall not be started. The UE stays in the current serving cell and applies the normal cell reselection process. The tracking area updating procedure is started as soon as possible and if still necessary, e.g. when access for "signalling" is granted on the current cell or when the UE moves to a cell where access for "signalling" is granted.

[TS 36.331, clause 5.3.3.2]

…

1> else (the UE is establishing the RRC connection for mobile originating signalling):

2> if timer T302 or T305 is running:

3> consider access to the cell as barred;

2> else if SystemInformationBlockType2 includes the ac-BarringInfo and the ac-BarringForMO-Signalling is present:

3> if the UE has one or more Access Classes, as stored on the USIM, with a value in the range 11..15, which is valid for the UE to use according to TS 22.011 [10] and TS 23.122 [11], and

3> for at least one of these Access Classes the corresponding bit in the ac-BarringForSpecialAC contained in ac-BarringForMO-Signalling is set to zero:

4> consider access to the cell as not barred;

3> else:

4> draw a random number ‘rand‘ uniformly distributed in the range: 0 ≤ rand < 1;

4> if ‘rand‘ is lower than the value indicated by ac-BarringFactor included in ac-BarringForMO-Signalling:

5> consider access to the cell as not barred;

4> else:

5> consider access to the cell as barred;

2> else:

3> consider access to the cell as not barred;

9.2.3.1.22.3 Test description

9.2.3.1.22.3.1 Pre-test conditions

System Simulator:

– cell A and cell B are configured according to table 6.3.2.2-1 in TS 36.508 [18].

– cell A belongs to TAI-1 (home PLMN)

– cell B belongs to TAI-2 (home PLMN)

– cell D belongs to TAI-4 (home PLMN)

UE:

None;

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell B according to TS 36.508 [18].

9.2.3.1.22.3.2 Test procedure sequence

Table 9.2.3.1.22.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS sets the cell type of cell A to the ”Serving cell”, sets the cell type of cell B to the ” Non-Suitable cell”, and sets SystemInformationBlockType2 parameters as described below.	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
2	Check: for 60 seconds if UE initiates the tracking area updating procedure on cell A?	–	–	1	F
3	The SS transmits a Paging message including systemInfoModification.	–	–	–	–
4	The SS changes SystemInformationBlockType2 parameters to default parameters defined in [18].	–	–	–	–
5	The UE transmits RRC Connection Request	–	–	–	–
6	SS responds with RRCConnectionReject message with IE waitTime set to 10 seconds(Max Value).	–	–	–	–
7	Check: for 10 seconds if UE initiates the tracking area updating procedure and hence transmits RRC Connection Request?	–	–	2	F
8	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST?	–>	TRACKING AREA UPDATE REQUEST	3	P
9	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
10	The UE sends TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
10A	The SS releases the RRC connection.	–	–	–	–
11	The SS set SystemInformationBlockType1 and SystemInformationBlockType2 parameters as described below.	–	–	–	–
12	Void	–	–
13	The SS sets the cell type of cell B to the ” serving cell”, cell A to “non-suitable off Cell” , and cell D to “Suitable neighbour intra-frequency cell”.
13A	Check: For 60 seconds if the UE initiates the tracking area update procedure on Cell B?	–	–	1	F
13B	The SS sets the cell type of cell B to “Suitable neighbour intra-frequency cell” and cell D to “serving cell”	–	–	–	–
–	The following messages are to be observed on Cell D unless explicitly stated otherwise.	–	–	–	–
14	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST?	–>	TRACKING AREA UPDATE REQUEST	4	P
15	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
16	The UE sends TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA connected (E2_T3440) according to TS 36.508	–	–	–	–

9.2.3.1.22.3.3 Specific message contents

Table 9.2.3.1.22.3.3-1: SystemInformationBlockType2 for Cell A (step 1, Table 9.2.3.1.22.3.2-1)

Derivation Path: 36.508, Table 4.4.3.3-1
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType2 ::= SEQUENCE {
accessBarringInformation SEQUENCE {
accessBarringForEmergencyCalls	FALSE
accessBarringForSignalling SEQUENCE {
accessProbabilityFactor	p00
accessBarringTime	s4
accessClassBarringList SEQUENCE (SIZE (maxAC)) OF SEQUENCE {	5 entries
accessClassBarring[1]	TRUE
accessClassBarring[2]	TRUE
accessClassBarring[3]	TRUE
accessClassBarring[4]	TRUE
accessClassBarring[5]	TRUE
}
}
accessBarringForOriginatingCalls	Not present
}
}

Table 9.2.3.1.22.3.3-1A: SystemInformationBlockType1 for Cell A (step 4, Table 9.2.3.1.22.3.2-1)

Derivation Path: 36.508, Table 4.4.3.2-3
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType1 ::= SEQUENCE {
systemInfoValueTag	1
}

Table 9.2.3.1.22.3.3-1AA: SystemInformationBlockType1-BR-r13 for Cell A (step 4 when UE under test is CAT-M1, Table 9.2.3.1.22.3.2-1)

Derivation Path: 36.508, Table 4.4.3.2-3A
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType1-BR-r13 ::= SEQUENCE {
systemInfoValueTag	1
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {	Not present
nonCriticalExtension SEQUENCE {			UECAT0
nonCriticalExtension SEQUENCE {
bandwidthReducedAccessRelatedInfo-r13 SEQUENCE {
systemInfoValueTagList-r13 SEQUENCE (SIZE (1..maxSI-Message)) OF	n entries	The same number of entries, and listed in the same order, as in SchedulingInfoList (without suffix)
SystemInfoValueTagSI-r13[1]	SystemInfoValueTagSI-r13[k]=1, where k is the entry corresponding to the system info including SystemInformationBlockType2. For all other entries the value is set to 0 (same as in the default SystemInformationBlockType1-BR-r13 message).
SystemInfoValueTagSI-r13[n]
}
}
}
}
}
}
}

Table 9.2.3.1.22.3.3-2: SystemInformationBlockType2 for Cell B (step 11, Table 9.2.3.1.22.3.2-1)

Derivation Path: 36.508, Table 4.4.3.3-1
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType2 ::= SEQUENCE {
accessBarringInformation SEQUENCE {
accessBarringForEmergencyCalls	FALSE
accessBarringForSignalling SEQUENCE {
accessProbabilityFactor	p00
accessBarringTime	s4
accessClassBarringList SEQUENCE (SIZE (maxAC)) OF SEQUENCE {	5 entries
accessClassBarring[1]	TRUE
accessClassBarring[2]	TRUE
accessClassBarring[3]	TRUE
accessClassBarring[4]	TRUE
accessClassBarring[5]	TRUE
}
}
accessBarringForOriginatingCalls	Not present
}
}

Table 9.2.3.1.22.3.3-3: SystemInformationBlockType1 for Cell B (step 11, Table 9.2.3.1.22.3.2-1)

Derivation Path: 36.508, Table 4.4.3.2-3
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType1 ::= SEQUENCE {
cellAccessRelatedInfo SEQUENCE {
intraFreqReselection	allowed
}
systemInfoValueTag	1
}

Table 9.2.3.1.22.3.3-4: SystemInformationBlockType1-BR-r13 for Cell B (step 11, Table 9.2.3.1.22.3.2-1 when UE under test is CAT-M1)

Derivation Path: 36.508, Table 4.4.3.2-3A
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType1-BR-r13 ::= SEQUENCE {
cellAccessRelatedInfo SEQUENCE {
intraFreqReselection	allowed
}
systemInfoValueTag	1
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {	Not present
nonCriticalExtension SEQUENCE {			UECAT0
nonCriticalExtension SEQUENCE {
bandwidthReducedAccessRelatedInfo-r13 SEQUENCE {
systemInfoValueTagList-r13 SEQUENCE (SIZE (1..maxSI-Message)) OF	n entries	The same number of entries, and listed in the same order, as in SchedulingInfoList (without suffix)
SystemInfoValueTagSI-r13[1]	SystemInfoValueTagSI-r13[k]=1, where k is the entry corresponding to the system info including SystemInformationBlockType2. For all other entries the value is set to 0 (same as in the default SystemInformationBlockType1-BR-r13 message).
SystemInfoValueTagSI-r13[n]
}
}
}
}
}
}
}

9.2.3.1.23 Normal tracking area update / Abnormal case / Success after several attempts due to no network response / TA belongs to TAI list and status is UPDATED / TA does not belong to TAI list or status is not UPDATED

9.2.3.1.23.1 Test Purpose (TP)

(1)

with { UE has sent a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘Periodic updating’ and has the tracking area updating attempt counter set to the value less than four, the TAI of the current serving cell is included in the TAI list and the update status is equal to EU1 UPDATED }

ensure that {
when { UE detects release of the NAS signalling connection }

then { UE keeps the update status to EU1 UPDATED, enters state EMM-REGISTERED.NORMAL-SERVICE and starts timer T3411 }

}

(2)

with { UE has sent a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘Periodic updating’, has the tracking area updating attempt counter set to the value less than four, has detected T3430 expiry, the TAI of the current serving cell is included in the TAI list and the update status is equal to EU1 UPDATED }

ensure that {
when { UE detects T3411 expiry }

then { UE initiates the tracking area updating procedure }

}

(3)

with { UE has sent a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘TA updating’ or ‘combined TA/LA updating’ and has the tracking area updating attempt counter set to the value less than four and the TAI of the current serving cell is not included in the TAI list or the update status is different to EU1 UPDATED }

ensure that {
when { UE detects release of the NAS signalling connection }

then { UE starts timer T3411, sets the update status to EU2 NOT UPDATED and changes to state EMM-REGISTERED.ATTEMPTING-TO-UPDATE }

}

(4)

with { UE has sent a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘TA updating’ or ‘combined TA/LA updating’, has the tracking area updating attempt counter set to the value less than four, has detected T3430 expiry and the TAI of the current serving cell is not included in the TAI list or the update status is different to EU1 UPDATED }

ensure that {
when { UE detects T3411 expiry }

then { UE initiates the tracking area updating procedure }

}

9.2.3.1.23.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.3.1, 5.5.3.2.6 and 5.5.3.3.6.

[TS 24.301, clause 5.5.3.1]

A tracking area updating attempt counter is used to limit the number of subsequently rejected tracking area update attempts. The tracking area updating attempt counter shall be incremented as specified in subclause 5.5.3.2.6. Depending on the value of the tracking area updating attempt counter, specific actions shall be performed. The tracking area updating attempt counter shall be reset when:

– an attach or combined attach procedure is successfully completed;

– a normal or periodic tracking area updating or a combined tracking area updating procedure is successfully completed; or

– a normal or periodic tracking area updating or a combined tracking area updating procedure is rejected with EMM cause #11, #12, #13, #14, #15 or #25.

Additionally the tracking area updating attempt counter shall be reset when the UE is in substate EMM-REGISTERED.ATTEMPTING-TO-UPDATE or EMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM, and:

– a new tracking area is entered; or

– timer T3402 expires.

[TS 24.301, clause 5.5.3.2.6]

The following abnormal cases can be identified:

…

b) Lower layer failure or release of the NAS signalling connection before the TRACKING AREA UPDATE ACCEPT or TRACKING AREA UPDATE REJECT message is received

The tracking area updating procedure shall be aborted, and the UE shall proceed as described below.

c) T3430 timeout

The UE shall abort the procedure and proceed as described below. The NAS signalling connection shall be released locally.

…

For the cases b, c, d, e, and f, the UE shall stop any ongoing transmission of user data.

For the cases b, c and d the UE shall proceed as follows:

Timer T3430 shall be stopped if still running. The tracking area updating attempt counter shall be incremented, unless it was already set to 5.

If the tracking area updating attempt counter is less than 5, and the TAI of the current serving cell is included in the TAI list and the EPS update status is equal to EU1 UPDATED:

– the UE shall keep the EPS update status to EU1 UPDATED and enter state EMM-REGISTERED.NORMAL-SERVICE. The UE shall start timer T3411.

If in addition the TRACKING AREA UPDATE REQUEST indicated "periodic updating", the timer T3411 may be stopped when the UE enters EMM-CONNECTED mode.

If timer T3411 expires the tracking area updating procedure is triggered again.

If the tracking area updating attempt counter is less than 5, and the TAI of the current serving cell is not included in the TAI list or the EPS update status is different to EU1 UPDATED:

– the UE shall start timer T3411, shall set the EPS update status to EU2 NOT UPDATED and change to state EMM-REGISTERED.ATTEMPTING-TO-UPDATE. When timer T3411 expires the tracking area updating procedure is triggered again.

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the GPRS update status as specified in 3GPP TS 24.008 [13] for the abnormal case when a normal or periodic routing area updating procedure fails and the routing area updating attempt counter is less than 5 and the GPRS update status is different from GU1 UPDATED.

[TS 24.301, clause 5.5.3.3.6]

If the tracking area updating attempt counter is incremented according to subclause 5.5.3.2.6 the next actions depend on the value of the tracking area updating attempt counter.

– if the update status is U1 UPDATED and the tracking area updating attempt counter is less than 5, then the UE shall keep the update status to U1 UPDATED, the new MM state is MM IDLE substate NORMAL SERVICE;

– if the tracking area updating attempt counter is less than 5 and, additionally, the update status is different from U1 UPDATED UE shall delete any LAI, TMSI, ciphering key sequence number and list of equivalent PLMNs and set the update status to U2 NOT UPDATED. The MM state remains MM LOCATION UPDATING PENDING; or

– if the tracking area updating attempt counter is equal to 5, the UE shall delete any LAI, TMSI, ciphering key sequence number and list of equivalent PLMNs and set the update status to U2 NOT UPDATED. A UE operating in CS/PS mode 1 of operation shall select GERAN or UTRAN radio access technology and proceed with appropriate MM or GMM specific procedures.

9.2.3.1.23.3 Test description

9.2.3.1.23.3.1 Pre-test conditions

System Simulator:

– cell A and cell B

– System information combination 3 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

UE:

none.

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.3.1.23.3.2 Test procedure sequence

Table 9.2.3.1.23.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of Cell A to the "Serving cell". Set the cell type of Cell B to the "Suitable neighbour intra-frequency cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
2	The UE is powered on or switched on.	–	–	–	–
3-8a2	Void	–	–	–	–
8A1-8A10	Steps 2-11 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed	–	–	–	–
8A	The SS activates UE radio bearer test mode.	–	–	–	–
9	The SS responds with an ATTACH ACCEPT message with the T3412 value indicating 6 min. The ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message is piggybacked in ATTACH ACCEPT message	<–	ATTACH ACCEPT	–	–
10	Void	–	–	–	–
11	Void	–	–	–	–
11A	The UE transmits an RRCConnectionReconfigurationComplete message to confirm the establishment of default bearer.	–>	RRC: RRCConnectionReconfigurationComplete	–	–
11B-11Db1	Steps 16 to 18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
12	Wait for 6 min to ensure that T3412 expires.	–	–	–	–
13	The UE transmits a TRACKING AREA UPDATE REQUEST message with the EPS update type value set to ‘Periodic updating’.	–>	TRACKING AREA UPDATE REQUEST	–	–
14	The SS releases the RRC connection. NOTE: The tracking area updating attempt counter is 1.	–	–	–	–
15	The SS pages the UE using S-TMSI with CN domain indicator set to "PS".	–	–	–	–
16	Check: Does the UE transmit a SERVICE REQUEST message?	–>	SERVICE REQUEST	1	P
17	The SS transmits a SERVICE REJECT message with EMM cause set to "Congestion".	<–	SERVICE REJECT	–	–
18	The SS releases the RRC connection.	–	–	–	–
19	IF pc_ue_CategoryDL_M1 wait for up to 11,25 else wait for 10s after step 14 to ensure that T3411 expires. (Note 2)	–	–	–	–
–	EXCEPTION: Steps 19Aa1 to 19Aa4 describes behaviour depending on UE behaviour; the “lower case letter” identifies a step sequence that take place if the UE does not transmit any TRACKING AREA UPDATE REQUEST message	–	–	–	–
19Aa1	IF the UE does not transmit any TRACKING AREA UPDATE REQUEST message THEN wait for 6 min to ensure that T3412 expires.	–	–	–	–
19Aa2	The UE transmits a TRACKING AREA UPDATE REQUEST message with the EPS update type value set to ‘Periodic updating’.	–>	TRACKING AREA UPDATE REQUEST	–	–
19Aa3	The SS releases the RRC connection.	–	–	–	–
19Aa4	Wait for 10s after step 19Aa3 to ensure that T3411 expires.	–	–	–	–
20	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message with the EPS update type value set to ‘Periodic updating’?	–>	TRACKING AREA UPDATE REQUEST	2	P
21	The SS transmits a TRACKING AREA UPDATE ACCEPT message. NOTE: The tracking area updating attempt counter is reset.	<–	TRACKING AREA UPDATE ACCEPT	–	–
22	The SS releases the RRC connection.	–	–	–	–
22A	Generic test procedure in TS 36.508 subclause 4.5.3A.3 is performed. NOTE: The UE performs the establishment of the new data radio bearer associated with the default EPS bearer context.	–	–	–	–
22B	Generic test procedure in TS 36.508 subclause 4.5.4.3 is performed. NOTE: The UE enters the UE test loop mode.	–	–	–	–
22C	The SS transmits one IP packet to the UE on the DRB associated with the default EPS bearer context.	–	–	–	–
22D	Wait for 1 s after the IP packet has been transmitted in step 22C. (Note 1)	–	–	–	–
22E	The SS releases the RRC connection.	–	–	–	–
23	Set the cell type of Cell A to the "non-Suitable cell". Set the cell type of Cell B to the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
24	The UE transmits a TRACKING AREA UPDATE REQUEST message with the EPS update type value set to ‘TA updating’ or ‘combined TA/LA updating’.	–>	TRACKING AREA UPDATE REQUEST	–	–
24A	Wait for 15s after step 24 to ensure that T3430 expires.	–	–	–	–
25	The SS releases the RRC connection. NOTE: The tracking area updating attempt counter is 1.	–	–	–	–
26	Void	–	–	–	–
27	Check: Does the UE transmit a SERVICE REQUEST message within 5s?	–>	SERVICE REQUEST	3	F
28	Wait for 10s after step 25 to ensure that T3411 expires.	–	–	–	–
29	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message with the EPS update type value set to ‘TA updating’ or ‘combined TA/LA updating’?	–>	TRACKING AREA UPDATE REQUEST	4	P
30	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
–	EXCEPTION: Step 31 and Step 32a1 can occur in any order.	–	–	–	–
31	The UE transmits a TRACKING AREA UPDATE COMPLETE message. NOTE: The tracking area updating attempt counter is reset.	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	EXCEPTION: Step 32a1 describes behaviour that depends on UE implementation; the "lower case letter" identifies a step sequence that takes place if the UE has user data pending.	–	–	–	–
32a1	IF the UE has user data pending THEN the UE loop backs the IP packet received in step 22C on the DRB associated with the default EPS bearer context on Cell B within 5s.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA connected (E2_T3440) according to TS 36.508.	–	–	–	–
Note 1: The 1 second delay is used to secure that the UE have received and forwarded the IP Packet transmitted by the SS in step 22C to the UE test loop function before the RRCConnectionRelease message is sent by the SS in step 22E. Note 2: According to TS 36.331 cl. 5.3.8.3 Cat M1 UEs may start T3411 only 1,25 sec after having received RRC Connection Release. T3411 will therefore elapse in the interval from 9 sec to 12.375 sec.

9.2.3.1.23.3.3 Specific message contents

Table 9.2.3.1.23.3.3-0: ACTIVATE TEST MODE (step 8A, Table 9.2.3.1.23.3.2-1)

Derivation Path: 36.508, Table 4.7A-1, condition UE TEST LOOP MODE B

Table 9.2.3.1.23.3.3-1: Message ATTACH ACCEPT (step 9, Table 9.2.3.1.23.3.2-1)

Derivation Path: 36.508, Table 4.7.2-1
Information Element	Value/remark	Comment	Condition
T3412 value		6 minutes
Timer value	‘0 0001’B
Unit	‘010’B	value is incremented in multiples of decihours
GUTI	GUTI-1

Table 9.2.3.1.23.3.3-2: Message TRACKING AREA UPDATE REQUEST (step 13, step 19Aa2 and step 20, Table 9.2.3.1.23.3.2-1)

Derivation Path: 36.508, Table 4.7.2-27
Information Element	Value/remark	Comment	Condition
EPS update type
EPS update type Value	‘011’B	Periodic updating
Old GUTI	GUTI-1
Last visited registered TAI	TAI-1

Table 9.2.3.1.23.3.3-3: Message TRACKING AREA UPDATE ACCEPT (step 21, Table 9.2.3.1.23.3.2-1)

Derivation Path: 36.508, Table 4.7.2-24
Information Element	Value/remark	Comment	Condition
GUTI	Not present
MS identity	Not present

Table 9.2.3.1.23.3.3-3A: CLOSE UE TEST LOOP (step 22B, Table 9.2.3.1.23.3.2-1)

Derivation Path: 36.508, Table 4.7A-3, condition UE TEST LOOP MODE B
Information Element	Value/remark	Comment	Condition
UE test loop mode B LB setup
IP PDU delay	‘0001 0100’B	20seconds

Table 9.2.3.1.23.3.3-4: Message TRACKING AREA UPDATE REQUEST (step 24, Table 9.2.3.1.23.3.2-1)

Derivation Path: 36.508, Table 4.7.2-27
Information Element	Value/remark	Comment	Condition
Old GUTI	GUTI-1
Last visited registered TAI	TAI-1

Table 9.2.3.1.23.3.3-5: Message TRACKING AREA UPDATE REQUEST (step 29, Table 9.2.3.1.23.3.2-1)

Derivation Path: 36.508, Table 4.7.2-27
Information Element	Value/remark	Comment	Condition
EPS update type
"Active" flag	Any allowed value	The UE may set this flag due to failing SERVICE REQUEST procedure.
Old GUTI	GUTI-1
Last visited registered TAI	TAI-1

Table 9.2.3.1.23.3.3-6: Message TRACKING AREA UPDATE ACCEPT (step 30, Table 9.2.3.1.23.3.2-1)

Derivation Path: 36.508, Table 4.7.2-24
Information Element	Value/remark	Comment	Condition
GUTI	GUTI-2

9.2.3.1.24 Void

9.2.3.1.25 Normal tracking area update / Abnormal case / Failure after 5 attempts due to no network response

9.2.3.1.25.1 Test Purpose (TP)

(1)

with { UE has sent a TRACKING AREA UPDATE REQUEST message and has the tracking area updating attempt counter set to four }

ensure that {
when { UE detects release of the NAS signalling connection }

then { UE starts timer T3402, sets the update status to EU2 NOT UPDATED, changes to state EMM-REGISTERED.ATTEMPTING-TO-UPDATE or optionally to EMM-REGISTERED.PLMN-SEARCH in order to perform a PLMN selection }

}

9.2.3.1.25.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.3.1 and 5.5.3.2.6.

[TS 24.301, clause 5.5.3.1]

– an attach or combined attach procedure is successfully completed;

– a normal or periodic tracking area updating or a combined tracking area updating procedure is successfully completed; or

– a normal or periodic tracking area updating or a combined tracking area updating procedure is rejected with EMM cause #11, #12, #13, #14, #15 or #25.

Additionally the tracking area updating attempt counter shall be reset when the UE is in substate EMM-REGISTERED.ATTEMPTING-TO-UPDATE or EMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM, and:

– a new tracking area is entered; or

– timer T3402 expires.

[TS 24.301, clause 5.5.3.2.6]

The following abnormal cases can be identified:

…

b) Lower layer failure or release of the NAS signalling connection before the TRACKING AREA UPDATE ACCEPT or TRACKING AREA UPDATE REJECT message is received

The tracking area updating procedure shall be aborted, and the UE shall proceed as described below.

…

For the cases b, c, d, e, and f, the UE shall stop any ongoing transmission of user data.

For the cases b, c and d the UE shall proceed as follows:

Timer T3430 shall be stopped if still running. The tracking area updating attempt counter shall be incremented, unless it was already set to 5.

…

If the tracking area updating attempt counter is equal to 5:

– the UE shall start timer T3402, shall set the EPS update status to EU2 NOT UPDATED, shall delete the list of equivalent PLMNs and shall change to state EMM-REGISTERED.ATTEMPTING-TO-UPDATE or optionally to EMM-REGISTERED.PLMN-SEARCH in order to perform a PLMN selection according to 3GPP TS 23.122 [6].

9.2.3.1.25.3 Test description

9.2.3.1.25.3.1 Pre-test conditions

System Simulator:

– Cell A (belongs to TAI-1, PLMN1);

– Cell B (belongs to TAI-2, PLMN1);

– Cell C (belongs to TAI-7, PLMN2);

UE:

– The UE is configured to initiate EPS attach;

Preamble:

– The UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.3.1.25.3.2 Test procedure sequence

Table 9.2.3.1.25.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of Cell A to the "Serving cell". Set the cell type of Cell B to the "non-Suitable cell". Set the cell type of Cell C to the "non-Suitable cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
2	The UE is powered on or switched on.	–	–	–	–
3-8D	Steps 2-11 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
9	SS responds with ATTACH ACCEPT message. The ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message is piggybacked in ATTACH ACCEPT message	<–	ATTACH ACCEPT	–	–
10-11Bb1	Steps 16-18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.	–	–	–	–
12	Wait for 6 min to ensure that T3412 expires.	–	–	–	–
13	The UE transmits a TRACKING AREA UPDATE REQUEST message with the EPS update type value set to ‘Periodic updating’.	–>	TRACKING AREA UPDATE REQUEST	–	–
14	Wait for T3430 and T3411 (25s) expiry (NOTE 1). NOTE 2: The tracking area updating attempt counter is 1.	–	–	–	–
15	The UE transmits a TRACKING AREA UPDATE REQUEST message with the EPS update type value set to ‘Periodic updating’.	–>	TRACKING AREA UPDATE REQUEST	–	–
16	Wait for T3430 and T3411 (25s) expiry (NOTE 1). NOTE 3: The tracking area updating attempt counter is 2.	–	–	–	–
17	The UE transmits a TRACKING AREA UPDATE REQUEST message with the EPS update type value set to ‘Periodic updating’.	–>	TRACKING AREA UPDATE REQUEST	–	–
18	Wait for T3430 and T3411 (25s) expiry (NOTE 1). NOTE 4: The tracking area updating attempt counter is 3.	–	–	–	–
19	The UE transmits a TRACKING AREA UPDATE REQUEST message with the EPS update type value set to ‘Periodic updating’.	–>	TRACKING AREA UPDATE REQUEST	–	–
20	Wait for T3430 and T3411 (25s) expiry (NOTE 1). NOTE 5: The tracking area updating attempt counter is 4.	–	–	–	–
21	The UE transmits a TRACKING AREA UPDATE REQUEST message with the EPS update type value set to ‘Periodic updating’.	–>	TRACKING AREA UPDATE REQUEST	–	–
22	The SS releases the RRC connection. NOTE 6: The tracking area updating attempt counter is 5.	–	–	–	–
23	Wait for 12 min to ensure that T3402 expires.	–	–	–	–
24	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message with the EPS update type value set to ‘TA updating’? NOTE 7: The tracking area updating attempt counter is reset.	–>	TRACKING AREA UPDATE REQUEST	1	P
25	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
26	Set the cell type of Cell A to the "non-Suitable cell". Set the cell type of Cell B to the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
27	The UE transmits a TRACKING AREA UPDATE REQUEST message with the EPS update type value set to ‘TA updating’. NOTE 8: The tracking area updating attempt counter is reset.	–>	TRACKING AREA UPDATE REQUEST	–	–
28	Wait for T3430 and T3411 (25s) expiry (NOTE 1). NOTE 9: The tracking area updating attempt counter is 1.	–	–	–	–
29	The UE transmits a TRACKING AREA UPDATE REQUEST message with the EPS update type value set to ‘TA updating’.	–>	TRACKING AREA UPDATE REQUEST	–	–
30	Wait for T3430 and T3411 (25s) expiry (NOTE 1). NOTE 10: The tracking area updating attempt counter is 2.	–	–	–	–
31	The UE transmits a TRACKING AREA UPDATE REQUEST message with the EPS update type value set to ‘TA updating’.	–>	TRACKING AREA UPDATE REQUEST	–	–
32	Wait for T3430 and T3411 (25s) expiry (NOTE 1). NOTE 11: The tracking area updating attempt counter is 3.	–	–	–	–
33	The UE transmits a TRACKING AREA UPDATE REQUEST message with the EPS update type value set to ‘TA updating’.	–>	TRACKING AREA UPDATE REQUEST	–	–
34	Wait for T3430 and T3411 (25s) expiry (NOTE 1). NOTE 12: The tracking area updating attempt counter is 4.	–	–	–	–
35	The UE transmits a TRACKING AREA UPDATE REQUEST message with the EPS update type value set to ‘TA updating’.	–>	TRACKING AREA UPDATE REQUEST	–	–
36	The SS releases the RRC connection. NOTE 13: The tracking area updating attempt counter is 5 and reset.	–	–	–	–
37	Set the cell type of Cell B to the "non-Suitable cell". Set the cell type of Cell C to the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell C unless explicitly stated otherwise.	–	–	–	–
38	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message with the EPS update type value set to ‘TA updating’?	–>	TRACKING AREA UPDATE REQUEST	1	P
39	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
40	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
41	The SS releases the RRC connection.	–	–	–	–
–	EXCEPTION: Step 42a1 describes optional behaviour that depends on the UE capability.	–	–	–	–
42a1	The UE may attempt the generic test procedure for IMS Re-registration on EPS VPLMN as specified in TS 36.508 [18] subclause 4.5A.30.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA Idle (E1) according to TS 36.508.	–	–	–	–
NOTE 1: If the UE supports CE mode B and UE’s usage setting is not voice centric, T3430 takes a value of 77 sec (see TS 24.301 [28] clause 10.2). Combined with T3411 this gives an expiry value of 87s then.

9.2.3.1.25.3.3 Specific message contents

Table 9.2.3.1.25.3.3-1: Message ATTACH ACCEPT (step 9, Table 9.2.3.1.25.3.2-1)

Derivation Path: 36.508, Table 4.7.2-1
Information Element	Value/remark	Comment	Condition
T3412 value		6 minutes
Timer value	‘0 0001’B
Unit	‘010’B	value is incremented in multiples of decihours
GUTI	GUTI-1

Table 9.2.3.1.25.3.3-2: Message TRACKING AREA UPDATE REQUEST (step 13, step 15, step 17, step 19 and step 21, Table 9.2.3.1.25.3.2-1)

Derivation Path: 36.508, Table 4.7.2-27
Information Element	Value/remark	Comment	Condition
EPS update type
EPS update type Value	‘011’B	Periodic updating
Old GUTI	GUTI-1
Last visited registered TAI	TAI-1

Table 9.2.3.1.25.3.3-3: Message TRACKING AREA UPDATE REQUEST (step 24, step 27, step 29, step 31, step 33, step 35 and step 38, Table 9.2.3.1.25.3.2-1)

Derivation Path: 36.508, Table 4.7.2-27
Information Element	Value/remark	Comment	Condition
EPS update type
EPS update type value	‘000’B	TA updating
Old GUTI	GUTI-1
Last visited registered TAI	TAI-1

Table 9.2.3.1.25.3.3-4: Message TRACKING AREA UPDATE ACCEPT (step 25, Table 9.2.3.1.25.3.2-1)

Derivation Path: 36.508, Table 4.7.2-24
Information Element	Value/remark	Comment	Condition
GUTI	Not present

Table 9.2.3.1.25.3.3-5: Message TRACKING AREA UPDATE ACCEPT (step 39, Table 9.2.3.1.25.3.2-1)

Derivation Path: 36.508, Table 4.7.2-24
Information Element	Value/remark	Comment	Condition
GUTI	GUTI-3

9.2.3.1.26 Normal tracking area update / Abnormal case / TRACKING AREA UPDATE REJECT

9.2.3.1.26.1 Test Purpose (TP)

(1)

with { UE has sent a TRACKING AREA UPDATE REQUEST message}

ensure that {

when { UE receives a TRACKING AREA UPDATE REJECT message with reject cause #95"semantically incorrect message" }

then { the UE sets the tracking area updating attempt counter to 5, starts timer T3402, and performs tracking area updating on the expiry of timers T3402}

(2)

with { UE has sent a TRACKING AREA UPDATE REQUEST message}

ensure that {

when { UE receives a TRACKING AREA UPDATE REJECT message with reject cause #96" invalid mandatory information" }

then { the UE sets the tracking area updating attempt counter to 5, starts timer T3402, and performs tracking area updating on the expiry of timers T3402}

(3)

with { UE has sent a TRACKING AREA UPDATE REQUEST message}

ensure that {

when { UE receives a TRACKING AREA UPDATE REJECT message with reject cause #97"message type non-existent or not implemented" }

then { the UE sets the tracking area updating attempt counter to 5, starts timer T3402, and performs tracking area updating on the expiry of timers T3402}

(4)

with { UE has sent a TRACKING AREA UPDATE REQUEST message}

ensure that {

when { UE receives a TRACKING AREA UPDATE REJECT message with reject cause #99"information element non-existent or not implemented" }

then { the UE sets the tracking area updating attempt counter to 5, starts timer T3402, and performs tracking area updating on the expiry of timers T3402}

(5)

with { UE has sent a TRACKING AREA UPDATE REQUEST message}

ensure that {

when { UE receives a TRACKING AREA UPDATE REJECT message with reject cause #111"protocol error, unspecified" }

then { the UE sets the tracking area updating attempt counter to 5, starts timer T3402, and performs tracking area updating on the expiry of timers T3402}

9.2.3.1.26.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 24.301 clauses 5.5.3.2.6.

[TS 24.301 clause5.5.3.2.6]

…

d) TRACKING AREA UPDATE REJECT, other causes than those treated in subclause 5.5.3.2.5

Upon reception of the EMM causes #95, #96, #97, #99 and #111 the UE should set the tracking area updating attempt counter to 5. The UE shall proceed as described below.

If the tracking area updating attempt counter is equal to 5:

9.2.3.1.26.3 Test description

9.2.3.1.26.3.1 Pre-test conditions

System Simulator:

– cell A.

UE:

– the UE is configured to initiate EPS attach.

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell A according to TS 36.508 [18] except for those shown in table 9.2.3.1.26.3.3-6;

9.2.3.1.26.3.2 Test procedure sequence

Table 9.2.3.1.26.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS waits for T3412 to elapse.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST on Cell A.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE REJECT message with EMM cause #95"semantically incorrect message" as specified. (Note)	<–	TRACKING AREA UPDATE REJECT	–	–
4	The SS releases the RRC connection.	–	–	–	–
5	Check: When the timer T3402 expires does the UE re-transmit TRACKING AREA UPDATE REQUEST message on cell A?	–>	TRACKING AREA UPDATE REQUEST	1	P
6	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
7	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
7A	The SS releases the RRC connection.	–	–	–	–
8	The SS waits for T3412 to elapse.	–	–	–	–
9	The UE transmits a TRACKING AREA UPDATE REQUEST on Cell A.	–>	TRACKING AREA UPDATE REQUEST	–	–
10	The SS transmits a TRACKING AREA UPDATE REJECT message with EMM cause #96" invalid mandatory information" as specified. (Note)	<–	TRACKING AREA UPDATE REJECT	–	–
11	The SS releases the RRC connection.	–	–	–	–
12	Check: When the timer T3402 expires does the UE re-transmit TRACKING AREA UPDATE REQUEST message on cell A?	–>	TRACKING AREA UPDATE REQUEST	2	P
13	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
14	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
14A	The SS releases the RRC connection.	–	–	–	–
15	The SS waits for T3412 to elapse	–	–	–	–
16	The UE transmits a TRACKING AREA UPDATE REQUEST on Cell A.	–>	TRACKING AREA UPDATE REQUEST	–	–
17	The SS transmits a TRACKING AREA UPDATE REJECT message with EMM cause #97"message type non-existent or not implemented". (Note)	<–	TRACKING AREA UPDATE REJECT	–	–
18	The SS releases the RRC connection.	–	–	–	–
19	Check: When the timer T3402 expires does the UE re-transmit TRACKING AREA UPDATE REQUEST message on cell A?	–>	TRACKING AREA UPDATE REQUEST	3	P
20	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
21	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
21A	The SS releases the RRC connection.	–	–	–	–
22	The SS waits for T3412 to elapse.	–	–	–	–
23	The UE transmits a TRACKING AREA UPDATE REQUEST on Cell A.	–>	TRACKING AREA UPDATE REQUEST	–	–
24	The SS transmits a TRACKING AREA UPDATE REJECT message with EMM cause #99"information element non-existent or not implemented" as specified. (Note)	<–	TRACKING AREA UPDATE REJECT	–	–
25	The SS releases the RRC connection.	–	–	–	–
26	Check: When the timer T3402 expires does the UE re-transmit TRACKING AREA UPDATE REQUEST message on cell A?	–>	TRACKING AREA UPDATE REQUEST	4	P
27	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
28	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
28A	The SS releases the RRC connection.	–	–	–	–
29	The SS waits for T3412 to elapse.	–	–	–	–
30	The UE transmits a TRACKING AREA UPDATE REQUEST on Cell A.	–>	TRACKING AREA UPDATE REQUEST	–	–
31	The SS transmits a TRACKING AREA UPDATE REJECT message with EMM cause #111"protocol error, unspecified" as specified. (Note)	<–	TRACKING AREA UPDATE REJECT	–	–
32	The SS releases the RRC connection.	–	–	–	–
33	Check: When the timer T3402 expires does the UE re-transmit TRACKING AREA UPDATE REQUEST message on cell A?	–>	TRACKING AREA UPDATE REQUEST	5	P
34	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
35	the UE transmit a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA connected (E2_T3440) according to TS 36.508.	–	–	–	–
Note: Upon reception of TRACKING AREA UPDATE REJECT message with EMM causes #95, #96, #97, #99 and #111, timer T3402 shall be started.

9.2.3.1.26.3.3 Specific message contents

Table 9.2.3.1.26.3.3-1: Message TRACKING AREA UPDATE REJECT (step 3, Table 9.2.3.1.26.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EMM cause	01011111	#95 "semantically incorrect message "

Table 9.2.3.1.26.3.3-2: Message TRACKING AREA UPDATE REJECT (step 10, Table 9.2.3.1.26.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EMM cause	01100000	#96 " invalid mandatory information "

Table 9.2.3.1.26.3.3-3: Message TRACKING AREA UPDATE REJECT (step 17, Table 9.2.3.1.26.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EMM cause	01100001	#97 " message type non-existent or not implemented "

Table 9.2.3.1.26.3.3-4: Message TRACKING AREA UPDATE REJECT (step 24, Table 9.2.3.1.26.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EMM cause	01100011	#99 " information element non-existent or not implemented "

Table 9.2.3.1.26.3.3-5: Message TRACKING AREA UPDATE REJECT (step 31, Table 9.2.3.1.26.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EMM cause	01101111	#111 " protocol error, unspecified "

Table 9.2.3.1.26.3.3-6: Message ATTACH ACCEPT (For the UE registration procedure in TS 36.508 clause 4.5.2.3)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark	Comment	Condition
T3412 value		1 minute
Timer value	‘00001’B
Unit	‘001’B
T3402 value		30 seconds
Timer value	‘01111’B
Unit	‘000’B

Table 9.2.3.1.26.3.3-7: Message TRACKING AREA UPDATE ACCEPT (steps 6,13,20,27,34, Table 9.2.3.1.26.3.2-1)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark	Comment	Condition
T3412 value		1 minute
Timer value	‘00001’B
Unit	‘001’B
T3402 value		30 seconds
Timer value	‘01111’B
Unit	‘000’B

Table 9.2.3.1.26.3.3-8: Message TRACKING AREA UPDATE REQUEST (steps 2,9,16,23,30 Table 9.2.3.1.26.3.2-1)

Derivation Path: 36.508, Table 4.7.2-27
Information Element	Value/remark	Comment	Condition
EPS update type
EPS update type Value	‘011’B	Periodic updating

9.2.3.1.27 Normal tracking area update / Abnormal case / Change of cell into a new tracking area

9.2.3.1.27.1 Test Purpose (TP)

(1)

with { UE has sent a TRACKING AREA UPDATE REQUEST message}

ensure that {

when { cell change into a new tracking area occurs before the tracking area updating procedure is completed }

then { UE aborts the tracking area updating procedure and re-initiates it in the new tracking area immediately }

}

9.2.3.1.27.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 24.301 clauses 5.5.3.2.6, and 5.5.3.3.6.

[TS 24.301 clause5.5.3.2.6]

The following abnormal cases can be identified:

…

e) Change of cell into a new tracking area

If a cell change into a new tracking area occurs before the tracking area updating procedure is completed, the tracking area updating procedure shall be aborted and re-initiated immediately. The UE shall set the EPS update status to EU2 NOT UPDATED.

[TS 24.301 clause5.5.3.3.6]

The UE shall proceed as follows:

…

– otherwise, the abnormal cases specified in subclause 5.5.3.2.6 apply with the following modification.

If the tracking area updating attempt counter is incremented according to subclause 5.5.3.2.6 the next actions depend on the value of the tracking area updating attempt counter.

9.2.3.1.27.3 Test description

9.2.3.1.27.3.1 Pre-test conditions

System Simulator:

– cell A, cell B.

UE:

None.

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell A according to 36.508 [18].

9.2.3.1.27.3.2 Test procedure sequence

Table 9.2.3.1.27.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of cell A to the ”Non-Suitable cell”. Set the cell type of cell B to the ”Serving cell”.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST on Cell B (Note 1).	–>	TRACKING AREA UPDATE REQUEST	–	–
3	SS does not send TRACKING AREA UPDATE ACCEPT to the UE and update TAC value in SystemInformationBlockType1.	–	–	–	–
4	The SS transmits a Paging message paging occasion including a systemInfoModification.	<–	Paging	–	–
–	EXCEPTION: IF pc_ue_CategoryDL_M1 THEN execute 5b1 to 5b3 ELSE execute step 5a1.	–	–	–	–
5 a1	From the beginning of the next modification period the SS transmits a modified SystemInformationBlockType1 as specified.	–	–	–	–
5b1	The SS transmits an RRCConnectionRelease message in Cell B.	–	–	–	–
5b2	Void	–	–	–	–
5b3	The SS indicates a new system information by Direct Indication information with bit 1 and transmitted on MPDCCH using P-RNTI. From the beginning of the next modification period the SS transmits a modified SystemInformationBlockType1-BR-r13.	–	–	–	–
6	Check: Does the UE transmit TRACKING AREA UPDATE REQUEST message on cell B in the next 12 seconds? Note: Wait time is more than 2.1* modification period for the UE to receive system information and inferior to T3430.	–>	TRACKING AREA UPDATE REQUEST	1	P
7	SS responds with TRACKING AREA UPDATE ACCEPT message	<–	TRACKING AREA UPDATE ACCEPT	–	–
8	UE sends TRACKING AREA UPDATE COMPLETE	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA connected (E2_T3440) according to TS 36.508.	–	–	–	–
Note 1: Any type of tracking area update is acceptable.

9.2.3.1.27.3.3 Specific message contents

Table 9.2.3.1.27.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 2, step 6, Table 9.2.3.1.27.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Old GUTI	GUTI-1
Last visited registered TAI	TAI-1

Table 9.2.3.1.27.3.3-2: Message TRACKING AREA UPDATE ACCEPT (step 7, 9.2.3.1.27.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
GUTI	GUTI-3
TAI list
Length of tracking area identity list contents	‘00000110’B
Partial tracking area identity list
Number of elements	‘00000’B
Type of list	’00’B	”list of TACs belonging to one PLMN, with non-consecutive TAC values”
MCC MNC TAC 1	TAC =4	”PLMN is set to the same MCC/MNC stored in EF_IMSI” ”TAI-4”

Table 9.2.3.1.27.3.3-3: SystemInformationBlockType1 for Cell B (From step 3 in Table 9.2.3.1.27.3.2-1)

Derivation Path: 36.508 clause 4.4.3.2, Table 4.4.3.2-3
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType1 ::= SEQUENCE {
systemInfoValueTag	1	Default value is 0
cellAccessRelatedInfo SEQUENCE {
trackingAreaCode	TAC =4
}
}

Table 9.2.3.1.27.3.3-3A: SystemInformationBlockType1-BR-r13 for Cell B (From step 3 in Table 9.2.3.1.27.3.2-1 when UE under test is CAT M1)

Derivation Path: 36.508 clause 4.4.3.2, Table 4.4.3.2-3A
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType1-BR-r13 ::= SEQUENCE {
systemInfoValueTag	1	Default value is 0
cellAccessRelatedInfo SEQUENCE {
trackingAreaCode	TAC =4
}
}

Table 9.2.3.1.27.3.3-4: Paging (step 4, Table 9.2.3.1.27.3.2-1)

Derivation Path: 36.508 Table 4.6.1-7
Information Element	Value/remark	Comment	Condition
Paging ::= SEQUENCE {
pagingRecordList	Not present
systemInfoModification	true
}

9.2.3.1.28 Normal tracking area update / Abnormal case / Tracking area updating and detach procedure collision

9.2.3.1.28.1 Test Purpose (TP)

(1)

with { UE has sent a TRACKING AREA UPDATE REQUEST message}

ensure that {

when { UE receives a DETACH REQUEST message before the tracking area updating procedure has been completed }

then { the tracking area updating procedure shall be aborted and the detach procedure shall be progressed }

}

9.2.3.1.28.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 24.301 clauses 5.5.3.2.6 and 5.5.3.3.6.

[TS 24.301 clause5.5.3.2.6]

The following abnormal cases can be identified:

…

f) Tracking area updating and detach procedure collision

If the UE receives a DETACH REQUEST message before the tracking area updating procedure has been completed, the tracking area updating procedure shall be aborted and the detach procedure shall be progressed.

[TS 24.301 clause5.5.3.3.6]

The UE shall proceed as follows:

…

– otherwise, the abnormal cases specified in subclause 5.5.3.2.6 apply with the following modification.

If the tracking area updating attempt counter is incremented according to subclause 5.5.3.2.6 the next actions depend on the value of the tracking area updating attempt counter.

9.2.3.1.28.3 Test description

9.2.3.1.28.3.1 Pre-test conditions

System Simulator:

– cell A, cell B.

– System information combination 3 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

UE:

None.

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on Cell A according to 36.508 [18].

9.2.3.1.28.3.2 Test procedure sequence

Table 9.2.3.1.28.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of cell A to the ”Non-Suitable cell”. Set the cell type of cell B to the ”Serving cell”.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST on Cell B (Note 1).	–>	TRACKING AREA UPDATE REQUEST	–	–
3	SS does not send TRACKING AREA UPDATE ACCEPT to the UE.	–	–	–	–
4	The SS transmits a DETACH REQUEST message with Detach type = ‘re-attach not required’ on Cell B. Note: this message should be sent before timer T3430 expired.	<–	DETACH REQUEST	–	–
5	Check: Does the UE transmit a DETACH ACCEPT message on Cell B in the next 6 seconds? Note: the default value for timer T3422 is 6 seconds	–>	DETACH ACCEPT	1	P
6	The SS releases the RRC connection.	–	–	–	–
7	Check: Does the test result of the generic procedure defined in clause 6.4.2.5 of TS 36.508 indicates that the UE responds to paging when paged with S-TMSI1 and with CN domain indicator set to "PS" on Cell B?	–	–	1	–
Note 1: Any type of tracking area update is acceptable.

9.2.3.1.28.3.3 Specific message contents

Table 9.2.3.1.28.3.3-1: Message DETACH REQUEST (step 4, Table 9.2.3.1.28.3.2-1)

Derivation path: 36.508 table 4.7.2-12
Information Element	Value/Remark	Comment	Condition
Detach type	‘010’B	“re-attach not required”
EMM cause	‘00001100’B	”Tracking area not allowed”

9.2.3.1.29 Normal tracking area update / Accepted / MUSIM

9.2.3.1.29.1 Test Purpose (TP)

(1)

with { UE in state EMM-REGISTERED and EMM-IDLE mode}

ensure that {

when { the UE detects entering a new tracking area not included in the TAI list }

then { the UE transmits TRACKING AREA UPDATE REQUEST message and sets one or more MUSIM feature bits in UE network capability IE to "supported"(i.e. the NAS signalling connection release, the paging indication for voice services, the reject paging request, the paging restriction and the paging timing collision control) }

}

9.2.3.1.29.2 Conformance requirements

[TS 24.301, clause 5.5.3.2.2]

The UE in state EMM-REGISTERED shall initiate the tracking area updating procedure by sending a TRACKING AREA UPDATE REQUEST message to the MME,

a) when the UE detects entering a tracking area that is not in the list of tracking areas that the UE previously registered in the MME, unless the UE is configured for "AttachWithIMSI" as specified in 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17] and is entering a tracking area in a new PLMN that is neither the registered PLMN nor in the list of equivalent PLMNs;

b) when the periodic tracking area updating timer T3412 expires;

c) when the UE enters EMM-REGISTERED.NORMAL-SERVICE and the UE’s TIN indicates "P-TMSI";

d) when the UE performs an inter-system change from S101 mode to S1 mode and has no user data pending;

e) when the UE receives an indication from the lower layers that the RRC connection was released with cause "load balancing TAU required";

f) when the UE deactivated EPS bearer context(s) locally while in EMM-REGISTERED, because it could not establish a NAS signalling connection, and then returns to EMM-REGISTERED.NORMAL-SERVICE and no EXTENDED SERVICE REQUEST message, CONTROL PLANE SERVICE REQUEST message or DETACH REQUEST message with detach type is "EPS detach" or "combined EPS/IMSI detach" is pending to be sent by the UE;

g) when the UE changes any one of the UE network capability information, the MS network capability information or the N1 UE network capability information;

h) when the UE changes the UE specific DRX parameter (in WB-S1 mode or NB-S1 mode);

j) when the UE enters S1 mode after 1xCS fallback or 1xSRVCC;

k) when due to manual CSG selection the UE has selected a CSG cell whose CSG identity and associated PLMN identity are not included in the UE’s Allowed CSG list or in the UE’s Operator CSG list;

l) when the UE reselects an E-UTRAN cell while it was in GPRS READY state or PMM-CONNECTED mode;

m) when the UE supports SRVCC to GERAN or UTRAN or supports vSRVCC to UTRAN and changes the mobile station classmark 2 or the supported codecs, or the UE supports SRVCC to GERAN and changes the mobile station classmark 3;

n) when the UE changes the radio capability for GERAN, or cdma2000^® or both;

o) when the UE’s usage setting or the voice domain preference for E-UTRAN change in the UE;

NOTE 1: For the change of UE’s usage setting or the voice domain preference for E-UTRAN which results in disabling UE’s E-UTRA capability, the UE can skip sending TRACKING AREA UPDATE REQUEST message and directly perform disabling of UE’s E-UTRA capability.

p) when the UE activates mobility management for IMS voice termination as specified in 3GPP TS 24.008 [13], annex P.2, and the TIN indicates "RAT-related TMSI";

q) when the UE performs an inter-system change from A/Gb mode to S1 mode and the TIN indicates "RAT-related TMSI", but the UE is required to perform tracking area updating for IMS voice termination as specified in 3GPP TS 24.008 [13], annex P.4;

r) upon reception of a paging indication using S-TMSI and the UE is in state EMM-REGISTERED.ATTEMPTING-TO-UPDATE;

s) when the UE needs to update the network with EPS bearer context status due to local de-activation of EPS bearer context(s) as specified in clause 6.5.1.4A;

t) when the UE needs to request the use of PSM or needs to stop the use of PSM;

u) when the UE needs to request the use of eDRX or needs to stop the use of eDRX;

v) when a change in the eDRX usage conditions at the UE requires different extended DRX parameters;

w) when a change in the PSM usage conditions at the UE requires a different timer T3412 value or different timer T3324 value;

NOTE 2: A change in the PSM or eDRX usage conditions at the UE can include e.g. a change in the UE configuration, a change in requirements from upper layers or the battery running low at the UE.

x) when the CIoT EPS optimizations the UE needs to use, change in the UE;

y) when the Default_DCN_ID value changes, as specified in 3GPP TS 24.368 [15A] or in USIM file NAS_CONFIG as specified in 3GPP TS 31.102 [17];

NOTE 3: The tracking area updating procedure is initiated after deleting the DCN-ID list as specified in annex C.

z) when the UE performs inter-system change from N1 mode to S1 mode in EMM-IDLE mode, the UE operates in single-registration mode, and conditions specified in 3GPP TS 24.501 [54] apply;

za) when the UE in EMM-IDLE mode changes the radio capability for E-UTRAN;

zb) when the UE needs to request new ciphering keys for ciphered broadcast assistance data;

zc) when the UE in EMM-IDLE mode changes the radio capability for NG-RAN;

zd) when the UE performs inter-system change from N1 mode to S1 mode in EMM-CONNECTED mode;

ze) in WB-S1 mode, when the applicable UE radio capability ID for the current UE radio configuration changes due to a revocation of the network-assigned UE radio capability IDs by the serving PLMN;

zf) when the UE needs to use the WUS assistance, stop to use the WUS assistance, or change the conditions for using the WUS assistance; or

zg) when the MUSIM UE needs to request an IMSI Offset value as specified in 3GPP TS 23.401 [10] that is used for deriving the paging occasion as specified in 3GPP TS 36.304 [21]

…

For all cases except case b, if the MUSIM UE supports the NAS signalling connection release, then the UE shall set the NAS signalling connection release bit to "NAS signalling connection release supported" in the UE network capability IE of the TRACKING AREA UPDATE REQUEST message otherwise the UE shall not set the NAS signalling connection release bit to "NAS signalling connection release supported" in the UE network capability IE of the TRACKING AREA UPDATE REQUEST message.

For all cases except case b, if the MUSIM UE supports the paging indication for voice services, then the UE shall set the paging indication for voice services bit to "paging indication for voice services supported" in the UE network capability IE of the TRACKING AREA UPDATE REQUEST message otherwise the UE shall not set the paging indication for voice services bit to "paging indication for voice services supported" in the UE network capability IE of the TRACKING AREA UPDATE REQUEST message.

For all cases except case b, if the MUSIM UE supports the reject paging request, then the UE shall set the reject paging request bit to "reject paging request supported" in the UE network capability IE of the TRACKING AREA UPDATE REQUEST message otherwise the UE shall not set the reject paging request bit to "reject paging request supported" in the UE network capability IE of the TRACKING AREA UPDATE REQUEST message.

For all cases except case b, if the MUSIM UE sets:

– the reject paging request bit to "reject paging request supported";

– the NAS signalling connection release bit to "NAS signalling connection release supported"; or

– both of them;

and supports the paging restriction, then the UE shall set the paging restriction bit to "paging restriction supported" in the UE network capability IE of the TRACKING AREA UPDATE REQUEST message otherwise the UE shall not set the paging restriction bit to "paging restriction supported" in the UE network capability IE of the TRACKING AREA UPDATE REQUEST message.

For all cases except case b, if the MUSIM UE supports the paging timing collision control, then the UE shall set the paging timing collision control bit to "paging timing collision control supported" in the UE network capability IE of the TRACKING AREA UPDATE REQUEST message otherwise the UE shall not set the paging timing collision control bit to "paging timing collision control supported" in the UE network capability IE of the TRACKING AREA UPDATE REQUEST message.

…

9.2.3.1.29.3 Test description

9.2.3.1.29.3.1 Pre-test conditions

System Simulator:

– Cell A/Cell B(home PLMN1) and Cell G/Cell H(home PLMN2) are configured according to table 6.3.2.2-1 in TS 36.508 [18] and belong to the different frequency as specified in TS 36.523-3 [20].

– cell A (belongs to TAI-1, home PLMN1, MCC=001,MNC=01) is set to ”Serving cell” for USIM A.

– cell B (belongs to TAI-2, home PLMN1, MCC=001,MNC=01) is set to ” Non- Suitable cell” for USIM A.

– cell G (belongs to TAI-7, home PLMN2, MCC=001,MNC=02) is set to ” Serving cell” for USIM B.

– cell H (belongs to TAI-8, home PLMN2, MCC=001,MNC=02) is set to ” Non- Suitable cell ” for USIM B.

UE:

– the UE is a MUSIM UE;

– each USIM of the UE is configured to initiate EPS attach;

– roaming is disabled

The UE is equipped with two USIMs containing values shown in Table 9.2.3.1.29.3.1-1 and Table 9.2.3.1.29.3.1-2.

Table 9.2.3.1.29.3.1-1: USIM A Configuration

USIM field	Value
EF_IMSI	MCC = 001 and MNC = 01

Table 9.2.3.1.29.3.1-2: USIM B Configuration

USIM field	Value
EF_IMSI	MCC = 001 and MNC = 02

Preamble:

– USIM A of the UE is in state Registered, Idle Mode (state 2) on cell A according to TS 36.508 [18].

– USIM B of the UE is in state Registered, Idle Mode (state 2) on cell G according to TS 36.508 [18].

9.2.3.1.29.3.2 Test procedure sequence

Table 9.2.3.1.29.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
	The following messages are sent and shall be received on cell B.	–	–	–	–
1	Set the cell type of cell A to the "Non-Suitable cell". Set the cell type of cell B to the " Serving cell"	–	–	–	–
2	Check: Does the USIM A of UE transmit a TRACKING AREA UPDATE REQUEST message including UE network capability witch at least one MUSIM feature is set to “support”?	–>	TRACKING AREA UPDATE REQUEST	1	P
3	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
4	The USIM A of UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
5	The SS releases the RRC connection.			–	–
	EXCEPTION: The following events step 6 to 10 may parallel or before or after to steps 1 to 5.	–	–	–	–
	The following messages are sent and shall be received on cell H.	–	–
6	Set the cell type of cell G to the "Non-Suitable cell". Set the cell type of cell H to the " Serving cell"	–	–
7	Check: Does the USIM B of UE transmit a TRACKING AREA UPDATE REQUEST message including UE network capability witch at least one MUSIM feature is set to “support”?	–>	TRACKING AREA UPDATE REQUEST	1	P
8	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT
9	The USIM B of UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE
10	The SS releases the RRC connection.

9.2.3.1.29.3.3 Specific message contents

Table 9.2.3.1.29.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 2, Table 9.2.3.1.29.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type	000	TA updating
Old GUTI	GUTI-1	”Old GUTI is included by UE if valid, IMSI otherwise”
UE network capability			pc_EPC_MUSIM
All octets with the exception of octet 10, bit 6 to bit 8 and octet 11,bit 1 to 2	Any allowed value
NAS signalling connection release (NCR) (octet 10, bit 6)	‘1’B	NAS signalling connection release supported	pc_EPC_MUSIM_NCR
Paging indication for voice services (PIV) (octet 10, bit 7)	‘1’B	Paging indication for voice services supported	pc_EPC_MUSIM_PIV
Reject paging request (RPR) (octet 10, bit 8)	1	Reject paging request supported	pc_EPC_MUSIM_RPR
Paging restriction (PR) (octet 11, bit 1)	1	Paging restriction supported	pc_EPC_MUSIM_PR
Paging timing collision control (PTCC) (octet 11, bit 2)	1	Paging timing collision control supported	pc_EPC_MUSIM_PTCC

Table 9.2.3.1.29.3.3-2: Message TRACKING AREA UPDATE ACCEPT (step 3, Table 9.2.3.1.29.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EPS update result	000	“TA only”
GUTI	GUTI-2
EPS network feature support			pc_EPC_MUSIM
All octets with the exception of octet 5, bit 1 to bit 5	Any allowed value
NAS signalling connection release (NCR) (octet 5, bit 1)	‘1’B	NAS signalling connection release supported	pc_EPC_MUSIM_NCR
Paging indication for voice services (PIV) (octet 5, bit 2)	‘1’B	Paging indication for voice services supported	pc_EPC_MUSIM_PIV
Reject paging request (RPR) (octet 5, bit 3)	‘1’B	Reject paging request supported	pc_EPC_MUSIM_RPR
Paging restriction (PR) (octet 5, bit 4)	‘1’B	Paging restriction supported	pc_EPC_MUSIM_PR
Paging timing collision control (PTCC) (octet 5, bit 5)	‘1’B	Paging timing collision control supported	pc_EPC_MUSIM_PTCC

9.2.3.2 Combined tracking area updating

9.2.3.2.1 Combined tracking area update / Successful

9.2.3.2.1.1 Test Purpose (TP)

(1)

with { a combined EPS/IMSI attached UE in state EMM-REGISTERED and EMM-IDLE mode}

ensure that {

when { UE enters a tracking area included in the TAI list }

then { UE does not transmit a TRACKING AREA UPDATE REQUEST message }

}

(2)

with { a combined EPS/IMSI attached UE in state EMM-REGISTERED and EMM-IDLE mode}

ensure that {

when { UE enters a tracking area not included in the TAI list }

then { UE transmits a TRACKING AREA UPDATE REQUEST message with "EPS update type = combined TA/LA updating" }

}

(3)

with { UE has sent a combined TRACKING AREA UPDATE REQUEST message }

ensure that {

when { UE receives a TRACKING AREA UPDATE ACCEPT message containing a GUTI and/or a mobile identity }

then { UE transmits a TRACKING AREA UPDATE COMPLETE message and enters EMM-REGISTERED state }

}

9.2.3.2.1.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clauses 5.5.3.1, 5.5.3.2.2, 5.5.3.2.4, 5.5.3.3.1, 5.5.3.3.2, 5.5.3.3.4.1 and 5.5.3.3.4.2.

[TS 24.301 clause 5.5.3.1]

The tracking area updating procedure is always initiated by the UE and is used for the following purposes:

…- combined tracking area updating to update the registration of the actual tracking area for a UE in CS/PS mode 1 or CS/PS mode 2 of operation;

…

[TS 24.301 clause 5.5.3.2.2]

The UE in state EMM-REGISTERED shall initiate the tracking area updating procedure by sending a TRACKING AREA UPDATE REQUEST message to the MME,

a) when the UE detects entering a tracking area that is not in the list of tracking areas that the UE previously registered in the MME;

…

If the UE supports A/Gb mode or Iu mode, the UE shall handle the Old GUTI IE as follows:

…

– If the TIN indicates "GUTI" or "RAT-related TMSI" and the UE holds a valid GUTI, the UE shall indicate the GUTI in the Old GUTI IE.

…

If a UE has uplink user data pending when it initiates the tracking area updating procedure, or uplink signalling not related to the tracking area updating procedure, it may also set an "active" flag in the TRACKING AREA UPDATE REQUEST message to indicate the request to establish the user plane to the network and to keep the NAS signalling connection after the completion of the tracking area updating procedure.

If the UE has a current EPS security context, the UE shall include the eKSI (either KSI_ASME or KSI_SGSN) in the NAS Key Set Identifier IE in the TRACKING AREA UPDATE REQUEST message. Otherwise, the UE shall set the NAS Key Set Identifier IE to the value "no key is available". If the UE has a current EPS security context, the UE shall integrity protect the TRACKING AREA UPDATE REQUEST message with the current EPS security context. Otherwise the UE shall not integrity protect the TRACKING AREA UPDATE REQUEST message.

…

[TS 24.301 clause 5.5.3.2.4]

…

If the TRACKING AREA UPDATE ACCEPT message contained a GUTI, the UE shall return a TRACKING AREA UPDATE COMPLETE message to the MME to acknowledge the received GUTI.

…

[TS 24.301 clause 5.5.3.3.1]

Within a combined tracking area updating procedure the messages TRACKING AREA UPDATE ACCEPT and TRACKING AREA UPDATE COMPLETE carry information for the tracking area updating and the location area updating.

The combined attach procedure basically follows the normal tracking area updating procedure described in subclause 5.5.3.2.

[TS 24.301 clause 5.5.3.3.2]

…

The UE shall include the TMSI status IE if no valid TMSI is available. Furthermore, if the UE has stored a valid location area identification, the UE shall include it in the Old location area identification IE in the TRACKING AREA UPDATE REQUEST message.

[TS 24.301 clause 5.5.3.3.4.1]

Depending on the value of the EPS update result IE received in the TRACKING AREA UPDATE ACCEPT message, two different cases can be distinguished:

1) The EPS update result IE value indicates "combined TA/LA updated": Tracking and location area updating is successful;

…

A TRACKING AREA UPDATE COMPLETE message shall be returned to the network if the TRACKING AREA UPDATE ACCEPT message contains a GUTI and/or a mobile identity.

[TS 24.301 clause 5.5.3.3.4.2]

The description for normal tracking area update as specified in subclause 5.5.3.2.4 shall be followed. In addition, the following description for location area updating applies.

The TMSI reallocation may be part of the combined tracking area updating procedure. The TMSI allocated is then included in the TRACKING AREA UPDATE ACCEPT message together with the location area identification (LAI). In this case the MME shall change to state EMM-COMMON-PROCEDURE-INITIATED and shall start the timer T3450 as described in subclause 5.4.1. The LAI may be included in the TRACKING AREA UPDATE ACCEPT message without TMSI.

The UE, receiving a TRACKING AREA UPDATE ACCEPT message, stores the received location area identification, resets the location update attempt counter, sets the update status to U1 UPDATED and enters MM state MM IDLE.

…

How to handle the old TMSI stored in the UE depends on the mobile identity included in the TRACKING AREA UPDATE ACCEPT message.

– If the TRACKING AREA UPDATE ACCEPT message contains an IMSI, the UE is not allocated any TMSI, and shall delete any old TMSI accordingly.

– If the TRACKING AREA UPDATE ACCEPT message contains a TMSI, the UE shall use this TMSI as new temporary identity. The UE shall delete its old TMSI and shall store the new TMSI. In this case, a TRACKING AREA UPDATE COMPLETE message is returned to the network to confirm the received TMSI.

– If neither a TMSI nor an IMSI has been included by the network in the TRACKING AREA UPDATE ACCEPT message, the old TMSI, if any is available, shall be kept.

…

9.2.3.2.1.3 Test description

9.2.3.2.1.3.1 Pre-test conditions

System Simulator:

– cell A, cell C and cell D (HPLMN, different TAs);

– at most 2 cells are active simultaneously.

– System information combination 3 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

UE:

– the UE is configured to initiate combined EPS/IMSI attach.

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.2.1.3.2 Test procedure sequence

Table 9.2.3.2.1.3.2-1: Main Behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
	The following messages are sent and shall be received on cell C.	–	–	–	–
1-13	Void	–	–	–	–
14	Set the cell type of cell A to the "non-Suitable neighbour cell ". Set the cell type of cell C to the " Serving cell"	–	–	–	–
15	Check: Does the UE transmit a combined TRACKING AREA UPDATE REQUEST message as specified?	–>	TRACKING AREA UPDATE REQUEST	2	P
16	The SS sends TRACKING AREA UPDATE ACCEPT message including GUTI, TMSI and LAI. The TAI list includes TAI for cell C and cell D.	<–	TRACKING AREA UPDATE ACCEPT	–	–
17	Check: Does the UE transmit a TRACKING AREA UPDATE COMPLETE message?	–>	TRACKING AREA UPDATE COMPLETE	2,3	P
18	The SS releases the RRC connection.	–	–	–	–
19	Check: Does the test results of generic procedure in TS 36.508 [18] subclause 6.4.2.4 indicate that the UE is in E-UTRA EMM-REGISTERED state on cell C with PagingUE-Identity = S-TMSI2?	–	–	2	–
	The following messages are sent and shall be received on cell D.	–	–	–	–
20	Set the cell type of cell A to the "non-Suitable off cell ". Set the cell type of cell C to the "Suitable neighbour cell". Set the cell type of cell D to the " Serving cell"	–	–	–	P
20A	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message in the next 30 seconds?	–>	TRACKING AREA UPDATE REQUEST	1	F
20B	Check: Does the test results of generic procedure in TS 36.508 [18] subclause 6.4.2.4 indicate that the UE is in E-UTRA EMM-REGISTERED state on cell D with PagingUE-Identity = S-TMSI2?	–	–	1
20C	Set the cell type of cell A to the "Serving cell". Set the cell type of cell C to the "Non-suitable off cell". Set the cell type of cell D to the "Suitable neighbour cell".
	The following messages are sent and shall be received on cell A.
21	Check: Does the UE transmit a combined TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	2	P
22	The SS sends TRACKING AREA UPDATE ACCEPT message. Note: GUTI not present and MS identity present	<–	TRACKING AREA UPDATE ACCEPT	–	–
23	Check: Does the UE send TRACKING AREA UPDATE COMPLETE message?	–>	TRACKING AREA UPDATE COMPLETE	2,3	P
–	At the end of this test procedure sequence, the UE is in end state E-UTRA connected (E2_T3440) according to TS 36.508.	–	–	–	–

NOTE 1: It is assumed in the test procedure sequence that the UE initially has a valid GUTI.

NOTE 2: NAS security procedures are not checked in this TC.

9.2.3.2.1.3.3 Specific message contents

Table 9.2.3.2.1.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 15, Table 9.2.3.2.1.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
NAS key set identifier	KSI sent during the test case preamble in step 7.
TSC	‘0’B	native security context (for KSI_ASME)
Old GUTI	GUTI-1	GUTI-1 was allocated in cell A during the preamble
Last visited registered TAI	TAI-1	TAI of cell A
Old location area identification	LAI-1	LAI received in the ATTACH ACCEPT message in the preamble
TMSI status	Not Present	Valid TMSI available

Table 9.2.3.2.1.3.3-2: Message TRACKING AREA UPDATE ACCEPT (step 16, Table 9.2.3.2.1.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
GUTI	GUTI-2
TAI list
Length of tracking area identity list contents	‘00001000’B	8 octets
Type of list	’00’B	”list of TACs belonging to one PLMN, with non-consecutive TAC values”
Number of elements	‘00001’ B	2 elements
Partial tracking area identity list	PLMN = MCC/MNC stored in EF_IMSI TAC 1 = 3 TAC 2 = 4	TAI-3 and TAI-4

Table 9.2.3.2.1.3.3-3: Message TRACKING AREA UPDATE REQUEST (step 21, Table 9.2.3.2.1.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Old GUTI	GUTI-2
Last visited registered TAI	TAI-4
Old location area identification	LAI-2
TMSI status	Not present	Valid TMSI available

Table 9.2.3.2.1.3.3-4: Message TRACKING AREA UPDATE ACCEPT (step 22, Table 9.2.3.2.1.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
GUTI	Not present	The SS doesn’t assign a new GUTI
TAI list
Length of tracking area identity list contents	‘00000110’B	6 octets
Type of list	‘00’B	One PLMN with non-consecutive TACs
Number of elements	‘00000’B	1 element
Partial tracking area identity list	PLMN = MCC/MNC stored in EF_IMSI TAC 1 = TAC-1	TAI-1
LAI	LAI-1
MS identity	TMSI-3	SS provides a new TMSI

9.2.3.2.1a Combined tracking area update / Successful / Check of last visited TAI and handling of TAI list, LAI and TMSI

9.2.3.2.1a.1 Test Purpose (TP)

(1)

with { a combined EPS/IMSI attached UE has sent a combined TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘Combined TA/LA updating’, including a last visited registered TAI }

ensure that {

when { the UE receives a TRACKING AREA UPDATE ACCEPT message containing a new TAI list, a location area information(LAI) and a TMSI as the mobile identity }

then { the UE shall delete its old TMSI and shall store the new TMSI and transmits a TRACKING AREA UPDATE COMPLETE message and enters EMM-REGISTERED state }

}

(2)

Void

(3)

with { UE in state GMM-REGISTERED mode }

ensure that {

when { the UE receives a Paging message including an ue-Identity set to an unmatched TMSI i.e. other than the one allocated to the UE at the UE registration procedure }

then { the UE doesn’t establish an RRC connection to answer the paging }

}

(4)

with { UE in state GMM-REGISTERED mode }

ensure that {

when { the UE receives a Paging message including an ue-Identity set to the TMSI which was allocated to the UE }

then { the UE establishes an RRC connection to answer the paging and the TMSI and the location area information(LAI) as Initial UE Identity are included in RRCConnectionRequest message }

}

(5)

with { a combined EPS/IMSI attached UE has sent a combined TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘Combined TA/LA updating with IMSI attach ‘, including a last visited registered TAI }

ensure that {

when { the UE receives a TRACKING AREA UPDATE ACCEPT message containing a new TAI list, a location area information(LAI) (Neither a TMSI nor an IMSI as the mobile identity is included) }

then { the UE shall keep the old TMSI if any available and enters EMM-REGISTERED state }

}

(6)

Void

(7)

Void

(8)

ensure that {

when { the UE receives a TRACKING AREA UPDATE ACCEPT message containing a new TAI list, a location area information(LAI) and an IMSI as the mobile identity }

then { the UE shall delete any old TMSI and enters EMM-REGISTERED state }

}

(9)

Void

(10)

with { UE in state GMM-REGISTERED mode }

ensure that {

when { the UE receives a Paging message including an ue-Identity set to a TMSI }

then { the UE doesn’t establish an RRC connection to answer the paging }

}

9.2.3.2.1a.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clauses 5.5.3.3.1, 5.5.3.3.2 , 5.5.3.3.4.1 and 5.5.3.3.4.2; TS 24.008, clause 4.4.1.

[TS 24.301 clause 5.5.3.3.1]

The combined tracking area updating procedure follows the normal tracking area updating procedure described in subclause 5.5.3.2.

[TS 24.301 clause 5.5.3.3.2]

The UE operating in CS/PS mode 1 or CS/PS mode 2, in state EMM-REGISTERED, shall initiate the combined tracking area updating procedure:

a) when the UE that is attached for both EPS and non-EPS services detects entering a tracking area that is not in the list of tracking areas that the UE previously registered in the MME;

b) when the UE that is attached for EPS services wants to perform an attach for non-EPS services. In this case the EPS update type IE shall be set to "Combined TA/LA updating with IMSI attach";

c) when the UE performs an intersystem change from A/Gb mode to S1 mode and the EPS services were previously suspended in A/Gb mode;

d) when the UE performs an intersystem change from A/Gb or Iu mode to S1 mode and the UE previously performed a location area update procedure in A/Gb or Iu mode, in order to re-establish the SGs association;

e) when the UE enters EMM-REGISTERED.NORMAL-SERVICE and the UE’s TIN indicates "P-TMSI";

f) when the UE receives an indication from the lower layers that the RRC connection was released with cause "load balancing TAU required";

g) when the UE deactivated EPS bearer context(s) locally while in EMM-REGISTERED.NO-CELL-AVAILABLE, and then returns to EMM-REGISTERED.NORMAL-SERVICE;

h) when the UE changes the UE core network capability information or the UE specific DRX parameter or both;

i) when the UE receives an indication of "RRC Connection failure" from the lower layers and has no user uplink data pending; or

j) when the UE has selected a CSG cell whose CSG identity is not included in the UE’s Allowed CSG list.

[TS 24.301 clause 5.5.3.3.4.1]

Depending on the value of the EPS update result IE received in the TRACKING AREA UPDATE ACCEPT message, two different cases can be distinguished:

1) The EPS update result IE value indicates "combined TA/LA updated": Tracking and location area updating is successful;

2) The EPS update result IE value indicates "TA updated": Tracking area updating is successful, but location area updating is not successful.

A TRACKING AREA UPDATE COMPLETE message shall be returned to the network if the TRACKING AREA UPDATE ACCEPT message contains a GUTI or a mobile identity or both.

[TS 24.301 clause 5.5.3.3.4.2]

The description for normal tracking area update as specified in subclause 5.5.3.2.4 shall be followed. In addition, the following description for location area updating applies.

How to handle the old TMSI stored in the UE depends on the mobile identity included in the TRACKING AREA UPDATE ACCEPT message.

– If the TRACKING AREA UPDATE ACCEPT message contains an IMSI, the UE is not allocated any TMSI, and shall delete any old TMSI accordingly.

– If neither a TMSI nor an IMSI has been included by the network in the TRACKING AREA UPDATE ACCEPT message, the old TMSI, if any is available, shall be kept.

The network receiving a TRACKING AREA UPDATE COMPLETE message stops timer T3450, changes to state EMM-REGISTERED and considers the new TMSI as valid.

[TS 24.008 clause 4.4.1]

The location updating procedure is a general procedure which is used for the following purposes:

…..

– indicating to the network that the MS, configured to use CS fallback and SMS over SGs, or SMS over SGs only, has entered a GERAN or UTRAN cell in NMO II or III, after intersystem change from S1 mode to Iu or A/Gb mode, the TIN indicates "GUTI" and the location area of the current cell is the same as the stored location area; or

NOTE 1: The location updating procedure can be delayed when the intersystem change is due to CS fallback. In this case, the MS has to remember that it has to perform a location updating procedure after the RR connection is released, if the MS is still in GERAN/UTRAN.

…..

The normal location updating procedure shall also be started if the MS is configured to use CS fallback and SMS over SGs, or SMS over SGs only, and the TIN indicates "RAT-related TMSI",

– when the periodic tracking area update timer T3412 expires and the network operates in network operation mode II or III; or

– when the MS enters a GERAN or UTRAN cell in network operation mode II or III and the E-UTRAN deactivate ISR timer T3423 is running.

NOTE 2: The timers T3412 and T3423 are specified in 3GPP TS 24.301 [120].

The normal location updating procedure shall also be started when the MS, configured to use CS fallback and SMS over SGs, or SMS over SGs only, enters a GERAN or UTRAN cell in network operation mode II or III and the E-UTRAN deactivate ISR timer T3423 has expired.

If the MS, configured to use CS fallback and SMS over SGs, enters a GERAN or UTRAN cell in network operation mode II or III, after intersystem change from S1 mode to Iu or A/Gb mode due to CS fallback, and the location area of the current cell is not available, the MS should initiate the location updating procedure.

…..

In the case that the mobile station is initiating an emergency call but, due to cell re-selection or redirection by the network, it moves to a different LAI then the mobile station may delay the location updating procedure in the new LA until after the emergency call is completed.

9.2.3.2.1a.3 Test description

9.2.3.2.1a.3.1 Pre-test conditions

System Simulator:

– cell A (belongs to TAI-1) is set to ”Serving cell”;

– cell B (belongs to TAI-2) is set to ”Non-suitable cell”;

– System information combination 9 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

– cell 5 (UTRA FDD or UTRA TDD, belongs to LAI-3) is set to ”Non-suitable “off” cell”.

– cell 7 (UTRA FDD or UTRA TDD, as exception contains LAI-4) is set to ”Non-suitable cell”.

– UTRAN is NOT using Gs interface. (NMO in System Information Block 1 indicates NMO II).

UE:

– the UE is configured to initiate combined EPS/IMSI attach.

Preamble:

– the UE is in state Registered, Idle mode (state 2) with condition CombinedAttach on Cell A according to [18].

9.2.3.2.1a.3.2 Test procedure sequence

Table 9.2.3.2.1a.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
–	The following messages are sent and shall be received on Cell B.	–	–	–	–
1	Set cell type of Cell A to the "non-Suitable cell" Set cell type of Cell B to the "Serving cell".	–	–	–	–
2	Check: Does the UE transmit a combined TRACKING AREA UPDATE REQUEST message with Last visited registered TAI set to TAI-1?	–>	TRACKING AREA UPDATE REQUEST	1	P
3	The SS sends TRACKING AREA UPDATE ACCEPT message including with LAI set to LAI-2, including a new TMSI (TMSI-2) as MS identity.	<–	TRACKING AREA UPDATE ACCEPT	–	–
4	Check: Does the UE send TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	1	P
5	The SS releases the RRC connection.	–	–	–	–
–	The following messages are sent and shall be received on Cell 7.	–	–	–	–
6	Set cell type of Cell B to the "non-Suitable cell" Set cell type of Cell 7 to the "Serving cell".	–	–	–	–
7	The UE performs Cell Reselection from Cell B (E-UTRAN cell) to Cell 7 (UTRAN cell).	–	–	–	–
8	Void	–	–	–	–
–	EXCEPTION: The behaviour in table 9.2.3.2.1a.3.2-2 occurs in parallel with steps 9-9B.	–	–	–	–
9	Check: Does the UE transmit a ROUTING AREA UPDATE REQUEST message?	–>	ROUTING AREA UPDATE REQUEST	–	–
9A	The SS transmits a ROUTING AREA UPDATE ACCEPT message	<–	ROUTING AREA UPDATE ACCEPT	–	–
9B	The UE transmits a ROUTING AREA UPDATE COMPLETE message	–>	ROUTING AREA UPDATE COMPLETE	–	–
10	The SS send Paging message including an unmatched identity.	<–	Paging	–	–
11	Check: Does the UE transmit RRCConnectionRequest to answer the Paging?	–>	RRCConnectionRequest	3	F
12	The SS send Paging message including a matched identity (UE Identity = TMSI-2).	<–	Paging	–	–
13	Check: Does the test results of Mobile terminated establishment of Radio Resource Connection [5] indicate that the UE transmit RRCConnectionRequest with Initial UE identity set to TMSI-2 and LAI-2 to answers on Paging message?	–	–	4	P
13a	The UE sends a PAGING RESPONSE message	–>	PAGING RESPONSE	–	–
14	The SS releases the RRC connection.	–	–	–	–
–	The following messages are sent and shall be received on Cell A.	–	–	–	–
15	Set cell type of Cell 7 to the "non-Suitable cell" Set cell type of Cell A to the "Serving cell".	–	–	–	–
16	The UE performs Cell Reselection from Cell 7 (UTRAN cell) to Cell A (E-UTRAN cell).	–	–	–	–
17	Check: Does the UE transmit a combined TRACKING AREA UPDATE REQUEST message with Last visited registered TAI set to TAI-2?	–>	TRACKING AREA UPDATE REQUEST	5	P
18	The SS sends TRACKING AREA UPDATE ACCEPT message with LAI set to LAI-1, not including MS identity.	<–	TRACKING AREA UPDATE ACCEPT	–	–
19	The SS releases the RRC connection.	–	–	–	–
–	The following messages are sent and shall be received on Cell 5.	–	–	–	–
20	Set cell type of Cell A to the "non-Suitable cell. Set cell type of Cell 7 to the "non-Suitable “off” cell". " Set cell type of Cell 5 to the "Serving cell".	–	–	–	–
21	The UE performs Cell Reselection from Cell A (E-UTRAN cell) to Cell 5(UTRAN cell).	–	–	–	–
22	Void	–	–	–	–
–	EXCEPTION: The behaviour in table 9.2.3.2.1a.3.2-3 occurs in parallel with steps 23-23B.	–	–	–	–
23	Check: Does the UE transmit a ROUTING AREA UPDATE REQUEST message?	–>	ROUTING AREA UPDATE REQUEST	–	–
23A	The SS transmits a ROUTING AREA UPDATE ACCEPT message	<–	ROUTING AREA UPDATE ACCEPT	–	–
23B	The UE transmits a ROUTING AREA UPDATE COMPLETE message	–>	ROUTING AREA UPDATE COMPLETE	–	–
24	The SS send Paging message including a matched identity (UE Identity = TMSI-2).	<–	Paging	–	–
25	Check: Does the test results of Mobile terminated establishment of Radio Resource Connection [5] indicate that the UE transmit RRCConnectionRequest with Initial UE identity set to TMSI-2 and LAI-1 to answers on Paging message?	–	–	4	P
25a	The UE sends a PAGING RESPONSE message	–>	PAGING RESPONSE	–	–
26	The SS releases the RRC connection.	–	–	–	–
–	The following messages are sent and shall be received on Cell B.	–	–	–	–
27	Set cell type of Cell 5 to the "non-Suitable cell" Set cell type of Cell B to the "Serving cell".	–	–	–	–
28	The UE performs Cell Reselection from Cell 5(UTRAN cell) to Cell B (E-UTRAN cell).	–	–	–	–
29	Check: Does the UE transmit a combined TRACKING AREA UPDATE REQUEST message with Last visited registered TAI set to TAI-1?	–>	TRACKING AREA UPDATE REQUEST	8	P
30	The SS sends TRACKING AREA UPDATE ACCEPT message with LAI set to LAI-2, including the IMSI as MS identity.	<–	TRACKING AREA UPDATE ACCEPT	–	–
–	EXCEPTION: Step 30a is optional for Release 8 to Release 10 UE implementation, from release 11 onwards, UE shall not send this message.	–	–	–	–
30a	The UE sends a TRACKING AREA UPDATE COMPLETE message	–>	TRACKING AREA UPDATE COMPLETE	–	–
31	The SS releases the RRC connection.	–	–	–	–
–	The following messages are sent and shall be received on Cell 7.	–	–	–	–
32	Set cell type of Cell B to the "non-Suitable cell". Set cell type of Cell A to the "non-Suitable “off” cell". Set cell type of Cell 7 to the "Serving cell".	–	–	–	–
33	The UE performs Cell Reselection from Cell B (E-UTRAN cell) to Cell 7 (UTRAN cell).	–	–	–	–
34	Void	–	–	–	–
–	EXCEPTION: The behaviour in table 9.2.3.2.1a.3.2-3 occurs in parallel with steps 35-35B.	–	–	–	–
35	Check: Does the UE transmit a ROUTING AREA UPDATE REQUEST message?	–>	ROUTING AREA UPDATE REQUEST	–	–
35A	The SS transmits a ROUTING AREA UPDATE ACCEPT message	<–	ROUTING AREA UPDATE ACCEPT	–	–
35B	The UE transmits a ROUTING AREA UPDATE COMPLETE message	–>	ROUTING AREA UPDATE COMPLETE	–	–
36	The SS sends Paging message including a TMSI.	<–	Paging	–	–
37	Check: Does the UE transmit RRCConnectionRequest to answer the Paging?	–>	RRCConnectionRequest	10	F

Table: 9.2.3.2.1a.3.2-2: Parallel behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Check: Does the UE perform Location updating procedure?	–>	LOCATION UPDATING REQUEST	–	–
2	The SS transmits an AUTHENTICATION REQUEST message.	<–	AUTHENTICATION REQUEST	–	–
3	The UE transmits an AUTHENTICATION RESPONSE message.	–>	AUTHENTICATION RESPONSE	–	–
4	The SS transmits a LOCATION UPDATING ACCEPT message.	<–	LOCATION UPDATING ACCEPT	–	–

Table: 9.2.3.2.1a.3.2-3: Parallel behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Check: Does the UE perform Location updating procedure?	–>	LOCATION UPDATING REQUEST	–	–
2	The SS transmits a LOCATION UPDATING ACCEPT message.	<–	LOCATION UPDATING ACCEPT	–	–

9.2.3.2.1a.3.3 Specific message contents

Table 9.2.3.2.1a.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 2, Table 9.2.3.2.1a.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Old GUTI	GUTI-1	Old GUTI is included by UE if valid, IMSI otherwise.
Last visited registered TAI	TAI-1	If available, the last TAI is included by UE and will be used to establish a good list of TAIs in subsequent ATTACH ACCEPT message.
Old LAI	LAI-1
TMSI status	Not present

Table 9.2.3.2.1a.3.3-2: Message TRACKING AREA UPDATE ACCEPT (step 3, Table 9.2.3.2.1a.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
T3412 value	Not present
GUTI	Not present	This IE may be included to assign a new GUTI
TAI list
Length of tracking area identity list contents	00000110	6 octets
Number of elements	00000	1 element
Type of list	00	One PLMN with non-consecutive TACs
MCC MNC TAC 1	TAI-2
LAC	2 (LAI-2)
MS identity	TMSI-2
T3402 value	Not present
Equivalent PLMNs	Not present
EMM cause	Not present

Table 9.2.3.2.1a.3.3-3: Message PAGING TYPE 1 (step 10, Table 9.2.3.2.1a.3.2-1)

Derivation path: 34.108 sec 7.1.2.4.1
Information Element	Value/Remark	Comment	Condition
Paging record list
Paging record
CN originator
Paging cause CN domain identity UE identity	Terminating Speech Call CS domain TMSI other than TMSI-2

Table 9.2.3.2.1a.3.3-4: Message PAGING TYPE 1 (step 12, Table 9.2.3.2.1a.3.2-1)

Derivation path: 34.108 sec 7.1.2.4.1
Information Element	Value/Remark	Comment	Condition
Paging record list
Paging record
CN originator
Paging cause CN domain identity UE identity	Terminating Speech Call CS domain TMSI-2

Table 9.2.3.2.1a.3.3-5: Message RRC CONNECTION REQUEST (step 13, Table 9.2.3.2.1a.3.2-1)

Derivation path: 34.108 sec 9.1.1
Information Element	Value/Remark	Comment	Condition
Initial UE identity
TMSI(GSM-MAP) LAI (GSM-MAP)	TMSI-2 LAI-4
Establishment cause	Terminating Conversational Call

Table 9.2.3.2.1a.3.3-6 Message TRACKING AREA UPDATE REQUEST (step 17, Table 9.2.3.2.1a.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Old GUTI	GUTI-1	Old GUTI is included by UE calculated by using UTRAN P-TMSI.
Last visited registered TAI	TAI-2	If available, the last TAI is included by UE and will be used to establish a good list of TAIs in subsequent ATTACH ACCEPT message.
Old LAI	LAI-4
TMSI status	Not present
EPS update type	010	combined TA/LA updating with IMSI attach
Nonce_UE	Any allowed value
Old P-TMSI signature	Present
Additional GUTI	GUTI-1

Table 9.2.3.2.1a.3.3-7: Message TRACKING AREA UPDATE ACCEPT (step 18, Table 9.2.3.2.1a.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
T3412 value	Not present
GUTI	Not present	This IE may be included to assign a new GUTI
TAI list
Length of tracking area identity list contents	00000110	6 octets
Number of elements	00000	1 element
Type of list	00	One PLMN with non-consecutive TACs
MCC MNC TAC 1	TAI-1
LAC	1 (LAI-1)
MS identity	Not present
T3402 value	Not present
Equivalent PLMNs	Not present
EMM cause	Not present

Table 9.2.3.2.1a.3.3-8: Message PAGING TYPE 1 (step 24, Table 9.2.3.2.1a.3.2-1)

Derivation path: 34.108 sec 7.1.2.4.1
Information Element	Value/Remark	Comment	Condition
Paging record list
Paging record
CN originator
Paging cause CN domain identity UE identity	Terminating Speech Call CS domain TMSI-2

Table 9.2.3.2.1a.3.3-9: Message RRC CONNECTION REQUEST (step 25, Table 9.2.3.2.1a.3.2-1)

Derivation path: 34.108 sec 9.1.1
Information Element	Value/Remark	Comment	Condition
Initial UE identity
TMSI(GSM-MAP) LAI (GSM-MAP)	TMSI-2 LAI-3
Establishment cause	Terminating Conversational Call

Table 9.2.3.2.1a.3.3-10: Message TRACKING AREA UPDATE REQUEST (step 29, Table 9.2.3.2.1a.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Old GUTI	GUTI-1	Old GUTI is included by UE calculated by using UTRAN P-TMSI.
Last visited registered TAI	TAI-1	If available, the last TAI is included by UE and will be used to establish a good list of TAIs in subsequent ATTACH ACCEPT message.
Old LAI	LAI-3
TMSI status	Not present
EPS update type	010	combined TA/LA updating with IMSI attach
Nonce_UE	Any allowed value
Old P-TMSI signature	Present
Additional GUTI	GUTI-1

Table 9.2.3.2.1a.3.3-11: Message TRACKING AREA UPDATE ACCEPT (step 30, Table 9.2.3.2.1a.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EPS update result	001	"combined TA/LA"
T3412 value	Not present
GUTI	Not present	This IE may be included to assign a new GUTI
TAI list
Length of tracking area identity list contents	00000110	6 octets
Number of elements	00000	1 element
Type of list	00	One PLMN with non-consecutive TACs
MCC MNC TAC 1	TAI-2
LAC	2(LAI-2)
MS identity	IMSI
T3402 value	Not present
Equivalent PLMNs	Not present
EMM cause	Not present

Table 9.2.3.2.1a.3.3-12: Message PAGING TYPE 1 (step 36, Table 9.2.3.2.1a.3.2-1)

Derivation path: 34.108 sec 7.1.2.4.1
Information Element	Value/Remark	Comment	Condition
Paging record list
Paging record
CN originator
Paging cause CN domain identity UE identity	Terminating Speech Call CS domain TMSI (any value)

Table 9.2.3.2.1a.3.3-13: LOCATION UPDATING REQUEST (step 1, Table 9.2.3.2.1a.3.2-2 and step 1, Table 9.2.3.2.1a.3.2-3)

Derivation Path: TS 36.508 Table 4.7B.2-4
Information Element	Value/remark	Comment	Condition
Location updating type	Normal location updating

Table 9.2.3.2.1a.3.3-14: LOCATION UPDATING ACCEPT (step 4, Table 9.2.3.2.1a.3.2-2 and step 2, Table 9.2.3.2.1a.3.2-3)

Derivation Path: TS 36.508 Table 4.7B.2-5
Information Element	Value/remark	Comment	Condition
Mobile identity	Not present

9.2.3.2.1b Combined tracking area update / Success / SMS only

9.2.3.2.1b.1 Test Purpose (TP)

(1)

with { UE, operating in CS/PS mode 1, has sent a combined TRACKING AREA UPDATE REQUEST message }

ensure that {

when { UE receives a TRACKING AREA UPDATE ACCEPT message containing a GUTI and/or a mobile identity and Additional update result IE ‘SMS only’ and indicating that IMS voice over PS sessions is not supported }

then { UE automatically disable the E-UTRAN capability and performs a registration to UTRAN cell or GERAN cell(depending on the UE capability)}

}

(2)

with { UE, operating in CS/PS mode 2, in state EMM-REGISTERED and state MM-IDLE}

ensure that {

when { UE receives TRACKING AREA UPDATE ACCEPT message with EPS attach result ‘combined EPS/IMSI attach’ and Additional update result IE ‘SMS only’ and SS sends Paging message with PS domain }

then { UE sends SERVICE REQUEST message }

}

(3)

with { UE operating in CS/PS mode 2 and configured to use IMS voice, in state EMM-REGISTERED and state MM-IDLE}

ensure that {

when { UE receives TRACKING AREA UPDATE ACCEPT message with EPS attach result ‘combined EPS/IMSI attach’ and Additional update result IE ‘SMS only’ and the user initiates an IMS voice call}

then { UE does not initiate an IMS voice call}

(4)

with { UE operating in CS/PS mode 1}

ensure that {

when { UE receives TRACKING AREA UPDATE ACCEPT message with EPS updateresult ‘combined EPS/IMSI attach’ and Additional update result IE ‘SMS only’ and indicating that IMS voice over PS sessions is not supported }

then { UE does not set the E-UTRA support bit in the relevant NAS and AS messages}

9.2.3.2.1b.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clauses 4.3.1, 4.5, 4.3.1, 4.5, 5.5.3.3.1, 5.5.3.3.2, 5.5.3.3.4.1, 5.5.3.3.4.2 and 5.6.2.4.

[TS 24.301 clause 4.3.1]

The behaviour of the UE in CS/PS mode 1 of operation, upon failure to access the CS domain or upon reception of a "CS fallback not preferred" or "SMS only" indication, will depend on the availability of voice over IMS. In the present document, "IMS voice not available" refers to one of the following conditions:

– the UE is not configured to use IMS;

– the UE is not configured to use IMS voice, i.e. when the voice domain preference for E-UTRAN, as defined in 3GPP TS 24.167 [13B], indicates that voice communication services are allowed to be invoked only over the CS domain;

– the UE is configured to use IMS voice, but the network indicates in the ATTACH ACCEPT message or the TRACKING AREA UPDATE ACCEPT message that IMS voice over PS sessions are not supported; or

– the UE is configured to use IMS voice, the network indicates in the ATTACH ACCEPT message or the TRACKING AREA UPDATE ACCEPT message that IMS voice over PS sessions are supported, but the upper layers indicate that the UE is not available for voice calls in the IMS.

[TS 24.301 clause 4.5]

When the UE supporting the A/Gb and/or Iu mode together with the S1 mode needs to stay in A/Gb or Iu mode, in order to prevent unwanted handover or cell reselection from UTRAN/GERAN to E-UTRAN, the UE shall disable the E-UTRA capability.

– The UE shall not set the E-UTRA support bits of the MS Radio Access capability IE (see 3GPP TS 24.008 [13], subclause 10.5.5.12a), the E-UTRA support bits of Mobile Station Classmark 3 IE (see 3GPP TS 24.008 [13], subclause 10.5.1.7) and the ISR support bit of the MS network capability IE (see 3GPP TS 24.008 [13], subclause 10.5.5.12) in the ATTACH REQUEST message and the ROUTING AREA UPDATE REQUEST message after it selects GERAN or UTRAN; and

– the UE NAS layer shall indicate the access stratum layer(s) of disabling of the E-UTRA capability.

NOTE: The UE can only disable the E-UTRAN capabilities when in EMM-IDLE mode.

The UE shall enable the E-UTRA capability again in the following cases:

– the UE mode of operation changes from CS/PS mode 1 of operation to CS/PS mode 2 of operation;

– the UE mode of operation changes from PS mode 1 of operation to PS mode 2 of operation;

– the UE powers off and powers on again; or

– for the PLMN selection purpose.

[TS 24.301 clause 5.5.3.3.1]

The combined tracking area updating procedure follows the normal tracking area updating procedure described in subclause 5.5.3.2.

[TS 24.301 clause 5.5.3.3.2]

…

If the UE initiates the combined tracking area updating procedure for EPS services and "SMS only", the UE shall indicate "SMS only" in the Additional update Type IE.

[TS 24.301 clause 5.5.3.3.4.1]

Depending on the value of the EPS update result IE received in the TRACKING AREA UPDATE ACCEPT message, the following different cases can be distinguished:

1) The EPS update result IE value indicates "combined TA/LA updated": Tracking and location area updating is successful for EPS and non-EPS services, or for EPS services and "SMS only";

…

A TRACKING AREA UPDATE COMPLETE message shall be returned to the network if the TRACKING AREA UPDATE ACCEPT message contains a GUTI or a mobile identity or both.

[TS 24.301 clause 5.5.3.3.4.2]

The description for normal tracking area update as specified in subclause 5.5.3.2.4 shall be followed. In addition, the following description for location area updating applies.

…

If the UE requested "SMS only" in the Additional update type IE, the network shall indicate "SMS only" in the Additional update result IE.

If the TRACKING AREA UPDATE ACCEPT message includes the Additional update result IE with value "SMS only" or "CS Fallback not preferred", a UE operating in CS/PS mode 1 with "IMS voice not available" shall attempt to select GERAN or UTRAN radio access technology rather than E-UTRAN for the selected PLMN or equivalent PLMN. The UE shall disable the E-UTRA capability (see subclause 4.5). If the UE is in the EMM-CONNECTED mode, the UE shall locally release the established NAS signalling connection and enter the EMM-IDLE mode before selecting GERAN or UTRAN radio access technology.

If the TRACKING AREA UPDATE ACCEPT message includes the Additional update result IE with value "SMS only", a UE operating in CS/PS mode 2 shall not attempt to use CS fallback for mobile originating services.

…

[TS 24.301 clause5.6.2.4]

The network shall initiate the paging procedure when it receives an incoming mobile terminating SMS to the UE that is IMSI attached for non-EPS services or for "SMS only", and no NAS signalling connection exists.

To initiate the procedure for SMS when no NAS signalling connection exists, the EMM entity in the network requests the lower layer to start paging (see 3GPP TS 36.413 [23]). The paging message shall include a CN domain indicator set to "PS". The paging procedure is performed according to subclause 5.6.2.2.1. The MME shall not start timer T3413 for this procedure.

9.2.3.2.1b.3 Test description

9.2.3.2.1b.3.1 Pre-test conditions

System Simulator:

– Cell A and Cell B are configured according to Table 6.3.2.2-1 in [18].

– Cell A belongs to TAI-1(home PLMN) is set to ”Serving Cell”.

– Cell B belongs to TAI-2(home PLMN and another TAC) is set to ”Non-Suitable cell”

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 5 (belongs to LAI-1 and RAI-1, home PLMN) is set to the ”Non-Suitable cell”;

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, cell 24 (belongs to LAI-1 and RAI-1, home PLMN); is set to the ”Non-Suitable cell”;

– System information combination 10a as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

NOTE: Setting px_RATComb_Tested = EUTRA_Only is not allowed.

UE:

– The UE is configured to initiate combined EPS/IMSI attach.

Preamble:

– The UE is in state Registered, Idle Mode (state 2) on cell A according to [18].

9.2.3.2.1b.3.2 Test procedure sequence

Table 9.2.3.2.1b.3.2-1: Main Behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
	The following messages are sent and shall be received on Cell B	–	–	–	–
1	Set the cell type of cell A to the ”Non-Suitable cell”. Set the cell type of cell B to the ”Serving cell”. Set the cell type of cell 5 or cell 24 to ”Suitable neighbour cell”.
2	UE transmits a combined TRACKING AREA UPDATE REQUEST message.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS sends TRACKING AREA UPDATE ACCEPT message including GUTI, TMSI and LAI. The TAI list includes TAI for cell C and cell D.	<–	TRACKING AREA UPDATE ACCEPT	–	–
4	Void			–	–
5	Void			–	–
–	EXCEPTION: Steps 6a1 to 6b2 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported	–	–	–	–
6a1	IF CS/PS mode 1 of operation is configured on the UE THEN perform actions specified in Table 9.2.3.2.1b.3.2-2.
6a2-6a6	Void
6b1	ELSE the UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
6b1A1	The SS releases the RRC connection.	–	–	–	–
6b2	Check: Does the UE respond to paging on cell B with S-TMSI in GUTI-2 for PS domain?(Generic Procedure TS 36.508 6.4.2.4)	–	–	2	–
–	EXCEPTION: Steps 6b3a1 to 6b3a2 describe behaviour that depends on the UE capability.	–	–	–	–
6b3 a1	IF pc_VoLTE THEN an IMS voice call is initiated (see Note 1)	–	–	–	–
6b3a2	Check: Does the UE send RRC CONNECTION REQUEST message?	–>	RRC CONNECTION REQUEST	3	F
Note 1: The request may be triggered by AT command D.

Table 9.2.3.2.1b.3.2-2: CS/PS mode 1 of operation behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
–	EXCEPTION: Step 1a1 to 1b2 are optional and depend on UE implementation. They shall be executed if the UE sends a TRACKING AREA UPDATE COMPLETE or a DETACH REQUEST message during [2] seconds. The "lower case letter" identifies a step sequence that takes place if a particular condition specified in the first step is met.	–	–	–	–
1a1	IF UE sent a TRACKING AREA UPDATE COMPLETE message	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	EXCEPTION: Steps 1a2a1 to 1a2a2 are optional and depend on UE implementation; the second "lower case letter" identifies a step sequence that takes place if the condition is met.	–	–	–	–
1a2a1	IF UE sends a DETACH REQUEST message during [2] seconds.	–>	DETACH REQUEST	–	–
1a2a2	SS sends a DETACH ACCEPT message.	<–	DETACH ACCEPT	–	–
1a2a3	The SS releases the RRC connection.
1b1	IF UE sent a DETACH REQUEST message.	–>	DETACH REQUEST	–	–
1b2	SS sends a DETACH ACCEPT message.	<–	DETACH ACCEPT	–	–
1b3	The SS releases the RRC connection.
2	Void
–	The following messages are to be observed on Cell 5 or Cell 24 unless explicitly stated otherwise.	–	–	–	–
–	EXCEPTION: Step 3a1 to 3b5 are optional and depend on UE implementation. The "lower case letter" identifies a step sequence that takes place if a particular condition specified in the first step is met.
3a1	IF UE did not sent DETACH REQUEST in step 1a2a1 or 1b1 AND UE transmits a ROUTING AREA UPDATE REQUEST message during [2] seconds THEN check contents of ROUTING AREA UPDATE REQUEST	–>	ROUTING AREA UPDATE REQUEST	1,4	P
–	EXCEPTION: step 3a1Aa1 to 3a1Aa2 take place if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN	–	–	–	–
3a1Aa1	The SS transmits an AUTHENTICATION AND CIPHERING REQUEST message from Cell 24	<–	AUTHENTICATION AND CIPHERING REQUEST	–	–
3a1Aa2	The UE transmits a AUTHENTICATION AND CIPHERING RESPONSE message on Cell 24	–>	AUTHENTICATION AND CIPHERING RESPONSE	–	–
3a2	The SS transmits a ROUTING AREA UPDATE ACCEPT message.	<–	ROUTING AREA UPDATE ACCEPT	–	–
3a3	The UE transmits a ROUTING AREA UPDATE COMPLETE message.	–>	ROUTING AREA UPDATE COMPLETE	–	–
3b1	ELSE check: Does the UE transmit an ATTACH REQUEST message?	–>	ATTACH REQUEST	1,4	P
–	EXCEPTION: Step 3b2 to 3b3 are performed if UE sent a DETACH REQUEST in step 1a2a1 or 1b1	–	–	–	–
3b2	The SS transmits an AUTHENTICATION AND CIPHERING REQUEST message.	<–	AUTHENTICATION AND CIPHERING REQUEST	–	–
3b3	The UE transmits a AUTHENTICATION AND CIPHERING RESPONSE message.	–>	AUTHENTICATION AND CIPHERING RESPONSE	–	–
3b4	The SS transmits an ATTACH ACCEPT message.	<–	ATTACH ACCEPT	–	–
3b5	The UE transmits an ATTACH COMPLETE message.	–>	ATTACH COMPLETE	–	–
3b6	The UE may attempt the generic procedures for IMS signalling defined in 36.508 4.5A.3A (for cell 5) or 4.5A.3B (for cell 24)	–	–	–	–

9.2.3.2.1b.3.3 Specific message contents

Table 9.2.3.2.1b.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 2, Table 9.2.3.2.1b.3.2-1)

Derivation path: 36.508 table 4.7.2-27 with condition combined_TA_LA
Information Element	Value/Remark	Comment	Condition
Old GUTI	GUTI-1	GUTI-1 was allocated in cell A during the preamble
Last visited registered TAI	TAI-1	TAI of cell A
Old location area identification	LAI-1	LAI received in the ATTACH ACCEPT message in the preamble
TMSI status	0	no valid TMSI available

Table 9.2.3.2.1b.3.3-2: Message TRACKING AREA UPDATE ACCEPT (step 3, Table 9.2.3.2.1b.3.2-1)

Derivation path: 36.508 table 4.7.2-24 with condition combined_TA_LA
Information Element	Value/Remark	Comment	Condition
GUTI	GUTI-2
TAI list
Length of tracking area identity list contents	‘00000110’B	6 octets
Type of list	’00’B	list of TACs belonging to one PLMN, with non-consecutive TAC values
Number of elements	‘00000’	1 elements
Partial tracking area identity list	PLMN = MCC/MNC stored in EF_IMSI TAC 1 = 2	TAI-2
EPS network feature support	0000 0000’B	MS voice over PS session in S1 mode NOT supported
Additional update result	’10’B	SMS only

Table 9.2.3.2.1b.3.3-3: Void

Table 9.2.3.2.1b.3.3-4: Message ROUTING AREA UPDATE REQUEST (step 3a1, Table 9.2.3.2.1b.3.2-2)

Derivation path: 36.508 table 4.7B.2-1
Information Element	Value/Remark	Comment	Condition
MS Radio Access capability		The UE shall not indicate support for E-UTRAN
MS RA capability value part
Access capabilities
E-UTRA FDD support :	‘0’B
E-UTRA TDD support	‘0’B
GERAN to E-UTRA support in GERAN packet transfer mode	‘00’B
UE network capability	Not Present	UE does not support S1 mode any more

Table 9.2.3.2.1b.3.3-5: Message ATTACH REQUEST (step 3b1, Table 9.2.3.2.1b.3.2-2)

Derivation path: 36.508 table 4.7B.2-6
Information Element	Value/Remark	Comment	Condition
MS Radio Access capability		The UE shall not indicate support for E-UTRAN
MS RA capability value part
Access capabilities
E-UTRA FDD support :	‘0’B
E-UTRA TDD support	‘0’B
GERAN to E-UTRA support in GERAN packet transfer mode	‘00’B
UE network capability	Not Present	UE does not support S1 mode any more

Table 9.2.3.2.1b.3.3-6: Message ATTACH ACCEPT (Preamble)

Derivation Path: TS 36.508, Table 4.7.2-1
Information Element	Value/remark	Comment	Condition
EPS network feature support	0000 0000’B	IMS voice over PS session in S1 mode not supported

9.2.3.2.1c Combined tracking area update / Success / CS Fallback not preferred

9.2.3.2.1c.1 Test Purpose (TP)

(1)

with { UE operating in CS/PS mode 2 in state EMM-REGISTERED-INITIATED}

ensure that {

when { UE receives a TRACKING AREA UPDATE ACCEPT message with “EPS network feature support” IE indicating that “IMS voice over PS session in S1 mode NOT supported” and “Additional update result” IE indicating “CS Fallback not preferred”}

then { UE stays on the E-UTRAN cell.}

}

(2)

with { UE operating in CS/PS mode 2}

ensure that {

when receives a TRACKING AREA UPDATE ACCEPT message with “EPS network feature support” IE indicating that “IMS voice over PS session in S1 mode NOT supported” and “Additional update result” IE indicating “CS Fallback not preferred” }

then { The UE is able to initiate an MO-CS fallback call}

}

(3)

with { UE operating in CS/PS mode 2}

ensure that {

then { The UE is able to receive MT CS fallback call}

}

9.2.3.2.1c.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: 3GPP TS 24.301 clauses 4.3.1 and 5.5.3.3.4.2.

[TS 24.301 clause 4.3.1]

– the UE is not configured to use IMS;

– the UE is configured to use IMS voice, but the network indicates in the ATTACH ACCEPT message or the TRACKING AREA UPDATE ACCEPT message that IMS voice over PS sessions are not supported; or

[TS 24.301 clause 5.5.3.3.4.2]

If the TRACKING AREA UPDATE ACCEPT message includes the Additional update result IE with value "CS Fallback not preferred", this indicates to a UE operating in CS/PS mode 2 that it is attached for EPS and non-EPS services and that it can use CS fallback.

9.2.3.2.1c.3 Test description

9.2.3.2.1c.3.1 Pre-test conditions

System Simulator:

cell A, cell B and cell 5;

System information combination 9 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells

UE:

– the UE is configured to initiate combined EPS/IMSI attach;

– the UE is configured to be data centric.

– the UE is previously registered on cell 5.

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell A using default message contents according to TS 36.508 [18].

Preamble:

– if possible, the UE is configured to operate in CS/PS mode 2

– The UE is in state Registered, Idle mode (state 2) on Cell A (serving cell) according to [18].

9.2.3.2.1c.3.2 Test procedure sequence

Table 9.2.3.2.1c.3.2-1illustrates the downlink power levels and other changing parameters to be applied for the cells at various time instants of the test execution. Configurations marked "T1" is applied at the point indicated in the Main behaviour description in Table 9.2.3.2.1c.3.2-2.

Table 9.2.3.2.1c.3.2-1: instances of cell power level and parameter changes

	Parameter name	Unit	Cell A	Cell B	Cell 5
T1	RS EPRE	dBm/15kHz	-91	-85
	CPICH_Ec	dBm/3.84 MHz			-70
	P-CCPCH	dBm/1.28 MHz			-70
T2	RS EPRE	dBm/15kHz	-115	-115
	CPICH_Ec	dBm/3.84 MHz			-70
	P-CCPCH	dBm/1.28 MHz			-70
T3	RS EPRE	dBm/15kHz	-91	-85
	CPICH_Ec	dBm/3.84 MHz			-70
	P-CCPCH	dBm/1.28 MHz			-70
T4	RS EPRE	dBm/15kHz	OFF	OFF
	CPICH_Ec	dBm/3.84 MHz			-70
	P-CCPCH	dBm/1.28 MHz			-70

Table 9.2.3.2.1c.3.2-2: Main Behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	SS adjust the cell power levels according to row T1 in table 9.2.3.2.1c.3.2-1.			–	–
2-7	Steps 2-7 of the tracking area updating procedure on cell B as described in TS 36.508 table 4.5A.2.1-1 are performed.			–	–
8	Check: Does the UE try to access the UTRAN cell (cell 5) in the next 90s?			1	F
10-13	Steps 1-4 of the procedure in table 13.1.4.3.2-2 are performed.	–	–	–	–
–	The UE accepts CS fallback	–	–	–	–
14	Check: Does the UE transmit an RRCConnectionSetupComplete message containing an EXTENDED SERVICE REQUEST with message content set the same as in step 5 table 13.1.4.3.2-2?	–>	RRCConnectionSetupComplete NAS: EXTENDED SERVICE REQUEST	3	P
15-26	Steps 5A-19 of the procedure described in table 13.1.4.3.2-2 are performed. SS then adjusts the cell power levels according to row T2 in table 9.2.3.2.1c.3.2-1.	–	–	–	–
26A	CS disconnect procedure defined in TS 36.523-3 table 10.1.3.1-1 is performed. SS then adjusts the cell power levels according to row T3 in table 9.2.3.2.1c.3.2-1 so ensure UE reselects cell B.	–	–	–	–
26B-26G	Steps 2-7 of the tracking area updating procedure on cell B as described in TS 36.508 table 4.5A.2.1-1 are performed.	–	–	–	–
27-27B	Steps 1-3 of the procedure in table 13.1.2.3.2-1. (A CS call is initiated) are performed	–	–	–	–
28	Check: Does the UE transmit EXTENDED SERVICE REQUEST message with the content set as in step 4 of table 13.1.2.3.2-1?	–>	EXTENDED SERVICE REQUEST	2	P
29-33	Steps 8-12 of the procedure in table 13.1.2.3.2-1 are performed.	–	–	–	–
34	SS adjusts cell levels according to row T4 of table 9.2.3.2.1c.3.2-1.
–	The UE is in end state UTRA CS fallback (U4).	–	–	–	–

9.2.3.2.1c.3.3 Specific message contents

Table 9.2.3.2.1c.3.3-1: Message TRACKING AREA UPDATE ACCEPT (steps 5 and 26C, Table 9.2.3.2.1c.3.2-2)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark	Comment	Condition
EPS update result	‘001’B	"combined TA/LA updated"
EPS network feature support	‘0000 0000’B	IMS voice over PS session in S1 mode NOT supported
Additional update result	‘01’b	“CS Fallback not preferred”

Table 9.2.3.2.1c.3.3-2: Message TRACKING AREA UPDATE REQUEST (step 26B, Table 9.2.3.2.1c.3.2-2)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type
EPS update type Value	‘010’B	"Combined TA/LA updating with IMSI attach”
Old P-TMSI Signature	Any Value
Additional GUTI	Any Value
Nonce	Any Value

Table 9.2.3.2.1c.3.3-3: Message ATTACH ACCEPT (Preamble)

Derivation Path: TS 36.508, Table 4.7.2-1
Information Element	Value/remark	Comment	Condition
EPS network feature support	0000 0000’B	IMS voice over PS session in S1 mode not supported

9.2.3.2.2 Combined tracking area update / Successful for EPS services only / IMSI unknown in HSS

9.2.3.2.2.1 Test Purpose (TP)

(1)

with { UE has sent a combined TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘Combined TA/LA updating’ }

ensure that {

when { UE receives a TRACKING AREA UPDATE ACCEPT message with EPS update result set to "TA updated" and EMM cause set to "IMSI unknown in HSS" }

then { UE considers the USIM as invalid for non-EPS services and enters EMM-REGISTERED.NORMAL-SERVICE state and MM idle state }

}

9.2.3.2.2.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clauses 5.5.3.3.4.3.

[TS 24.301 clause 5.5.3.3.4.3]

Apart from the actions on the tracking area updating attempt counter, the description for tracking area for EPS services as specified in subclause 5.5.3.2.4 shall be followed. In addition, the following description for location updating for non-EPS services applies.

The UE receiving the TRACKING AREA UPDATE ACCEPT message takes one of the following actions depending on the EMM cause value:

#2 (IMSI unknown in HSS)

The UE shall stop T3430 if still running and shall reset the tracking area updating attempt counter. The UE shall set the update status to U3 ROAMING NOT ALLOWED and shall delete any TMSI, LAI and ciphering key sequence number. The UE shall enter state EMM-REGISTERED.NORMAL-SERVICE. The new MM state is MM IDLE. The USIM shall be considered as invalid for non-EPS services until switching off or the UICC containing the USIM is removed.

…

9.2.3.2.2.3 Test description

9.2.3.2.2.3.1 Pre-test conditions

System Simulator:

– cell A (belongs to TAI-1) is set to ”Serving cell”;

– cell B (belongs to TAI-2) is set to ”Non-suitable cell”.

– System information combination 3 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

UE:

– the UE is configured to initiate combined attach

Preamble:

– the UE is in state Registered, Idle mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.2.2.3.2 Test procedure sequence

Table 9.2.3.2.2.3.2-1: Main Behaviour

St	Procedure		Message Sequence				TP		Verdict
			U – S		Message
1	Set the cell type of cell A to the "non-Suitable cell". Set the cell type of cell B to the "Serving cell".		–		–		–		–
–	The following messages are sent and shall be received on cell B.
2	The UE transmits a combined TRACKING AREA UPDATE REQUEST message.		–>		TRACKING AREA UPDATE REQUEST		–		–
3	The SS transmits a TRACKING AREA UPDATE ACCEPT message with EPS update result set to "TA updated" and EMM cause set to "IMSI unknown in HSS"		<–		TRACKING AREA UPDATE ACCEPT		–		–
3A	The UE transmits a TRACKING AREA UPDATE COMPLETE message		–>		TRACKING AREA UPDATE COMPLETE		–		–
4	The SS releases the RRC connection.		–		–		–		–
5	The SS pages the UE using S-TMSI with CN domain indicator set to “PS”.		<–		–		–		–
6	The UE transmits a SERVICE REQUEST message.		–>		SERVICE REQUEST		–		–
7	The SS transmits a DETACH REQUEST message with Detach Type set to "re-attach required"		<–		DETACH REQUEST		–		–
8	The UE sends a DETACH ACCEPT message.		–>		DETACH ACCEPT		–		–
9	The SS releases the RRC connection.		–		–		–		–
–	EXCEPTION: Step 9a describes a behaviour which depends on the UE capability		–		–		–		–
9a	IF NOT pc_Automatic_Re_Attach, the user initiates an attach by MMI or by AT command.		–		–		–		–
10	Check: Does the UE send ATTACH REQUEST message with EPS attach type set to “EPS attach”, including a PDN CONNECTIVITY REQUEST message?		–>		ATTACH REQUEST		1		P
11-19	Steps 5 to 13 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.		–		–		–		–
20	The SS sends ATTACH ACCEPT message with the ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message.		<–		ATTACH ACCEPT		–		–
20A	The UE transmits an RRCConnectionReconfigurationComplete message to confirm the establishment of default bearer.	–>		RRC: RRCConnectionReconfigurationComplete		–		–
21-23b1	Steps 16 to 18b1 of the generic procedure for UE registration specified in TS 36.508 subclause 4.5.2.3 are performed.		–		–		–		–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.		–		–		–		–

9.2.3.2.2.3.3 Specific message contents

Table 9.2.3.2.2.3.3-1: Message TRACKING AREA UPDATE REQ (step 2, Table 9.2.3.2.2.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type	001	"combined TA/LA updating"
Old GUTI	GUTI-1	Old GUTI is included by UE if valid, IMSI otherwise.
Last visited registered TAI	TAI-1	If available, the last TAI is included by UE and will be used to establish a good list of TAIs in subsequent ATTACH ACCEPT message.
Old P-TMSI signature	Not present
Old LAI	LAI-1
TMSI status	Not present

Table 9.2.3.2.2.3.3-2: Message TRACKING AREA UPDATE ACCEPT (step 3, Table 9.2.3.2.2.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EPS update result	000	"TA updated"
T3412 value	Not present
GUTI	GUTI-2
TAI list
Length of tracking area identity list contents	00000110	6 octets
Number of elements	00000	1 element
Type of list	00	One PLMN with non-consecutive TACs
MCC MNC TAC 1	TAI-2
LAC	Not present
MS identity	Not present
T3402 value	Not present
Equivalent PLMNs	Not present
EMM cause	00000010	"IMSI unknown in HSS"

Table 9.2.3.2.2.3.3-3: Message DETACH REQUEST (step 7, Table 9.2.3.2.2.3.2-1)

Derivation path: 36.508 table 4.7.2-12
Information Element	Value/Remark	Comment	Condition
Detach type	001	"re-attach required"

Table 9.2.3.2.2.3.3-4: Message ATTACH REQUEST (step 10, Table 9.2.3.2.2.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
EPS attach type	001	“EPS attach”

Table 9.2.3.2.2.3.3-5: Message ATTACH ACCEPT (step 20, Table 9.2.3.2.2.3.2-1)

Derivation path: 36.508 table 4.7.2-1
Information Element	Value/Remark	Comment	Condition
EPS attach result	‘001’B	”EPS only”

9.2.3.2.3 Combined tracking area update / Successful for EPS services only / MSC temporarily not reachable

9.2.3.2.3.1 Test Purpose (TP)

(1)

with { UE having sent a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘Combined TA/LA updating’ or ‘Combined TA/LA updating with IMSI attach’ and having the tracking area updating attempt counter set to the value less than four }

ensure that {
when { UE receives a TRACKING AREA UPDATE ACCEPT message with the EPS update result set to ‘TA updated’ and the EMM cause set to ‘MSC temporarily not reachable’ or ‘Network failure’ }

then { UE sends TRACKING AREA UPDATE REQUEST message after T3411 expiry }

}

(2)

with { UE having sent a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘Combined TA/LA updating with IMSI attach’, having the tracking area updating attempt counter set to four and operating in CS/PS mode 2 of operation }

then { UE sends TRACKING AREA UPDATE REQUEST message after T3402 expiry }

}

(3)

then { UE attempts to select GERAN or UTRAN radio access technology }

}

9.2.3.2.3.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.3.3.4.3, TS 24.301, clause 4.5.

[TS 24.301, clause 5.5.3.3.4.3]

…

#16 (MSC temporarily not reachable); or

#17 (Network failure)

The UE shall stop timer T3430 if still running. The tracking area updating attempt counter shall be incremented, unless it was already set to 5.

If the tracking area updating attempt counter is less than 5:

– the UE shall start timer T3411, shall set the EPS update status to EU1 UPDATED and shall enter state EMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM. When timer T3411 expires the combined tracking area updating procedure indicating "combined TA/LA updating with IMSI attach" is triggered again.

If the tracking area updating attempt counter is equal to 5:

– a UE operating in CS/PS mode 2 of operation shall start timer T3402, shall set the EPS update status to EU1 UPDATED and shall enter state EMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM. When timer T3402 expires the combined tracking area updating procedure indicating "combined TA/LA updating with IMSI attach" is triggered again;

– a UE operating in CS/PS mode 1 of operation with "IMS voice not available" shall attempt to select GERAN or UTRAN radio access technology and proceed with appropriate MM or GMM specific procedures. The UE shall disable the E-UTRA capability (see subclause 4.5).

…

[TS 24.301, clause 4.5]

– the UE shall use the same value of the EPC capability bit of the MS network capability IE (see 3GPP TS 24.008 [13], subclause 10.5.5.12) in the ATTACH REQUEST message and the ROUTING AREA UPDATE REQUEST message;

– the UE NAS layer shall indicate the access stratum layer(s) of disabling of the E-UTRA capability ; and

– the UE shall change the MS network capability IE (see 3GPP TS 24.008 [13], subclause 10.5.5.12) in the ATTACH REQUEST message and the ROUTING AREA UPDATE REQUEST message after it selects GERAN or UTRAN if any capability bit is subject to change after disabling of the UE’s E-UTRA capability.NOTE: The UE can only disable the E-UTRAN capabilities when in EMM-IDLE mode.

The UE shall enable the E-UTRA capability again in the following cases:

– the UE mode of operation changes from CS/PS mode 1 of operation to CS/PS mode 2 of operation;

– the UE mode of operation changes from PS mode 1 of operation to PS mode 2 of operation; or

– the UE powers off and powers on again.

…

9.2.3.2.3.3 Test description

9.2.3.2.3.3.1 Pre-test conditions

System Simulator:

– cell A and cell B;

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 5 (belongs to LAI-1 and RAI-1, home PLMN) is configured;

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, cell 24 (belongs to LAI-1 and RAI-1, home PLMN) is configured;

– System information combination 10a as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

NOTE: Setting px_RATComb_Tested = EUTRA_Only is not allowed.

UE:

– the UE is configured to initiate combined EPS/IMSI attach.

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.3.2.3.3.2 Test procedure sequence

The sequence is executed for execution counter k = 1, 2.

Table 9.2.3.2.3.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
0	Set the cell type of Cell A to the "Serving cell". Set the cell type of Cell B to the "non-Suitable cell". Set the cell type of Cell 5 or Cell 24 to the "non-Suitable cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
0A	The UE is switched on or the USIM is inserted or the UE is powered on.	–	–	–	–
0B-0M	Steps 2-13 of the generic test procedure in TS 36.508 subclause 4.5.2.3 is performed. NOTE: The UE performs an ATTACH procedure	–	–	–	–
0N	The SS transmits an ATTACH ACCEPT message	<-	ATTACH ACCEPT
0O-0Qb1	Steps 16-18b1 of the generic test procedure in TS 36.508 subclause 4.5.2.3 is performed. NOTE: The UE completes the ATTACH procedure and the RRC connection is released.
1	Set the cell type of Cell A to the "non-Suitable cell". Set the cell type of Cell B to the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
2	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	–	–
3	Void	–	–	–	–
4	Void	–	–	–	–
5	The SS transmits a TRACKING AREA UPDATE ACCEPT message. Note: T3411 is started on the UE	<–	TRACKING AREA UPDATE ACCEPT	–	–
6	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
7	The SS releases the RRC connection.	–	–	–	–
–	EXCEPTION: The step 8 to 13 shall be repeated 3 times.	–	–	–	–
8	Wait for 10s for T3411 to expire.	–	–	–	–
9	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message at the time when T3411 expired?	–>	TRACKING AREA UPDATE REQUEST	1	P
10	Void	–	–	–	–
11	Void	–	–	–	–
12	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
13	The SS releases the RRC connection.	–	–	–	–
13A1	Set the cell type of cell 5 or cell 24 to ”Suitable neighbour cell” and wait for 10s for T3411 to expire.	–	–	–	–
13A2	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message at the time when T3411 expired?	–>	TRACKING AREA UPDATE REQUEST	1	P
13A3	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
14-19	Void	–	–	–	–
–	EXCEPTION: Steps 20a1 to 20b17 describe behaviour that depends on UE configuration; the "lower case letter" identifies a step sequence that takes place according to UE mode of operation.	–	–	–	–
20a1	IF the UE is configured to operate in CS/PS mode 2 THEN the SS releases the RRC connection. Note: T3402 is started on the UE.	–	–	–	–
20a2	The SS waits for 30 sec for T3402 to expire.	–	–	–	–
20a3	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	2	P
20a4	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
20a5	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
20a6	The SS releases the RRC connection.	–	–	–	–
20a7	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
–	EXCEPTION: Step 20a8 describes behaviour that depends on the UE capability.
20a8	If pc_SwitchOnOff or pc_USIM_Removal then the UE transmits a DETACH REQUEST message.	–>	DETACH REQUEST	–	–
20b1-20b16	Void	–	–	–	–
20b17	IF the UE is configured in CS/PS mode 1 of operation with “IMS voice not available” THEN perform actions specified in Table 9.2.3.2.3.3.2-2	–	–	–	–
21	Void	–	–	–	–

Table 9.2.3.2.3.3.2-2: CS/PS mode 1 of operation behaviour

–	EXCEPTION: Step 1a1 to 1a2 are optional and depend on UE implementation. They shall be executed if the UE sends a DETACH REQUEST message during [2] seconds. The "lower case letter" identifies a step sequence that takes place if a particular condition specified is met.	–	–	–	–
1a1	UE sends a DETACH REQUEST message.	–>	DETACH REQUEST	–	–
1a2	The SS transmits a DETACH COMPLETE message.	<–	DETACH COMPLETE	–	–
2	The SS releases the RRC connection.	–	–	–	–
–	The following messages are to be observed on Cell 5 or Cell 24 unless explicitly stated otherwise.	–	–	–	–
–	EXCEPTION: Step 3a1 to 3b5 are optional and depend on UE implementation. The "lower case letter" identifies a step sequence that takes place if a particular condition specified in the first step is met.	–	–	–	–
3a1	IF UE has not sent a DETACH REQUEST in step 1a1 AND sends a ROUTING AREA UPDATE REQUEST message during [2] seconds THEN check contents of ROUTING AREA UPDATE REQUEST.	–>	ROUTING AREA UPDATE REQUEST	3	P
–	EXCEPTION: step 3a1Aa1 to 3a1Aa2 take place if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN	–	–	–	–
3a1Aa1	The SS transmits an AUTHENTICATION AND CIPHERING REQUEST message on Cell 24	<–	AUTHENTICATION AND CIPHERING REQUEST	–	–
3a1Aa2	The UE transmits an AUTHENTICATION AND CIPHERING RESPONSE message on Cell 24	–>	AUTHENTICATION AND CIPHERING RESPONSE	–	–
3a2	The SS transmits a ROUTING AREA UPDATE ACCEPT message.	<–	ROUTING AREA UPDATE ACCEPT	–	–
3a3	The UE transmits a ROUTING AREA UPDATE COMPLETE message.	–>	ROUTING AREA UPDATE COMPLETE	–	–
3b1	ELSE Check: Does the UE transmit an ATTACH REQUEST message?	–>	ATTACH REQUEST	3	P
–	EXCEPTION: Step 3b2 to 3b3 are performed if UE sent a DETACH REQUEST in step 1a1	–	–	–	–
3b2	The SS transmits an AUTHENTICATION AND CIPHERING REQUEST message.	<–	AUTHENTICATION AND CIPHERING REQUEST	–	–
3b3	The UE transmits an AUTHENTICATION AND CIPHERING RESPONSE message.	–>	AUTHENTICATION AND CIPHERING RESPONSE	–	–
3b4	The SS transmits an ATTACH ACCEPT message.	<–	ATTACH ACCEPT	–	–
3b5	The UE transmits an ATTACH COMPLETE message.	–>	ATTACH COMPLETE	–	–
4	The SS releases the RRC connection.	–	–	–	–
–	Exception: Steps 4AAa1 to 4AAa1b1 describe optional behaviour that depend on the UE capability.	–	–	–	–
4AAa1	IF UE has sent ROUTING AREA REQUEST at step 3a1 AND pc_IMS = TRUE THEN SS starts 6s timer	–	–	–	–
4AAa1a1- 4AAa1a4a6	The procedure defined in TS 36.523-3 Table 10.1.2.1-2 Steps 1-4a6 is performed	–	–	–	–
4AAa1a5	SS releases RRC Connection	–	–	–	–
4AAa1a6	SS Stops 6s timer	–	–	–	–
4AAa1b1	The 6s timer expires	–	–	–	–
4A	The UE may attempt the generic procedures for IMS signalling defined in 36.508 4.5A.3A (for cell 5) or 4.5A.3B (for cell 24)	–	–	–	–
5	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
–	EXCEPTION: Step 6 describes behaviour that depends on the UE capability.
6	If pc_SwitchOnOff or pc_USIM_Removal then the UE transmits a DETACH REQUEST message	–>	DETACH REQUEST	–	–

9.2.3.2.3.3.3 Specific message contents

Table 9.2.3.2.3.3.3-0: Message ATTACH ACCEPT (step 0N, Table 9.2.3.2.3.3.2-1)

Derivation Path: TS 36.508, Table 4.7.2-1
Information Element	Value/remark	Comment	Condition
EPS network feature support	0000 0000’B	IMS voice over PS session in S1 mode not supported

Table 9.2.3.2.3.3.3-1: TRACKING AREA UPDATE ACCEPT (step 5, Table 9.2.3.2.3.3.2-1)

Derivation Path: 36.508, Table 4.7.2-24
Information Element	Value/remark	Comment	Condition
GUTI	GUTI-2
EPS update result	000	"TA updated"
EMM cause	‘0001 0000’B for k=1 or ‘0001 0001’B for k=2	MSC temporarily not reachable for k=1 Network failure for k=2
EPS network feature support	0000 0000’B	IMS voice over PS session in S1 mode not supported

Table 9.2.3.2.3.3.3-2: TRACKING AREA UPDATE REQUEST (step 9 and 20a3, Table 9.2.3.2.3.3.2-1)

Derivation Path: 36.508, Table 4.7.2-27
Information Element	Value/remark	Comment	Condition
EPS update type
EPS update type value	‘010’B	Combined TA/LA updating with IMSI attach

Table 9.2.3.2.3.3.3-3: TRACKING AREA UPDATE ACCEPT (step 12, and 13A3 Table 9.2.3.2.3.3.2-1)

Derivation Path: 36.508, Table 4.7.2-24
Information Element	Value/remark	Comment	Condition
EPS update result	000	"TA updated"
GUTI	Not present
EMM cause	‘0001 0000’B for k=1 or ‘0001 0001’B for k=2	MSC temporarily not reachable for k=1 Network failure for k=2
T3402	‘000 01111’B	30 seconds
EPS network feature support	0000 0000’B	IMS voice over PS session in S1 mode not supported

Table 9.2.3.2.3.3.3-4: TRACKING AREA UPDATE ACCEPT (step 20a4, Table 9.2.3.2.3.3.2-1)

Derivation Path: 36.508, Table 4.7.2-24
Information Element	Value/remark	Comment	Condition
GUTI	Not present
Location area identification	LAI-1
MS identity	TMSI-1

Table 9.2.3.2.3.3.3-5: Message ROUTING AREA UPDATE REQUEST (step 3a1, Table 9.2.3.2.3.3.2-2)

Derivation path: 36.508 table 4.7B.2-1
Information Element	Value/Remark	Comment	Condition
UE network capability	Not Present	UE does not support S1 mode any more

Table 9.2.3.2.3.3.3-6: Message ATTACH REQUEST (step 3b1, Table 9.2.3.2.3.3.2-2)

Derivation path: 36.508 table 4.7B.2-6
Information Element	Value/Remark	Comment	Condition
UE network capability	Not Present	UE does not support S1 mode any more

Table 9.2.3.2.3.3.3-7: DETACH REQUEST (step 1a1, Table 9.2.3.2.3.3.2-2)

Derivation path: 36.508 table 4.7.2-11, condition EPS_only

9.2.3.2.4 Combined tracking area update / Successful for EPS services only / CS domain not available

9.2.3.2.4.1 Test Purpose (TP)

(1)

with { UE having sent a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘Combined TA/LA updating’ }

ensure that {
when { UE receives a TRACKING AREA UPDATE ACCEPT message with the EPS update result set to ‘TA updated’ and the EMM cause set to ‘CS domain not available’ }

then { UE transmits TRACKING AREA UPDATE COMPLETE message and set the update status to U2 NOT UPDATED and enters EMM-REGISTERED state }

}

(2)

with { UE receives a TRACKING AREA UPDATE ACCEPT message with the EPS update result set to ‘TA updated’ and the EMM cause set to ‘CS domain not available’ }

ensure that {

when { UE enters a new tracking area }

then { UE initiates the tracking area updating procedure with EPS update type as "TA updating" }

}

9.2.3.2.4.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.3.3.4.3.

[TS 24.301, clause 5.5.3.3.4.3]

…

#18 (CS domain not available)

The UE shall stop timer T3430 if still running, shall reset the tracking area updating attempt counter, shall set the EPS update status to EU1 UPDATED and shall enter state EMM-REGISTERED.NORMAL-SERVICE.

The UE shall set the update status to U2 NOT UPDATED.

A UE in CS/PS mode 1 of operation with "IMS voice not available" shall attempt to select GERAN or UTRAN radio access technology rather than E-UTRAN for the selected PLMN or equivalent PLMN. The UE shall disable the E-UTRA capability (see subclause 4.5). If the UE is in the EMM-CONNECTED mode, the UE shall locally release the established NAS signalling connection and enter the EMM-IDLE mode before selecting GERAN or UTRAN radio access technology.

A UE in CS/PS mode 2 of operation may provide a notification to the user or the upper layers that the CS domain is not available.

The UE shall not attempt combined attach or combined tracking area updating procedure with current PLMN until switching off the UE or the UICC containing the USIM is removed.

9.2.3.2.4.3 Test description

9.2.3.2.4.3.1 Pre-test conditions

System Simulator:

– cell A (belongs to TAI-1, home PLMN) is set to "Serving cell”

– cell B (belongs to TAI-2, home PLMN) is set to ”Non-suitable cell’.’

– System information combination 3 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

UE:

– the UE is configured to initiate combined attach

Preamble:

– the UE is in state Registered, Idle mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.2.4.3.2 Test procedure sequence

Table 9.2.3.2.4.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of Cell B to the "Serving cell". Set the cell type of Cell A to the "non-Suitable cell".	–	–	–	–
–	The following messages are sent and shall be received on Cell B.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST message.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
4	Check: Does the UE transmit a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	1	P
5	The SS releases the RRC connection.	–	–	–	–
5A	Wait 15 seconds for UE to camp on Cell B (UE might attempt to select GERAN or UTRAN cells)	–	–	–	–
6	Void	–	–	–	–
6A	Void	–	–	–	–
7	Check: Does the test result of generic test procedure in TS 36.508 subclause 6.4.2.2 indicate that the UE is in state Registered, Idle Mode on Cell B?	–	–	1	P
8	Set the cell type of Cell A to the "Serving cell". Set the cell type of Cell B to the "non-Suitable cell".	–	–	–	–
9	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message with EPS update type as "TA updating"?	–>	TRACKING AREA UPDATE REQUEST	2	P
10	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
11	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	At the end of this test procedure sequence, the UE is PS attached in end state E-UTRA connected (E2_T3440) according to TS 36.508.	–	–	–	–

9.2.3.2.4.3.3 Specific message contents

Table 9.2.3.2.4.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 2, Table 9.2.3.2.4.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type
EPS update type Value	‘001’B	"combined TA/LA updating”

Table 9.2.3.2.4.3.3-2: TRACKING AREA UPDATE ACCEPT (step 3, Table 9.2.3.2.4.3.2-1)

Derivation Path: 36.508, Table 4.7.2-24
Information Element	Value/remark	Comment	Condition
GUTI	GUTI-2
EMM cause	‘00010010’B	"CS domain not available"
EPS update result	‘000’B	“TA updated”

Table 9.2.3.2.4.3.3-3: Message TRACKING AREA UPDATE REQUEST (step 9, Table 9.2.3.2.4.3.2-1)

Derivation path: 36.508 table 4.7.2-27 with condition TA_only.

Table 9.2.3.2.4.3.3-4: TRACKING AREA UPDATE ACCEPT (step 10, Table 9.2.3.2.4.3.2-1)

Derivation Path: 36.508, Table 4.7.2-24 with condition TA_only.
Information Element	Value/remark	Comment	Condition
GUTI	GUTI-1

9.2.3.2.4a Combined tracking area update / Successful for EPS services only / Congestion

9.2.3.2.4a.1 Test Purpose (TP)

(1)

with { the UE having initiated a Combined tracking area update by sending a TRACKING AREA UPDATE REQUEST message }

ensure that {

when { the UE receives a TRACKING AREA UPDATE ACCEPT message with the EPS update result set to ‘TA updated’ and the EMM cause set to #22 ‘Congestion’ }

then { the UE re-initiates a Combined tracking area procedure indicating ‘combined TA/LA updating with IMSI attach’ after time=T3402 }

}

9.2.3.2.4a.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clause 5.5.3.3.4.3 and 5.2.3.2.7. Unless otherwise stated these are Rel-11 requirements.

[TS 24.301, clause 5.5.3.3.4.3]

The UE receiving the TRACKING AREA UPDATE ACCEPT message takes one of the following actions depending on the EMM cause value:

…

#22 (Congestion)

The UE shall stop timer T3430 if still running. The tracking area updating attempt counter shall be set to 5. The UE shall start timer T3402, shall set the EPS update status to EU1 UPDATED, shall enter state EMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM, shall enter state MM IDLE.

[TS 24.301, clause 5.2.3.2.7]

The UE:

– …

– shall initiate combined tracking area updating procedure indicating "combined TA/LA updating with IMSI attach" on the expiry of timers T3411 or T3402 or when the UE enters a tracking area not in the list of registered tracking areas.

9.2.3.2.4a.3 Test description

9.2.3.2.4a.3.1 Pre-test conditions

System Simulator:

– cell A (belongs to TAI-1, home PLMN) is set to "Serving cell”

– cell B (belongs to TAI-2, home PLMN) is set to ”Non-suitable cell"

– System information combination 3 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

UE:

– the UE is configured to initiate combined attach.

Preamble:

– the UE is in state Registered, Idle mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.2.4a.3.2 Test procedure sequence

Table 9.2.3.2.4a.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of Cell B to the "Serving cell". Set the cell type of Cell A to the "non-Suitable cell".	–	–	–	–
–	The following messages are sent and shall be received on Cell B.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST message.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE ACCEPT message with the EPS update result set to ‘TA updated’ and the EMM cause set to #22 ‘Congestion’.	<–	TRACKING AREA UPDATE ACCEPT	–	–
4	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
5	The SS releases the RRC connection.	–	–	–	–
6	Wait for time=T3402. Note: The value of T3402 is provided in TRACKING AREA UPDATE ACCEPT message in step 3.	–	–	–	–
7	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message indicating "combined TA/LA updating with IMSI attach"?	–>	TRACKING AREA UPDATE REQUEST	1	P
8	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
9	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	At the end of the test procedure sequence, the UE is in end state E-UTRA connected (E2_T3440) according to TS 36.508.	–	–	–	–

9.2.3.2.4a.3.3 Specific message contents

Table 9.2.3.2.4a.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 2, Table 9.2.3.2.4a.3.2-1)

Derivation path: 36.508, Table 4.7.2-27 with condition combined_TA_LA

Table 9.2.3.2.4a.3.3-2: TRACKING AREA UPDATE ACCEPT (step 3, Table 9.2.3.2.4a.3.2-1)

Derivation Path: 36.508, Table 4.7.2-24
Information Element	Value/remark	Comment	Condition
EPS update result	‘0000’B	"TA updated"
GUTI	GUTI-2
EMM cause	‘00010110’B	"Congestion"
T3402	‘00001111’B	30 seconds

Table 9.2.3.2.4a.3.3-3: Message TRACKING AREA UPDATE REQUEST (step 7, Table 9.2.3.2.4a.3.2-1)

Derivation Path: 36.508, Table 4.7.2-27
Information Element	Value/remark	Comment	Condition
EPS update type
EPS update type Value	‘010’B	"combined TA/LA updating with IMSI attach"

Table 9.2.3.2.4a.3.3-4: TRACKING AREA UPDATE ACCEPT (step 8, Table 9.2.3.2.4a.3.2-1)

Derivation Path: 36.508, Table 4.7.2-24 with condition combined TA/LA updated

9.2.3.2.5 Combined tracking area update / Rejected / IMSI invalid

9.2.3.2.5.1 Test Purpose (TP)

(1)

with { UE having sent a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘Combined TA/LA updating’ }

ensure that {
when { UE receives a TRACKING AREA UPDATE REJECT message with the EMM cause set to ‘Illegal UE’ }

then { UE considers the USIM as invalid for EPS services and non-EPS services and enters state EMM-DEREGISTERED }

}

(2)

with { The UE is in the state EMM-DEREGISTERED }

ensure that {

when { UE is powered up }

then { UE send ATTACH REQUEST message with Old GUTI or IMSI IE = ”IMSI”}

9.2.3.2.5.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.3.3.5.

[TS 24.301, clause 5.5.3.3.5]

If the combined tracking area updating cannot be accepted by the network, the MME shall send a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value.

Upon receiving the TRACKING AREA UPDATE REJECT message, the UE shall stop timer T3430, stop any transmission of user data, enter state MM IDLE, and take the following actions depending on the EMM cause value received.

#3 (Illegal UE);

…

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI List and eKSI.

The UE shall consider the USIM as invalid for EPS and non-EPS services until switching off or the UICC containing the USIM is removed. Additionally, the UE shall delete the list of equivalent PLMNs and shall enter the state EMM-DEREGISTERED.

If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the MM parameters update status, TMSI, LAI and ciphering key sequence number, and the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number as specified in 3GPP TS 24.008 [13] for the case when the combined routing area updating procedure is rejected with the GMM cause with the same value.

9.2.3.2.5.3 Test description

9.2.3.2.5.3.1 Pre-test conditions

System Simulator:

– cell A, cell B and cell C;

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 9 (belongs to LAI-1 and RAI-1, home PLMN) is configured;

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, cell 24 (belongs to LAI-1 and RAI-1, home PLMN) is configured;

– cell A is "Serving cell" and cell B, cell C, cell 9 and cell 24 are "Non-suitable "off" cell".

– System information combination 10a as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

NOTE: Setting px_RATComb_Tested = EUTRA_Only is not allowed.

UE:

– the UE is configured to initiate combined EPS/IMSI attach.

Preamble:

– the UE is in state Registered, Idle mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.2.5.3.2 Test procedure sequence

Table 9.2.3.2.5.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of Cell A to the "non-Suitable "off" cell". Set the cell type of Cell B to the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST message.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE REJECT message with the EMM cause set to ‘Illegal UE’.	<–	TRACKING AREA UPDATE REJECT	–	–
4	The SS releases the RRC connection.	–	–	–	–
5	Set the cell type of Cell B to the "non-Suitable "off" cell". Set the cell type of Cell C to the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell C unless explicitly stated otherwise.	–	–	–	–
6	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	1	F
–	EXCEPTION: Steps 7a1 to 7a2 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported	–	–	–	–
7a1	The SS sets the cell type of the cell other than Cell 9 and Cell 24 to the "non-Suitable "off" cell" and sets the cell type of Cell 9 (px_RATComb_Tested = EUTRA_UTRA) or Cell 24 (px_RATComb_Tested = EUTRA_GERAN) to the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell 9 or Cell 24 unless explicitly stated otherwise.	–	–	–	–
7a2	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	1	F
8	Set the cell type of the cell other than Cell A to the "non-Suitable "off" cell". Set the cell type of Cell A to the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
9	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	1	F
10	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
11	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
12	Check: Does the UE transmit an ATTACH REQUEST message on cell A?	–>	ATTACH REQUEST	2	P
13-26 b1	The attach procedure is completed by executing steps 5 to 18b1 of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.3.2.5.3.3 Specific message contents

Table 9.2.3.2.5.3.3-1: TRACKING AREA UPDATE REJECT (step 3, Table 9.2.3.2.5.3.2-1)

Derivation Path: 36.508, Table 4.7.2-26
Information Element	Value/remark	Comment	Condition
EMM cause	‘0000 0011’B	Illegal UE

Table 9.2.3.2.5.3.3-2: Message ATTACH REQUEST (step 12, Table 9.2.3.2.5.3.2-1)

Derivation Path: TS 36.508, Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
Old GUTI or IMSI	IMSI

9.2.3.2.6 Combined tracking area update / Rejected / Illegal ME

9.2.3.2.6.1 Test Purpose (TP)

(1)

with { UE having sent a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘Combined TA/LA updating’ }

ensure that {
when { UE receives a TRACKING AREA UPDATE REJECT message with the EMM cause set to ‘Illegal ME’ }

then { UE considers the USIM as invalid for EPS services and non-EPS services and enters state EMM-DEREGISTERED }

}

(2)

with { The UE is in the state EMM-DEREGISTERED }

ensure that {

when { UE is powered up }

then { UE send ATTACH REQUEST message with Old GUTI or IMSI IE = ”IMSI”}

9.2.3.2.6.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.3.3.5.

[TS 24.301, clause 5.5.3.3.5]

If the combined tracking area updating cannot be accepted by the network, the MME shall send a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value.

…

#6 (Illegal ME); or

…

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI List and eKSI.

9.2.3.2.6.3 Test description

The test description is identical to the one of subclause 9.2.3.2.5 except that the reject cause #3 "Illegal UE" is replaced with the reject cause #6 "Illegal ME".

9.2.3.2.7 Combined tracking area update / Rejected / EPS services and non-EPS services not allowed

9.2.3.2.7.1 Test Purpose (TP)

(1)

with { UE having sent a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘Combined TA/LA updating’ }

ensure that {
when { UE receives a TRACKING AREA UPDATE REJECT message with the EMM cause set to ‘EPS services and non-EPS services not allowed’ }

then { UE considers the USIM as invalid for EPS services and non-EPS services and enters state EMM-DEREGISTERED }

}

(2)

with { The UE is in the state EMM-DEREGISTERED }

ensure that {

when { UE is powered up }

then { UE send ATTACH REQUEST message with Old GUTI or IMSI IE = ”IMSI”}

9.2.3.2.7.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clause 5.5.3.3.5.

[TS 24.301, clause 5.5.3.3.5]

…

#3 (Illegal UE);

#6 (Illegal ME); or

#8 (EPS services and non-EPS services not allowed);

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI List and KSI.

…

9.2.3.2.7.3 Test description

The test description is identical to the one of subclause 9.2.3.2.5 except that the reject cause #3 "Illegal UE" is replaced with the reject cause #8 " EPS services and non-EPS services not allowed".

9.2.3.2.8 Combined tracking area update / Rejected / EPS services not allowed

9.2.3.2.8.1 Test Purpose (TP)

(1)

with { UE having sent a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘Combined TA/LA updating’ }

ensure that {
when { UE receives a TRACKING AREA UPDATE REJECT message with the EMM cause set to ‘EPS services not allowed’ }

then { UE considers the USIM as invalid for EPS services and enters state EMM-DEREGISTERED }

}

(2)

with { UE in CS/PS mode 1 or CS/PS mode 2 of operation and have been IMSI attached for non-EPS services }

ensure that {
when { UE sends a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘Combined TA/LA updating’ and receives a TRACKING AREA UPDATE REJECT message with the EMM cause set to ‘EPS services not allowed’ }

then { The UE shall still IMSI attached for non-EPS services }

}

9.2.3.2.8.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.3.3.5.

[TS 24.301, clause 5.5.3.3.5]

If the combined tracking area updating cannot be accepted by the network, the MME shall send a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value.

…

#7 (EPS services not allowed);

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI List and KSI. The UE shall consider then USIM as invalid for EPS services until switching off or the UICC containing the USIM is removed. The UE shall delete the list of equivalent PLMNs and shall enter the state EMM-DEREGISTERED.

A UE in CS/PS mode 1 or CS/PS mode 2 of operation is still IMSI attached for non-EPS services. The UE shall set the update status to U2 NOT UPDATED, shall select GERAN or UTRAN radio access technology and proceed with appropriate MM specific procedure according to the MM service state. The UE shall not reselect E-UTRAN radio access technology until switching off or the UICC containing the USIM is removed.

NOTE: Some interaction is required with the access stratum to disable E-UTRAN cell reselection.

If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number as specified in 3GPP TS 24.008 [13] for the case when the combined routing area updating procedure is rejected with the GMM cause with the same value.

9.2.3.2.8.3 Test description

9.2.3.2.8.3.1 Pre-test conditions

System Simulator:

– cell A (belongs to TAI-1, home PLMN) is set to ”Serving cell”;

– cell B (belongs to TAI-2(, home PLMN) is set to ”Non-suitable cell”;

– cell G (belongs to TAI-7, visited PLMN) is set to ”Non-suitable off cell”;

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 9 (belongs to LAI-1 and RAI-1, home PLMN) is configured;

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, cell 24 (belongs to LAI-1 and RAI-1, home PLMN) is configured;

– Set the cell type of cell 9 or cell 24 to the ” Non-Suitable off cell ”.

– the different cells may not be simultaneously activated.

– System information combination 10 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

NOTE: Setting px_RATComb_Tested = EUTRA_Only is not allowed.

UE:

– the UE is configured to initiate combined EPS/IMSI attach.

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.2.8.3.2 Test procedure sequence

Table 9.2.3.2.8.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: Cell A as the "non-Suitable cell". Cell B as the "Serving cell".	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST on Cell B.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE REJECT message with the EMM cause set to as ”EPS services not allowed” as specified.	<–	TRACKING AREA UPDATE REJECT	–	–
4	The SS releases the RRC connection.	–	–	–	–
5	The SS configures: Cell A as the "Serving cell". Cell B as the "non-Suitable cell".	–	–	–	–
6	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on cell A? Note: Cell A belongs to the same PLMN where the UE was rejected but a different TAI	–>	ATTACH REQUEST	1	F
7	The user initiates an attach by MMI or by AT command.	–	–	–	–
8	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on cell A?	–>	ATTACH REQUEST	1	F
9	The SS configures: Cell A as the "non-Suitable cell", Cell B as the "non-Suitable “off” cell". Cell G as the "Serving cell".	–	–	–	–
10	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on cell G? Note: Cell G belongs to a PLMN which is not the same like the one on which the UE was rejected.	–>	ATTACH REQUEST	1	F
11	The user initiates an attach by MMI or by AT command.	–	–	–	–
12	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on cell G?	–>	ATTACH REQUEST	1	F
13	The SS configures: Cell G as the "Serving cell". Cell 9 or 24 as the "Suitable cell".	–	–	–	–
	EXCEPTION: Steps 14a1 to 14a5 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported
14a1	The following messages are sent and shall be received on Cell 9 (px_RATComb_Tested = EUTRA_UTRA) or 24 (px_RATComb_Tested = EUTRA_GERAN).	–	–	–	–
14a2	Check: Does the UE transmit a LOCATION UPDATING REQUEST message with Location updating type set to "Normal location updating" on Cell 9 or 24?	–>	LOCATION UPDATING REQUEST	2	P
–	EXCEPTION: The messages in the next two steps are sent only on Cell 24	–	–	–	–
14a2Aa1	The UE transmits a Classmark Change message	–>	CLASSMARK CHANGE
–	EXCEPTION: The next step describes behaviour that depends on UE capability.	–	–	–	–
14a2Aa2	IF pc_UTRA THEN the UE transmits a Utran Classmark Change message.	–>	UTRAN CLASSMARK CHANGE.
14a3	The SS transmits an AUTHENTICATION REQUEST message to initiate the authentication and AKA procedure.	<–	AUTHENTICATION REQUEST	–	–
14a4	The UE transmits an AUTHENTICATION RESPONSE message.	–>	AUTHENTICATION RESPONSE	–	–
14a5	The SS transmits a LOCATION UPDATING ACCEPT message.	<–	LOCATION UPDATING ACCEPT	–	–
15	The SS configures: Cell G as the "Serving cell". Cell 9 or 24 as the "non-Suitable cell".	–	–	–	–
16	The user initiates attach by MMI or by AT command.	–	–	–	–
17	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on cell G?	–>	ATTACH REQUEST	1	F

9.2.3.2.8.3.3 Specific message contents

Table 9.2.3.2.8.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 2, Table 9.2.3.2.8.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type
EPS update type Value	‘001’B	" combined TA/LA updating "
Old GUTI	GUTI-1

Table 9.2.3.2.8.3.3-2: Message TRACKING AREA UPDATE REJECT (step 3, Table 9.2.3.2.8.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EMM cause	‘00000111’B	"EPS services not allowed”

Table 9.2.3.2.8.3.3-3: LOCATION UPDATING REQUEST (step 14a2, Table 9.2.3.2.8.3.2-1)

Derivation Path: TS 36.508 Table 4.7B.2-4
Information Element	Value/remark	Comment	Condition
Location updating type	Normal location updating

Table 9.2.3.2.8.3.3-4: LOCATION UPDATING ACCEPT (step 14a5, Table 9.2.3.2.8.3.2-1)

Derivation Path: TS 36.508 Table 4.7B.2-5
Information Element	Value/remark	Comment	Condition
Mobile identity	Not present

9.2.3.2.9 Combined tracking area update / Rejected / UE identity cannot be derived by the network

9.2.3.2.9.1 Test Purpose (TP)

(1)

with { UE has sent a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘Combined TA/LA updating’ }

ensure that {
when { UE receives a TRACKING AREA UPDATE REJECT message with the EMM cause set to ‘UE identity cannot be derived by the network’ }

then { UE deletes GUTI, last visited registered TAI, TAI list and KSI, enters the state EMM-DEREGISTERED, subsequently, automatically initiates the attach procedure and is still IMSI attached for non-EPS services }

}

(2)

with { UE has sent a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘Combined TA/LA updating’ }

ensure that {
when { UE receives a TRACKING AREA UPDATE REJECT message with the EMM cause set to ‘UE identity cannot be derived by the network’ }

then { UE deletes P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number }

}

9.2.3.2.9.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.3.3.5 and TS 24.008, clause 4.7.5.2.4.

[TS 24.301, clause 5.5.3.3.5]

If the combined tracking area updating cannot be accepted by the network, the MME shall send a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value.

…

#9 (UE identity cannot be derived by the network);

The UE shall set the EPS update status to EU2 NOT UPDATED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI List and eKSI. The UE shall delete the list of equivalent PLMNs and enter the state EMM-DEREGISTERED.

Subsequently, the UE shall automatically initiate the attach procedure.

NOTE 2: User interaction is necessary in some cases when the UE cannot re-activate the EPS bearer(s) automatically.

A UE in CS/PS mode 1 or CS/PS mode 2 of operation is still IMSI attached for non-EPS services. The UE shall set the update status to U2 NOT UPDATED.

[TS 24.008, clause 4.7.5.2.4]

The MS shall then take different actions depending on the received reject cause:

…

# 9 (MS identity cannot be derived by the network);

The MS shall set the GPRS update status to GU2 NOT UPDATED (and shall store it according to subclause 4.1.3.2), enter the state GMM-DEREGISTERED, and shall delete any P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number. Subsequently, the MS may automatically initiate the GPRS attach procedure.

9.2.3.2.9.3 Test description

9.2.3.2.9.3.1 Pre-test conditions

System Simulator:

– cell A (belongs to TAI-1, home PLMN) is set to ”Serving cell”;

– cell B (belongs to TAI-2, home PLMN) is set to ”Non-suitable cell”;

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 5 (belongs to RAI-1, home PLMN) is set to ‘"Non-Suitable cell";

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, cell 24 (belongs to RAI-1, home PLMN) is set to ‘"Non-Suitable cell";

– System information combination 10a as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

NOTE: Setting px_RATComb_Tested = EUTRA_Only is not allowed.

UE:

– the UE is configured to initiate combined EPS/IMSI attach.

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, the UE is previously registered on UTRAN cell 5 using default message contents according to TS 36.508 [18].

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, the UE is previously registered on GERAN cell 24 using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Registered, Idle mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.2.9.3.2 Test procedure sequence

Table 9.2.3.2.9.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of Cell A to the ”Non-Suitable cell”. Set the cell type of Cell B to the ”Serving cell”.	–	–	–	–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE REJECT message with EMM cause set to ”UE identity cannot be derived by the network”.	<–	TRACKING AREA UPDATE REJECT	–	–
–	EXCEPTION: Steps 3a1-3a2 describes the behaviour that depends on UE behaviour (Note 2).	–	–	–	–
3a1	The SS releases the RRC connection.	–	–	–	–
–	EXCEPTION: Step 3a2 describes a behaviour which depends on the UE capability	–	–	–	–
3a2	IF NOT pc_Automatic_EPS_Re_Attach , the user initiates an attach by MMI or by AT command.	–	–	–	–
4	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	1	P
4Aa1-4Aa13	Void	–	–	–	–
–	EXCEPTION: Steps 5a1 to 5a28 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported	–	–	–	–
5a1	The SS sets the cell type of Cell B to the “non-Suitable cell" and sets the cell type of Cell 5 (px_RATComb_Tested = EUTRA_UTRA) or Cell 24 (px_RATComb_Tested = EUTRA_GERAN) to the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell 5 or Cell 24 unless explicitly stated otherwise.	–	–	–	–
5a2	Void	–	–	–	–
5a3	Check: Does the UE transmit an ATTACH REQUEST message?	–>	ATTACH REQUEST	2	P
5a4-5a24	Void	–	–	–	–
5a25-5a28	Void	–	–	–	–
5a29	The SS transmits an ATTACH REJECT message	<–	ATTACH REJECT	–	–
–	At the end of this test procedure sequence, the UE is in end state UTRA deregistered (U6) or GERAN deregistered (G5) according to TS 36.508.	–	–	–	–
Note 2: SS waits for 1 second to receive the Attach Request on the existing RRC Connection. In case Attach Request is not received within 1 second, existing RRC Connection is released.

9.2.3.2.9.3.3 Specific message contents

Table 9.2.3.2.9.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 2, Table 9.2.3.2.9.3.2-1)

Derivation Path: TS 36.508, Table 4.7.2-27
Information Element	Value/remark	Comment	Condition
Old GUTI	GUTI-1
Old location area identification	LAI-1
TMSI status	Not present

Table 9.2.3.2.9.3.3-2: Message TRACKING AREA UPDATE REJECT (step 3, Table 9.2.3.2.9.3.2-1)

Derivation Path: TS 36.508, Table 4.7.2-26
Information Element	Value/remark	Comment	Condition
EMM cause	‘0000 1001’B	UE identity cannot be derived by the network

Table 9.2.3.2.9.3.3-3: Message ATTACH REQUEST (step 4, Table 9.2.3.2.9.3.2-1)

Derivation Path: TS 36.508, Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
NAS key set identifier
NAS key set identifier	‘111’B	no key is available
TSC	Any allowed value	TSC does not apply for NAS key set identifier value "111".
Old GUTI or IMSI	IMSI
Old P-TMSI signature	Not present
Last visited registered TAI	Not present
Old location area identification	Not Present or LAI-1
TMSI status	Not present or any allowed value

Table 9.2.3.2.9.3.3-4: Message ATTACH REQUEST (step 5a3, Table 9.2.3.2.9.3.2-1)

Derivation Path: TS 24.008 , Table 9.4.1
Information Element	Value/remark	Comment	Condition
MS network capability	Any allowed value
Attach type	‘011’B	Combined GPRS/IMSI attach
GPRS ciphering key sequence number	‘111’B	No key is available (MS to network)
DRX parameter	Any allowed value
P-TMSI or IMSI	IMSI-1
Old routing area identification	All bits of octets 5 and 6 are set to 1, except bit 1 of octet 6 which is set to 0. Other bits are not checked.
MS Radio Access capability	Any allowed value
Old P-TMSI signature	Not present
Requested READY timer value	Not present or any allowed value
TMSI status	Not present or any allowed value
PS LCS Capability	Not present or any allowed value
Mobile station classmark 2	Not present or any allowed value
Mobile station classmark 3	Not present or any allowed value
Supported Codecs	Not present or any allowed value
UE network capability	Not present or any allowed value
Additional mobile identity	Not present
Additional old routing area identification	Not present

Table 9.2.3.2.9.3.3-5: Message ATTACH REJECT (step 5a29, Table 9.2.3.2.9.3.2-1)

Derivation Path: TS 24.008 , Table 9.4.4
Information Element	Value/remark	Comment	Condition
GMM cause	‘00001000’B	GPRS services and non-GPRS services not allowed

9.2.3.2.10 Combined tracking area update / Rejected / UE implicitly detached

9.2.3.2.10.1 Test Purpose (TP)

(1)

with { UE having sent a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘Combined TA/LA updating’ }

ensure that {
when { UE receives a TRACKING AREA UPDATE REJECT message with the EMM cause set to ‘Implicitly detached’ }

then { UE sends an ATTACH REQUEST message }

}

9.2.3.2.10.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.3.3.5.

[TS 24.301, clause 5.5.3.3.5]

If the combined tracking area updating cannot be accepted by the network, the MME shall send a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value.

…

#10 (Implicitly detached);

The UE shall delete the list of equivalent PLMNs and shall enter the state EMM-DEREGISTERED.NORMAL-SERVICE. The UE shall perform a new attach procedure.

NOTE 3: User interaction is necessary in some cases when the UE cannot re-activate the EPS bearer(s) automatically.

…

9.2.3.2.10.3 Test description

9.2.3.2.10.3.1 Pre-test conditions

System Simulator:

– cell A and cell B;

– cell A is set to the "Serving cell" and cell B is set to the "non-Suitable cell".

– System information combination 3 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

UE:

– the UE is configured to initiate combined EPS/IMSI attach.

Preamble:

– the UE is in state Registered, Idle mode (state 2) on cell A according to 36.508 [18].

9.2.3.2.10.3.2 Test procedure sequence

Table 9.2.3.2.10.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of Cell A to the "non-Suitable cell". Set the cell type of Cell B to the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST message.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE REJECT message with the EMM cause set to ‘Implicitly detached’.	<–	TRACKING AREA UPDATE REJECT	–	–
–	EXCEPTION: Steps 3a1-3a2 describes the behaviour that depends on UE behaviour (Note 1).	–	–	–	–
3a1	The SS releases the RRC connection.	–	–	–	–
–	EXCEPTION: Step 3a2 describes a behaviour which depends on the UE capability	–	–	–	–
3a2	IF NOT pc_Automatic_EPS_Re_Attach , the user initiates an attach by MMI or by AT command.	–	–	–	–
4	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	1	P
5-18b1	The attach procedure is completed by executing steps 5 to 18b1 of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–
Note 1: SS waits for 1.5 second to receive the Attach Request on the existing RRC Connection. In case Attach Request is not received within 1.5 second, existing RRC Connection is released.

9.2.3.2.10.3.3 Specific message contents

Table 9.2.3.2.10.3.3-1: TRACKING AREA UPDATE REJECT (step 3, Table 9.2.3.2.10.3.2-1)

Derivation Path: TS 36.508 Table 4.7.2-26
Information Element	Value/remark	Comment	Condition
EMM cause	‘0000 1010’B	Implicitly detached

9.2.3.2.11 Combined tracking area update / Rejected / PLMN not allowed

9.2.3.2.11.1 Test Purpose (TP)

(1)

with { UE has sent a TRACKING AREA UPDATE REQUEST message }

ensure that {
when { UE receives a TRACKING AREA UPDATE REJECT message with the EMM cause set to ‘PLMN not allowed’ }

then { UE deletes GUTI, last visited registered TAI, TAI list and KSI, enters the state EMM-DEREGISTERED.PLMN-SEARCH, stores the PLMN identity in the "forbidden PLMN list" }

}

(2)

with { UE has sent a TRACKING AREA UPDATE REQUEST message }

ensure that {
when { UE receives a TRACKING AREA UPDATE REJECT message with the EMM cause set to ‘PLMN not allowed’ }

then { UE deletes P-TMSI, P-TMSI signature, TMSI, RAI, LAI, ciphering key sequence number GPRS ciphering key sequence number }

}

(3)

with { UE is switched off and a PLMN is stored in the "forbidden PLMN list" }

ensure that {

when { UE is powered on this PLMN }

then { UE doesn’t perform an attach procedure }

}

(4)

with { UE in EMM-DEREGISTERED.PLMN-SEARCH state and a PLMN is stored in the "forbidden PLMN list" }

ensure that {

when { UE enters a cell belonging to a PLMN which is not in the "forbidden PLMN list" }

then { UE initiates an attach procedure }

}

(5)

with { UE in EMM-DEREGISTERED.PLMN-SEARCH state and a PLMN is stored in the "forbidden PLMN list" }

ensure that {

when { UE is in a forbidden PLMN cells and when the PLMN is selected manually }

then { UE initiates an attach procedure }

}

9.2.3.2.11.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.3.3.5, TS 24.008, clause 4.7.5.2.4, and TS 23.122, clause 4.4.3.1.2.

[TS 24.301, clause 5.5.3.3.5]

If the combined tracking area updating cannot be accepted by the network, the MME shall send a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value.

…

#11 (PLMN not allowed);

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI List and eKSI, and reset the tracking area updating attempt counter. The UE shall delete the list of equivalent PLMNs and enter the state EMM-DEREGISTERED.PLMN-SEARCH.

The UE shall store the PLMN identity in the "forbidden PLMN list".

The UE shall then perform a PLMN selection according to 3GPP TS 23.122 [6].

If A/Gb mode or Iu mode is supported by the UE, the UE shall handle and the MM parameters update status, TMSI, LAI, ciphering key sequence number and the location update attempt counter, and the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and routing area updating attempt counter as specified in 3GPP TS 24.008 [13] for the case when the combined routing area updating procedure is rejected with the GMM cause with the same value and no RR connection exists.

[TS 24.008, clause 4.7.5.2.4]

# 11 (PLMN not allowed);

The MS shall set the GPRS update status to GU3 ROAMING NOT ALLOWED and the update status to U3 ROAMING NOT ALLOWED (and shall store it according to subclause 4.1.3.2) and enter the state GMM-DEREGISTERED. Furthermore, it shall delete any P-TMSI, P-TMSI signature, TMSI, RAI, LAI, ciphering key sequence number GPRS ciphering key sequence number, and reset the routing area updating attempt counter and the location update attempt counter.

[TS 23.122, clause 4.4.3.1.2]

The user may select his desired PLMN and the MS then initiates registration on this PLMN using the access technology chosen by the user for that PLMN or using the highest priority available access technology for that PLMN, if the associated access technologies have a priority order. (This may take place at any time during the presentation of PLMNs). For such a registration, the MS shall ignore the contents of the "forbidden LAs for roaming", "forbidden TAs for roaming", "forbidden LAs for regional provision of service", "forbidden TAs for regional provision of service", "forbidden PLMNs for GPRS service" and "forbidden PLMNs" lists.

9.2.3.2.11.3 Test description

9.2.3.2.11.3.1 Pre-test conditions

System Simulator:

– cell G (belongs to TAI-7, visited PLMN) is set to ”Serving cell”;

– cell H (belongs to TAI-8, visited PLMN) is set to ”Non-suitable cell”;

– cell I (belongs to TAI-9, visited PLMN, another PLMN) is set to ”Non-suitable off cell”;

– the cells are configured according to Table 6.3.2.2-1 and Table 6.3.2.2-3 in36.508[18], except replacing f3 with f1;

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 9 (belongs to LAI-1 and RAI-1, visited PLMN) is configured;

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, cell 24 (belongs to LAI-1 and RAI-1, visited PLMN) is configured;

– Set the cell type of cell 5 or cell 24 to the ” Non-Suitable cell ”.

– cell G, cell 9 and cell 24 are in same PLMN.

– System information combination 10 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

NOTE: Setting px_RATComb_Tested = EUTRA_Only is not allowed.

UE:

– the UE is configured to initiate combined EPS/IMSI attach.

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell G using default message contents according to TS 36.508 [18];

Preamble:

– UE is in state Registered, Idle Mode (state 2) on Cell G according to [18].

9.2.3.2.11.3.2 Test procedure sequence

Table 9.2.3.2.11.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of Cell G to the ”Non-Suitable cell”. Set the cell type of Cell H to the ”Serving cell”.	–	–	–	–
–	The following messages are to be observed on Cell H unless explicitly stated otherwise.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST message.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE REJECT message with the EMM cause set to ‘PLMN not allowed’.	<–	TRACKING AREA UPDATE REJECT	–	–
4	The SS releases the RRC connection.	–	–	–	–
5	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	1	F
6	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
7	Set the cell type of Cell G to the ”Serving cell”’. Set the cell type of Cell H to the ”Non-Suitable cell”. NOTE: Cell G and Cell H are in the same PLMN.	–	–	–	–
–	The following messages are to be observed on Cell G unless explicitly stated otherwise.	–	–	–	–
8	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
9	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds?	–>	ATTACH REQUEST	3	F
–	EXCEPTION: Steps 10a1 to 10a2 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that takes place if a capability is supported	–	–	–	–
10a1	The cell type of Cell G and Cell I to the “non-Suitable cell", the cell type of Cell H to “non-Suitable “off” cell” and sets the cell type of Cell 9 (px_RATComb_Tested = EUTRA_UTRA) or Cell 24 (px_RATComb_Tested = EUTRA_GERAN) to the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell 9 or Cell 24 unless explicitly stated otherwise.	–	–	–	–
10a2	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds?	–>	ATTACH REQUEST	1	F
11	Set the cell type of Cell I to the “Serving cell". Set the cell type of Cell 9 or Cell 24 to the “non-Suitable cell".	–	–	–	–
–	The following messages are to be observed on Cell I unless explicitly stated otherwise.	–	–	–	–
12	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	1, 2, 4	P
13-21	Steps 5 to 13 of the generic test procedure in TS 36.508 subclause 4.5.2.3 are performed. NOTE: The UE performs an ATTACH procedure.	–	–	–	–
22	The SS responds with an ATTACH ACCEPT message. The ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message is piggybacked in ATTACH ACCEPT message.	<–	ATTACH ACCEPT	–	–
–	EXCEPTION: In parallel to the event described in step 23 below the generic procedure for IP address allocation in the U-plane specified in TS 36.508 subclause 4.5A.1 takes place performing IP address allocation in the U-plane if requested by the UE.	–	–	–	–
23	The UE transmits an ATTACH COMPLETE message including an ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message.	–>	ATTACH COMPLETE	–	–
24	The SS releases the RRC connection.	–	–	–	–
25	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
26	The UE transmits a DETACH REQUEST message.	–>	DETACH REQUEST	–	–
26A	The SS releases the RRC connection.	–	–	–	–
27	Set the cell type of Cell G to the ”Serving cell”’. Set the cell type of Cell I to the ”Non-Suitable cell”.	–	–	–	–
–	The following messages are to be observed on Cell G unless explicitly stated otherwise.	–	–	–	–
28	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
29	The UE is switched to manual PLMN selection mode and is made to select the forbidden PLMN cell.	–	–	–	–
30	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	5	P
31-43	Steps 5 to 17 of the generic test procedure in TS 36.508 subclause 4.5.2.3 are performed. NOTE: The UE performs an ATTACH procedure and the RRC connection is released.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle (E1) according to TS 36.508.	–	–	–	–

9.2.3.2.11.3.3 Specific message contents

Table 9.2.3.2.11.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 2, Table 9.2.3.2.11.3.2-1)

Derivation Path: TS 36.508, Table 4.7.2-27
Information Element	Value/remark	Comment	Condition
Old GUTI	GUTI-7
Old location area identification	LAI-1
TMSI status	Not present

Table 9.2.3.2.11.3.3-2: Message TRACKING AREA UPDATE REJECT (step 3, Table 9.2.3.2.11.3.2-1)

Derivation Path: TS 36.508, Table 4.7.2-26
Information Element	Value/remark	Comment	Condition
EMM cause	‘0000 1011’B	PLMN not allowed

Table 9.2.3.2.11.3.3-3: Message ATTACH REQUEST (step 12, Table 9.2.3.2.11.3.2-1)

Derivation Path: TS 36.508, Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
NAS key set identifier
NAS key set identifier	‘111’B	no key is available
TSC	Any allowed value	TSC does not apply for NAS key set identifier value "111".
Old GUTI or IMSI	IMSI-1
Old P-TMSI signature	Not present
Additional GUTI	Not present
Last visited registered TAI	Not present
Old location area identification	Not present
TMSI status	‘0’B	no valid TMSI available

Table 9.2.3.2.11.3.3-4: Message ATTACH ACCEPT (step 22, Table 9.2.3.2.11.3.2-1)

Derivation Path: TS 36.508, Table 4.7.2-1
Information Element	Value/remark	Comment	Condition
GUTI	GUTI-9
Location area identification	LAI-9
MS identity	TMSI-9

Table 9.2.3.2.11.3.3-5: Message ATTACH REQUEST (step 30, Table 9.2.3.2.11.3.2-1)

Derivation Path: TS 36.508, Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
Old GUTI or IMSI	GUTI-9
Old P-TMSI signature	Not present
Additional GUTI	Not present
Last visited registered TAI	TAI-9
Old location area identification	LAI-9
TMSI status	Not present

9.2.3.2.12 Combined tracking area update / Rejected / Tracking area not allowed

9.2.3.2.12.1 Test Purpose (TP)

(1)

with { UE having sent a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘Combined TA/LA updating’ }

ensure that {
when { UE receives a TRACKING AREA UPDATE REJECT message with the EMM cause set to ‘Tracking Area not allowed’ }

then { UE sets the EPS update status to EU3 ROAMING NOT ALLOWED, deletes any GUTI, last visited registered TAI, TAI List and KSI, enters the state EMM-DEREGISTERED.LIMITED-SERVICE and stores the current TAI in the list of "forbidden tracking areas for regional provision of service" }

}

(2)

with { UE in EMM-DEREGISTERED.LIMITED-SERVICE state having the list of "forbidden tracking areas for regional provision of service" }

ensure that {
when { serving cell belongs to TAI where UE was rejected }

then { UE does not attempt to attach }

}

(3)

with { UE in EMM-DEREGISTERED.LIMITED-SERVICE state having the list of "forbidden tracking areas for regional provision of service" }

ensure that {
when { UE reselects a new cell which belongs to the TAI in the list of "forbidden tracking areas for regional provision of service" }

then { UE does not attempt to attach }

}

(4)

with { UE is powered off or switched off }

ensure that {
when { UE is powered on or switched on in the cell belonging to the TAI which was in the list of "forbidden tracking areas for regional provision of service" before the UE was powered off or switched off }

then { UE attempts to attach }

}

(5)

with { UE is in EMM-DEREGISTERED.LIMITED-SERVICE state and the current TAI in the list of "forbidden tracking areas for regional provision of service"}

ensure that {

when { UE reselects a new cell which does not belong to any of the TAI in the list of "forbidden tracking areas for regional provision of service""}

then { UE initiates attach procedure with IMSI }

}

9.2.3.2.12.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.3.3.5.

[TS 24.301, clause 5.5.3.3.5]

If the combined tracking area updating cannot be accepted by the network, the MME shall send a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value.

…

#12 (Tracking area not allowed);

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI List and KSI. The UE shall reset the tracking area updating attempt counter and shall enter the state EMM-DEREGISTERED.LIMITED-SERVICE.

The UE shall store the current TAI in the list of "forbidden tracking areas for regional provision of service".

If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the MM parameters update status, TMSI, LAI, ciphering key sequence number and the location update attempt counter, and the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and routing area updating attempt counter as specified in 3GPP TS 24.008 [13] for the case when the combined routing area updating procedure is rejected with the GMM cause with the same value.

…

9.2.3.2.12.3 Test description

9.2.3.2.12.3.1 Pre-test conditions

System Simulator:

– cell A, cell B and cell M;

– cell A is set to the "Non-suitable", and cell B set to the “Serving cell” and cell M is set to the "non-Suitable cell".

– System information combination 3 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

UE:

– the UE is configured to initiate combined EPS/IMSI attach.

Preamble:

– the UE is in state Registered, Idle mode (state 2) on cell B according to TS 36.508 [18].

9.2.3.2.12.3.2 Test procedure sequence

Table 9.2.3.2.12.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of Cell B to the "Non-suitable". Set the cell type of Cell A to the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell A unless explicitly stated otherwise.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST message.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE REJECT message with the EMM cause set to ‘Tracking Area not allowed’.	<–	TRACKING AREA UPDATE REJECT	–	–
4	The SS releases the RRC connection.	–	–	–	–
4A	The user initiates an attach by MMI or by AT command.	–	–	–	–
5	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds on Cell A?	–>	ATTACH REQUEST	1,2	F
6	Set the cell type of Cell A to the "non-Suitable cell". Set the cell type of Cell M to the "Serving cell".	–	–	–	–
–	The following messages are to be observed on Cell M unless explicitly stated otherwise.	–	–	–	–
7	Check: Does the UE transmit an ATTACH REQUEST message in the next 90 seconds?	–>	ATTACH REQUEST	3	F
8	Set the cell type of Cell B to the "Serving cell". Set the cell type of Cell M to the "non-Suitable cell".	–	–	–	–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
8A	Check: Does the UE transmit an ATTACH REQUEST message on cell B including a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	1,5	P
8B-8Ob1	The attach procedure is completed by executing steps 5 to 18b1 of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
9	Void	–	–	–	–
10	If possible (see ICS) switch off is performed or the USIM is removed. Otherwise the power is removed.	–	–	–	–
	EXCEPTION: Step 10Aa1 describes behaviour that depends on the UE capability.
10Aa1	If pc_SwitchOnOff or pc_USIM_Removal then UE sends DETACH REQUEST message	–>	DETACH REQUEST	–	–
	Set the cell type of cell A to the ” Serving cell”. Set the cell type of cell B to the ” Non-Suitable cell”.
11	The UE is brought back to operation or the USIM is inserted.	–	–	–	–
12	Check: Does the UE transmit an ATTACH REQUEST message including a PDN CONNECTIVITY REQUEST message?	–>	ATTACH REQUEST	4	P
13-26b1	The attach procedure is completed by executing steps 5 to 18b1 of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle(E1) according to TS 36.508.	–	–	–	–

9.2.3.2.12.3.3 Specific message contents

Table 9.2.3.2.12.3.3-1: TRACKING AREA UPDATE REJECT (step 3, Table 9.2.3.2.12.3.2-1)

Derivation Path: 36.508, Table 4.7.2-26
Information Element	Value/remark	Comment	Condition
EMM cause	‘0000 1100’B	Tracking Area not allowed

Table 9.2.3.2.12.3.3-2: ATTACH REQUEST (step 8A, Table 9.2.3.2.12.3.2-1)

Derivation Path: 36.508, Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
NAS key set identifier
NAS key set identifier	‘111’B	no key is available
TSC	Any allowed value	TSC does not apply for NAS key set identifier value "111".
Old GUTI or IMSI	IMSI of the UE
Last visited registered TAI	Not present

Table 9.2.3.2.12.3.3-3: ATTACH REQUEST (step 12, Table 9.2.3.2.12.3.2-1)

Derivation Path: 36.508, Table 4.7.2-4
Information Element	Value/remark	Comment	Condition
Old GUTI or IMSI	GUTI-2
Last visited registered TAI	TAI-2

NOTE: GUTI-2 and TAI-2 are GUTI and TAI allocated when the UE registered at Cell B in the preamble.

9.2.3.2.13 Combined tracking area update / Rejected / Roaming not allowed in this tracking area

9.2.3.2.13.1 Test Purpose (TP)

(1)

with { UE having sent a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘Combined TA/LA updating’ }

ensure that {

when { the UE receives TRACKING AREA UPDATE REJECT message with the reject cause set to "roaming not allowed in this tracking area" }

}

(2)

with { the UE is in EMM-REGISTERED.PLMN-SEARCH state and the current TAI in the list of "forbidden tracking areas for roaming"}

ensure that {

when { the serving cell belongs to TAI where UE was rejected }

then { the UE does not attempt to send TRACKING AREA UPDATE REQUEST message }

}

(3)

with { the UE is in EMM-REGISTERED.PLMN-SEARCH state and the TAI of the current cell belongs to the list of "forbidden tracking areas for roaming"}

ensure that {

when { the UE enters a cell belonging to same PLMN and TAI not in the list of "forbidden tracking areas for roaming"}

then { the UE sends TRACKING AREA UPDATE REQUEST message with EPS update type set to "combined TA/LA updating with IMSI attach"}

}

(4)

with { the UE is in EMM-REGISTERED.PLMN-SEARCH state and the TAI of the current cell belongs to the list of "forbidden tracking areas for roaming"}

ensure that {

when { the UE enters a cell belonging to another PLMN }

then { the UE sends TRACKING AREA UPDATE REQUEST message with EPS update type set to "combined TA/LA updating with IMSI attach" }

}

(5)

with { the UE, which A/Gb mode or Iu mode is supported by the UE, in EMM-DEREGISTERED.PLMN-SEARCH state and the list of "forbidden tracking areas for roaming" contains more than one TAI }

ensure that {

when { the UE move to UTRAN or GERAN cell }

then { the UE sends ROUTING AREA UPDATE REQUEST message }

9.2.3.2.13.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.3.3.5

[TS 24.301, clause 5.5.3.3.5]

If the combined tracking area updating cannot be accepted by the network, the MME shall send a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value.

…

#13 (Roaming not allowed in this tracking area);

The UE shall store the current TAI in the list of "forbidden tracking areas for roaming" and shall remove the current TAI from the stored TAI list if present.

The UE shall perform a PLMN selection according to 3GPP TS 23.122 [6].

The UE shall indicate the Update type IE "combined TA/LA updating with IMSI attach" when performing the tracking area updating procedure following the PLMN selection.

If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the MM parameters update status and the location update attempt counter, and the GMM parameters GMM state, GPRS update status and routing area updating attempt counter as specified in 3GPP TS 24.008 [13] for the case when the combined routing area updating procedure is rejected with the GMM cause with the same value.

…

9.2.3.2.13.3 Test description

9.2.3.2.13.3.1 Pre-test conditions

System Simulator:

– cell E (belongs to TAI-12, visited PLMN) is set to ”Serving cell”;

– cell I (belongs to TAI-9, same visited PLMN) is set to ”Non-suitable cell”;

– cell B (belongs to TAI-2, another visited PLMN) is set to ”Non-suitable off cell”;

– the cells are configured according to Table 6.3.2.2-1 and Table 6.3.2.2-3 in36.508[18], except that cell E and cell I are on different frequencies;

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 9 (belongs to RAI-8, visited PLMN) is set to "Non-suitable cell";

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, cell 24 (belongs to RAI-8, visited PLMN) is set to "Non-suitable cell";

– system information indicate that NMO 1 is used.

– System information combination 10 a as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

NOTE: Setting px_RATComb_Tested = EUTRA_Only is not allowed.

UE:

– The UE is configured to initiate combined EPS/IMSI attach.

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell E according to TS 36.508 [18].

9.2.3.2.13.3.2 Test procedure sequence

Table 9.2.3.2.13.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of Cell E to the ”Suitable cell”. Set the cell type of Cell I to the ”Serving cell”.	–	–	–	–
2	The UE transmits TRACKING AREA UPDATE REQUEST on Cell I.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE REJECT message with EMM cause = ”Roaming not allowed in this tracking area” as specified.	<–	TRACKING AREA UPDATE REJECT	–	–
4	The SS releases the RRC connection.
5	Void	–	–	–	–
6	Void	–	–	–	–
7	Check: Does the UE transmit TRACKING AREA UPDATE REQUEST message on cell E?	–>	TRACKING AREA UPDATE REQUEST	1, 3	P
8	The SS transmits TRACKING AREA UPDATE REJECT message with EMM cause = ”Roaming not allowed in this tracking area” as specified.	<–	TRACKING AREA UPDATE REJECT	–	–
9	The SS releases the RRC connection.
10	Set the cell type of Cell E and Cell B to the ”Non-Suitable cell”, set the cell type of cell I to the ”Non-Suitable "off" cell”. Set the cell type of cell 9 or 24 to the ”Serving cell”. Note: Cell E and Cell 9 or 24 are in the same PLMN.	–	–	–	–
	EXCEPTION: Steps 11a1 to 11a3 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if a capability is supported
11a1	Check: Does the UE transmit ROUTING AREA UPDATE REQUEST message on cell 9 or 24?	–>	ROUTING AREA UPDATE REQUEST	5	P
11a2	The SS transmits a ROUTING AREA UPDATE REJECT message with cause = ” Roaming not allowed in this routing area ” as specified.	<–	ROUTING AREA UPDATE REJECT	–	–
11a3	The SS releases the RRC connection.
12	Set the cell type of cell 9 or 24 to the ” Non-Suitable cell”. Set the cell type of cell B to the ”Serving cell”. Note: cell 9 or 24 and cell B are in different PLMNs.	–	–	–	–
13	Check: Does the UE transmit TRACKING AREA REQUEST message on cell B?	–>	TRACKING AREA UPDATE REQUEST	1, 4	P
14	The SS sends TRACKING AREA ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
15	The UE transmits TRACKING AREA COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
16	SS Releases the RRC Connection.	–	–	–	–
16a1	The UE may attempt the generic test procedure for IMS Re-registration on EPS HPLMN as specified in TS 36.508 [18] subclause 4.5A.30.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA connected (E1) according to TS 36.508.	–	–	–	–

9.2.3.2.13.3.3 Specific message contents

Table 9.2.3.2.13.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 2, Table 9.2.3.2.13.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Old GUTI	GUTI-7

Table 9.2.3.2.13.3.3-2: TRACKING AREA UPDATE REJECT (step 3 and 8, Table 9.2.3.2.13.3.2-1)

Derivation Path: 36.508, Table 4.7.2-26
Information Element	Value/remark	Comment	Condition
EMM cause	‘0000 1101’B	Roaming not allowed in this tracking area

Table 9.2.3.2.13.3.3-3: Message TRACKING AREA UPDATE REQUEST (step 7 and 13, Table 9.2.3.2.13.3.2-1)

Derivation Path: 36.508, Table 4.7.2-27
Information Element	Value/remark	Comment	Condition
EPS update type
EPS update type value	‘010’B	Combined TA/LA updating with IMSI attach

Table 9.2.3.2.13.3.3-4: Message ROUTING AREA UPDATE REQUEST (step 11a1, Table 9.2.3.2.13.3.2-1)

Derivation Path: 36.508, Table 4.7B.2-1
Information Element	Value/remark	Comment	Condition
Update type	‘010’B	Combined RA/LA updating with IMSI attach

9.2.3.2.14 Combined tracking area update / Rejected / EPS services not allowed in the PLMN

9.2.3.2.14.1 Test Purpose (TP)

(1)

with { UE having sent a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘Combined TA/LA updating’ }

ensure that {
when { UE receives a TRACKING AREA UPDATE REJECT message with the EMM cause set to ‘EPS services not allowed in this PLMN’ }

then { UE deletes any GUTI, last visited registered TAI, TAI List and eKSI, and UE stores the PLMN identity in the "forbidden PLMNs for GPRS service" list }

}

(2)

with { UE is in EMM-DEREGISTERED.PLMN-SEARCH state }

ensure that {
when { UE detects a E-UTRAN cell which belongs to the same PLMN which is stored in the "forbidden PLMNs for GPRS service" list }

then { UE does not attempt to access on this cell }

}

(3)

with { UE is IMSI attached for non-EPS services and is in EMM-DEREGISTERED.PLMN-SEARCH state and one PLMN stored in the "forbidden PLMNs for GPRS service" list }

ensure that {
when { UE update status is U2 NOT UPDATED and detects a new GERAN or UTRAN cell which belongs to the PLMN }

then { UE initiates location update procedure in this GERAN or UTRAN cell }

}

(4)

with { UE is in EMM-DEREGISTERED.PLMN-SEARCH state }

ensure that {
when { UE detects a E-UTRAN cell which belongs to another PLMN which is not stored in the "forbidden PLMNs for GPRS service" list }

then { UE attempts to access on this cell }

}

9.2.3.2.14.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.3.3.5.

[TS 24.301, clause 5.5.3.3.5]

If the combined tracking area updating cannot be accepted by the network, the MME shall send a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value.

…

#14 (EPS services not allowed in this PLMN);

The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3). Furthermore the UE shall delete any GUTI, last visited registered TAI, TAI List and eKSI. The UE shall reset the tracking area updating attempt counter and shall enter the state EMM-DEREGISTERED.PLMN-SEARCH.

The UE shall store the PLMN identity in the "forbidden PLMNs for GPRS service" list.

The UE operating in CS/PS mode 1 or CS/PS mode 2 of operation is still IMSI attached for non-EPS services and shall set the update status to U2 NOT UPDATED.

A UE operating in CS/PS mode 1 of operation may select GERAN or UTRAN radio access technology and proceed with the appropriate MM specific procedure according to the MM service state. In this case the UE shall not reselect E-UTRAN radio access technology for the duration the UE is on the PLMN or equivalent PLMN.

A UE in CS/PS mode 1 of operation may perform a PLMN selection according to 3GPP TS 23.122 [6].

A UE operating in CS/PS mode 2 of operation shall perform a PLMN selection according to 3GPP TS 23.122 [6].

If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and routing area updating attempt counter as specified in 3GPP TS 24.008 [13] for the case when the combined routing area updating procedure is rejected with the GMM cause with the same value.

9.2.3.2.14.3 Test description

9.2.3.2.14.3.1 Pre-test conditions

System Simulator:

– cell G (visited PLMN) is set to ”Serving cell”;

– cell H (visited PLMN, ) is set to ”Non-suitable cell”;

– cell I (another visited PLMN) is set to ”Non-suitable off cell”;

– the cells are configured according to Table 6.3.2.2-1 and Table 6.3.2.2-3 in 36.508[18], except replacing f3 with f1 for cell J, and replacing f3 with f1 for cell I in Table 6.3.2.2-3 in 36.508[18];

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 9 (visited PLMN) is set to ”Non- Suitable cell”;

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, cell 24 (visited PLMN) is set to ”Non- Suitable cell’;

– System information combination 10 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

NOTE: Setting px_RATComb_Tested = EUTRA_Only is not allowed.

UE:

– the UE is configured to initiate combined attach

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell G according to TS 36.508 [18].

9.2.3.2.14.3.2 Test procedure sequence

Table 9.2.3.2.14.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: Cell G as the "non-Suitable cell". Cell H as the "Serving cell".	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST on Cell H.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE REJECT message with the EMM cause set to as ”EPS services not allowed in this PLMN” as specified.	<–	TRACKING AREA UPDATE REJECT	–	–
4	The SS releases the RRC connection.	–	–	–	–
5	The SS configures: Cell H as the "non-Suitable cell". Cell G as the "Serving cell".	–	–	–	–
6	Check: Does the UE transmit an ATTACH REQUEST message in the next 30 seconds on cell G?	–>	ATTACH REQUEST	1, 2	F
7	The SS configures: Cell G and Cell I as a "non-Suitable cell". Cell H as “non-Suitable “off” cell” Cell 9 or 24 as the "Serving cell".	–	–	–	–
	EXCEPTION: Steps 8a1 to 8a4 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that takes place if a capability is supported.	–	–	–	–
8a1	The following messages are sent and shall be received on Cell 9 or 24. Check: Does the UE transmit a LOCATION UPDATING REQUEST message on Cell 9 or cell 24?	–>	LOCATION UPDATING REQUEST	3	P
–	EXCEPTION: The messages in the next two steps are sent only on Cell 24	–	–	–	–
8a1Aa1	The UE transmits a Classmark Change message	–>	CLASSMARK CHANGE
–	EXCEPTION: The next step describes behaviour that depends on UE capability.	–	–	–	–
8a1Aa2	IF pc_UTRA THEN the UE transmits a Utran Classmark Change message.	–>	UTRAN CLASSMARK CHANGE.
8a2	The SS transmits an AUTHENTICATION REQUEST message to initiate the authentication and AKA procedure.	<–	AUTHENTICATION REQUEST	–	–
8a3	The UE transmits an AUTHENTICATION RESPONSE message.	–>	AUTHENTICATION RESPONSE	–	–
8a4	The SS transmits a LOCATION UPDATING ACCEPT message.	<–	LOCATION UPDATING ACCEPT	–	–
9	The SS configures: Cell I as the ”Serving cell". Cell 9 or 24 as the "non-Suitable cell".	–	–	–	–
10	Check: Does the UE transmit ATTACH REQUEST message with a PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN on cell I?	–>	ATTACH REQUEST	1, 4	P
11-224a1	The attach procedure is completed by executing steps 5 to 18a2of the UE registration procedure in TS 36.508 sub clause 4.5.2.3.	–	–	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA idle(E1) according to TS 36.508.	–	–	–	–

9.2.3.2.14.3.3 Specific message contents

Table 9.2.3.2.14.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 2, Table 9.2.3.2.14.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type
EPS update type Value	‘001’B	"combined TA/LA updating "
Old GUTI	GUTI-7

Table 9.2.3.2.14.3.3-2: Message TRACKING AREA UPDATE REJECT (step 3, Table 9.2.3.2.14.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EMM cause	‘00001110’B	" EPS services not allowed in this PLMN ”

Table 9.2.3.2.14.3.3-3: Message ATTACH REQUEST (step 10, Table 9.2.3.2.14.3.2-1)

Derivation path: 36.508 table 4.7.2-4
Information Element	Value/Remark	Comment	Condition
Old GUTI or IMSI	IMSI
Last visited registered TAI	Not present

Table 9.2.3.2.14.3.3-4: LOCATION UPDATING REQUEST (step 8a1, Table 9.2.3.2.14.3.2-1)

Derivation Path: TS 36.508 Table 4.7B.2-4
Information Element	Value/remark	Comment	Condition
Location updating type	Normal update

Table 9.2.3.2.14.3.3-5: LOCATION UPDATING ACCEPT (step 8a4, Table 9.2.3.2.14.3.2-1)

Derivation Path: TS 36.508 Table 4.7B.2-5
Information Element	Value/remark	Comment	Condition
Mobile identity	Not present

9.2.3.2.15 Combined tracking area update / Rejected / No suitable cells in tracking area

9.2.3.2.15.1 Test Purpose (TP)

(1)

with { UE having sent a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘Combined TA/LA updating’ }

ensure that {
when { UE receives a TRACKING AREA UPDATE REJECT message with the EMM cause set to ‘No Suitable Cells In tracking area’ }

then { UE selects a suitable cell in another tracking area in the same PLMN and performs the tracking area updating procedure with EPS update type set to ‘combined TA/LA updating with IMSI attach’ }

}

9.2.3.2.15.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301, clause 5.5.3.3.5.

[TS 24.301, clause 5.5.3.3.5]

If the combined tracking area updating cannot be accepted by the network, the MME shall send a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value.

…

#15 (No suitable cells in tracking area);

The UE shall store the current TAI in the list of "forbidden tracking areas for roaming" and shall remove the current TAI from the stored TAI list if present.

The UE shall search for a suitable cell in another tracking area or in another location area in the same PLMN according to 3GPP TS 36.304 [21].

The UE shall indicate the Update type IE "combined TA/LA updating with IMSI attach" when performing the tracking area updating procedure.

9.2.3.2.15.3 Test description

9.2.3.2.15.3.1 Pre-test conditions

System Simulator:

– cell A, cell B and cell C;

– cell A is set to the "Serving cell" and cell B and cell C is set to the "Non-suitable cell".

– System information combination 3 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

UE:

– the UE is configured to initiate combined EPS/IMSI attach.

Preamble:

– the UE is in state Registered, Idle mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.2.15.3.2 Test procedure sequence

Table 9.2.3.2.15.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of Cell A to the "non-Suitable cell". Set the cell type of Cell B to the "Serving cell". Set the cell type of Cell C to the "Suitable neighbour cell".	–	–	–	–
–	The following messages are to be observed on Cell B unless explicitly stated otherwise.	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST message.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE REJECT message with the EMM cause set to ‘No Suitable Cells In tracking area’.	<–	TRACKING AREA UPDATE REJECT	–	–
4	The SS releases the RRC connection.	–	–	–	–
–	The following messages are to be observed on Cell C unless explicitly stated otherwise.	–	–	–	–
5	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘combined TA/LA updating with IMSI attach’?	–>	TRACKING AREA UPDATE REQUEST	1	P
6	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
7	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA connected (E2_T3440) according to TS 36.508.	–	–	–	–

9.2.3.2.15.3.3 Specific message contents

Table 9.2.3.2.15.3.3-1: TRACKING AREA UPDATE REJECT (step 3, Table 9.2.3.2.15.3.2-1)

Derivation Path: 36.508, Table 4.7.2-26
Information Element	Value/remark	Comment	Condition
EMM cause	‘0000 1111’B	No Suitable Cells In tracking area

Table 9.2.3.2.15.3.3-2: TRACKING AREA UPDATE REQUEST (step 5, Table 9.2.3.2.15.3.2-1)

Derivation Path: 36.508, Table 4.7.2-27
Information Element	Value/remark	Comment	Condition
EPS update type
EPS update type value	‘010’B	Combined TA/LA updating with IMSI attach

9.2.3.2.16 Combined tracking area update / Rejected / Not authorized for this CSG

9.2.3.2.16.1 Test Purpose (TP)

(1)

with { UE has sent a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘Combined TA/LA updating’ }

ensure that {

when { UE receives a TRACKING AREA UPDATE REJECT message with the reject cause set to "Not authorized for this CSG" and with integrity protection }

then { UE removes the CSG ID from the Allowed CSG list }

}

(2)

with { UE has sent a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘Combined TA/LA updating’ }

ensure that {

when { UE receives a TRACKING AREA UPDATE REJECT message with the reject cause set to "Not authorized for this CSG" and with integrity protection }

then { UE searches for a suitable cell in the same PLMN and sent a TRACKING AREA UPDATE REQUEST message with EPS update type set to ‘ combined TA/LA updating with IMSI attach ‘ }

}

9.2.3.2.16.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clause 5.5.3.3.5.

[TS 24.301, clause 5.5.3.3.5]

#25 (Not authorized for this CSG);

Cause #25 is only applicable when received from a CSG cell. Cause #25 received from a non-CSG cell is considered as an abnormal case and the behaviour of the UE is specified in subclause 5.5.3.3.6.

If the TRACKING AREA UPDATE REJECT message with cause #25 was received without integrity protection, then the UE shall discard the message.

If the CSG ID of the cell where the UE has sent the TRACKING AREA UPDATE REQUEST message is contained in the Allowed CSG list, the UE shall remove the CSG ID from the Allowed CSG list.

The UE shall search for a suitable cell in the same PLMN according to 3GPP TS 36.304 [21].

The UE shall indicate the Update type IE "combined TA/LA updating with IMSI attach" when performing the tracking area updating procedure.

9.2.3.2.16.3 Test description

9.2.3.2.16.3.1 Pre-test conditions

System Simulator:

– cell A (TAI-1, frequency 1, HPLMN, not a CSG cell) is set to ”Serving cell”;

– cell B (TAI-2, frequency 1, HPLMN, is a CSG cell) is set to ”Non-suitable cell”;

– cell C (TAI-3, frequency 1, HPLMN, not a CSG cell) is set to ”Non-suitable off cell”.

– System information combination 3 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

UE:

– the UE is previously registered on cell B using either manual CSG selection or a USIM with field EFACSGL preconfigured (so the allowed CSG list includes CSG ID of cell B).

Preamble:

– the UE is in state Registered, Idle mode (state 2) with condition CombinedAttach on cell A according to TS 36.508 [18]

9.2.3.2.16.3.2 Test procedure sequence

Table 9.2.3.2.16.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS configures: – Cell A as a "Not Suitable cell". – Cell B as a "Serving cell".	–	–	–	–
2	The UE transmits a TRACKING AREA UPDATE REQUEST message.	–>	TRACKING AREA UPDATE REQUEST	–	–
3	The SS transmits a TRACKING AREA UPDATE REJECT message with EMM cause = "Not authorized for this CSG".	<–	TRACKING AREA UPDATE REJECT	–	–
4	The SS releases the RRC connection.	–	–	–	–
5	Check: Does the UE transmit an TRACKING AREA UPDATE REQUEST message on Cell B in the next 30 seconds?	–>	TRACKING AREA UPDATE REQUEST	1	F
6	The SS configures: – Cell A as a "Not Suitable off cell". – Cell B as a "Not Suitable cell". – Cell C as a "Suitable cell".	–	–	–	–
7	Check: Does the UE transmit an TRACKING AREA UPDATE REQUEST message on Cell C?	–>	TRACKING AREA UPDATE REQUEST	2	P
8	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
9	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
9A	The SS releases the RRC connection.	–	–	–	–
10	The SS configures: – Cell A as a "Not Suitable off cell". – Cell B as a " Serving cell". – Cell C as a " Not Suitable cell".	–	–	–	–
11	Check: Does the UE transmit an TRACKING AREA UPDATE REQUEST message in the next 30 seconds on Cell B?	–>	TRACKING AREA UPDATE REQUEST	1	F

9.2.3.2.16.3.3 Specific message contents

Table 9.2.3.2.16.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 2, Table 9.2.3.2.16.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type	‘001’B	"combined TA/LA updating"

Table 9.2.3.2.16.3.3-2: Message TRACKING AREA UPDATE REJECT (step 3, Table 9.2.3.2.16.3.2-1)

Derivation Path: 36.508, Table 4.7.2-26
Information Element	Value/remark	Comment	Condition
EMM cause	‘00011001’B	#25 " Not authorized for this CSG"

Table 9.2.3.2.16.3.3-3: Message TRACKING AREA UPDATE REQUEST (step 7, Table 9.2.3.2.16.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type	‘010’B	" combined TA/LA updating with IMSI attach "

Table 9.2.3.2.16.3.3-4: SystemInformationBlockType1 for Cell A, B, C (Pre-test conditions and all steps in Table 9.2.3.2.16.3.2-1)

Derivation Path: 36.508 clause 4.4.3.2
Information Element	Value/remark	Comment	Condition
SystemInformationBlockType1 ::= SEQUENCE {
cellAccessRelatedInfo SEQUENCE {
csg-Indication	TRUE		Cell B
	FALSE		Cell A
	FALSE		Cell C
csg-Identity	Not present		Cell A
	‘000 0000 0000 0000 0000 0000 0010’B		Cell B
	Not present		Cell C
}
}

9.2.3.2.17 Combined tracking area update / Abnormal case / handling of the EPS tracking area updating attempt counter

9.2.3.2.17.1 Test Purpose (TP)

(1)

with { UE has initiated combined tracking area updating procedure and has the tracking area updating attempt counter less than 5 }

ensure that {
when { UE detects release of the NAS signalling connection and in a EPS update status different to EU1 UPDATED and update status is U1 UPDATED }

then { UE starts timer T3411, does not delete any LAI, TMSI, ciphering key sequence number and list of equivalent PLMNs and set the update status to U2 NOT UPDATED }

}

(2)

with { UE has initiated combined tracking area updating procedure and has the tracking area updating attempt counter equal to 5 }

ensure that {
when { UE detects release of the NAS signalling connection }

then { UE starts timer T3402, deletes any LAI, TMSI, ciphering key sequence number and list of equivalent PLMNs and set the update status to U2 NOT UPDATED }

}

9.2.3.2.17.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 24.301, clause 5.5.3.1, clause 5.5.3.2.6 and clause 5.5.3.3.6.

[TS 24.301, clause 5.5.3.1]

– an attach or combined attach procedure is successfully completed;

– a normal or periodic tracking area updating or a combined tracking area updating procedure is successfully completed; or

– a normal or periodic tracking area updating or a combined tracking area updating procedure is rejected with EMM cause #11, #12, #13, #14, #15 or #25.

Additionally the tracking area updating attempt counter shall be reset when the UE is in substate EMM-REGISTERED.ATTEMPTING-TO-UPDATE or EMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM, and:

– a new tracking area is entered; or

– timer T3402 expires.

[TS 24.301, clause 5.5.3.2.6]

The following abnormal cases can be identified:

…

c) T3430 timeout

The UE shall abort the procedure and proceed as described below. The NAS signalling connection shall be released locally.

…

For the cases b, c and d the UE shall proceed as follows:

Timer T3430 shall be stopped if still running. The tracking area updating attempt counter shall be incremented, unless it was already set to 5.

If the tracking area updating attempt counter is less than 5, and the TAI of the current serving cell is included in the TAI list and the EPS update status is equal to EU1 UPDATED:

– the UE shall keep the EPS update status to EU1 UPDATED and enter state EMM-REGISTERED.NORMAL-SERVICE. The UE shall start timer T3411. When timer T3411 expires the tracking area updating procedure is triggered again.

If the tracking area updating attempt counter is less than 5, and the TAI of the current serving cell is not included in the TAI list or the EPS update status is different to EU1 UPDATED:

If the tracking area updating attempt counter is equal to 5:

[TS 24.301, clause 5.5.3.3.6]

If the tracking area updating attempt counter is incremented according to subclause 5.5.3.2.6 the next actions depend on the value of the tracking area updating attempt counter.

9.2.3.2.17.3 Test description

9.2.3.2.17.3.1 Pre-test conditions

System Simulator:

cell A and cell B.

– System information combination 3 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

UE:

– the UE is configured to initiate combined attach in DATA Centric mode

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell A according to TS 36.508 [18] with the exception of the ATTACH ACCEPT message in which the T3402 is explicitly set to 1 min.

9.2.3.2.17.3.2 Test procedure sequence

Table 9.2.3.2.17.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	Set the cell type of Cell A to the "non-Suitable cell". Set the cell type of Cell B to the "Serving cell".	–	–	–	–
–	The following messages are sent and shall be received on Cell B.	–	–	–	–
2	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	1	P
3	Wait for 25s to ensure that T3430 and T3411 expire. NOTE 1: The tracking area updating attempt counter is 1.	–	–	–	–
4	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	1	P
5	Wait for 25s to ensure that T3430 and T3411 expire. NOTE 2: The tracking area updating attempt counter is 2.	–	–	–	–
6	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	1	P
7	Wait for 25s to ensure that T3430 and T3411 expire. NOTE 3: The tracking area updating attempt counter is 3.	–	–	–	–
8	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	1	P
9	Wait for 25s to ensure that T3430 and T3411 expire. NOTE 4: The tracking area updating attempt counter is 4.	–	–	–	–
10	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	1	P
11	The SS releases the RRC connection. NOTE 5: The tracking area updating attempt counter is 5 and reset.	–	–	–	–
12	Wait for 12 min to ensure that T3402 expires.	–	–	–	–
13	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message?	–>	TRACKING AREA UPDATE REQUEST	2	P
14	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
15	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA connected (E2_T3440) according to TS 36.508.	–	–	–	–

9.2.3.2.17.3.3 Specific message contents

Table 9.2.3.2.17.3.3-1: Message TRACKING AREA UPDATE REQUEST (step 2, step 4, step 6, step 8, step 10, Table 9.2.3.2.17.3.2-1)

Derivation Path: 36.508, Table 4.7.2-27
Information Element	Value/remark	Comment	Condition
EPS update type
EPS update type Value	‘001’B	"combined TA/LA updating"
Old GUTI	GUTI-1
Last visited registered TAI	TAI-1
Old LAI	LAI-1
TMSI Status	Not Present

Table 9.2.3.2.17.3.3-2: Message TRACKING AREA UPDATE REQUEST (step 13, Table 9.2.3.2.17.3.2-1)

Derivation Path: 36.508, Table 4.7.2-27
Information Element	Value/remark	Comment	Condition
EPS update type
EPS update type Value	‘001’B	"combined TA/LA updating"
Old GUTI	GUTI-1
Old location area identification	Not present
TMSI status	0	no valid TMSI available

Table 9.2.3.2.17.3.3-3: Message TRACKING AREA UPDATE ACCEPT (step 14, Table 9.2.3.2.17.3.2-1)

Derivation Path: 36.508, Table 4.7.2-24
Information Element	Value/remark	Comment	Condition
GUTI	GUTI-2

9.2.3.3 Iu mode to S1 mode inter-system change in idle mode

9.2.3.3.1 First Iu mode to S1 mode inter-system change after attach

9.2.3.3.1.1 Test Purpose (TP)

(1)

with { the UE is powered on in UTRAN with a USIM containing valid EPS identities and EPS security context and has attached in UTRAN and activated a PDP context }

ensure that {

when { the UE reselects a E-UTRAN cell }

then { the UE transmits a TRACKING AREA UPDATE REQUEST message including eKSI stored in the USIM, old GUTI mapped from RAI and P-TMSI, GPRS ciphering sequence number, nonceUE and the UE radio capability information update needed IE, the message is integrity protected using the EPS security context stored in the USIM and encapsulated in an RRCConnectionSetupComplete message with registeredMME set to the MME part of the mapped GUTI }

(2)

with { the UE has performed a TAU procedure in EUTRAN after initial registration at power on in UTRAN }

ensure that {

when { the UE reselects a UTRAN cell }

then { the UE transmits a ROUTING AREA UPDATE REQUEST message including P-TMSI and P-TMSI signature mapped from GUTI, previously allocated P-TMSI as additional mobile identity, RAI where P-TMSI was allocated as additional old routing area identification, eKSI allocated in UTRAN as GPRS ciphering key sequence number, the message is encapsulated in an INITIAL DIRECT TRANSFER message including IDNSS mapped from P-TMSI }

(3)

with { the UE has performed a TAU procedure in EUTRAN after initial registration at power on in UTRAN and has transmitted a ROUTING AREA UPDATE REQUEST message and received an AUTHENTICATION AND CIPHERING REQUSET message }

ensure that {

when { the UE receives a SECURITY MODE COMMAND message }

then { the UE transmits a SECURITY MODE COMPLETE and starts performing ciphering an integrity protection using new CK and IK }

(4)

with { the UE has performed initial registration at power on in UTRAN and has EPS security context }

ensure that {

when { UE performs a TAU procedure in E-UTRAN }

then { the UE starts performing ciphering an integrity protection using EPS security context }

NOTE: ISR considered not in the scope of this test case, so it is never activated.

9.2.3.3.1.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 23.003 clause 2.8.2.1, 2.8.2.2, TS 23.401 clauses 5.3.1.1, 5.3.3.1, 5.3.3.3 and Annex D; TS 25.331 clauses 8.1.8.2 and 10.3.1.6 (on IDNNS); TS 24.008 [NAS message contents]; TS 24.301 clause 5.5.3.2.2 and TS 24.301 V12.2.0 clause 5.5.3.3.2; and TS 36.331 clauses 5.3.3.3 and 5.3.3.4. Unless otherwise stated these are Rel-8 requirements.

[TS 23.003, clause 2.8.2.1]

The mapping of the GUTI shall be done to the combination of RAI of GERAN / UTRAN and the P‑TMSI:

E‑UTRAN <MCC> maps to GERAN/UTRAN <MCC>

E‑UTRAN <MNC> maps to GERAN/UTRAN <MNC>

E‑UTRAN <MME Group ID> maps to GERAN/UTRAN <LAC>

E‑UTRAN <MME Code> maps to GERAN/UTRAN <RAC> and is also copied into the 8 most significant bits of the NRI field within the P‑TMSI;

E‑UTRAN <M-TMSI> maps as follows:

– 6 bits of the E‑UTRAN <M-TMSI> starting at bit 29 and down to bit 24 are mapped into bit 29 and down to bit 24 of the GERAN/UTRAN <P‑TMSI>;

– 16 bits of the E‑UTRAN <M-TMSI> starting at bit 15 and down to bit 0 are mapped into bit 15 and down to bit 0 of the GERAN/UTRAN <P‑TMSI>;

– and the remaining 8 bits of the E‑UTRAN <M-TMSI> are mapped into the 8 MBS bits of the <P-TMSI signature> field.

For UTRAN, the 10-bit long NRI bits are masked out from the P-TMSI and also supplied to the RAN node as IDNNS (Intra Domain NAS Node Selector). However, the RAN configured NRI length should not exceed 8 bits.

[TS 23.003, clause 2.8.2.2]

The mapping of P‑TMSI (TLLI) and RAI in GERAN/UTRAN to GUTI in E‑UTRAN shall be performed as follows:

GERAN/UTRAN <MCC> maps to E‑UTRAN <MCC>

GERAN/UTRAN <MNC> maps to E‑UTRAN <MNC>

GERAN/UTRAN <LAC> maps to E‑UTRAN <MME Group ID>

GERAN/UTRAN <RAC> maps into bit 23 and down to bit 16 of the M‑TMSI

The 8 most significant bits of GERAN/UTRAN <NRI> map to the MME code.

GERAN/UTRAN <P‑TMSI> maps as follows:

– 6 bits of the GERAN/UTRAN <P‑TMSI> starting at bit 29 and down to bit 24 are mapped into bit 29 and down to bit 24 of the E‑UTRAN <M-TMSI>;

– 16 bits of the GERAN/UTRAN <P‑TMSI> starting at bit 15 and down to bit 0 are mapped into bit 15 and down to bit 0 of the E‑UTRAN <M-TMSI>.

The values of <LAC> and <MME group id> shall be disjoint, so that they can be differentiated. The most significant bit of the <LAC> shall be set to zero; and the most significant bit of <MME group id> shall be set to one. Based on this definition, the most significant bit of the <MME group id> can be used to distinguish the node type, i.e. whether it is an MME or SGSN.

[TS 24.301 clause 5.3.1.1]

When the UE is in EMM-IDLE mode and needs to transmit an initial NAS message, the UE shall request the lower layer to establish a RRC connection. In this request to the lower layer the NAS shall provide to the lower layer the RRC establishment cause and the call type as specified in annex D of this specification.

…

[TS 23.401, clause 5.3.3.1, step 2, “Tracking Area Update procedure with Serving GW change”]

…

If the UE’s TIN indicates "P‑TMSI" and the UE holds a valid P‑TMSI and related RAI then these two elements are indicated as the old GUTI.

…

[TS 23.401, clause 5.3.3.3, step 2, “Routeing Area Update with MME interaction and without S‑GW change”]

…

If the UE’s internal TIN indicates "GUTI" and the UE holds a valid GUTI then the UE indicates the GUTI as the old P‑TMSI and old RAI

…

[TS 24.301, clause 5.5.3.2.2 “Normal and periodic tracking area updating procedure initiation”]

…

If the UE supports A/Gb mode or Iu mode, the UE shall handle the GUTI as follows:

– if the TIN indicates "P-TMSI" and the UE holds a valid P-TMSI and RAI, the UE shall map the P-TMSI and RAI into the old GUTI IE. If a P-TMSI signature is associated with the P-TMSI, the UE shall include it in the Old P-TMSI signature IE. Additionally, if the UE holds a valid GUTI, the UE shall indicate the GUTI in the Additional GUTI IE.

NOTE: Mapping the P-TMSI and RAI to the GUTI is specified in Annex H of 3GPP TS 23.401 [10].

– if the TIN indicates "GUTI" or "RAT-related TMSI" and the UE holds a valid GUTI, the UE shall indicate the GUTI in the Old GUTI IE.

…

When the tracking area updating procedure is initiated in EMM-IDLE mode to perform an inter-system change from A/Gb mode or Iu mode to S1 mode and the TIN is set to "P-TMSI", the UE shall include the GPRS ciphering key sequence number applicable for A/Gb mode or Iu mode and a nonce_UE in the TRACKING AREA UPDATE REQUEST message.

…

If the UE initiates the first tracking area updating procedure following an attach in A/Gb mode or Iu mode, the UE shall include a UE radio capability information update needed IE in the TRACKING AREA UPDATE REQUEST message.

[Rel-12]

[TS 24.301, clause 5.5.3.3.2]

The UE operating in CS/PS mode 1 or CS/PS mode 2, in state EMM-REGISTERED, shall initiate the combined tracking area updating procedure:

…

d) when the UE performs an intersystem change from A/Gb or Iu mode to S1 mode, and the UE previously either performed a combined GPRS attach procedure, an IMSI attach procedure, a location area updating procedure or a combined routing area updating procedure, in A/Gb or Iu mode, or moved to A/Gb or Iu mode from S1 mode through an SRVCC handover or moved to Iu mode from S1 mode through an vSRVCC handover. In this case the EPS update type IE shall be set to "combined TA/LA updating with IMSI attach";

[TS 24.301, Annex D]

…

Table D.1.1: Mapping of NAS procedure to establishment cause and call type

NAS procedure	RRC establishment cause (according 3GPP TS 36.331 [22])	Call type
Tracking Area Update	MO signalling (See Note 1)	"originating signalling"
Note 1: For these NAS procedures initiated by UEs of access class 12, 13 or 14 in their home country, the RRC establishment cause will be set to "High priority access AC 11 – 15". For this purpose the home country is defined as the country of the MCC part of the IMSI, see 3GPP TS 22.011 [1A]. For these NAS procedures initiated by UE of access class 11 or 15 in their HPLMN or EHPLMN, the RRC establishment cause will be set to "High priority access AC 11 – 15".

[TS 36.331, clause 5.3.3.3]

The UE shall set the contents of RRCConnectionRequest message as follows:

1> set the ue-Identity as follows:

2> if upper layers provide an S-TMSI:

3> set the ue-Identity to the value received from upper layers;

2> else

3> draw a random value in the range 0 .. 2⁴⁰-1 and set the ue-Identity to this value;

NOTE 1 Upper layers provide the S-TMSI if the UE is registered in the TA of the current cell.

1> Set the establishmentCause in accordance with the information received from upper layers;

[TS 36.331, clause 5.3.3.4]

…

1> set the content of RRCConnectionSetupComplete message as follows:

2> set the selectedPLMN-Identity to the PLMN selected by upper layers (see TS 23.122 [11], TS 24.301 [35]) from the PLMN(s) included in the plmn-IdentityList in SystemInformationBlockType1;

2> if upper layers provide the ‘Registered MME’, set the registeredMME as follows:

3> if the PLMN identity of the ‘Registered MME’ is different from the PLMN selected by the upper layers:

4> include the plmnIdentity in the registeredMME and set it to the value of the PLMN identity in the ‘Registered MME’ received from upper layers;

3> set the mmegi and the mmec to the value received from upper layers;

2> set the dedicatedInfoNAS to include the information received from upper layers;

…

[TS 24.008, clause 4.7.5]

This procedure is used for:

…

– S1 mode to Iu mode or S1 mode to A/Gb mode intersystem change and ISR is not activated;

…

[TS 24.008, clause 4.7.5.1.1]

To initiate the normal routing area updating procedure, the MS sends the message ROUTING AREA UPDATE REQUEST to the network, starts timer T3330 and changes to state GMM-ROUTING-AREA-UPDATING-INITIATED.

If the MS supports S1 mode, the MS shall handle the P-TMSI IE as follows:

…

If the routing area updating procedure is initiated by the MS due to an S1 mode to Iu mode or S1 mode to A/Gb mode inter-system change in idle mode and the TIN indicates "GUTI", the MS shall derive a UMTS security context for the PS domain from the current EPS security context as described in the subclause 4.7.7.10. The ROUTING AREA UPDATE REQUEST message shall include a P-TMSI signature filled with a NAS token as specified in 3GPP TS 33.401 [119]. Furthermore, the MS shall indicate the eKSI value, which is associated with the derived UMTS security keys, in the CKSN field of the GPRS GSM ciphering key sequence number IE in the ROUTING AREA UPDATE REQUEST message.

NOTE: When the MS includes a P-TMSI signature filled with a NAS token, 8 bits of the NAS token will be filled with bits from the M‑TMSI (see 3GPP TS 23.003 [4]).

If the routing area updating procedure is initiated by the MS due to the S1 mode to Iu mode or S1 mode to A/Gb mode inter-system change in connected mode, the MS shall derive a UMTS security context for the PS domain from the current EPS security context as described in the subclause 4.7.7.10. Furthermore, the MS shall indicate the eKSI value, which is associated with the derived UMTS security keys, in the CKSN field of the GPRS GSM ciphering key sequence number IE in the ROUTING AREA UPDATE REQUEST message.

[TS 25.331, clause 8.1.8.2]

…

The UE shall, in the INITIAL DIRECT TRANSFER message:

1> set the IE "NAS message" as received from upper layers; and

1> set the IE "CN domain identity" as indicated by the upper layers; and

1> set the IE "Intra Domain NAS Node Selector" as follows:

2> derive the IE "Intra Domain NAS Node Selector" from TMSI/PMTSI, IMSI, or IMEI; and

2> provide the coding of the IE "Intra Domain NAS Node Selector" according to the following priorities:

1. derive the routing parameter for IDNNS from TMSI (CS domain) or PTMSI (PS domain) whenever a valid TMSI/PTMSI is available;

2. base the routing parameter for IDNNS on IMSI when no valid TMSI/PTMSI is available;

3. base the routing parameter for IDNNS on IMEI only if no (U)SIM is inserted in the UE.

1> if the UE, on the existing RRC connection, has received a dedicated RRC message containing the IE "Primary PLMN Identity" in the IE "CN Information Info":

2> set the IE "PLMN identity" in the INITIAL DIRECT TRANSFER message to the latest PLMN information received via dedicated RRC signalling. If NAS has indicated the PLMN towards which a signalling connection is requested, and this PLMN is not in agreement with the latest PLMN information received via dedicated RRC signalling, then the initial direct transfer procedure shall be aborted, and NAS shall be informed.

1> if the UE, on the existing RRC connection, has not received a dedicated RRC message containing the IE "CN Information Info" , and if the IE "Multiple PLMN List" was broadcast in the cell where the current RRC connection was established:

2> set the IE "PLMN identity" in the INITIAL DIRECT TRANSFER message to the PLMN chosen by higher layers [5, 25] amongst the PLMNs in the IE "Multiple PLMN List" broadcast in the cell where the RRC connection was established.

1> if the IE "Activated service list" within variable MBMS_ACTIVATED_SERVICES includes one or more MBMS services with the IE "Service type" set to "Multicast" and;

1> if the IE "CN domain identity" as indicated by the upper layers is set to "CS domain" and;

1> if the variable ESTABLISHED_SIGNALLING_CONNECTIONS does not include the CN domain identity ‘PS domain’:

2> include the IE "MBMS joined information";

2> include the IE "P-TMSI" within the IE "MBMS joined information" if a valid PTMSI is available.

1> if the UE is in CELL_FACH state and the IE "CN domain identity" as indicated by the upper layers is set to "CS domain":

2> if the value of the variable ESTABLISHMENT_CAUSE is set to "Originating Conversational Call" or "Emergency Call":

3> set the value of the IE "Call type" to "speech", "video" or "other" according to the call being initiated.

1> if the variable ESTABLISHMENT_CAUSE is initialised:

2> set the IE "Establishment cause" to the value of the variable ESTABLISHMENT_CAUSE;

2> clear the variable ESTABLISHMENT_CAUSE.

1> calculate the START according to subclause 8.5.9 for the CN domain as set in the IE "CN Domain Identity"; and

1> include the calculated START value for that CN domain in the IE "START".

9.2.3.3.1.3 Test description

9.2.3.3.1.3.1 Pre-test conditions

System Simulator:

– cell A, cell B and cell 5 (UTRA cell in LAI-1/RAI-1);

– cell 5 is configured as Serving cell, cell A as Non-Suitable cell.

– System information combination 4 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

NOTE: For Cell 5, power levels are defined in TS 34.108 subclause 6.1.5 (FDD) or 6.1.6 (TDD).

UE:

– the UE is previously registered on E-UTRAN, and when on E-UTRAN, the UE is last authenticated and registered on cell B using default message contents according to TS 36.508 [18].

NOTE: Cell B belongs to TAI-2 (unlike cell A).

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.3.3.1.3.2 Test procedure sequence

Table 9.2.3.3.1.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2	The UE transmits an ATTACH REQUEST message on Cell 5	–>	ATTACH REQUEST	–	–
3	The SS transmits an AUTHENTICATION AND CIPHERING REQUEST message.	<–	AUTHENTICATION AND CIPHERING REQUEST	–	–
4	The UE transmits an AUTHENTICATION AND CIPHERING RESPONSE message.	–>	AUTHENTICATION AND CIPHERING RESPONSE	–	–
5	Void	–	–	–	–
6	Void	–	–	–	–
7	Void	–	–	–	–
8	SS responds with ATTACH ACCEPT message including P-TMSI-1 and RAI-1.	<–	ATTACH ACCEPT	–	–
9	The UE transmits an ATTACH COMPLETE message.	–>	ATTACH COMPLETE	–	–
9A	The SS releases the RRC connection.	–	–	–	–
9B	Generic test procedure in TS 36.508 subclause 4.5A.3A.2 is performed	–	–	–	–
10	The activation of a PDP context is triggered by MMI or AT command.	–	–	–	–
11	Void	–	–	–	–
12	The SS establishes a radio bearer associated with the requested PDP context.	–	–	–	–
13	The SS releases the RRC connection.	–	–	–	–
14	Cell A is configured as the Serving Cell, Cell 5 is configured as a Suitable Neighbour Cell.	–	–	–	–
15	Check: Does the UE transmit an RRCConnectionRequest with the InitialUE-Identity set to “randomValue” and the establishmentcause set to MO-signalling?	–	–	1	P
16	The SS responds with RRCConnectionSetup.	–	–
17	Check: Does the UE transmit an RRCConnectionSetupComplete message with the mmegi and mmec are set to the values derived from the mapped RAI and P-TMSI, and containing a TRACKING AREA UPDATE REQUEST message as described in the specific message contents? Check2: Does the UE transmit a TRACKING AREA UPDATE REQUEST message integrity protected using IK derived from K_ASME?	–>	TRACKING AREA UPDATE REQUEST	1, 4	P
18	The SS responds with a TRACKING AREA UPDATE ACCEPT allocating a new GUTI and TAI list. This message is ciphered and integrity protected using CK and IK derived from K_ASME.	<–	TRACKING AREA UPDATE ACCEPT	–	–
18A	Check: Does the UE transmit a TRACKING AREA UPDATE COMPLETE message ciphered and integrity protected using CK and IK derived from K_ASME.	–>	TRACKING AREA UPDATE COMPLETE	4	P
19	The SS releases the RRC connection	–	–	–	–
–	Exception: Steps 19A to 19Aa5/19Ab1 describe optional behaviour that depend on the UE capability.	–	–	–
19A	If pc_IMS = TRUE SS starts 10s timer	–	–	–
19Aa1	The UE establishes an RRC connection and transmits a SERVICE REQUEST message	–	–	–
19Aa2	The SS establishes SRB2 and DRB	–	–	–
19Aa3	If MULTI-PDN = TRUE the UE executes the generic procedure for establishment of additional PDN connectivity defined in TS 36.508 4.5A.16.3.	–	–	–
19Aa4	The UE performs IMS registration using the generic procedure defined in 34.229-1 [35] Annex C.2 steps 4-11.	–	–	–
19Aa5	The SS releases the RRC connection	–	–	–
19Ab1	The 10s timer expires	–	–	–
20	Void	–	–	–	–
21	Cell 5 is configured as the Serving Cell and Cell A is configured as a Non-Suitable Cell as defined in table 6.2.2.1-1 of TS 36.508 [18].	–	–	–	–
22	Void	–	–	–	–
23	Check: Does the UE transmit a ROUTING AREA UPDATE REQUEST message as specified in the specific message contents included in an INITIAL DIRECTE TRANSFER message with intraDomainNasNodeSelector mapped from GUTI allocated in step 18?	–>	ROUTING AREA UPDATE REQUEST	2	P
23AA	The SS sends an AUTHENTICATION AND CIPHERING REQUEST message to perform a UMTS AKA procedure.	<–	AUTHENTICATION AND CIPHERING REQUEST	–	–
23AB	The UE sends an AUTHENTICATION AND CIPHERING RESPONSE message.	–>	AUTHENTICATION AND CIPHERING RESPONSE	–	–
23A	The SS sends a SECURITY MODE COMMAND message to activate integrity protection and ciphering. This message is integrity protected using new IK.	–	–	–	–
23B	Check: Does the UE transmit a SECURITY MODE COMPLETE message integrity protected using new IK?	–	–	3	P
24	The SS transmits a ROUTING AREA UPDATE ACCEPT message (no new P-TMSI nor RAI). This message is ciphered and integrity protected using CK and IK derived at step 23AA.	<–	ROUTING AREA UPDATE ACCEPT	–	–
25	After the activation time indicated at step 23A, the SS transmits a UE CAPABILITY ENQUIRY message requesting the UE UTRAN capability. This message is ciphered and integrity protected using CK and IK derived at step 23AA.	–	–	–	–
26	Check: Does the UE transmit a UE CAPABILITY INFORMATION message? Note: the purpose of this message is to show that the UE uses CK and IK derived at step 23AA, and not the CK and IK allocated at step 4.	–	–	3	P
27	The SS transmits a UE CAPABILITY INFORMATION CONFIRM message.	–	–	–	–
28	The SS releases the RRC connection	–	–	–	–

9.2.3.3.1.3.3 Specific message contents

Table 9.2.3.3.1.3.3-1: Message RRCConnectionRequest (step 15, Table 9.2.3.3.1.3.2-1)

Derivation path: 36.508 table 4.6.1-16
Information Element	Value/Remark	Comment	Condition
RRCConnectionRequest ::= SEQUENCE {
criticalExtensions CHOICE {
rrcConnectionRequest-r8 SEQUENCE {
ue-Identity CHOICE {
random-Value	Any allowed value
}
establishmentCause	Mo-Signalling
}
}
}

Table 9.2.3.3.1.3.3-2: Message RRCConnectionSetupComplete (step 17, Table 9.2.3.3.1.3.2-1)

Derivation path: 36.508 table 4.6.1-18
Information Element	Value/Remark	Comment	Condition
RRCConnectionSetupComplete ::= SEQUENCE {
criticalExtensions CHOICE {
c1 CHOICE {
rrcConnectionSetupComplete-r8 SEQUENCE {
selectedPLMN-Identity	1
registeredMME {
plmn-Identity	Not present
mmegi	LAC sent to the UE in step 8
mmec	Bit 23 to bit 16 of P-TMSI sent to the UE in step 8
}
dedicatedInfoNAS	See table 9.2.3.3.1.3.3-3
nonCriticalExtension SEQUENCE {}
}
}
}
}
Details to be added

Table 9.2.3.3.1.3.3-3: Message TRACKING AREA UPDATE REQUEST (step 17, Table 9.2.3.3.1.3.2-1)

Derivation path: 36.508 table 4.7.2-24 with condition UNCIPHERED (the message is integrity protected using the key stored in the USIM).
Information Element	Value/Remark	Comment	Condition
EPS update type	000 or 001 or 010	‘TA updating’ or ‘combined TA/LA updating’ or ‘combined TA/LA updating with IMSI attach’	Rel-8 to Rel-11 only
	000 or 010	‘TA updating’ or ‘combined TA/LA updating with IMSI attach’	Rel-12 and later releases
NAS key set identifier
NAS key set identifier	The valid NAS key set identifier stored in the USIM
TSC	‘0’B	native security context (for KSI_ASME)
Old GUTI or IMSI
Type of identity	110	GUTI
MNC/MCC	Mobile Country Code and Mobile Network Code stored in EF_IMSI on the test USIM
MME Group ID	LAI allocated at step 8
MME Code	Bit 23 to bit 16 of P-TMSI allocated at step 8
M-TMSI	Value is specified bit by bit below: – bit 31 and bit 30: 1 – bit 29 to bit 24: bit 29 to bit 24 of P-TMSI allocated at step 8 – bit 23 to bit 16: RAC allocated at step 8 – bit 15 to bit 0: bit 15 to bit 0 of P-TMSI allocated at step 8
GPRS ciphering key sequence number	GPRS ciphering key sequence number allocated at step 3
Old P-TMSI signature	P-TMSI signature allocated at step 8
Additional GUTI	GUTI-1
Nonce_UE	Any allowed value (must be present)
UE network capability	Any allowed value (must be present)
Last visited registered TAI	TAI stored in the test USIM
UE radio capability information update needed	1	UE radio capability information update needed
MS network capability	Any allowed value (must be present)
Old location area identification	Not present if "EPS update type" is ‘TA updating’, LAI-1 if "EPS update type" is ‘combined TA/LA updating’
TMSI status	Not present

Table 9.2.3.3.1.3.3-4: INITIAL DIRECT TRANSFER (step 23, Table 9.2.3.3.1.3.2-1)

Derivation path: 34.108 clause 9.1.1
Information Element	Value/Remark	Comment	Condition
InitialDirectTransfer ::= SEQUENCE {
cn-DomainIdentity	ps-domain
intraDomainNasNodeSelector SEQUENCE {
version CHOICE {
release99 SEQUENCE {
gsm-Map-IDNNS SEQUENCE {
routingbasis CHOICE {
tMSIofsamePLMN {
routingparameter	bit 23 to bit 14 of P-TMSI mapped from GUTI allocated to UE in step 18
}
}
}
}
}
}
}
nas-Message	See table 9.2.3.3.1.3.3-5
}

Table 9.2.3.3.1.3.3-5: Message ROUTING AREA UPDATE REQUEST (step 23, Table 9.2.3.3.1.3.2-1)

Derivation path: 24.008 table 9.4.14
Information Element	Value/Remark	Comment	Condition
Update type	000 or 001	RA updating or Combined RA/LA updating
GPRS ciphering key sequence number	eKSI stored on the test USIM
Old routing area identification	GUTI-1 right shifted by 32bits
MS Radio Access capability	Not checked
Old P-TMSI signature	Value is specified bit by bit below: – bit 23 to bit 16: bit 23 to bit 16 of M-TMSI allocated in step 18 – bit 15 to bit 0: Truncated NAS-token
Requested READY timer value	Not checked
DRX parameter	Not checked
TMSI status	Not present
P-TMSI	Value is specified bit by bit below: – bit 31 and bit 30: 1 – bit 29 to bit 24: bit 29 to bit 24 of M-TMSI allocated in step 18 – bit 23 to bit 16: MME code allocated in step 18 – bit 15 to bit 0: bit 15 to bit 0 of M-TMSI allocated in step 18
MS network capability	Not checked
PDP context status	Not checked
PS LCS Capability	Not checked
MBMS context status	Not checked
UE network capability	Any allowed value
Additional mobile identity	P-TMSI allocated in step 8
Additional old routing area identification	RAI-1
Mobile station classmark 2	Not checked
Mobile station classmark 3	Not checked
Supported Codecs	Not checked

9.2.3.3.2 Iu mode to S1 mode intersystem change / ISR is active / Expiry of T3312 in E-UTRAN or T3412 in UTRAN and further intersystem change

9.2.3.3.2.1 Test Purpose (TP)

(1)

with { the UE is camped on a E-UTRAN cell, ISR is active, T3312 has expired, T3323 hasn’t expired }

ensure that {

when { UE enters a UTRAN cell belonging to the RA where the UE was last updated }

then { the UE performs a RAU procedure including the UE P-TMSI and RAI }

}

(2)

with { the UE is camped on a E-UTRAN cell, ISR is active, T3312 and T3323 have expired }

ensure that {

when { UE enters a UTRAN cell belonging to the RA where the UE was last updated }

then { the UE performs a RAU procedure including mapped identities from E-UTRAN and additional P-TMSI and old RAI }

}

(3)

with { the UE operating in PS mode 1 or PS mode 2, is camped on a UTRAN cell, ISR is active, T3412 has expired, T3423 hasn’t expired }

ensure that {

when { UE enters a E-UTRAN cell in a TA belonging to the current TA list }

then { the UE performs a TAU procedure including the UE GUTI and last visited TAI}

}

(4)

with { the UE operating in PS mode 1 or PS mode 2, is camped on a UTRAN cell, ISR is active, T3412 and T3423 have expired }

ensure that {

when { the UE enters a E-UTRAN cell in a TA belonging to the current TA list }

then { the UE performs a TAU procedure including mapped GUTI from UTRAN, P-TMSI signature and additional GUTI}

}

9.2.3.3.2.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301 clauses 5.3.5 and 5.5.3.2.2 and TS 24.008 clauses 4.7.2.2 and 4.7.5.1.1.

[24.301, clause 5.3.5]

If ISR is activated, the UE shall keep both the periodic tracking area update timer (timer T3412) and the periodic routeing area update timer (timer T3312). The two separate timers run in the UE for updating MME and SGSN independently. If the periodic tracking area update timer expires and the UE cannot initiate the tracking area updating procedure, as it is in state EMM-REGISTERED.NO-CELL-AVAILABLE, the UE shall start the E-UTRAN deactivate ISR timer T3423. The UE shall initiate the tracking area updating procedure and stop the timer T3423 when it enters state EMM-REGISTERED.NORMAL-SERVICE before timer T3423 expires. After expiry of timer T3423 the UE shall set its TIN to "P-TMSI" in order to initiate the tracking area updating procedure when it returns to state EMM-REGISTERED.NORMAL-SERVICE.

[24.301, clause 5.5.3.2.2]

If the UE supports neither A/Gb mode nor Iu mode, the UE shall include a valid GUTI in the Old GUTI IE in the TRACKING AREA UPDATE REQUEST message.

If the UE supports A/Gb mode or Iu mode, the UE shall handle the Old GUTI IE as follows:

NOTE: The mapping of the P-TMSI and RAI to the GUTI is specified in 3GPP TS 23.003 [2].

– If the TIN indicates "GUTI" or "RAT-related TMSI" and the UE holds a valid GUTI, the UE shall indicate the GUTI in the Old GUTI IE.

[24.008, clause 4.7.2.2]

If ISR is activated, the MS shall keep both the periodic tracking area update timer (timer T3412) and the periodic routeing area update timer (timer T3312). The two separate timers run in the MS for updating MME and SGSN independently. If the periodic routeing area update timer expires and the MS is in state GMM-REGISTERED.NO-CELL-AVAILABLE, the MS shall set its TIN to "RAT-related TMSI" and start the GERAN/UTRAN Deactivate ISR timer T3323. The MS shall initiate the routeing area updating procedure and stop the timer T3323 when the MS enters the state GMM-REGISTERED.NORMAL-SERVICE before timer T3323 expires. After expiry of timer T3323 the MS shall deactivate ISR by setting its TIN to "GUTI" and initiate the routing area updating procedure when the MS enters the state GMM-REGISTERED.NORMAL-SERVICE.

…

If the MS is both IMSI attached for GPRS and non-GPRS services, and if the MS lost coverage of the registered PLMN and timer T3312 expires or timer T3323 expires, then:

a) if the MS returns to coverage in a cell that supports GPRS and that indicates that the network is in network operation mode I, then the MS shall either perform the combined routing area update procedure indicating "combined RA/LA updating with IMSI attach"; or

b) if the MS returns to coverage in a cell in the same RA that supports GPRS and that indicates that the network is in network operation mode II or III, then the MS shall perform the periodic routing area updating procedure indicating "Periodic updating"; or

c) if the MS was both IMSI attached for GPRS and non-GPRS services in network operation mode I and the MS returns to coverage in a cell in the same LA that does not support GPRS, then the MS shall perform the periodic location updating procedure. In addition, the MS shall perform a combined routing area update procedure indicating "combined RA/LA updating with IMSI attach" when the MS enters a cell that supports GPRS and that indicates that the network is in network operation mode I; or

d) if the MS returns to coverage in a new RA the description given in subclause 4.7.5 applies.

If the MS is both IMSI attached for GPRS and non-GPRS services in a network that operates in network operation mode I, and if the MS has camped on a cell that does not support GPRS, and timer T3312 expires or timer T3323 expires, then the MS shall start an MM location updating procedure. In addition, the MS shall perform a combined routing area update procedure indicating "combined RA/LA updating with IMSI attach" when the MS enters a cell that supports GPRS and indicates that the network is in operation mode I.

If timer T3312 expires or timer T3323 expires during an ongoing CS connection, then a MS operating in MS operation mode B shall treat the expiry of T3312 when the MM state MM-IDLE is entered, analogous to the descriptions for the cases when the timer expires out of coverage or in a cell that does not support GPRS.

In A/Gb mode, timer T3312 and timer T3323 shall not be stopped when a GPRS MS enters state GMM-REGISTERED.SUSPENDED.

[24.008, clause 4.7.5.1.1]

If the MS supports S1 mode, the MS shall handle the P-TMSI IE as follows:

9.2.3.3.2.3 Test description

9.2.3.3.2.3.1 Pre-test conditions

System Simulator:

– cell A and cell 5 (HPLMN);

– cell 5 indicates NMO I.

– System information combination 4 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

UE:

none.

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell A according to TS 36.508 [18] and with M-TMSI = 9a26319c (arbitrary value chosen for this test case).

9.2.3.3.2.3.2 Test procedure sequence

Table 9.2.3.3.2.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS sets the cell type of Cell 5 to "Serving Cell" and the cell type of Cell A to "Non-suitable cell".	–	–	–	–
2	The UE transmits a ROUTING AREA UPDATE message on cell 5.	–>	ROUTING AREA UPDATE REQUEST	–	–
3	The SS transmits a ROUTING AREA UPDATE ACCEPT message on Cell 5 with T3312 set to 1 minute and T3323 set to 2 minutes.	<–	ROUTING AREA UPDATE ACCEPT	–	–
4	The UE transmits a ROUTING AREA UPDATE COMPLETE message on Cell 5.	–>	ROUTING AREA UPDATE COMPLETE	–	–
4A	The SS releases the RRC connection.	–	–	–	–
–	Exception: Steps 4Ba1 to 4Ba1b1 describe optional behaviour that depend on the UE capability.	–	–	–	–
4Ba1	IF pc_IMS = TRUE THEN SS starts 6s timer	–	–	–	–
4Ba1a1- 4Ba1a4a6	The procedure defined in TS 36.523-3 Table 10.1.2.1-2 Steps 1-4a6 is performed	–	–	–	–
4Ba1a5	SS releases RRC Connection	–	–	–	–
4Ba1a6	SS Stops 6s timer	–	–	–	–
4Ba1b1	The 6s timer expires	–	–	–	–
5	The SS sets the cell type of Cell A to "Serving cell" and the cell type of Cell 5 to "Non-suitable cell".	–	–	–	–
–	EXCEPTION: Steps 5Aa1 to 5Aa4 describe behaviour that depends on the UE configuration; the "lower case letter" identifies a step sequence that takes place if the UE sends an optional TAU message.	–	–	–	–
5Aa1	The UE may transmit a TRACKING AREA UPDATE REQUEST message on Cell A.	–>	TRACKING AREA UPDATE REQUEST	–	–
5Aa2	The SS transmits a TRACKING AREA UPDATE ACCEPT message on Cell A.	<–	TRACKING AREA UPDATE ACCEPT	–	–
5Aa3	The UE transmits a TRACKING AREA UPDATE COMPLETE message on Cell A.	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	Exception: Steps 5Aa4 to 5Aa5b1 describe optional behaviour if UE sends optional IMS deregistration at steps 4Ba1 to 4Ba1b1	–	–	–	–
5Aa4-5AAa5b1	The procedure defined in TS 36.508 subclause 4.5A.3 Steps 10a1-10a2b1 is performed	–	–	–	–
5Aa4	The SS releases the RRC connection.	–	–	–	–
6	90s after step 3, the SS sets the cell type of Cell 5 to "Serving Cell" and the cell type of Cell A to "Non-suitable cell".	–	–	–	–
7	Check: Does the UE transmit a ROUTING AREA UPDATE REQUEST message on Cell 5 in the time period between expiry of T3312 – started upon RRC Connection Release after step 4A – and before expiry of T3323 – which was started when T3312 expired?	–>	ROUTING AREA UPDATE REQUEST	1	P
8	The SS transmits a ROUTING AREA UPDATE ACCEPT message on Cell 5 with T3312 set to 1 minute and T3323 set to 1 minute.	<–	ROUTING AREA UPDATE ACCEPT	–	–
8A	The SS releases the RRC connection.	–	–	–	–
–	Exception: Steps 8Ba1 to 8Ba1b1 describe optional behaviour that depend on the UE capability.	–	–	–	–
8Ba1	IF pc_IMS = TRUE THEN SS starts 6s timer	–	–	–	–
8Ba1a1- 8Ba1a4a6	The procedure defined in TS 36.523-3 Table 10.1.2.1-2 Steps 1-4a6 is performed	–	–	–	–
8Ba1a5	SS releases RRC Connection	–	–	–	–
8Ba1a6	SS Stops 6s timer	–	–	–	–
8Ba1b1	The 6s timer expires	–	–	–	–
9	The SS sets the cell type of Cell A to "Serving cell" and the cell type of Cell 5 to "Non-suitable cell".	–	–	–	–
–	EXCEPTION: Steps 9Aa1 to 9Aa4 describe behaviour that depends on the UE configuration; the "lower case letter" identifies a step sequence that takes place if the UE sends an optional TAU message.	–	–	–	–
9Aa1	The UE may transmit a TRACKING AREA UPDATE REQUEST message on Cell A.	–>	TRACKING AREA UPDATE REQUEST	–	–
9Aa2	The SS transmits a TRACKING AREA UPDATE ACCEPT message on Cell A.	<–	TRACKING AREA UPDATE ACCEPT	–	–
9Aa3	The UE transmits a TRACKING AREA UPDATE COMPLETE message on Cell A.	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	EXCEPTION: Steps 9Aa4 to 9Aa5b1 describe optional behaviour if UE sends IMS deregistration at steps 8Ba1 to 8Ba1b1	–	–	–	–
9Aa4-9Aa5b1	The procedure defined in TS 36.508 subclause 4.5A.3 Steps 10a1-10a2b1 is performed	–	–	–	–
9Aa4	The SS releases the RRC connection.	–	–	–	–
10	150s after step 8, the SS sets the cell type of Cell 5 to "Serving Cell" and the cell type of Cell A to "Non-suitable cell".	–	–	–	–
11	Check: Does the UE transmit a ROUTING AREA UPDATE REQUEST message on Cell 5 after both timers expired, T3312 which was started after step 8A and T3323 which was started upon expiry of T3312?	–>	ROUTING AREA UPDATE REQUEST	2	P
12	The SS transmits a ROUTING AREA UPDATE ACCEPT message on Cell 5.	<–	ROUTING AREA UPDATE ACCEPT	–	–
12A	The SS releases the RRC connection.	–	–	–	–
–	Exception: Steps 12AAa1 to 12AAa1b1 describe optional behaviour that depend on the UE capability.	–	–	–	–
12AAa1	IF pc_IMS = TRUE THEN SS starts 6s timer	–	–	–	–
8AAa1a1- 12AAa1a4a6	The procedure defined in TS 36.523-3 Table 10.1.2.1-2 Steps 1-4a6 is performed	–	–	–	–
12AAa1a5	SS releases RRC Connection	–	–	–	–
12AAa1a6	SS Stops 6s timer	–	–	–	–
12AAa1b1	The 6s timer expires	–	–	–	–
13	The SS sets the cell type of Cell A to "Serving cell" and the cell type of Cell 5 to "Non-suitable cell".	–	–	–	–
14	The UE transmits a TRACKING AREA UPDATE REQUEST message	–>	TRACKING AREA UPDATE REQUEST	–	–
15	The SS transmits a TRACKING AREA UPDATE ACCEPT message with EPS update result indicating that ISR is active, T3412 set to 1 minute and T3423 set to 2 minutes.	<–	TRACKING AREA UPDATE ACCEPT	–	–
16	The UE transmits a TRACKING AREA UPDATE COMPLETE message.	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	Exception: Steps 16AAa1 to 16AAa2b1 describe optional behaviour if UE sends IMS deregistration at steps 12AAa1 to 12AAa1b1.	–	–	–	–
16AAa1-16AAa2b1	The procedure defined in TS 36.508 subclause 4.5A.3 Steps 10a1-10a2b1 is performed	–	–	–	–
–	EXCEPTION: Steps 16A to 24 describe behaviour that is performed if PS mode 1 or PS mode 2 of operation is configured on the UE.	–	–	–	–
16A	The SS releases the RRC connection.	–	–	–	–
17	The SS sets the cell type of Cell 5 to "Serving Cell" and the cell type of Cell A to "Non-suitable cell".	–	–	–	–
17Aa1	Void	–	–	–	–
17Aa2	Void	–	–	–	–
18	90s after step 16, the SS sets the cell type of Cell A to "Serving cell" and the cell type of Cell 5 to "Non-suitable cell".	–	–	–	–
19	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message on Cell A in the time period between expiry of T3412 – started upon RRC Connection Release after step 16A – and before expiry of T3423 – which was started when T3412 expired?	–>	TRACKING AREA UPDATE REQUEST	3	P
20	The SS transmits a TRACKING AREA UPDATE ACCEPT message with EPS update result indicating that ISR is active, T3412 set to 1 minute and T3423 set to 1 minute.	<–	TRACKING AREA UPDATE ACCEPT	–	–
20A	The SS releases the RRC connection.	–	–	–	–
21	The SS sets the cell type of Cell 5 to "Serving Cell" and the cell type of Cell A to "Non-suitable cell".	–	–	–	–
21Aa1	Void	–	–	–	–
21Aa2	Void	–	–	–	–
22	150s after step 20, the SS sets the cell type of Cell A to "Serving cell" and the cell type of Cell 5 to "Non-suitable cell".	–	–	–	–
23	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message on Cell A after both timers expired, T3412 which was started after step 20A and T3423 which was started upon expiry of T3412?	–>	TRACKING AREA UPDATE REQUEST	4	P
24	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA connected (E2_T3440) according to TS 36.508.	–	–	–	–

9.2.3.3.2.3.3 Specific message contents

Table 9.2.3.3.2.3.3-1: Message ROUTING AREA UPDATE ACCEPT (step 3, table 9.2.3.3.2.3.2-1)

Derivation path: 24.008 table 9.4.15
Information Element	Value/Remark	Comment	Condition
Update result	100	RA updated and ISR activated
	001	combined RA/LA updated
Periodic RA update timer	00100001	1 minute
Routing area identification	See 36.508 table 4.4.4-2	RAI of Cell 5
P-TMSI signature	Not present
Allocated P-TMSI	efb1ee97	TMSI is an arbitrary value chosen different from M-TMSI in the preamble
T3323 value	00100010	2 minutes

Table 9.2.3.3.2.3.3-2: Message ROUTING AREA UPDATE REQUEST (step 7, table 9.2.3.3.2.3.2-1)

Derivation path: 24.008 table 9.4.14
Information Element	Value/Remark	Comment	Condition
Update type	011	Periodic updating
Update type	001 or 010	Combined RA/LA updating or combined RA/LA updating with IMSI attach
GPRS ciphering key sequence number	Any allowed value
Old routing area identification	RAI of Cell 5 according to 36.508 table 4.4.4-2	The UE includes the RAI from UTRAN
MS Radio Access capability	Any allowed value
Old P-TMSI signature	Not present
P-TMSI	Same value like allocated at step 3, see table 9.2.3.3.2.3.3-1	The UE includes the P-TMSI assigned from UTRAN
UE network capabilities	Not present		Update Type = periodic updating
	Any allowed value		Update Type <> periodic updating
Additional mobile identity	Not present
Additional old routing area identification	Not present

Table 9.2.3.3.2.3.3-3: Message ROUTING AREA UPDATE ACCEPT (step 8, table 9.2.3.3.2.3.2-1)

Derivation path: 24.008 table 9.4.15
Information Element	Value/Remark	Comment	Condition
Update result	100	RA updated and ISR activated
	001	combined RA/LA updated
Periodic RA update timer	00100001	1 minute
Routing area identification	See 36.508 table 4.4.4-2	RAI of Cell 5
P-TMSI signature	Not present
Allocated P-TMSI	Not present
T3323 value	00100001	1 minute

Table 9.2.3.3.2.3.3-4: Message ROUTING AREA UPDATE REQUEST (step 11, table 9.2.3.3.2.3.2-1)

Derivation path: 24.008 table 9.4.14
Information Element	Value/Remark	Comment	Condition
Update type	000	RA updating
Update type	010	combined RA/LA updating with IMSI attach
GPRS ciphering key sequence number	Any allowed value
Old routing area identification	TAI of cell A	The value is the same as the RAI of cell 5
MS Radio Access capability	Any allowed value
Old P-TMSI signature	Any allowed value
P-TMSI	da01319c	Mapped from M-TMSI and MME code assigned in the preamble (start with 11 and MME code in 2^nd most significant byte).
Additional mobile identity	Same value like allocated at step 3, see table 9.2.3.3.2.3.3-1
Additional routing area identification	RAI of cell 5	The value is the same as the TAI of cell A

Table 9.2.3.3.2.3.3-5: Message ROUTING AREA UPDATE ACCEPT (step 12, table 9.2.3.3.2.3.2-1)

Derivation path: 24.008 table 9.4.15
Information Element	Value/Remark	Comment	Condition
Update result	000	RA updated
	001	combined RA/LA updated
Periodic RA update timer	01010101	54 minutes
Routing area identification	See 36.508 table 4.4.4-2	RAI of Cell 5
P-TMSI signature	Not present
Allocated P-TMSI	Not present

Table 9.2.3.3.2.3.3-6: Message TRACKING AREA UPDATE REQUEST (step 14, table 9.2.3.3.2.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type	Any allowed value
Additional GUTI	Any allowed value
Nonce_UE	Any allowed value

Table 9.2.3.3.2.3.3-7: Message TRACKING AREA UPDATE ACCEPT (step 15, table 9.2.3.3.2.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EPS update result	100	TA updated and ISR activated	TA_only
	101	combined TA/LA updated and ISR activated	combined_TA_LA
T3412 value	00100001	1 minute
T3423 value	00100010	2 minutes
GUTI
M-TMSI	9a26319c	Same value like in preamble, different from P-TMSI

Table 9.2.3.3.2.3.3-8: Message TRACKING AREA UPDATE REQUEST (step 19, table 9.2.3.3.2.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type	Any allowed value
Old GUTI	Same GUTI as in step 15 see table 9.2.3.3.2.3.3-7		TA_Only
Last visited registered TAI	RAI of cell 5	The value is the same as the TAI of cell A
Nonce_UE	Not Present		TA_only
Additional GUTI	Not present		TA_only

Table 9.2.3.3.2.3.3-9: Message TRACKING AREA UPDATE ACCEPT (step 20, table 9.2.3.3.2.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EPS update result	100	TA updated and ISR activated	TA_only
T3412 value	00100001	1 minute
GUTI	Not present
MS identity	Not present
T3423 value	00100001	1 minute

Table 9.2.3.3.2.3.3-10: Message TRACKING AREA UPDATE REQUEST (step 23, table 9.2.3.3.2.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type	Any allowed value
Old GUTI
M-TMSI	ef01ee97	Mapped from P-TMSI assigned in the preamble and RAI of cell 5 (start with 11 and RAI in 2^nd most significant byte).
Nonce_UE	Any allowed value
Last visited registered TAI	RAI of cell 5
Additional GUTI	Same GUTI as in step 15 see table 9.2.3.3.2.3.3-7

Table 9.2.3.3.2.3.3-11: Message TRACKING AREA UPDATE ACCEPT (step 24, table 9.2.3.3.2.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EPS update result	000	TA updated	TA_only
T3412 value	01010101	54 minutes
GUTI	Not present
MS identity	Not present

Table 9.2.3.3.2.3.3-12: Message TRACKING AREA UPDATE REQUEST (steps 5Aa1 and 9Aa1, table 9.2.3.3.2.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS Update Type	000	TA updating	TA_only
EPS Update Type	010	combined RA/LA updating with IMSI attach	Combined TA/LA
GPRS ciphering key sequence number	Any allowed value
Additional GUTI	Not present or any allowed value
Nonce_UE	Any allowed value

Table 9.2.3.3.2.3.3-13: Message TRACKING AREA UPDATE ACCEPT (steps 5Aa2 and 9Aa2, table 9.2.3.3.2.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EPS update result	100	TA updated and ISR activated
EPS update result	101	combined TA/LA updated and ISR activated

9.2.3.3.3 Iu mode to S1 mode intersystem change / Periodic TAU and RAU/ ISR activated, T3423 expired

9.2.3.3.3.1 Test Purpose (TP)

(1)

with { the UE is camped on a E-UTRAN cell, ISR is active, T3312 has expired }

ensure that {

when { UE enters a UTRAN cell belonging to the RA where the UE was last updated }

then { the UE performs a RAU procedure }

}

(2)

with { the UE is camped on a UTRAN cell, ISR is active, T3412 and T3423 have expired }

ensure that {

when { the UE enters a E-UTRAN cell in a TA belonging to the current TA list }

then { the UE performs a TAU procedure including mapped GUTI from UTRAN, P-TMSI signature and additional GUTI}

}

9.2.3.3.3.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.301 clauses 5.3.5 and 5.5.3.2.2 and TS 24.008 clauses 4.7.2.2 and 4.7.5.1.1.

[24.301, clause 5.3.5]

[24.301, clause 5.5.3.2.2]

…

If the UE supports neither A/Gb mode nor Iu mode, the UE shall include a valid GUTI in the Old GUTI IE in the TRACKING AREA UPDATE REQUEST message.

If the UE supports A/Gb mode or Iu mode, the UE shall handle the Old GUTI IE as follows:

NOTE: The mapping of the P-TMSI and RAI to the GUTI is specified in 3GPP TS 23.003 [2].

– If the TIN indicates "GUTI" or "RAT-related TMSI" and the UE holds a valid GUTI, the UE shall indicate the GUTI in the Old GUTI IE.

[24.008, clause 4.7.2.2]

…

If the MS is both IMSI attached for GPRS and non-GPRS services, and if the MS lost coverage of the registered PLMN and timer T3312 expires or timer T3323 expires, then:

d) if the MS returns to coverage in a new RA the description given in subclause 4.7.5 applies.

In A/Gb mode, timer T3312 and timer T3323 shall not be stopped when a GPRS MS enters state GMM-REGISTERED.SUSPENDED.

[24.008, clause 4.7.5.1.1]

…

If the MS supports S1 mode, the MS shall handle the P-TMSI IE as follows:

[24.008, clause 4.7.5.2.1]

The combined routing area updating procedure is initiated only by a GPRS MS operating in MS operation modes A or B, if the MS is in state GMM-REGISTERED and MM-IDLE, and if the network operates in network operation mode I:

– when a GPRS MS that is IMSI attached for GPRS and non-GPRS services detects a change of the routing area in state GMM-REGISTERED and MM-IDLE, unless the MS is configured for "AttachWithIMSI" as specified in 3GPP TS 24.368 [135] or 3GPP TS 31.102 [112] and is entering a routing area in a new PLMN that is neither the registered PLMN nor in the list of equivalent PLMNs;

…

– when the MS which is configured to use CS fallback and SMS over SGs, or SMS over SGs only, enters a GERAN or UTRAN cell and timer T3423 has expired, or is in the GERAN or UTRAN cell when timer T3423 expires;

…

9.2.3.3.3.3 Test description

9.2.3.3.3.3.1 Pre-test conditions

System Simulator:

– cell A and cell 5 (HPLMN);

– cell 5 indicates NMO I.

– System information combination 4 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

UE:

none.

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell A according to TS 36.508 [18] and with M-TMSI = 9a26319c (arbitrary value chosen for this test case).

9.2.3.3.3.3.2 Test procedure sequence

Table 9.2.3.3.3.3.2-1: Main Behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The SS sets the cell type of Cell 5 to "Serving Cell" and the cell type of Cell A to "Non-suitable cell".	–	–	–	–
2	The UE transmits a ROUTING AREA UPDATE message on cell 5.	–>	ROUTING AREA UPDATE REQUEST	–	–
3	The SS transmits a ROUTING AREA UPDATE ACCEPT message on Cell 5 with T3312 set to1 minute and T3323 set to 2 minutes.	<–	ROUTING AREA UPDATE ACCEPT	–	–
4	The UE transmits a ROUTING AREA UPDATE COMPLETE message on Cell 5. Note: RRC connection released	–>	ROUTING AREA UPDATE COMPLETE	–	–
–	Exception: Steps 4Aa1 to 4Aa1b1 describe optional behaviour that depends on the UE capability.	–	–	–	–
4Aa1	IF pc_IMS = TRUE THEN SS starts 6s timer	–	–	–	–
4Aa1a1- 4Aa1a4a6	The procedure defined in TS 36.523-3 Table 10.1.2.1-2 Steps 1-4a6 is performed	–	–	–	–
4Aa1a5	SS releases RRC Connection	–	–	–	–
4Aa1a6	SS Stops 6s timer	–	–	–	–
4Aa1b1	The 6s timer expires	–	–	–	–
5	The SS sets the cell type of Cell A to "Serving cell" and the cell type of Cell 5 to "Non-suitable cell".	–	–	–	–
–	EXCEPTION: Steps 5Aa1 to 5Aa4 describe behaviour that depends on the UE configuration; the "lower case letter" identifies a step sequence that takes place if the UE sends an optional TAU message.	–	–	–	–
5Aa1	The UE may transmit a TRACKING AREA UPDATE REQUEST message on Cell A.	–>	TRACKING AREA UPDATE REQUEST	–	–
5Aa2	The SS transmits a TRACKING AREA UPDATE ACCEPT message on Cell A.	<–	TRACKING AREA UPDATE ACCEPT	–	–
5Aa3	The UE transmits a TRACKING AREA UPDATE COMPLETE message on Cell A.	–>	TRACKING AREA UPDATE COMPLETE	–	–
	EXCEPTION: Steps 5AAa1 to 5AAa2b1 describe optional behaviour if UE sends optional IMS deregistration at steps 4Aa1 to 4Aa1b1	–	–	–	–
5AAa1-5AAa2b1	The procedure defined in TS 36.508 subclause 4.5A.3 Steps 10a1-10a2b1 is performed	–	–	–	–
5Aa4	The SS releases the RRC connection.	–	–	–	–
6	90s after step 3, the SS sets the cell type of Cell 5 to "Serving Cell" and the cell type of Cell A to "Non-suitable cell".	–	–	–	–
7	Check: After T3312 started after Step 4 expires and before T3323 expires, does the UE transmit a ROUTING AREA UPDATE REQUEST message on Cell 5?	–>	ROUTING AREA UPDATE REQUEST	1	P
8	The SS transmits a ROUTING AREA UPDATE ACCEPT message on Cell 5	<–	ROUTING AREA UPDATE ACCEPT	–	–
8A	The SS releases the RRC connection.
–	Exception: Steps 8Ba1 to 8Ba1b1 describe optional behaviour that depends on the UE capability.	–	–	–	–
–	Exception: Steps 8Ba1 to 8Ba1b1 describe optional behaviour that depends on the UE capability.	–	–	–	–
8Ba1	IF pc_IMS = TRUE THEN SS starts 6s timer	–	–	–	–
8Ba1a1- 8Ba1a4a6	The procedure defined in TS 36.523-3 Table 10.1.2.1-2 Steps 1-4a6 is performed	–	–	–	–
8Ba1a5	SS releases RRC Connection	–	–	–	–
8Ba1a6	SS Stops 6s timer	–	–	–	–
8Ba1b1	The 6s timer expires	–	–	–	–
9	The SS sets the cell type of Cell A to "Serving cell" and the cell type of Cell 5 to "Non-suitable cell".	–	–	–	–
10	The UE transmits a TRACKING AREA UPDATE REQUEST message	–>	TRACKING AREA UPDATE REQUEST	–	–
11	The SS transmits a TRACKING AREA UPDATE ACCEPT message with EPS update result indicating that ISR is active, T3412 set to 1 minute and T3423 set to 1 minute.	<–	TRACKING AREA UPDATE ACCEPT	–	–
–	Exception: Steps 11AAa1 to 11AAa1b1 describe optional behaviour if UE sends optional IMS deregistration at steps 8Ba1 to 8Ba1b1	–	–	–	–
11AAa1-11AAa2b1	The procedure defined in TS 36.508 subclause 4.5A.3 Steps 10a1-10a2b1 is performed	–	–	–	–
11A	The SS releases the RRC connection.	–	–	–	–
12	The SS sets the cell type of Cell 5 to "Serving Cell" and the cell type of Cell A to "Non-suitable cell".	–	–	–	–
–	EXCEPTION: Steps 12Aa1 to 12Aa3 describe behaviour that depends on the UE configuration; the "lower case letter" identifies a step sequence that takes place if the UE sends an optional RAU message.	–	–	–	–
12Aa1	Check: Does the UE transmit a ROUTING AREA UPDATE REQUEST message on Cell 5 after T3412 expires? NOTE: A Rel-11 or earlier UEs will send the ROUTING AREA UPDATE REQUEST message before T3423 expires and Rel-12 or later UEs will send ROUTING AREA UPDATE REQUEST message after T3423 expires.	–>	ROUTING AREA UPDATE REQUEST	–	–
12Aa2	The SS transmits a ROUTING AREA UPDATE ACCEPT message on Cell 5	<–	ROUTING AREA UPDATE ACCEPT	–	–
12Aa3	SS releases RRC Connection
–	Exception: Steps 12Aa4 to 12Aa4b1 describe optional behaviour that depends on the UE capability.	–	–	–	–
12Aa4	IF ROUTING AREA UPDATE received at step 12Aa1 and pc_IMS = TRUE THEN SS starts 6s timer	–	–	–	–
12Aa4a1- 12Aa4a4a6	The procedure defined in TS 36.523-3 Table 10.1.2.1-2 Steps 1-4a6 is performed	–	–	–	–
12Aa4a5	SS releases RRC Connection	–	–	–	–
12Aa4a6	SS Stops 6s timer	–	–	–	–
12Aa4b1	The 6s timer expires	–	–	–	–
13	150s after step 12, the SS sets the cell type of Cell A to "Serving cell" and the cell type of Cell 5 to "Non-suitable cell".	–	–	–	–
14	Check: Does the UE transmit a TRACKING AREA UPDATE REQUEST message on Cell A? Note: Both the timers T3412 (1 min) and T3423 (1 min, started after the expiry of T3412) have expired before this test step as there is a wait period of 150s at Step 13	–>	TRACKING AREA UPDATE REQUEST	2	P
15	The SS transmits a TRACKING AREA UPDATE ACCEPT message.	<–	TRACKING AREA UPDATE ACCEPT	–	–
–	Exception: Steps 16a1 to 16a2b1 describe optional behaviour if UE sends optional IMS deregistration at steps 12Aa4 to 12Aa4b1.	–	–	–	–
16a1-16a2b1	The procedure defined in TS 36.508 subclause 4.5A.3 Steps 10a1-10a2b1 is performed	–	–	–	–
–	The UE is in end state E-UTRA connected (E2_T3440).	–	–	–	–

9.2.3.3.3.3.3 Specific message contents

Table 9.2.3.3.3.3.3-1: Void

Table 9.2.3.3.3.3.3-2: Message ROUTING AREA UPDATE ACCEPT (step 3, table 9.2.3.3.3.3.2-1)

Derivation path: 24.008 table 9.4.15
Information Element	Value/Remark	Comment	Condition
Update result	100	RA updated and ISR activated
	001	combined RA/LA updated
Periodic RA update timer	00100001	1 minute
Routing area identification	See 36.508 table 4.4.4-2	RAI of Cell 5
P-TMSI signature	Not present
Allocated P-TMSI RAI TMSI	See 36.508 table 4.4.4-2 efb1ee97	TMSI is an arbitrary value chosen different from M-TMSI in the preamble
T3323 value	00100010	2 minutes

Table 9.2.3.3.3.3.3-3: Message ROUTING AREA UPDATE REQUEST (step 7 table 9.2.3.3.3.3.2-1)

Derivation path: 24.008 table 9.4.14
Information Element	Value/Remark	Comment	Condition
Update type	011	Periodic updating
	010	combined RA/LA updating with IMSI attach
GPRS ciphering key sequence number	Any allowed value
Old routing area identification	RAI of Cell 5 according to 36.508 table 4.4.4-2	The UE includes the RAI from UTRAN
MS Radio Access capability	Any allowed value
Old P-TMSI signature	Not present
P-TMSI	Same value like allocated at step 3, see table 9.2.3.3.3.3.3-1	The UE includes the P-TMSI assigned from UTRAN
UE network capability	Not Present		Update Type = periodic updating
UE network capability	Any allowed value		Update Type <> periodic updating
Additional mobile identity	Not present
Additional old routing area identification	Not present

Table 9.2.3.3.3.3.3-4: Message ROUTING AREA UPDATE ACCEPT (step 8, table 9.2.3.3.3.3.2-1)

Derivation path: 24.008 table 9.4.15
Information Element	Value/Remark	Comment	Condition
Update result	000	RA updated
	001	combined RA/LA updated
Periodic RA update timer	01010101	126 minutes
Routing area identification	See 36.508 table 4.4.4-2	RAI of Cell 5
P-TMSI signature	Not present
Allocated P-TMSI	Not present

Table 9.2.3.3.3.3.3-5: Message TRACKING AREA UPDATE REQUEST (step 10, table 9.2.3.3.3.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type	Any allowed value
Additional GUTI	Any allowed value
Nonce_UE	Any allowed value

Table 9.2.3.3.3.3.3-6: Message TRACKING AREA UPDATE ACCEPT (step 11, table 9.2.3.3.3.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EPS update result	100	TA updated and ISR activated	TA_only
	101	combined TA/LA updated and ISR activated	combined_TA_LA
T3412 value	00100001	1 minute
GUTI	Not present
MS identity	Not present
T3423 value	00100001	1 minute

Table 9.2.3.3.3.3.3-7: Message TRACKING AREA UPDATE REQUEST (step 14, table 9.2.3.3.3.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type	Any allowed value
Old GUTI
M-TMSI	EFB1EE97	Mapped from P-TMSI assigned in the preamble and RAI of cell 5 (start with 11 and RAI in 2^nd most significant byte).
Last visited registered TAI	RAI of cell 5
Additional GUTI	Same GUTI as assigned in the preamble
Nonce_UE	Any allowed value

Table 9.2.3.3.3.3.3-8: Message TRACKING AREA UPDATE ACCEPT (step 15, table 9.2.3.3.3.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EPS update result	000	TA updated	TA_only
	001	combined TA/LA updated	combined_TA_LA
T3412 value	01010101	126 minutes
GUTI	Not present
MS identity	Not present

Table 9.2.3.3.3.3.3-9: Message TRACKING AREA UPDATE REQUEST (step 5Aa1, table 9.2.3.3.3.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type	000	TA updating
EPS update type	010	combined TA/LA updating with IMSI attach
GPRS ciphering key sequence number	Any allowed value
Additional GUTI	Not present or any allowed value
Nonce_UE	Any allowed value

Table 9.2.3.3.3.3.3-10: Message TRACKING AREA UPDATE ACCEPT (step 5Aa2, table 9.2.3.3.3.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EPS update result	100	TA updated and ISR activated
EPS update result	101	combined TA/LA updated and ISR activated

Table 9.2.3.3.3.3.3-11: Message ROUTING AREA UPDATE ACCEPT (step 12Aa2, table 9.2.3.3.3.3.2-1)

Derivation path: 24.008 table 9.4.15
Information Element	Value/Remark	Comment	Condition
Update result	001	combined RA/LA updated
Periodic RA update timer	01010101	126 minutes
Routing area identification	See 36.508 table 4.4.4-2	RAI of Cell 5
P-TMSI signature	Not present
Allocated P-TMSI	Not present

9.2.3.3.4 First S1 mode to Iu mode inter-system change after attach

9.2.3.3.4.1 Test Purpose (TP)

(1)

with { the UE powered on in E-UTRAN with a USIM containing valid E-UTRAN NAS and Security parameters including a valid GUTI, and has successfully performed a combined EPS/IMSI attach or EPS only attach, established PDN connectivity, and performed TRACKING AREA UPDATE REQUEST }

ensure that {

when { the UE reselects UTRAN configured in MNO=II and TIN is set to the temporary ID belonging to the currently used RAT (i.e. ISR not active) }

then { the UE transmits a LOCATION UPDATING REQUEST to the MSC/VLR and derives the IDNNS from the MSC/VLR TMSI, and transmits a ROUTING AREA UPDATE REQUEST message including P-TMSI, P-TMSI signature including the NAS token, and RAI mapped from GUTI, the old routing area identification mapped from the RAI, the GPRS ciphering key sequence number indicating the eKSI associated with the EPS security context. Old P-TMSI signature and Old routing area identification are mapped from the GUTI. The message is encapsulated in an INITIAL DIRECT TRANSFER message including IDNSS mapped from GUTI, START value set to 0 and PLMN identity }

(2)

with { the UE camped on E-UTRAN and has a valid GUTI and P-TMSI }

ensure that {

when { the UE reselects UTRAN and receives a new P-TMSI as part of the RAU procedure }

then { the UE uses the new P-TMSI (and not GUTI or old P-TMSI) for subsequent IDNNS network access (e.g. via the Service Request procedure }

}

(3)

with { the UE has performed a RAU procedure in UTRAN after initial registration at power on in E-UTRAN }

ensure that {

when { the UE reselects a E-UTRAN cell with the same LA as previously selected}

then { the UE transmits a TRACKING AREA UPDATE REQUEST message including eKSI stored in the USIM, old GUTI mapped from RAI and P-TMSI, GPRS ciphering sequence number, nonceUE. The UE encodes the RRC parameters in the RRC Connection Establishment messages correctly (i.e. in the RRCConnectionRequest message, the ue-Identity is set to s-TMSI or "Random value” for pre-Rel-12 UE, or set to randomValue from Rel-12 and onwards UE. The establishmentcause is set to MO-signalling; and, in the RRCConnectionSetupComplete message the selectedPLMN-identity, mmegi and mmec indicate the value of the registered MME when ue-Identity is set to randomValue (e.g. as retrieved from the USIM at power-on, or, as received in the last TRACKING AREA UPDATE ACCEPT message) }

}

(4)

with { the UE has transmitted a ROUTING AREA UPDATE REQUEST message after initial registration at power on in E-UTRAN }

ensure that {

when { the UE receives a SECURITY MODE COMMAND message }

then { the UE transmits a SECURITY MODE COMPLETE and starts performing ciphering an integrity protection using CK’ and IK’ derived from K_ASME and UL NAS COUNT }

(5)

with { the UE has received an AUTHENTICATION AND CIPHERING REQUSET message after it has performed ciphering an integrity protection using CK’ and IK’ derived from K_ASME and UL NAS COUNT }

ensure that {

when { the UE receives a SECURITY MODE COMMAND message }

then { the UE transmits a SECURITY MODE COMPLETE and starts performing ciphering an integrity protection using new CK and IK }

NOTE: ISR considered not in the scope of this test case, so it is never activated.

9.2.3.3.4.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 23.003 clause 2.8.2.1, 2.8.2.2, TS 23.401 Annex J.2; TS 24.301 clause 5.5.3.2.2 and Annex D; TS 25.331 clauses 8.1.8.2, 8.1.8.3 (on IDNNS) and 8.3.8.2; TS 24.008 clause 4.7.5.1.1 and 4.7.5.1.3; TS 23.236 clause 5.1; and TS 36.331 clauses 5.3.3.3 and 5.3.3.4.

[TS 23.003, clause 2.8.2.1]

The mapping of the GUTI shall be done to the combination of RAI of GERAN / UTRAN and the P‑TMSI:

E‑UTRAN <MCC> maps to GERAN/UTRAN <MCC>

E‑UTRAN <MNC> maps to GERAN/UTRAN <MNC>

E‑UTRAN <MME Group ID> maps to GERAN/UTRAN <LAC>

E‑UTRAN <MME Code> maps to GERAN/UTRAN <RAC> and is also copied into the 8 most significant bits of the NRI field within the P‑TMSI;

E‑UTRAN <M-TMSI> maps as follows:

– 6 bits of the E‑UTRAN <M-TMSI> starting at bit 29 and down to bit 24 are mapped into bit 29 and down to bit 24 of the GERAN/UTRAN <P‑TMSI>;

– 16 bits of the E‑UTRAN <M-TMSI> starting at bit 15 and down to bit 0 are mapped into bit 15 and down to bit 0 of the GERAN/UTRAN <P‑TMSI>;

– and the remaining 8 bits of the E‑UTRAN <M-TMSI> are mapped into the 8 MBS bits of the <P-TMSI signature> field.

[TS 23.003, clause 2.8.2.2]

The mapping of P‑TMSI (TLLI) and RAI in GERAN/UTRAN to GUTI in E‑UTRAN shall be performed as follows:

GERAN/UTRAN <MCC> maps to E‑UTRAN <MCC>

GERAN/UTRAN <MNC> maps to E‑UTRAN <MNC>

GERAN/UTRAN <LAC> maps to E‑UTRAN <MME Group ID>

GERAN/UTRAN <RAC> maps into bit 23 and down to bit 16 of the M‑TMSI

The 8 most significant bits of GERAN/UTRAN <NRI> map to the MME code.

GERAN/UTRAN <P‑TMSI> maps as follows:

– 6 bits of the GERAN/UTRAN <P‑TMSI> starting at bit 29 and down to bit 24 are mapped into bit 29 and down to bit 24 of the E‑UTRAN <M-TMSI>;

– 16 bits of the GERAN/UTRAN <P‑TMSI> starting at bit 15 and down to bit 0 are mapped into bit 15 and down to bit 0 of the E‑UTRAN <M-TMSI>.

[TS 23.401, Annex J.2 "Usage of TIN”]

…

When ISR is not active the TIN is always set to the temporary ID belonging to the currently used RAT. This guarantees that always the most recent context data are used, which means during inter-RAT changes there is always context transfer from the CN node serving the last used RAT. The UE identities, old GUTI IE and additional GUTI IE, indicated in the next TAU Request message, and old P-TMSI IE and additional P-TMSI/RAI IE, indicated in the next RAU Request message depend on the setting of TIN and are specified in table 4.3.5.6-2.

[TS 24.301, clause 5.5.3.2.2 "Normal and periodic tracking area updating procedure initiation”]

…

If the UE supports A/Gb mode or Iu mode, the UE shall handle the GUTI as follows:

– if the TIN indicates "GUTI" or "RAT-related TMSI" and the UE holds a valid GUTI, the UE shall indicate the GUTI in the Old GUTI IE.

…

…[TS 24.301, Annex D]

…

Table D.1.1: Mapping of NAS procedure to establishment cause and call type

NAS procedure	RRC establishment cause (according 3GPP TS 36.331 [22])	Call type
…
Tracking Area Update	MO signalling (See Note 1)	"originating signalling"
…
Note 1: For these NAS procedures initiated by UEs of access class 12, 13 or 14 in their home country, the RRC establishment cause will be set to "High priority access AC 11 – 15". For this purpose the home country is defined as the country of the MCC part of the IMSI, see 3GPP TS 22.011 [1A]. For these NAS procedures initiated by UE of access class 11 or 15 in their HPLMN or EHPLMN, the RRC establishment cause will be set to "High priority access AC 11 – 15".

[TS 36.331, clause 5.3.3.3]

The UE shall set the contents of RRCConnectionRequest message as follows:

1> set the ue-Identity as follows:

2> if upper layers provide an S-TMSI:

3> set the ue-Identity to the value received from upper layers;

2> else

3> draw a random value in the range 0 .. 2⁴⁰-1 and set the ue-Identity to this value;

NOTE 1: Upper layers provide the S-TMSI if the UE is registered in the TA of the current cell.

1> Set the establishmentCause in accordance with the information received from upper layers;

[TS 36.331, clause 5.3.3.4]

…

1> set the content of RRCConnectionSetupComplete message as follows:

2> set the selectedPLMN-Identity to the PLMN selected by upper layers (see TS 23.122 [11], TS 24.301 [35]) from the PLMN(s) included in the plmn-IdentityList in SystemInformationBlockType1;

2> if upper layers provide the ‘Registered MME’, set the registeredMME as follows:

3> if the PLMN identity of the ‘Registered MME’ is different from the PLMN selected by the upper layers:

4> include the plmnIdentity in the registeredMME and set it to the value of the PLMN identity in the ‘Registered MME’ received from upper layers;

3> set the mmegi and the mmec to the value received from upper layers;

2> set the dedicatedInfoNAS to include the information received from upper layers;

…

[TS 24.008, clause 4.7.5.1.1]

If the MS supports S1 mode, the MS shall handle the P-TMSI IE as follows:

…

If the routing area updating procedure is initiated by the MS due to an S1 mode to Iu mode or S1 mode to A/Gb mode inter-system change in idle mode and the TIN indicates "GUTI", the message ROUTING AREA UPDATE REQUEST shall include a P-TMSI signature filled with a NAS token as specified in 3GPP TS 33.401 [119]. In the GPRS ciphering key sequence number IE the MS shall indicate the value of the eKSI associated with the current EPS security context.

NOTE: When the MS includes a P-TMSI signature filled with a NAS token, 8 bits of the NAS token will be filled with bits from the M‑TMSI (see 3GPP TS 23.003 [4]).

If the routing area updating procedure is initiated by the MS due to the S1 mode to Iu mode or S1 mode to A/Gb mode inter-system change in connected mode, the MS shall derive CK’ and IK’ from K_ASME and from the NAS downlink COUNT value indicated by lower layers as specified in 3GPP TS 33.401 [119]. If the routing area updating procedure is initiated by the MS due to the S1 mode to Iu mode or S1 mode to A/Gb mode inter-system change in idle mode when the TIN indicates "GUTI", the MS shall derive CK’ and IK’ from the K_ASME and the NAS downlink COUNT value corresponding to the NAS token derived as specified in 3GPP TS 33.401 [119]. The MS shall indicate the eKSI value in the CKSN field of the GPRS ciphering key sequence number IE in the ROUTING AREA UPDATE REQUEST message. Then, the MS shall reset the START value and store the mapped UMTS security context replacing the established UMTS security context.

[TS 24.008, clause 4.7.5.1.3]

…

A ROUTING AREA UPDATE COMPLETE message shall be returned to the network if the ROUTING AREA UPDATE ACCEPT message contained any of:

– a P-TMSI;

– Receive N‑PDU Numbers (see 3GPP TS 44.065 [78] and 3GPP TS 25.322 [19b]); or

– a request for the provision of Inter RAT handover information or E-UTRAN inter RAT handover information or both.

If Receive N‑PDU Numbers were included, the Receive N‑PDU Numbers values valid in the MS, shall be included in the ROUTING AREA UPDATE COMPLETE message.

If the network has requested the provision of Inter RAT handover information or E-UTRAN inter RAT handover information or both, the MS shall return a ROUTING AREA UPDATE COMPLETE message including the Inter RAT handover information IE or E-UTRAN inter RAT handover information IE or both to the network.

NOTE 1: In Iu mode, after a routing area updating procedure, the mobile station can initiate Service Request procedure to request the resource reservation for the active PDP contexts if the resources have been released by the network or send upper layer message (e.g. ACTIVATE PDP CONTEXT REQUEST) to the network via the existing PS signalling connection.

In Iu mode, if the network wishes to prolong the PS signalling connection (for example, if the mobile station has indicated "follow-on request pending" in ROUTING AREA UPDATE REQUEST message) the network shall indicate the "follow-on proceed" in the ROUTING AREA UPDATE ACCEPT message. If the network wishes to release the PS signalling connection, the network shall indicate "no follow-on proceed" in the ROUTING AREA UPDATE ACCEPT message.

After that in Iu mode, the mobile station shall act according to the follow-on proceed flag included in the Update result information element in the ROUTING AREA UPDATE ACCEPT message (see subclause 4.7.13).

[TS 23.236, clause 5.1 "MS Functions”]

…

In Iu mode the MS provides the IDNNS to the RNC in the access stratum part of the RRC_initial_DT message as described in TS 25.331 [5].

If the MS is E‑UTRAN capable, then TS 23.401 [22], TS 23.060 [2] and TS 23.003 [18] define rules as to how the MS shall select and encode the identity to place in the P‑TMSI/TLLI parameters used in the Routing Area Update procedure. For the PS domain, the E‑UTRAN capable MS shall use this P‑TMSI parameter to derive the UTRAN IDNNS parameter. For the CS domain, the E‑UTRAN temporary identities shall not be used to derive the IDNNS: instead the MS shall use its (MSC supplied) TMSI, if that TMSI is valid, to derive the IDNNS.

…

When the MS in Iu mode replies to IMSI paging, it shall derive IDNNS from (P)TMSI if a valid one is available. If (P)TMSI is not available, the MS shall derive IDNNS from IMSI.

[TS 25.331, clause 8.1.8.2]

In the UE, the initial direct transfer procedure shall be initiated, when the upper layers request establishment of a signalling connection. This request also includes a request for the transfer of a NAS message.

Upon initiation of the initial direct transfer procedure the UE shall:

1> set the variable ESTABLISHMENT_CAUSE to the cause for establishment indicated by upper layers.

Upon initiation of the initial direct transfer procedure when the UE is in idle mode, the UE shall:

1> perform an RRC connection establishment procedure, according to subclause 8.1.3;

NOTE: If an RRC connection establishment is ongoing, this procedure continues unchanged, i.e. it is not interrupted.

1> if the RRC connection establishment procedure was not successful:

2> if the establishment cause for the failed RRC connection establishment was set to "MBMS reception" and a different cause value is stored in the variable "ESTABLISHMENT_CAUSE":

3> UE-AS (RRC) initiates a new RRC connection establishment procedure, using the establishment cause as contained in the variable ESTABLISHMENT_CAUSE.

2> otherwise:

3> indicate failure to establish the signalling connection to upper layers and end the procedure.

1> when the RRC connection establishment procedure is completed successfully:

2> continue with the initial direct transfer procedure as below.

…

The UE shall, in the INITIAL DIRECT TRANSFER message:

1> set the IE "NAS message" as received from upper layers; and

1> set the IE "CN domain identity" as indicated by the upper layers; and

1> set the IE "Intra Domain NAS Node Selector" as follows:

2> derive the IE "Intra Domain NAS Node Selector" from TMSI/PMTSI, IMSI, or IMEI; and

2> provide the coding of the IE "Intra Domain NAS Node Selector" according to the following priorities:

1. derive the routing parameter for IDNNS from TMSI (CS domain) or PTMSI (PS domain) whenever a valid TMSI/PTMSI is available;

2. base the routing parameter for IDNNS on IMSI when no valid TMSI/PTMSI is available;

3. base the routing parameter for IDNNS on IMEI only if no (U)SIM is inserted in the UE.

1> if the UE, on the existing RRC connection, has received a dedicated RRC message containing the IE "Primary PLMN Identity" in the IE "CN Information Info":

[TS 25.331, clause 8.1.8.3]

On reception of the INITIAL DIRECT TRANSFER message the NAS message should be routed using the IE "CN Domain Identity". UTRAN may also use the IE "Intra Domain NAS Node Selector" and the IE "PLMN identity" for routing among the CN nodes for the addressed CN domain.

If no signalling connection exists towards the chosen node, then a signalling connection is established.

When the UTRAN receives an INITIAL DIRECT TRANSFER message, it shall not affect the state of any other ongoing RRC procedures, when not stated otherwise elsewhere.

The UTRAN should:

1> set the START value for the CN domain indicated in the IE "CN domain identity" to the value of the IE "START".

[TS 25.331, clause 8.3.8.2]

When the UE makes an inter-RAT cell reselection to UTRAN according to the criteria specified in [4], it shall initiate this procedure. The inter-RAT cell reselection made by the UE may use system information broadcast from the source radio access technology or UE dedicated information.

If the NAS procedures associated with inter-system change specified in [5] require the establishment of an RRC connection, the UE shall:

1> set the variable ESTABLISHMENT_CAUSE to "Inter-RAT cell reselection";

NOTE: This value of ESTABLISHMENT_CAUSE has priority over the cause requested by upper layers.

1> initiate an RRC connection establishment procedure as specified in subclause 8.1.3;

1> after initiating an RRC connection establishment:

2> release all resources specific to the other radio access technology.

If the NAS procedures associated with inter-system change specified in [5] do not require the establishment of an RRC connection, the UE shall:

1> enter idle mode in the target cell without accessing the cell; and

1> release all resources specific to the other radio access technology.

9.2.3.3.4.3 Test description

9.2.3.3.4.3.1 Pre-test conditions

System Simulator:

– cell A is configured as Serving cell, cell 5 as Non-Suitable cell;

– cell 5 (belongs to LAI-2) is operating in network operation mode II (No Gs interface present);

– cell A has the absolute priorities set to LTE.

– System information combination 4 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

NOTE: For cell 5, power levels are defined in TS 34.108 subclause 6.1.5 (FDD) or 6.1.6 (TDD).

UE:

the UE is previously registered on UTRAN, and when on UTRAN, the UE is last registered on cell 5 using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Registered Idle Mode (state 2) in cell A according to TS 36.508 [18].

9.2.3.3.4.3.2 Test procedure sequence

Table 9.2.3.3.4.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The signal strength of Cell 5 is raised to that of the Serving Cell and that of Cell A is lowered to that of a non-Suitable Neighbour Cell as defined in table 6.2.2.1-1 of TS 36.508 [18].	–	–	–	–
2	Void	–	–	–	–
3	Void	–	–	–	–
4	Void	–	–	–	–
–	EXCEPTION: The behaviour in table 9.2.3.3.4.3.2-2 occurs in parallel with step 5	–	–	–	–
5	Check: Does the UE transmit a ROUTING AREA UPDATE REQUEST message on Cell 5 as specified in the specific message contents included in an INITIAL DIRECT TRANSFER message with intraDomainNasNodeSelector mapped from GUTI-1?	–>	ROUTING AREA UPDATE REQUEST	1	P
5A	The SS sends a SECURITY MODE COMMAND message to activate integrity protection and ciphering. This message is integrity protected using IK’ derived from K_ASME and UL NAS COUNT.	–	–	–	–
5B	Check: Does the UE transmit a SECURITY MODE COMPLETE message integrity protected using IK’ derived from K_ASME and UL NAS COUNT?	–	–	4	P
6	The SS transmits a ROUTING AREA UPDATE ACCEPT message with Update result = "RA updated” and new P-TMSI allocated with a different NRI (=IDNNS) to that in the GUTI and the P-TMSI that was stored on the USIM. This message is ciphered and integrity protected using CK’ and IK’ derived from K_ASME and UL NAS COUNT.	<–	ROUTING AREA UPDATE ACCEPT	–	–
7	Check: Does the UE transmit a ROUTING AREA UPDATE COMPLETE message ciphered and integrity protected using CK’ and IK’ derived from K_ASME and UL NAS COUNT?	–>	ROUTING AREA UPDATE COMPLETE	4	P
8	The SS releases the RRC connection	–	–	–	–
9	The SS transmits Paging with new P-TMSI allocated in step 6 on cell 5	<–	Page	–	–
10	Check: Does the UE send a Service Request to access the PS domain using IDNNS mapped from the P-TMSI allocated in step 6?	–>	SERVICE REQUEST	2	P
10A	The SS sends an AUTHENTICATION AND CIPHERING REQUEST message to perform a UMTS AKA procedure.	<–	AUTHENTICATION AND CIPHERING REQUEST	–	–
10B	The UE sends an AUTHENTICATION AND CIPHERING RESPONSE message.	–>	AUTHENTICATION AND CIPHERING RESPONSE	–	–
11	The SS sends a SECURITY MODE COMMAND message to activate integrity protection and ciphering. This message is integrity protected using new IK.	–	–	–	–
11A	Check: Does the UE transmit a SECURITY MODE COMPLETE message integrity protected using new IK?	–	–	5	–
11B	The SS transmits a UE CAPABILITY ENQUIRY message requesting the UE UTRAN capability. This message is ciphered and integrity protected using new CK and IK. Check: Does the UE transmit a UE CAPABILITY INFORMATION message? Note: the purpose of this message is to show that the UE uses new CK and IK, and not CK’ and IK’ used in step 7.	–	–	5	P
11C	SS transmits a UE CAPABILITY INFORMATION CONFIRM message	<–	UE CAPABILITY INFORMATION CONFIRM	–	–
12	The SS releases the RRC connection	–	–	–	–
12A	Cell A is configured as the Serving cell and cell 5 is configured as a Suitable Neighbour Cell.	–	–	–	–
12 B	Check: Does the UE transmit an RRCConnectionRequest with the ue-Identity set for pre-Rel-12 UE to s-TMSI or "random value”, and for Rel-12 and onwards UE set to randomValue, the establishmentcause set to MO-signalling?	–>	RRCConnectionRequest	3	P
13	The SS responds with RRCConnectionSetup.	<–	RRCConnectionSetup	–	–
14	Check: Does the UE transmit an RRCConnectionSetupComplete message with the mmegi and mmec set to the values derived from the mapped RAI and P-TMSI and with the gummei type set to mapped when randomValue is included in step 12B, otherwise without the registeredMME included, and containing a TRACKING AREA UPDATE REQUEST message?	–>	RRCConnectionSetupComplete (TRACKING AREA UPDATE REQUEST)	3	P
15	The SS responds with a TRACKING AREA UPDATE ACCEPT message	<–	TRACKING AREA UPDATE ACCEPT	–	–
15A	UE transmits a TRACKING AREA UPDATE COMPLETE message	–>	TRACKING AREA UPDATE COMPLETE	–	–
16	The SS releases the RRC connection.	–	–	–	–

Table: 9.2.3.3.4.3.2-2: Parallel behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
	EXCEPTION: Steps 1a1 to 1a2 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that take place if the UE is configured in CS/PS mode.
1a1	Check: The UE transmits a LOCATION UPDATING REQUEST on cell 5 to the MSC as specified in the specific message contents included in an INITIAL DIRECT TRANSFER message with intraDomainNasNodeSelector mapped from MSC TMSI allocated in the ATTACH ACCEPT message (step 14 table 4.5.2.3-1 of TS 36.508 [18])).	–>	LOCATION UPDATING REQUEST	1	P
1a2	The SS transmits a LOCATION UPDATING ACCEPT message.	<–	LOCATION UPDATING ACCEPT	–	–

Specific message contents

Table 9.2.3.3.4.3.3-1: Void

Table 9.2.3.3.4.3.3-2: Void

Table 9.2.3.3.4.3.3-2A: INITIAL DIRECT TRANSFER (step 1a1, Table 9.2.3.3.4.3.2-2)

Derivation path: 25.331 clause 11
Information Element	Value/Remark	Comment	Condition
InitialDirectTransfer ::= SEQUENCE {
cn-DomainIdentity	cs-domain
intraDomainNasNodeSelector SEQUENCE {
version CHOICE {
release99 SEQUENCE {
gsm-Map-IDNNS SEQUENCE {
routingbasis CHOICE {
tMSIofsamePLMN {			If UE is configured as PS/CS mode 1 or 2 of operation
Routingparameter	bit 23 to bit 14 of TMSI allocated in pre-test
}
localPTMSI {			If UE is configured as PS mode 1 or 2 of operation
Routingparameter	bit 23 to bit 14 of TMSI allocated in pre-test
}
}
}
}
}
}
}
nas-Message	See table 9.2.3.3.4.3.3-5
measuredResultsOnRACH	Not checked
v3a0NonCriticalExtensions SEQUENCE {
initialDirectTransfer-v3a0ext SEQUENCE {
start-Value	Any
}
laterNonCriticalExtensions SEQUENCE {
initialDirectTransfer-r3-add-ext	Not checked
v590NonCriticalExtension SEQUENCE {
initialDirectTransfer-v590ext SEQUENCE {
establishmentCause	Registration or Not present
}
v690NonCriticalExtensions	Not checked
}
}
}
}

Table 9.2.3.3.4.3.3-3: LOCATION UPDATING REQUEST (step 1a1, Table 9.2.3.3.4.3.2-2)

Derivation path: 24.008 table 9.2.17
Information Element	Value/Remark	Comment	Condition
Update type	0000	LA updating	If UE is configured as PS/CS mode 1 or 2 of operation
	0010	IMSI attach	If UE is configured as PS mode 1 or 2 of operation
Ciphering key sequence number	eKSI stored on the test USIM
Location area identification	PLMN= MCC/MNC LAC 1=1	”PLMN is set to the same MCC/MNC stored in EF_IMSI” ”TAI-1”	If UE is configured as PS/CS mode 1 or 2 of operation
	PLMN= MCC/MNC LAC 1=2		If UE is configured as PS mode 1 or 2 of operation
Mobile identity	TMSI-1	Allocated in preamble

Table 9.2.3.3.4.3.3-3A: LOCATION UPDATING ACCEPT (step 4, Table 9.2.3.3.4.3.2-1)

Derivation Path: TS 36.508 Table 4.7B.2-5
Information Element	Value/remark	Comment	Condition
Mobile identity	Not present

Table 9.2.3.3.4.3.3-4: INITIAL DIRECT TRANSFER (step 5, Table 9.2.3.3.4.3.2-1)

Derivation path: 25.331 clause 11
Information Element	Value/Remark	Comment	Condition
InitialDirectTransfer ::= SEQUENCE {
cn-DomainIdentity	ps-domain
intraDomainNasNodeSelector SEQUENCE {
version CHOICE {
release99 SEQUENCE {
gsm-Map-IDNNS SEQUENCE {
routingbasis CHOICE {
tMSIofsamePLMN {
Routingparameter	bit 23 to bit 14 of P-TMSI mapped from GUTI allocated to UE in pre-test
}
}
}
}
}
}
}
nas-Message	See table 9.2.3.3.4.3.3-5
measuredResultsOnRACH	Not checked
v3a0NonCriticalExtensions SEQUENCE {
initialDirectTransfer-v3a0ext SEQUENCE {
start-Value	Any
}
laterNonCriticalExtensions SEQUENCE {
initialDirectTransfer-r3-add-ext	Not checked
v590NonCriticalExtension SEQUENCE {
initialDirectTransfer-v590ext SEQUENCE {
establishmentCause	Registration or Not present
}
v690NonCriticalExtensions	Not checked
}
}
}
}

Table 9.2.3.3.4.3.3-5: Message ROUTING AREA UPDATE REQUEST (step 5, Table 9.2.3.3.4.3.2-1)

Derivation path: 24.008 table 9.4.14
Information Element	Value/Remark	Comment	Condition
Update type	000	RA updating
GPRS ciphering key sequence number	eKSI stored on the test USIM
Old routing area identification	GUTI-1 right shifted by 32bits
MS Radio Access capability	Not checked
Old P-TMSI signature	Mapped from GUTI-1
Requested READY timer value	Not checked
DRX parameter	Not checked
TMSI status	Not present
P-TMSI	Value is specified bit by bit below: – bit 31 and bit 30: 1 – bit 29 to bit 24: bit 29 to bit 24 of M-TMSI allocated in preamble – bit 23 to bit 16: MME code allocated in preamble – bit 15 to bit 0: bit 15 to bit 0 of M-TMSI allocated in preamble
MS network capability	Not checked
PDP context status	Not checked
PS LCS Capability	Not checked
MBMS context status	Not checked
UE network capability	Any allowed value
Additional mobile identity	P-TMSI allocated in pre-test
Additional old routing area identification	RAI-1
Mobile station classmark 2	Not checked
Mobile station classmark 3	Not checked
Supported Codecs	Not checked

Table 9.2.3.3.4.3.3-6: Message SERVICE REQUEST (step 10, Table 9.2.3.3.4.3.2-1)

Derivation path: 24.008 table 9.4.20
Information Element	Value/Remark	Comment	Condition
Ciphering key sequence number	FFS
Service Type	010 (Paging Response)
P-TMSI	P-TMSI allocated in step 6.

Table 9.2.3.3.4.3.3-6A: SECURITY MODE COMMAND (step 11, Table 9.2.3.3.4.3.2-1)

Derivation path: 34.108 clause 9.1.1
Information Element	Value/Remark	Comment	Condition
RRC transaction identifier	Arbitrarily selects an integer between 0 and 3
Integrity check info
– Message authentication code	Set to MAC-I value computed by the SS. The first/ leftmost bit of the bit string contains the most significant bit of the MAC-I.
– RRC Message Sequence Number	Set to an arbitrarily selected integer between 0 and 15
Security capability	Set same value as originally sent by UE in the RRC CONNECTION SETUP COMPLETE message in step 10.
Ciphering mode info
– Ciphering mode command	Start/restart
– Ciphering algorithm	Set one of the algorithms supported by the UE as indicated in the IE "security capability" in the RRC CONNECTION SETUP COMPLETE message in step 10.
– Ciphering activation time for DPCH	Not Present
– Radio bearer downlink ciphering activation time info
– Radio bearer activation time
– RB identity	1
– RLC sequence number	Current RLC SN stored in the SS
– RB identity	2
– RLC sequence number	Current RLC SN stored in the SS +2
– RB identity	3
– RLC sequence number	Current RLC SN stored in the SS
– RB identity	4
– RLC sequence number	Current RLC SN stored in the SS
Integrity protection mode info
– Integrity protection mode command	startIntegrityProtection
– Integrity protection initialisation number	Arbitrary selects 32 bits number for FRESH
– Integrity protection algorithm	Set one of the algorithms supported by the UE as indicated in the IE "security capability" in the RRC CONNECTION SETUP COMPLETE message in step 10.
CN domain identity	PS
UE system specific security capability	Not present		not GSM
UE system specific security capability			GSM
– Inter-RAT UE security capability
– CHOICE system	GSM
– GSM security capability	Set the same as the algorithms supported by the UE as indicated in the IE "UE system specific capability" in the RRC CONNECTION SETUP COMPLETE message in step 10.

Condition	Explanation
GSM	UE supporting GSM

Table 9.2.3.3.4.3.3-6B: SECURITY MODE COMPLETE (step 11 A , Table 9.2.3.3.4.3.2-1)

Derivation path: 34.108 clause 9.1.1
Information Element	Value/Remark	Comment	Condition
RRC transaction identifier	The value of this IE is checked to see that it matches the value of the same IE transmitted in the downlink SECURITY MODE COMMAND message.
Integrity check info
– Message authentication code	This IE is checked to see if it is present. The value is compared against the XMAC-I value computed by SS. The first/ leftmost bit of the bit string contains the most significant bit of the MAC-I.
– RRC Message Sequence Number	The value is used by SS to compute the XMAC-I value.
Uplink integrity protection activation info
– RRC message sequence number list
– RRC message sequence number	Check to see if the RRC SN for RB 0 is present
– RRC message sequence number	Check to see if the RRC SN for RB 1 is present
– RRC message sequence number	Check to see if the RRC SN for RB 2 is present
– RRC message sequence number	Check to see if the RRC SN for RB 3 is present
– RRC message sequence number	Check to see if the RRC SN for RB 4 is present
Radio bearer uplink ciphering activation time info
– Radio bearer activation time
– RB Identity	1
– RLC sequence number	Check to see if the RLC SN for RB1is present
– RB Identity	2
– RLC sequence number	Check to see if the RLC SN for RB2is present
– RB Identity	3
– RLC sequence number	Check to see if the RLC SN for RB3 is present
– RB Identity	4
– RLC sequence number	Check to see if the RLC SN for RB4 is present

Table 9.2.3.3.4.3.3-7: Message RRCConnectionRequest (step 12 B, Table 9.2.3.3.4.3.2-1)

Derivation path: 36.508 table 4.6.1-16
Information Element	Value/Remark	Comment	Condition
RRCConnectionRequest ::= SEQUENCE {
criticalExtensions CHOICE {
rrcConnectionRequest-r8 SEQUENCE {
ue-Identity CHOICE {
s-TMSI	Received from upper layer NAS	Rel-8 to Rel-11 inclusive
randomValue	Any allowed value	Rel-8 and onwards
}
establishmentCause	Mo-Signalling
}
}
}

Table 9.2.3.3.4.3.3-8: Message RRCConnectionSetupComplete (step 14, Table 9.2.3.3.4.3.2-1)

Derivation path: 36.508 table 4.6.1-18
Information Element	Value/Remark	Comment	Condition
RRCConnectionSetupComplete ::= SEQUENCE {
criticalExtensions CHOICE {
c1 CHOICE {
rrcConnectionSetupComplete-r8 SEQUENCE {
selectedPLMN-Identity	1
registeredMME	Not present	Shall be absent if the upper layers provided s-TMSI in RRCConnectionRequest message in step 12B for pre-Rel-12 UE
registeredMME {		Present only when the ue-Identity in step 12B is set to randomValue
plmn-Identity	Not present
Mmegi	LAC sent to the UE in step 6
Mmec	Bit 23 to bit 16 of P-TMSI sent to the UE in step 6
}
dedicatedInfoNAS	See table 9.2.3.3.4.3.3-9
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
gummei-Type-r10	mapped	Present when the registeredMME is included
}
}
}
}
}
}

Table 9.2.3.3.4.3.3-9: Message TRACKING AREA UPDATE REQUEST (step 14, Table 9.2.3.3.4.3.2-1)

Derivation path: 36.508 table 4.7.2-27 with condition UNCIPHERED (the message is integrity protected using the key stored in the USIM).
Information Element	Value/Remark	Comment	Condition
EPS update type	000 or 010	‘TA updating’ or ‘combined TA/LA updating with IMSI attach’
NAS key set identifier
NAS key set identifier	The valid NAS key set identifier stored in the USIM
TSC	‘0’B	native security context (for KSI_ASME)
Old GUTI or IMSI
Type of identity	110	GUTI
MNC/MCC	Mobile Country Code and Mobile Network Code stored in EF_IMSI on the test USIM
MME Group ID	LAI allocated at step 8
MME Code	Bit 23 to bit 16 of P-TMSI allocated at step 8
M-TMSI	Value is specified bit by bit below: – bit 31 and bit 30: FFS – bit 29 to bit 24: bit 29 to bit 24 of P-TMSI allocated at step 8 – bit 23 to bit 16: RAC allocated at step 8 – bit 15 to bit 0: bit 15 to bit 0 of P-TMSI allocated at step 8
GPRS ciphering key sequence number	GPRS ciphering key sequence number allocated at step 10A
Old P-TMSI signature	P-TMSI signature allocated at step 8
Additional GUTI	GUTI-1
Nonce_UE	Any allowed value (must be present)
UE network capability	Any allowed value (must be present)
Last visited registered TAI	TAI stored in the test USIM
MS network capability	Any allowed value (must be present)
Old location area identification	Not present if "EPS update type" is ‘TA updating’, LAI-2 is "EPS update type" is ‘combined TA/LA updating’
TMSI status	Not present

9.2.3.3.5 Periodic routing area update

9.2.3.3.5.1 Test Purpose (TP)

(1)

with { UE is camped on an E-UTRAN cell or in ECM-CONNECTED state and ISR is activated }

ensure that {

when { UE performs E-UTRA RRC state transitions }

then { UE keeps the periodic routing area update timer T3312 running }

}

(2)

with { UE is camped on an E-UTRAN cell or ECM-CONNECTED state and ISR is activated }

ensure that {

when { the periodic routing area update timer T3312 expires }

then { UE does not change RAT }

}

(3)

with { UE is in state GMM-REGISTERED.NO-CELL-AVAILABLE and ISR is activated and the periodic routing area update timer T3312 expires }

ensure that {

when { UE enters the state GMM-REGISTERED.NORMAL-SERVICE }

then { UE initiates the routing area updating procedure }

}

9.2.3.3.5.2 Conformance requirements

References: The conformance requirements covered in the present TC are specified in: TS 24.008, clause 4.7.2.2 and TS 23.401, clause 4.3.5.2.

[TS 24.008, clause 4.7.2.2]

[TS 23.401, clause 4.3.5.2]

If the UE is camped on an E‑UTRAN cell or is in ECM‑CONNECTED state when the UE’s periodic RAU or periodic LAU timer expires and ISR is activated the UE shall start the GERAN/UTRAN Deactivate ISR timer. After the GERAN/UTRAN Deactivate ISR timer expires the UE shall deactivate ISR by setting its TIN to "GUTI". The GMM/PMM-REGISTERED UE shall remember it has to perform a Routeing Area Update to the SGSN or a Location Area Update to the MSC when it next returns to 2G/3G coverage.

The E-UTRAN Deactivate ISR timer is stopped when the UE performs a successful TAU; and the GERAN/UTRAN Deactivate ISR timer is stopped when the UE performs a successful RAU/LAU.

Expiry of the periodic TAU timer, or, the periodic RAU timer, or, the periodic LAU timer shall not cause the UE to change RAT.

…

E‑UTRAN RRC state transitions shall have no impact on the periodic RAU timer or periodic LAU timer except that handover from 2G/3G to E‑UTRAN shall cause the periodic RAU timer to be started from its initial value.

9.2.3.3.5.3 Test description

9.2.3.3.5.3.1 Pre-test conditions

System Simulator:

– cell A (belongs to TAI-1, home PLMN) is set to "Serving cell";

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 5 (home PLMN, RAI-1, NMO 1) is set to "Non-suitable cell";

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, cell 24 (home PLMN, RAI-1, NMO 1) is set to "Non-suitable cell";

– System information combination 10 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

NOTE: Setting px_RATComb_Tested = EUTRA_Only is not allowed.

UE:

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, the UE is previously registered on UTRAN cell 5 using default message contents according to TS 36.508 [18].

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, the UE is previously registered on GERAN cell 24 using default message contents according to TS 36.508 [18].

Preamble:

– the UE is in state Registered, Idle Mode (state 2) on cell A according to TS 36.508 [18].

9.2.3.3.5.3.2 Test procedure sequence

Table 9.2.3.3.5.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
–	EXCEPTION: Steps 1a1 to 1b5 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that takes place if a capability is supported.	–	–	–	–
1a1	IF pc_UTRA THEN the SS sets the cell type of Cell 5 to "Serving cell" and the cell type of Cell A to "Non-suitable cell".	–	–	–	–
1a2	The UE transmits a ROUTING AREA UPDATE REQUEST message on Cell 5.	–>	ROUTING AREA UPDATE REQUEST	–	–
1a3	The SS transmits a ROUTING AREA UPDATE ACCEPT message on Cell 5.	<–	ROUTING AREA UPDATE ACCEPT	–	–
1a4	Void	–	–
1a5	The SS sets the cell type of Cell A to "Serving cell" and the cell type of Cell 5 to "Non-suitable cell".	–	–	–	–
1b1	ELSE IF pc_GERAN THEN the SS sets the cell type of Cell 24 to "Serving cell" and the cell type of Cell A to "Non-suitable cell".	–	–	–	–
1b2	The UE transmits a ROUTING AREA UPDATE REQUEST message on Cell 24.	–>	ROUTING AREA UPDATE REQUEST	–	–
1b2A1	The SS transmits an Authentication and Ciphering Request message on Cell 24	<–	Authentication and Ciphering Request	–	–
1b2A2	The UE transmits an Authentication and Ciphering Response message on Cell 24	–>	Authentication and Ciphering Response	–	–
1b3	The SS transmits a ROUTING AREA UPDATE ACCEPT message on Cell 24	<–	ROUTING AREA UPDATE ACCEPT	–	–
1b4	Void	–	–	–	–
1b5	The SS sets the cell type of Cell A to "Serving cell" and the cell type of Cell 24 to "Non-suitable cell".	–	–	–	–
–	EXCEPTION: Steps 1Aa1 to 1Aa4 describe behaviour that depends on the UE configuration; the "lower case letter" identifies a step sequence that takes place if the UE sends an optional TAU message.	–	–	–	–
1Aa1	The UE may transmit a TRACKING AREA UPDATE REQUEST message on Cell A.	–>	TRACKING AREA UPDATE REQUEST	–	–
1Aa2	The SS transmits a TRACKING AREA UPDATE ACCEPT message on Cell A.	<–	TRACKING AREA UPDATE ACCEPT	–	–
1Aa3	The UE transmits a TRACKING AREA UPDATE COMPLETE message on Cell A.	–>	TRACKING AREA UPDATE COMPLETE	–	–
1Aa4	The SS releases the RRC connection.	–	–	–	–
2	The SS waits for 1 min.	–	–	–	–
3	The SS pages the UE on Cell A using S-TMSI with CN domain indicator set to “PS”.	<–	–	–	–
4	The UE transmits a SERVICE REQUEST message on Cell A.	–>	SERVICE REQUEST	–	–
5	The SS transmits an ACTIVATE DEDICATED EPS BEARER CONTEXT REQUEST message on Cell A activating a new EPS bearer context. This message is included in an RRCConnectionReconfiguration message to setup the new radio bearer associated with the dedicated EPS bearer context activated by the NAS message.	<–	ACTIVATE DEDICATED EPS BEARER CONTEXT REQUEST	–	–
6	The UE transmits an ACTIVATE DEDICATED EPS BEARER CONTEXT ACCEPT message on Cell A.	–>	ACTIVATE DEDICATED EPS BEARER CONTEXT ACCEPT	–	–
7	The SS transmits a DEACTIVATE EPS BEARER CONTEXT REQUEST message on Cell A deactivating the dedicated EPS bearer context activated at Step 5. This message is included in an RRCConnectionReconfiguration message.	<–	DEACTIVATE EPS BEARER CONTEXT REQUEST	–	–
8	The UE transmits a DEACTIVATE EPS BEARER CONTEXT ACCEPT message on Cell A.	–>	DEACTIVATE EPS BEARER CONTEXT ACCEPT	–	–
8A	The SS releases the RRC connection.	–	–	–	–
–	EXCEPTION: Steps 9a1 to 9b5 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that takes place if a capability is supported.	–	–	–	–
9a1	IF pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA THEN the SS sets the cell type of Cell 5 to "Serving cell" and the cell type of Cell A to "Non-suitable cell".	–	–	–	–
9a2	Check: When T3312 started after Step 1a3 expires, does the UE transmit a ROUTING AREA UPDATE REQUEST on Cell 5?	–>	ROUTING AREA UPDATE REQUEST	1	P
9a3	The SS transmits a ROUTING AREA UPDATE ACCEPT message on Cell 5.	<–	ROUTING AREA UPDATE ACCEPT	–	–
9a4	Void	–	–
9a5	The SS sets the cell type of Cell A to "Serving cell" and the cell type of Cell 5 to "Non-suitable cell".	–	–	–	–
9b1	ELSE IF pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN THEN the SS sets the cell type of Cell 24 to "Serving cell" and the cell type of Cell A to "Non-suitable cell".	–	–	–	–
9b2	Check: When T3312 started after Step 1b3 expires, does the UE transmit a ROUTING AREA UPDATE REQUEST on Cell 24?	–>	ROUTING AREA UPDATE REQUEST	1	P
9b3	The SS transmits a ROUTING AREA UPDATE ACCEPT message on Cell 24.	<–	ROUTING AREA UPDATE ACCEPT	–	–
9b4	Void	–	–
9b5	The SS sets the cell type of Cell A to "Serving cell" and the cell type of Cell 24 to "Non-suitable cell".	–	–	–	–
–	EXCEPTION: Steps 9Aa1 to 9Aa4 describe behaviour that depends on the UE configuration; the "lower case letter" identifies a step sequence that takes place if the UE sends an optional TAU message.	–	–	–	–
9Aa1	The UE may transmit a TRACKING AREA UPDATE REQUEST message on Cell A.	–>	TRACKING AREA UPDATE REQUEST	–	–
9Aa2	The SS transmits a TRACKING AREA UPDATE ACCEPT message on Cell A.	<–	TRACKING AREA UPDATE ACCEPT	–	–
9Aa3	The UE transmits a TRACKING AREA UPDATE COMPLETE message on Cell A.	–>	TRACKING AREA UPDATE COMPLETE	–	–
9Aa4	The SS releases the RRC connection.	–	–	–	–
10	The SS waits for 1 min.	–	–	–	–
11	The SS pages the UE on Cell A using S-TMSI with CN domain indicator set to “PS”.	<–	–	–	–
12	The UE transmits a SERVICE REQUEST message on Cell A.	–>	SERVICE REQUEST	–	–
13	The SS transmits an ACTIVATE DEDICATED EPS BEARER CONTEXT REQUEST message on Cell A activating a new EPS bearer context. This message is included in an RRCConnectionReconfiguration message to setup the new radio bearer associated with the dedicated EPS bearer context activated by the NAS message.	<–	ACTIVATE DEDICATED EPS BEARER CONTEXT REQUEST	–	–
14	The UE transmits an ACTIVATE DEDICATED EPS BEARER CONTEXT ACCEPT message on Cell A.	–>	ACTIVATE DEDICATED EPS BEARER CONTEXT ACCEPT	–	–
15	The SS waits until T3312 timer started at Step 9a3/9b3 has expired.	–	–	–	–
16	Check: After T3312 started after Step 9a3/9b3 expires and before T3323 expires, does the test result of generic test procedure in TS 36.508 subclause 6.4.2.6 indicate that a dedicated EPS bearer context is active on cell A?	–	–	2	–
17	The SS transmits a DEACTIVATE EPS BEARER CONTEXT REQUEST message on Cell A deactivating the dedicated EPS bearer context activated at Step 13. This message is included in an RRCConnectionReconfiguration message.	<–	DEACTIVATE EPS BEARER CONTEXT REQUEST	–	–
18	The UE transmits a DEACTIVATE EPS BEARER CONTEXT ACCEPT message on Cell A.	–>	DEACTIVATE EPS BEARER CONTEXT ACCEPT	–	–
19	The SS waits for 2 min.	–	–	–	–
19A	The SS releases the RRC connection.	–	–	–	–
20	Check: After T3312 started after Step 9a3/9b3 expires and before T3323 expires, does the test result of generic test procedure in TS 36.508 subclause 6.4.2.2 indicate that the UE is in state Registered, Idle Mode on Cell A?	–	–	2	–
–	EXCEPTION: Steps 21a1 to 21b4 describe behaviour that depends on the UE capability; the "lower case letter" identifies a step sequence that takes place if a capability is supported.	–	–	–	–
21a1	IF pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA THEN the SS sets the cell type of Cell 5 to "Serving cell" and the cell type of Cell A to "Non-suitable cell".	–	–	–	–
21a2	Check: After T3312 started after Step 9a3 expires and before T3323 expires, does the UE transmit a ROUTING AREA UPDATE REQUEST message on Cell 5?	–>	ROUTING AREA UPDATE REQUEST	3	P
21a3	The SS transmits a ROUTING AREA UPDATE ACCEPT message on Cell 5.	<–	ROUTING AREA UPDATE ACCEPT	–	–
21a4	Void	–	–
21b1	ELSE IF pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN THEN the SS sets the cell type of Cell 24 to "Serving cell" and the cell type of Cell A to "Non-suitable cell".	–	–	–	–
21b2	Check: After T3312 started after Step 9b3 expires and before T3323 expires, does the UE transmit a ROUTING AREA UPDATE REQUEST message on Cell 24?	–>	ROUTING AREA UPDATE REQUEST	3	P
21b3	The SS transmits a ROUTING AREA UPDATE ACCEPT message on Cell 24.	<–	ROUTING AREA UPDATE ACCEPT	–	–
21b4	Void		–

9.2.3.3.5.3.3 Specific message contents

Table 9.2.3.3.5.3.3-1: Message ROUTING AREA UPDATE REQUEST (steps 1a2/1b2, Table 9.2.3.3.5.3.2-1)

Information Element	Value/remark	Comment	Condition
Update type	Any allowed value
P-TMSI	P-TMSI mapped from GUTI assigned to UE during preamble		UTRA
MS network capability
ISR support	1

Table 9.2.3.3.5.3.3-2: Message ROUTING AREA UPDATE REQUEST (step 9a2/9b2, Table 9.2.3.3.5.3.2-1)

Information Element	Value/remark	Comment	Condition
Update type	011	“Periodic updating”
P-TMSI	P-TMSI assigned to UE during preamble		UTRA
MS network capability
ISR support	1
UE network capability	Not present

Table 9.2.3.3.5.3.3-3: Message ROUTING AREA UPDATE ACCEPT (steps 1a3, and 21a3/21b3, Table 9.2.3.3.5.3.2-1)

Information Element	Value/remark	Comment	Condition
Update result	100	“RA updated and ISR activated”
	001	“combined RA/LA updated”
Periodic RA update timer	00100111	7 min
Allocated P-TMSI	Not present

Table 9.2.3.3.5.3.3-4: Message TRACKING AREA UPDATE REQUEST (step 9Aa1, table 9.2.3.3.5.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Old P-TMSI signature	Any allowed value
GPRS ciphering key sequence number	Any allowed value
Additional GUTI	Not present or any allowed value
Nonce_UE	Any allowed value

Table 9.2.3.3.5.3.3-5 Message TRACKING AREA UPDATE ACCEPT (steps 1Aa2 and 9Aa2 Table 9.2.3.3.5.3.2-1)

Derivation path: 36.508 table 4.7.2-24
Information Element	Value/Remark	Comment	Condition
EPS update result	100	TA updated and ISR activated	TA_only
EPS update result	101	“combined TA/LA updated and ISR activated”	combined_TA_LA

Table 9.2.3.3.5.3.3-6: Message TRACKING AREA UPDATE REQUEST (step 1Aa1, table 9.2.3.3.5.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
EPS update type	000	TA updating	TA_only
EPS update type	010	combined TA/LA updating with IMSI attach	combined_TA_LA
GPRS ciphering key sequence number	Any allowed value
Old P-TMSI signature	Any allowed value
Additional GUTI	Not present or any allowed value
Nonce_UE	Any allowed value

Table 9.2.3.3.5.3.3-7: Message ROUTING AREA UPDATE REQUEST (step 21a2/21b2, Table 9.2.3.3.5.3.2-1)

Information Element	Value/remark	Comment	Condition
Update type	011	“Periodic updating”
	010	“combined RA/LA updating with IMSI attach”
P-TMSI	P-TMSI assigned to UE during preamble		UTRA
MS network capability
ISR support	1
UE network capability	Not present		Update Type = periodic updating
	Any allowed value		Update Type <> periodic updating

Table 9.2.3.3.5.3.3-8: Message ROUTING AREA UPDATE ACCEPT (step 9a3, Table 9.2.3.3.5.3.2-1)

Information Element	Value/remark	Comment	Condition
Update result	100	“RA updated and ISR activated”
	000	“RA updated”
Periodic RA update timer	00100111	7 min
Allocated P-TMSI	Not present

Table 9.2.3.3.5.3.3-9: Message ROUTING AREA UPDATE ACCEPT (steps 1b3, Table 9.2.3.3.5.3.2-1)

Information Element	Value/remark	Comment	Condition
Update result	100	“RA updated and ISR activated”
	001	“combined RA/LA updated”
Periodic RA update timer	00100111	7 min
READY Timer	00000	0 sec
Allocated P-TMSI	Not present
PDP Context Status	Same value as in ROUTING AREA UPDATE REQUEST message

Table 9.2.3.3.5.3.3-10: Message ROUTING AREA UPDATE ACCEPT (step 9b3, Table 9.2.3.3.5.3.2-1)

Information Element	Value/remark	Comment	Condition
Update result	100	“RA updated and ISR activated”
	000	“RA updated”
Periodic RA update timer	00100111	7 min
READY Timer	00000	0 sec
Allocated P-TMSI	Not present
PDP Context Status	Same value as in ROUTING AREA UPDATE REQUEST message

9.2.3.3.5a Periodic Location Update

9.2.3.3.5a.1 Test Purpose (TP)

(1)

with { UE in MM IDLE substate NORMAL SERVICE with periodic location update timer T3212 running}

ensure that {

when { UE camps on a E-UTRAN cell and successfully performs a Tracking Area Update and T3212 expires}

then { the UE does not perform a periodic location update whilst in E-UTRAN coverage and does not change RAT because T3212 has expired}

}

9.2.3.3.5a.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 23.401 clauses 4.3.5.2; and TS 24.008 clauses 4.7.1.4.1 and 4.7.5.1.1; TS 24.301 clause 5.1.5.Unless otherwise stated these are Rel-8 requirements.

[TS 23.401, clause 4.3.5.2 "Reachability Management for UE in ECM-IDLE state"]

…

If the UE is EPS attached only and either camps on an E UTRAN cell or is in ECM CONNECTED state when the UE’s periodic LAU timer expires, the UE shall perform a Location Area Update procedure in NMO II/III or combined RA/LA update in NMO I when it next returns to GERAN/UTRAN coverage.

…

Expiry of the periodic TAU timer, or, the periodic RAU timer, or, the periodic LAU timer shall not cause the UE to change RAT.

…

E‑UTRAN RRC state transitions shall have no impact on the periodic RAU timer or periodic LAU timer except that handover from GERAN/UTRAN to E‑UTRAN shall cause the periodic RAU timer to be started from its initial value.

[TS 24.008, 4.2.2.1 "Service State, NORMAL SERVICE"]

When in state MM IDLE and service state NORMAL SERVICE, the mobile station shall:

– perform normal location updating when a new location area is entered;

– perform location updating procedure at expiry of timer T3211 or T3213;

– perform periodic updating at expiration of timer T3212;

– perform IMSI detach;

– support requests from the CM layer;

– respond to paging; and

– for an eCall only mobile station (as determined by information configured in USIM), perform the eCall inactivity procedure at expiry of timer T3242 or timer T3243.

[TS 24.008, 4.4.1 "Location updating procedure"]

…

Upon successful location updating the mobile station sets the update status to UPDATED in the SIM/USIM, and stores the Location Area Identification received in the LOCATION UPDATING ACCEPT message in the SIM/USIM. The attempt counter shall be reset.

[TS 24.008, 4.4.2 "Periodic updating"]

…

The procedure is controlled by the timer T3212 in the mobile station. If the timer is not already started, the timer is started each time the mobile station enters the MM IDLE substate NORMAL SERVICE or ATTEMPTING TO UPDATE. When the MS leaves the MM Idle State the timer T3212 shall continue running until explicitly stopped.

…

When the timer T3212 expires, the location updating procedure is started and the timer shall be set to its initial value for the next start. If the mobile station is in other state than MM Idle when the timer expires the location updating procedure is delayed until the MM Idle State is entered.

…

If the mobile station is in service state NO CELL AVAILABLE, LIMITED SERVICE, PLMN SEARCH or PLMN SEARCH-NORMAL SERVICE when the timer expires the location updating procedure is delayed until this service state is left.

[TS 24.301, clause 5.1.5]

UEs that operate in CS/PS mode 1 or CS/PS mode 2 of operation should not use any MM timers related to MM specific procedures (e.g. T3210, T3211, T3212, T3213) while camped on E-UTRAN, unless the re-activation of these timers is explicitly described. If the MM timers are already running, the UE should not react on the expiration of the timers.

9.2.3.3.5a.3 Test description

9.2.3.3.5a.3.1 Pre-test conditions

System Simulator:

– cell A is configured as Non-suitable cell;

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, cell 5 (LAI-1, NMO II) is configured as Serving cell. The value of T3212 (in SIB1) is 0110 (6 minutes);

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, Cell 24 (LAI-1, NMO II) is configured as Serving cell and does not support Dual Transfer Mode (DTM_SUPPORT is configured as default (see TS 51.010-1 clause 40.2.1.1 [23]. The value of T3212 (Octet 4 of the Control Channel Description IE) is 0110 (6 minutes);

– System information combination 10 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

UE:

– if pc_UTRA AND px_RATComb_Tested = EUTRA_UTRA, the UE is previously registered on UTRAN cell 5 using default message contents according to TS 36.508 [18].

– if pc_GERAN AND px_RATComb_Tested = EUTRA_GERAN, the UE is previously registered on GERAN cell 24 using default message contents according to TS 36.508 [18].

– the UE is configured to initiate combined EPS/IMSI attach.

Preamble:

– The UE is in state Switched Off (state 1).

9.2.3.3.5a.3.2 Test procedure sequence

Table 9.2.3.3.5a.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on and camps on Cell 24 or Cell 5.	–	–	–	–
–	EXCEPTION: In parallel to the events described in steps 5 to 7 the step specified in Table 9.2.3.3.5a.3.2-3 should take place.	–	–	–	–
2	Void	–	–	–	–
–	EXCEPTION: The messages in the next two steps are sent only on Cell 24	–	–	–	–
2Aa1	The UE transmits a Classmark Change message	–>	CLASSMARK CHANGE
–	EXCEPTION: The next step describes behaviour that depends on UE capability.	–	–	–	–
2Aa2	IF pc_UTRA THEN the UE transmits a Utran Classmark Change message.	–>	UTRAN CLASSMARK CHANGE.
3-4	Void	–	–	–	–
5	The UE transmits an ATTACH REQUEST message on Cell 24 or Cell 5 indicating "GPRS attach”.	–>	ATTACH REQUEST	–	–
–	EXCEPTION: The messages in the next two steps are only on Cell 24
5Aa1	The SS transmits an Authentication and Ciphering Request message on Cell 24	<–	Authentication and Ciphering Request	–	–
5Aa2	The UE transmits an Authentication and Ciphering Response message on Cell 24	–>	Authentication and Ciphering Response	–	–
6	The SS transmits an ATTACH ACCEPT message indicating "GPRS only attached”. The UE sets the update status to UPDATED on the USIM. The SS allocates a P-TMSI.	<–	ATTACH ACCEPT	–	–
7	The UE transmits an ATTACH COMPLETE to acknowledge the P-TMSI allocation.	–>	ATTACH COMPLETE
7A	The UE may attempt the generic procedures for IMS signalling defined in 36.508 4.5A.3A (for cell 5) or 4.5A.3B (for cell 24)
8	The UE requests the activation of a default PDP context	–>	ACTIVATE PDP CONTEXT REQUEST
9	The SS accepts the request for default PDP context request and return an ACTIVATE PDP CONTEXT ACCEPT	<–	ACTIVATE PDP CONTEXT ACCEPT
–	EXCEPTION: Step 9Aa1 describes behaviour that depends on the RAT combination; the "lower case letter" identifies a step sequence that takes place if a UTRA is applied.	–	–	–	–
9Aa1	IF px_RATComb_Tested = EUTRA_UTRA THEN the SS releases the RRC connection.	–	–	–	–
10	The signal strength of Cell A is raised to that of the Serving Cell and Cell 24 or Cell 5 is lowered to that of a Suitable Neighbour Cell as defined in table 6.2.2.1-1 of TS 36.508 [18]. Note: Cell 24 or Cell 5 is still suitable but the UE shall select Cell A	–	–	–	–
11	The UE camps on E-UTRAN cell A and transmits a TRACKING AREA UPDATE REQUEST message as defined in table 6.4.2.7A.1-1 of TS 36.508 [18].	–>	TRACKING AREA UPDATE REQUEST	–	–
12	The SS transmits an AUTHENTICATION REQUEST message to initiate the EPS authentication and AKA procedure.	<–	AUTHENTICATION REQUEST	–	–
13	The UE transmits an AUTHENTICATION RESPONSE message and establishes mutual authentication.	–>	AUTHENTICATION RESPONSE	–	–
14	The SS transmits a NAS SECURITY MODE COMMAND message to activate NAS security.	<–	SECURITY MODE COMMAND	–	–
15	The UE transmits a NAS SECURITY MODE COMPLETE message and establishes the initial security configuration.	–>	SECURITY MODE COMPLETE	–	–
16	SS responds with TRACKING AREA UPDATE ACCEPT message including a valid TAI list containing the TAI of Cell A; with PLMN ID of Cell A included in the GUTI. The UE sets the TIN = GUTI. Note: This Accept message includes EPS update result = combined TA/LA updated.	<–	TRACKING AREA UPDATE ACCEPT	–	–
17	The UE transmits a TRACKING AREA UPDATE COMPLETE message	–>	TRACKING AREA UPDATE COMPLETE	–	–
18	The SS releases the RRC Connection	–	–	–	–
–	Exception: Steps 18A to 18Aa4/18Ab1 describe optional behaviour that depend on the UE capability.	–	–	–	–
18A	If pc_IMS = TRUE SS starts 10s timer	–	–	–	–
18Aa1	The UE establishes an RRC connection and transmits a SERVICE REQUEST message	->	SERVICE REQUEST	–	–
18Aa2	The SS establishes SRB2 and DRB	–	–	–	–
18Aa3	If MULTI-PDN = TRUE the UE executes the generic procedure for establishment of additional PDN connectivity defined in TS 36.508 4.5A.16.3.	–	–	–	–
18Aa4	The UE performs IMS registration using the generic procedure defined in 34.229-1 [35] Annex C.32 steps 4-11.	–	–	–	–
18Aa5	The SS releases the RRC connection	–	–	–	–
18Ab1	The 10s timer expires	–	–	–	–
19-28	Void	–	–	–	–
29	Check: Does the UE transmit a LOCATION UPDATING REQUEST (on Cell 24 or Cell 5) and changes RAT. Check this until 7 minutes after step 3 in Table 9.2.3.3.5a.3.2-3 (when in GERAN) or 7 (when in UTRAN)	–>	LOCATION UPDATING REQUEST	1	F
30-36	Void	–	–	–	–

Table: 9.2.3.3.5a.3.2-2: Void

Table 9.2.3.3.5a.3.2-3: Parallel behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE transmits a LOCATION UPDATING REQUEST with location updating type set to "IMSI attach” on Cell 24 or Cell 5.	–>	LOCATION UPDATING REQUEST	–	–
2	The SS transmits a LOCATION UPDATING ACCEPT, and the UE stores the received LAI and sets the update status to UPDATED on the USIM. The SS allocates a TMSI.	<–	LOCATION UPDATING ACCEPT	–	–
3	The UE transmits a TMSI REALLOCATION COMPLETE message to acknowledge the TMSI allocation.	–>	TMSI REALLOCATION COMPLETE	–	–

9.2.3.3.5a.3.3 Specific message contents

Table 9.2.3.3.5a.3.3-1: Void

Table 9.2.3.3.5a.3.3-2: Void

9.2.3.3.6 Void

9.2.3.4 A/Gb mode to S1 mode inter-system change

9.2.3.4.1 TAU/RAU procedure for inter-system cell reselection between A/Gb and S1 modes

9.2.3.4.1.1 Test Purpose (TP)

(1)

with { UE attached to GERAN with a PDP context active, and, E-UTRAN NAS and Security parameters including a valid GUTI stored on the USIM }

ensure that {

when { UE performs a cell reselection to E-UTRAN and performs a Tracking Area Update }

then { the UE encodes the RRC parameters in the RRC Connection Establishment messages correctly (i.e. in the RRCConnectionRequest message, the ue-Identity is set to “randomValue” and the establishmentcause is set to MO-signalling; and, in the RRCConnectionSetupComplete message the selectedPLMN-identity, mmegi and mmec indicate the value of the registered MME }

}

(2)

with { UE attached to GERAN with a PDP context active, and, E-UTRAN NAS and EPS Security parameters including a valid GUTI stored on the USIM, and ISR not activated }

ensure that {

when { UE performs a cell reselection to E-UTRAN and performs a Tracking Area Update }

then { the UE encodes the parameters in the TRACKING AREA UPDATE REQUEST correctly i.e.:
– the NAS key set identifier_ASME IE is set to the value stored in the USIM/allocated in
the last TRACKING AREA UPDATE ACCEPT message;
– the Old GUTI IE is derived from the mapped P-TMSI and RAI;
– the Additional GUTI IE is set to the GUTI stored in the USIM/allocated in the last
TRACKING AREA UPDATE ACCEPT message;
– the GPRS ciphering key sequence number IE is set to the value allocated in the
AUTHENTICATION AND CIPHERING REQUEST message; and
– the NONCEue IE is included;
– the DRX parameter IE is not included. }

}

(3)

with { UE powered on in GERAN }

ensure that {

when { UE makes its first Tracking Area Update to E-UTRAN}

then { UE sends the UE radio capability information update needed IE }

}

(4)

with { UE registered in E-UTRAN, and, GERAN NAS and Security parameters including a valid P-TMSI available in the UE and ISR not activated }

ensure that {

when { UE performs a cell reselection to GERAN and performs a Routeing Area Update }

then { the UE derives the TLLI parameter in the RLC/MAC header from the GUTI allocated in the TRACKING AREA UPDATE ACCEPT message }

}

(5)

with { UE registered in E-UTRAN, and, GERAN NAS and GERAN Security parameters including a valid P-TMSI available in the UE, and ISR not activated }

ensure that {

when { UE performs a cell reselection to GERAN and performs a Routeing Area Update }

then { the UE encodes the parameters in the ROUTING AREA UPDATE REQUEST correctly i.e.:
– [the GPRS ciphering key sequence number IE is set to the value mapped from
KSI-ASME;;] – the Old routing area identification IE, and the Old P-TMSI signature IE are
mapped from the GUTI allocated in the TRACKING AREA UPDATE ACCEPT message;
– the Additional mobile identity IE contains the P-TMSI allocated in the last received
ATTACH ACCEPT/ROUTING AREA UPDATE ACCEPT message;
– the Additional old routing area identification IE contains the RAI allocated in the
last received ATTACH ACCEPT/ROUTING AREA UPDATE ACCEPT message; and
– [the DRX parameter IE is not included]. }

}

(6)

with { UE registered }

ensure that {

when { UE performs Tracking Area Update to E-UTRAN which is not for the "first TAU following GERAN/UTRAN Attach" or for a "UE radio capability update"}

then { UE does not send the UE radio capability information update needed IE }

}

(7)

with { UE attached to GERAN with a PDP context active, and, E-UTRAN NAS and Security parameters including a valid GUTI stored on the USIM }

ensure that {

when { UE performs a cell reselection to E-UTRAN and performs a Tracking Area Update }

then { the UE encodes the RRC parameters in the RRC Connection Establishment messages correctly (i.e. in the RRCConnectionRequest message, the ue-Identity is set to S-TMSI or random value for pre-Rel-12 UE,or set to random value from Rel-12 and onwards, and the establishmentcause is set to MO-signalling; and, in the RRCConnectionSetupComplete message the registeredMME is not included when s-TMSI is included, or include the registeredMME and the mapped GUMMEI otherwise }

}

9.2.3.4.1.2 Conformance requirements

References: The conformance requirements covered in the current TC are specified in: TS 23.003 clauses 2.8.2.1 and 2.8.2.2; TS 23.401 clauses 4.3.5.6, 5.3.3.1 and 5.3.3.3; TS 24.008 clauses 4.7.1.4.1 and 4.7.5.1.1; and TS 24.301 clauses 5.3.1.1 and 5.5.3.2.2.

[TS 23.003, clause 2.8.2.1 “Mapping from GUTI to RAI, P-TMSI and P-TMSI signature”]

The mapping of the GUTI shall be done to the combination of RAI of GERAN / UTRAN and the P‑TMSI:

E‑UTRAN <MCC> maps to GERAN/UTRAN <MCC>

E‑UTRAN <MNC> maps to GERAN/UTRAN <MNC>

E‑UTRAN <MME Group ID> maps to GERAN/UTRAN <LAC>

E‑UTRAN <MME Code> maps to GERAN/UTRAN <RAC> and is also copied into the 8 most significant bits of the NRI field within the P‑TMSI;

E‑UTRAN <M-TMSI> maps as follows:

– 6 bits of the E‑UTRAN <M-TMSI> starting at bit 29 and down to bit 24 are mapped into bit 29 and down to bit 24 of the GERAN/UTRAN <P‑TMSI>;

– 16 bits of the E‑UTRAN <M-TMSI> starting at bit 15 and down to bit 0 are mapped into bit 15 and down to bit 0 of the GERAN/UTRAN <P‑TMSI>;

– and the remaining 8 bits of the E‑UTRAN <M-TMSI> are mapped into the 8 MBS bits of the <P-TMSI signature> field.

[TS 23.003, clause 2.8.2.2 “Mapping from RAI and P-TMSI to GUTI”]

The mapping of P‑TMSI (TLLI) and RAI in GERAN/UTRAN to GUTI in E‑UTRAN shall be performed as follows:

GERAN/UTRAN <MCC> maps to E‑UTRAN <MCC>

GERAN/UTRAN <MNC> maps to E‑UTRAN <MNC>

GERAN/UTRAN <LAC> maps to E‑UTRAN <MME Group ID>

GERAN/UTRAN <RAC> maps into bit 23 and down to bit 16 of the M‑TMSI

The 8 most significant bits of GERAN/UTRAN <NRI> map to the MME code.

GERAN/UTRAN <P‑TMSI> maps as follows:

– 6 bits of the GERAN/UTRAN <P‑TMSI> starting at bit 29 and down to bit 24 are mapped into bit 29 and down to bit 24 of the E‑UTRAN <M-TMSI>;

– 16 bits of the GERAN/UTRAN <P‑TMSI> starting at bit 15 and down to bit 0 are mapped into bit 15 and down to bit 0 of the E‑UTRAN <M-TMSI>.

…

[TS 23.401, clause 4.3.5.6, “Idle mode signalling reduction function”]

Table 4.3.5.6-1: Setting of the TIN

Message received by UE	Current TIN value stored by UE	TIN value to be set by the UE when receiving message
Attach Accept via E-UTRAN (never indicates ISR activation)	Any value	GUTI
Attach Accept via GERAN/UTRAN (never indicates ISR activation)	Any value	P-TMSI
TAU Accept not indicating ISR	Any value	GUTI
TAU Accept indicating ISR	GUTI P‑TMSI or RAT-related TMSI	GUTI RAT-related TMSI
RAU Accept not indicating ISR	Any value	P‑TMSI
RAU Accept indicating ISR	P‑TMSI GUTI or RAT-related TMSI	P‑TMSI RAT-related TMSI

[TS 23.401, clause 5.3.3.1, step 2, “Tracking Area Update procedure with Serving GW change”]

….

If the UE’s TIN indicates "P‑TMSI" and the UE holds a valid P‑TMSI and related RAI then these two elements are indicated as the old GUTI.

…

[TS 23.401, clause 5.3.3.3, step 2, “Routeing Area Update with MME interaction and without S‑GW change”]

…

If the UE’s internal TIN indicates "GUTI" and the UE holds a valid GUTI then the UE indicates the GUTI as the old P‑TMSI and old RAI

…

[TS 24.008, clause 4.7.1.4.1, “Radio resource sublayer address handling (A/Gb mode only)”]

For an MS supporting S1 mode, the following five cases can be distinguished:

a) the TIN indicates "P-TMSI" or "RAT‑related TMSI" and the MS holds a valid P-TMSI and a RAI;

b) the TIN indicates "GUTI" and the MS holds a valid GUTI;

c) the TIN is deleted and the UE holds a valid P-TMSI and RAI;

d) the TIN is deleted and the UE holds a valid GUTI, but no valid P-TMSI and RAI; or

e) none of the previous cases is fulfilled.

In case a) the MS shall derive a foreign TLLI from the P-TMSI and proceed as specified for case i) above.

In case b), the MS shall derive a P-TMSI from the GUTI and then a foreign TLLI from this P-TMSI and proceed as specified for case i) above.

…

[TS 24.008, clause 4.7.5.1.1, “Normal and periodic routing area updating procedure initiation”]

If the MS supports S1 mode, the MS shall handle the P-TMSI IE as follows:

If the routing area updating procedure is not initiated by the MS due to an S1 mode to Iu mode or S1 mode to A/Gb mode intersystem change, the message ROUTING AREA UPDATE REQUEST shall contain the P-TMSI signature when received within a previous ATTACH ACCEPT or ROUTING AREA UPDATE ACCEPT message.

If the routing area updating procedure is initiated by the MS due to an S1 mode to Iu mode or S1 mode to A/Gb mode inter-system change in idle mode and the MS does not have a valid current UMTS security context, the message ROUTING AREA UPDATE REQUEST shall include a P-TMSI signature filled with a NAS token as specified in 3GPP TS 33.401 [119]. If the MS has a valid current UMTS security context, the MS shall indicate it in the GPRS ciphering key sequence number IE.

NOTE: If the TIN indicates "GUTI", 8 bits of the NAS token will be filled with bits from the M‑TMSI (see 3GPP TS 23.003 [4]).

If the routing area updating procedure is initiated by the MS due to the S1 mode to Iu mode or S1 mode to A/Gb mode inter-system change in connected mode or in idle mode if the MS does not have a valid current security context, the MS shall derive CK’ and IK’ from the K_ASME and the NAS downlink COUNT value corresponding to the NAS token derived as specified in 3GPP TS 33.401 [119]. The MS shall indicate the eKSI value in the CKSN field of the GPRS ciphering key sequence number IE in the ROUTING AREA UPDATE REQUEST message. Then, the MS shall reset the START value and store the mapped UMTS security context replacing the current UMTS security context.

…

In order to indicate the new DRX parameter while in GERAN or UTRAN coverage, the MS shall send the ROUTING AREA UPDATE REQUEST message containing the DRX parameter in the DRX parameter IE to the network, with the exception of the case if the MS had indicated its UE specific DRX parameter (3GPP TS 24.301 [120]) to the network while in E-UTRAN coverage. In this case, when the MS enters GERAN or UTRAN coverage and initiates a routing area updating procedure, the MS shall not include the DRX parameter in the DRX parameter IE in the ROUTING AREA UPDATE REQUEST message.

[TS 24.008, clause 4.7.5.1.3, “Normal and periodic routing area updating procedure accepted by the network”]

If the MS has indicated in the ROUTING AREA UPDATE REQUEST message that it supports PS inter-RAT HO from GERAN to E-UTRAN, the network may include in the ROUTING AREA UPDATE ACCEPT message a request to provide the E-UTRAN inter RAT information container.

[TS 24.301, clause 5.3.1.1 “Establishment of the NAS signalling connection”]

For the routing of the initial NAS message to the appropriate MME, the UE NAS provides the lower layers with either the S-TMSI or the registered globally unique MME identifier (GUMMEI) that consists of the PLMN ID, the MME group ID, and the MME code (see 3GPP TS 23.003 [2]).

– When the UE is registered in the tracking area of the current cell during the NAS signalling connection establishment, the UE NAS shall provide the lower layers with the S-TMSI, but shall not provide the registered MME identifier to the lower layers. Exceptionally, when the UE in EMM-IDLE mode initiates a tracking area updating procedure for load balancing purposes, the UE NAS shall provide the lower layers with neither S-TMSI nor registered MME identifier.

– When the UE is not registered in the tracking area of the current cell during the NAS signalling connection establishment, the UE NAS does not provide the lower layers with the S-TMSI. If the UE has a valid registered MME identifier from a previous registration, the UE NAS shall provide the lower layers with the registered MME identifier.

[TS 24.301, clause 5.5.3.2.2 “Normal and periodic tracking area updating procedure initiation”]

…

In order to indicate its UE specific DRX parameter while in E-UTRAN coverage, the UE shall send the TRACKING AREA UPDATE REQUEST message containing the UE specific DRX parameter in the DRX parameter IE to the network, with the exception of the case if the UE had indicated its DRX parameter (3GPP TS 24.008 [13]) to the network while in GERAN or UTRAN coverage. In this case, when the UE enters E-UTRAN coverage and initiates a tracking area updating procedure, the UE shall not include the UE specific DRX parameter in the DRX parameter IE in the TRACKING AREA UPDATE REQUEST message.

…

When initiating a tracking area updating procedure as a result of an Iu mode to S1 mode or A/Gb mode to S1 mode inter-system change, the UE shall handle the GUTI as follows:

– if the TIN indicates "P-TMSI" and the UE holds a valid P-TMSI and RAI, the UE shall map the P-TMSI and RAI into the old GUTI IE. Additionally, if the UE holds a valid GUTI, the UE shall indicate the GUTI in the Additional GUTI IE.

NOTE: Mapping the P-TMSI and RAI to the GUTI is specified in Annex H of 3GPP TS 23.401 [10].

– if the TIN indicates "GUTI" or "RAT-related TMSI" and the UE holds a valid GUTI, the UE shall indicate the GUTI in the Old GUTI IE.

…

When the tracking area updating procedure is initiated to perform an inter-system change from A/Gb mode or Iu mode to S1 mode, the UE shall include the KSI_ASME in the TRACKING AREA UPDATE REQUEST message if the UE has a cached EPS security context. Otherwise, the UE shall set the KSI_ASME to the value "no key is available".

When the tracking area updating procedure is initiated in EMM-IDLE mode to perform an inter-system change from A/Gb mode or Iu mode to S1 mode, the UE shall include the KSI_SGSN in the TRACKING AREA UPDATE REQUEST message. If the UE does not have a cached EPS security context, the UE shall include the Nonce_UE IE in the TRACKING AREA UPDATE REQUEST message. The TRACKING AREA UPDATE REQUEST message shall be integrity protected with the cached EPS security context if the UE has one. If the UE does not have a cached EPS security context, the TRACKING AREA UPDATE REQUEST message shall not be integrity protected.

…

[TS 24.301, clause 4.4.2 “Handling of EPS security contexts”]

…

The key set identifier eKSI is assigned by the MME either during the authentication procedure or, for the mapped security context, during the handover procedure. The eKSI consists of a value and a type of security context parameter indicating whether an EPS security context is a native EPS security context or a mapped EPS security context. When the EPS security context is a native EPS security context, the eKSI has the value of KSI_ASME, and when the current EPS security context is a mapped EPS security context, the eKSI has the value of KSI_SGSN.

…

[TS 24.301, clause 5.3.1.1 “Establishment of the NAS signalling connection”]

b) if the TIN indicates "P-TMSI" and the UE holds a valid P-TMSI and RAI, the UE NAS shall provide the lower layers with the MME identifier part of the mapped GUTI, which is generated from the P-TMSI and RAI.

9.2.3.4.1.3 Test description

9.2.3.4.1.3.1 Pre-test conditions

System Simulator:

NOTE: while this test describes the uses of 3 cells, it is intended that this test only requires 2 cells to be active at any one instant.

– cell A (E-UTRAN), cell B (E-UTRAN), cell 24 and cell 26 (GERAN)

– with the exception of the MCC and MNC, cell 24 and cell 26 take the default parameters of the GERAN cells as defined in clause 6.3.1 of TS 36.508 [18], cells 24 and 26 are configured with the same MCC and MNC as cell A. Cells 24 and 26 are in the same routing area;

– as defined in clause 40.1 of TS 51.010 [23], the GERAN cells are configured to use Network Mode of Operation I;

– the power level of Cell 24 is the Serving Cell level;

– the power level of Cell A is set to the Non-suitable level;

– the power level of Cell B is set to the Non-suitable" Off" level;

– the power level of Cell 26 is set to the Non-suitable Off.

– System information combination 5 as defined in TS 36.508[18] clause 4.4.3.1 is used in E-UTRA cells.

UE:

– the UE was previously registered on E-UTRAN cell B, and when on E-UTRAN, the UE was last authenticated and registered on a cell (no name assigned) frequency 2 belonging to a PLMN with (MCC, MNC) = (65, 987) and allocated a GUTI with (MMEGI, MMEC) = (0xfedc, 0xba) and an arbitrary M-TMSI value.

Preamble:

– the UE is in state Switched OFF (state 1) according to TS 36.508 [18].

9.2.3.4.1.3.2 Test procedure sequence

Table 9.2.3.4.1.3.2-1: Main behaviour

St	Procedure	Message Sequence		TP	Verdict
		U – S	Message
1	The UE is switched on.	–	–	–	–
2	The UE transmits an ATTACH REQUEST message on Cell 24	–>	ATTACH REQUEST	–	–
3	The SS transmits an AUTHENTICATION REQUEST message.	<–	AUTHENTICATION REQUEST	–	–
4	The UE transmits an AUTHENTICATION RESPONSE message.	–>	AUTHENTICATION RESPONSE	–	–
5	The SS transmits a NAS SECURITY MODE COMMAND message	<–	SECURITY MODE COMMAND	–	–
6	The UE transmits a NAS SECURITY MODE COMPLETE message ciphered with the new EPS security context identified by the KSI_ASME received in the SECURITY MODE COMMAND message in step 5	–>	SECURITY MODE COMPLETE	–	–
8	SS responds with ATTACH ACCEPT message including valid TMSI, P-TMSI (TIN set to P-TMSI) and RAI. Editor’s Note: the default message contents in 51.010 clause 40.2.4.3 allocate a Negotiated READY timer value of 32 seconds.	<–	ATTACH ACCEPT	–	–
9	The UE transmits an ATTACH COMPLETE message.	–	ATTACH COMPLETE	–	–
9AA	Exception: if pc_IMS = TRUE then the generic procedure specified in TS 36.508 4.5A.3B is performed. NOTE: The SS rejects any PDP context request to prevent IMS signalling on the GERAN cell.	–	–	–	–
9A	The activation of a PDP context is triggered by MMI or AT command.	–	–	–	–
9B	The UE transmits an ACTIVATE PDP CONTEXT REQUEST message	–>	ACTIVATE PDP CONTEXT REQUEST	–	–
9C	The SS responds with an ACTIVATE PDP CONTEXT ACCEPT message	<–	ACTIVATE PDP CONTEXT ACCEPT	–	–
10	Void	–	–	–	–
11	Void	–	–	–	–
12	Void	–	–	–	–
13	The signal strength of Cell A is raised to that of the Serving Cell and that of Cell 24 is lowered to that of a Suitable Neighbour Cell. Note: Cell 24 is still suitable but the UE is expected to select Cell A.	–	–	–	–
14	Void	–	–	–	–
15	Check: Does the UE send an RRCConnectionRequest with the ue-Identity set to “randomValue” and the establishmentcause set to MO-signalling on Cell A? Editor’s Note: Cell reselection to E-UTRAN might not occur until the GPRS READY timer has expired. Hence this step might occur up to 40 seconds after step 13.	–>	RRCConnectionRequest	1	P
16	The SS responds with RRCConnectionSetup	<–	RRCConnectionSetup
17	Check: Does the UE send an RRCConnectionSetupComplete with the mmegi and mmec set to the values derived from the mapped RAI and P-TMSI	–>	RRCConnectionSetupComplete(RRC parameters, TRACKING AREA UPDATE REQUEST)	1	P
	Check: Are the contents of the TRACKING AREA UPDATE REQUEST with the correct parameters?			2, 3
18	The SS sends TRACKING AREA UPDATE ACCEPT Note: the default message contents cause the allocation of a new GUTI and new TAI list	<–	TRACKING AREA UPDATE ACCEPT	–	–
19	The UE sends TRACKING AREA UPDATE COMPLETE	–>	TRACKING AREA UPDATE COMPLETE	–	–
20	The SS releases the RRC connection	–	–	–	–
–	Exception: Steps 20A to 20Aa4/20Ab1 describe optional behaviour that depend on the UE capability.	–	–	–	–
20A	If pc_IMS = TRUE SS starts 10s timer	–	–	–	–
20Aa1	The UE establishes an RRC connection and transmits a SERVICE REQUEST message	->	SERVICE REQUEST	–	–
20Aa2	The SS establishes SRB2 and DRB	–	–	–	–
20Aa3	If MULTI-PDN = TRUE the UE executes the generic procedure for establishment of additional PDN connectivity defined in TS 36.508 4.5A.16.3.	–	–	–	–
20Aa4	The UE performs IMS registration using the generic procedure defined in 34.229-1 [35] Annex C.32 steps 4-11.	–	–	–	–
20Aa5	The SS releases the RRC connection	–	–	–	–
20Ab1	The 10s timer expires	–	–	–	–
21	Cell 24 is switched off	–	–	–	–
22	The signal strength of Cell 26 is raised to that of the Serving Cell and that of Cell A is lowered to that of a Non suitable Neighbour Cell. Note: Cell A is still suitable but the UE is expected to select Cell 26.	–	–	–	–
23	Check: Does the UE send on Cell 26 an RLC/MAC header with the TLLI derived from the P-TMSI that is derived from the GUTI allocated in step 18?	–	–	4	P
24	Check: Does the UE send on Cell 26 a ROUTING AREA UPDATE REQUEST with the correct parameters?	–>	ROUTING AREA UPDATE REQUEST	5	P
24A	The SS transmits an AUTHENTICATION AND CIPHERING REQUEST message.	<–	AUTHENTICATION AND CIPHERING REQUEST	–	–
24B	The UE transmits an AUTHENTICATION AND CIPHERING RESPONSE message.	–>	AUTHENTICATION AND CIPHERING RESPONSE	–	–
25	The SS sends ROUTING AREA UPDATE ACCEPT (without the allocated P-TMSI IE).	<–	ROUTING AREA UPDATE ACCEPT	–	–
–	EXCEPTION: Step 26 describes behaviour that depends on the UE capability.	–	–	–	–
26	IF pc_GERAN_2_E_UTRAN_PSHO, then the UE sends ROUTING AREA UPDATE COMPLETE message	–>	ROUTING AREA UPDATE COMPLETE	–	–
27	The signal strength of Cell A is raised to that of the Serving Cell and that of Cell 26 is lowered to that of a Suitable Neighbour Cell. Note: Cell 26 is still suitable but the UE is expected to select Cell A.	–	–	–	–
27A	Check: Does the UE send an RRCConnectionRequest with the ue-Identity set for Rel-8 to Rel-11 UE to s-TMSI or randomValue, and, for Rel-12 and onwards UE set to randomValue?	–>	RRCConnectionRequest	7	P
27B	The SS responds with RRCConnectionSetup	<–	RRCConnectionSetup
28	Check: Does the UE send on Cell A an RRCConnectionSetupComplete without the registeredMME when s-TMSI is included in step 27A, otherwise with the registeredMME and the mapped GUMMEI?	–>	RRCConnectionSetupComplete(RRC parameters, TRACKING AREA UPDATE REQUEST)	7	P
–	Check: Does the UE send a TRACKING AREA UPDATE REQUEST with the correct parameters?			2, 6
29	The SS sends TRACKING AREA UPDATE ACCEPT Note: the default message contents cause the allocation of a new GUTI.	<–	TRACKING AREA UPDATE ACCEPT	–	–
30	The UE sends TRACKING AREA UPDATE COMPLETE	–>	TRACKING AREA UPDATE COMPLETE	–	–
–	At the end of this test procedure sequence, the UE is in end state E-UTRA connected (E2_T3440) according to TS 36.508.	–	–	–	–

9.2.3.4.1.3.3 Specific message contents

Table 9.2.3.4.1.3.3-1: Message RRCConnectionRequest (step 15, Table 9.2.3.4.1.3.2-1)

Derivation path: 36.508 table 4.6.1-16
Information Element	Value/Remark	Comment	Condition
InitialUE-Identity CHOICE {
random-Value	Any allowed value
}
establishmentCause	Mo-Signalling

Table 9.2.3.4.1.3.3-2: Message RRCConnectionSetupComplete (step 17, Table 9.2.3.4.1.3.2-1)

Derivation path: 36.508 table 4.6.1-18
Information Element	Value/remark	Comment	Condition
RRCConnectionSetupComplete ::= SEQUENCE {
rrc-TransactionIdentifier	RRC-TransactionIdentifier-UL
criticalExtensions CHOICE {
c1 CHOICE {
rrcConnectionSetupComplete-r8 SEQUENCE {
selectedPLMN-Identity	Indicates the PLMN of cell A.
registeredMME SEQUENCE {
plmn-Identity	Not Checked
Mmegi	LAC sent to the UE in step 8
Mmec	Bit 23 to bit 16 of P-TMSI sent to the UE in step 8
}
nas-DedicatedInformation	Not checked at RRC layer
nonCriticalExtension SEQUENCE {}	Not checked
}
}
}
}

Table 9.2.3.4.1.3.3-3: Message TRACKING AREA UPDATE REQUEST (step 17, Table 9.2.3.4.1.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Sent in SECURITY PROTECTED NAS MESSAGE with valid integrity check
EPS update type
EPS update type Value	‘000’B	TA updating	TA_only
	‘001’B or ‘010’B	Combined TA/LA updating or combined TA/LA updating with IMSI attach	No_LAU_CombinedRAU_GERAN_UTRA
	‘010’B	Combined TA/LA updating with IMSI attach	LAU_CombinedRAU_GERAN_UTRA
NAS key set identifier_ASME
NAS key set identifier	The valid NAS key set identifier KSI_ASME of the UE	As stored on the USIM in EF_EPSNSC
TSC	‘0’B	native security context
Old GUTI	Mapped from the P-TMSI and RAI allocated in step 8
Additional GUTI	GUTI1	Set to the value stored in the USIM in EF_EPSLOCI
DRX parameter	Not present
UE radio capability information update needed	‘1’B	UE radio capability information update needed
GPRS ciphering key sequence number	Value mapped from the AUTHENTICATION AND CIPHERING REQUEST message
Old Ptmsi Signature	Any Value
Nonce	Any Value

Table 9.2.3.4.1.3.3-3A: Message TRACKING AREA UPDATE REQUEST Conditions (Table 9.2.3.4.1.3.3-3)

Condition	Explanation
TA_only	See the definition below 36.508 table 4.7.2-24.
No_LAU_CombinedRAU_GERAN_UTRA	UE has not performed location area update procedure or a combined routing area update procedure in A/Gb or Iu mode
LAU_CombinedRAU_GERAN_UTRA	UE has performed location area update procedure or a combined routing area update procedure in A/Gb or Iu mode

Table 9.2.3.4.1.3.3-4: Message ROUTING AREA UPDATE REQUEST (step 24, Table 9.2.3.4.1.3.2-1)

Derivation path: 24.008 table 9.4.14
Information Element	Value/Remark	Comment	Condition
Protocol discriminator	GMM
Skip indicator	‘0000’
Routing area update request message identity	‘0000 1000’ B
Update type	Any allowed value
GPRS ciphering key sequence number	set to the value to KSI-ASME	With ISR inactive and TIN indicates GUTI, then eKSI value is set to KSI-ASME
Old routing area identification	Mapped from the GUTI received in step 18.
MS Radio Access capability	Any allowed value
Old P-TMSI signature	Mapped from the GUTI received in step 18.
Requested READY timer value	If present, any allowed value.
DRX parameter	Not present	Shall be absent
TMSI status	If present, any allowed value.
P-TMSI	Not present
MS network capability	Any allowed value.
PDP context status	If present, any allowed value.
PS LCS Capability	If present, any allowed value.
MBMS context status	If present, any allowed value.
UE network capability	Any allowed value.
Additional mobile identity	Set to the P-TMSI allocated in step 8
Additional old routing area identification	Set to the RAI allocated in step 8
Mobile station classmark 2	If present, any allowed value.
Mobile station classmark 3	If present, any allowed value.
Supported Codecs	If present, any allowed value.

Table 9.2.3.4.1.3.3-5: Message ROUTING AREA UPDATE ACCEPT (step 25, Table 9.2.3.4.1.3.2-1)

Derivation path: 24.008 table 9.4.15
Information Element	Value/Remark	Comment	Condition

allocated P-TMSI	Absent
PDP context status	Same value as received in ROUTING AREA UPDATE REQUEST in step 24

Table 9.2.3.4.1.3.3-6: Void

Table 9.2.3.4.1.3.3-6A: Message RRCConnectionRequest (step 27A, Table 9.2.3.4.1.3.2-1)

Derivation path: 36.508 table 4.6.1-16
Information Element	Value/Remark	Comment	Condition
ue-Identity CHOICE {
s-TMSI	Received from NAS layer	Rel-8 to Rel-11 inclusive
randomValue	Any allowed value	Rel-8 and onwards
}
establishmentCause	Mo-Signalling

Table 9.2.3.4.1.3.3-7: Message RRCConnectionSetupComplete (step 28, Table 9.2.3.4.1.3.2-1)

Derivation path: 36.508 table 4.6.1-18
Information Element	Value/remark	Comment	Condition
RRCConnectionSetupComplete ::= SEQUENCE {
Rrc-TransactionIdentifier	RRC-TransactionIdentifier-UL
criticalExtensions CHOICE {
C1 CHOICE {
rrcConnectionSetupComplete-r8 SEQUENCE {
selectedPLMN-Identity	Indicates the PLMN of cell 24.
registeredMME	Not present	Shall be absent if the upper layers provided S-TMSI in RRCConnectionRequest message in step 27A for pre-Rel-12 UE
registeredMME	generated from the P-TMSI and RAI	Present only when the InitialUE-Identity in step 27A is set to randomValue
nas-DedicatedInformation	Not checked at RRC layer
nonCriticalExtension SEQUENCE {
nonCriticalExtension SEQUENCE {
gummei-Type-r10	mapped	Present when the registeredMME is included,
}
}
}
}
}
}

Table 9.2.3.4.1.3.3-8: Message TRACKING AREA UPDATE REQUEST (step 28, Table 9.2.3.4.1.3.2-1)

Derivation path: 36.508 table 4.7.2-27
Information Element	Value/Remark	Comment	Condition
Sent in SECURITY PROTECTED NAS MESSAGE with valid integrity check
EPS update type	000	TA updating	TA_only
	010	combined TA/LA updating with IMSI attach	combined_TA_LA
EPS bearer context status	(octet 3 = ‘00100000’B and octet 4 = ‘00000000’B) or (octet 3 = ‘00100000’B and octet 4 = ‘00010000’B)
NAS key set identifier_ASME
NAS key set identifier	The valid NAS key set identifier KSI_ASME of the UE	As stored on the USIM in EF_EPSNSC in the pre-test conditions
TSC	‘0’B	native security context
Old GUTI	Mapped from the P-TMSI allocated in Step 8 and RAI allocated in
Additional GUTI	GUTI1	Set to the value allocated in step 18
DRX parameter	Not present
UE radio capability information update needed	Not present
Old Ptmsi Signature	Any Value
Nonce	Any Value