5.3.20.2 Requirements for UE in a PLMN

The UE shall maintain:

• a list of PLMN-specific attempt counters (see 3GPP TS 24.301 [15]). The maximum number of possible entries in the list is implementation dependent. This list is applicable to access attempts via 3GPP access only;
• a list of PLMN-specific attempt counters for non-3GPP access, if the UE supports non-3GPP access. The maximum number of possible entries in the list is implementation dependent. This list is applicable to access attempts via non-3GPP access only;
• a list of PLMN-specific N1 mode attempt counters for 3GPP access. The maximum number of possible entries in the list is implementation dependent. This list is applicable to access attempts via 3GPP access only;
• a list of PLMN-specific N1 mode attempt counters for non-3GPP access, if the UE supports non-3GPP access. The maximum number of possible entries in the list is implementation dependent. This list is applicable to access attempts via non-3GPP access only;
• one counter for "SIM/USIM considered invalid for GPRS services" events (see 3GPP TS 24. 008 [12]);
• one counter for "USIM considered invalid for 5GS services over non-3GPP access" events, if the UE supports non-3GPP access; and
• - a list of PLMN-specific attempt counters for the UE determined PLMN with disaster condition, if the UE supports MINT. The maximum number of possible entries in the list is implementation dependent. This list is applicable to access attempts via 3GPP access only.

A UE supporting non-EPS services shall maintain one counter for "SIM/USIM considered invalid for non-GPRS services" events (see 3GPP TS 24.008 [12]).

The UE shall store the above lists of attempt counters and the event counters in its non-volatile memory. The UE shall erase the lists and reset the event counters to zero when the UICC containing the USIM is removed. The counter values shall not be affected by the activation or deactivation of MICO mode or power saving mode (see 3GPP TS 24.301 [15]).

The UE implementation-specific maximum value for any of the above counters shall not be greater than 10.

NOTE 1: Different counters can use different UE implementation-specific maximum values.

If the UE receives a REGISTRATION REJECT or SERVICE REJECT message without integrity protection with 5GMM cause value #3, #6, #7, #11, #12, #13, #15, #27, #31, #36, #62, #72, #73 or #80 before the network has established secure exchange of NAS messages for the N1 NAS signalling connection, the UE shall stop timer T3510 or T3517 if running, and start timer T3247 (see 3GPP TS 24.008 [12]) with a random value uniformly drawn from the range between 30 minutes and 60 minutes, if the timer is not running, and take the following actions:

• if the 5GMM cause value received is #3, #6 or #7, and:
• if the 5GMM cause value is received over 3GPP access, the UE shall:
• if the UE is already registered over another access:
• store the current TAI in the list of "5GS forbidden tracking areas for roaming", memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for non-integrity protected NAS reject message and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE; and
• search for a suitable cell in another tracking area according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C]; or
• otherwise, if the counter for "SIM/USIM considered invalid for GPRS services" events has a value less than a UE implementation-specific maximum value,
• set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete 5G-GUTI, last visited registered TAI, TAI list and ngKSI for 3GPP access;
• if the 5GMM cause value received is #3 or #6, delete the list of equivalent PLMNs if any;
• increment the counter for "SIM/USIM considered invalid for GPRS services" events;
• if the 5GMM cause value received is #3 or #6, and if the counter for "SIM/USIM considered invalid for non-GPRS services" events has a value less than a UE implementation-specific maximum value, increment the counter;
• if a registration procedure was performed, reset the registration attempt counter and if a service request procedure was performed, reset the service request attempt counter;
• if the UE is operating in single-registration mode, handle the EMM parameters EMM state, EPS update status, EPS attach attempt counter, tracking area updating attempt counter or service request attempt counter, 4G-GUTI, TAI list, eKSI as specified in 3GPP TS 24.301 [15] for the case when the EPS attach, tracking area updating procedure or service request procedure is rejected with the EMM cause of the same value in a NAS message without integrity protection;
• store the current TAI in the list of "5GS forbidden tracking areas for roaming", memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for non-integrity protected NAS reject message and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE; and
• search for a suitable cell in another tracking area according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C]; and as a UE implementation option, the UE may perform registration attempt over the non-3GPP access, if non-3GPP access is available, and the USIM is not considered invalid for 5GS services over non-3GPP access; and

iii) otherwise proceed as specified in clauses 5.5.1 and 5.6.1;

• if the 5GMM cause value is received over non-3GPP access, the UE shall:
• if the UE is already registered over another access:
• enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE; and
• may perform registration attempt over the non-3GPP access if another access point for non-3GPP access is available; or
• otherwise, if the counter for "USIM considered invalid for 5GS services over non-3GPP access" events has a value less than a UE implementation-specific maximum value,
• set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete the 5G-GUTI, last visited registered TAI, TAI list and ngKSI for non-3GPP access;
• enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE;
• increment the counter for "USIM considered invalid for 5GS services over non-3GPP access" events; and as a UE implementation option, the UE may either perform registration attempt over the non-3GPP access if another access point for non-3GPP access is available, or if 3GPP access is available, and the USIM is not considered invalid for 5GS services over 3GPP access, perform registration attempt over the 3GPP access; and

NOTE 2: How to select another access point for non-3GPP access is implementation specific.

iii) otherwise proceed as specified in clauses 5.5.1 and 5.6.1;

• if the 5GMM cause value received is #12, #13 or #15, the UE shall proceed as specified in clauses 5.5.1 and 5.6.1. Additionally, the UE may:
• if the 5GMM cause value is received over 3GPP access, non-3GPP access is available, the UE is not registered over non-3GPP access yet, and the USIM is not considered invalid for 5GS services over non-3GPP access, perform registration attempt over the non-3GPP access; or
• if the 5GMM cause value is received over non-3GPP access, 3GPP access is available, the UE is not registered over 3GPP access yet, and the USIM is not considered invalid for 5GS services over 3GPP access, perform registration attempt over the 3GPP access;
• if the 5GMM cause value received is #11, #36 or #73 and the UE is in its HPLMN or EHPLMN:
• if the 5GMM cause value is received over 3GPP access, the UE shall:
• set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete, the 5G-GUTI, last visited registered TAI, TAI list, ngKSI for 3GPP access and the list of equivalent PLMNs. Additionally, if a registration procedure was performed, the UE shall reset the registration attempt counter and if a service request procedure was performed, reset the service request attempt counter;
• if the 5GMM cause value received is #11 and the UE is operating in single-registration mode, handle the EMM parameters EMM state, EPS update status, EPS attach attempt counter, tracking area updating attempt counter or service request attempt counter, 4G-GUTI, TAI list, eKSI as specified in 3GPP TS 24.301 [15] for the case when the EPS attach, tracking area updating procedure or service request procedure is rejected with the EMM cause of the same value in a NAS message without integrity protection;
• if the 5GMM cause value received is #73 and the UE is operating in single-registration mode, the UE shall in addition set the EPS update status to EU3 ROAMING NOT ALLOWED and shall delete any 4G-GUTI, last visited registered TAI, TAI list and eKSI. Additionally, the UE shall reset the attach attempt counter or tracking area updating attempt counter, and enter the state EMM-DEREGISTERED;
• store the current TAI in the list of "5GS forbidden tracking areas for roaming", memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for non-integrity protected NAS reject message and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE; and
• search for a suitable cell in another tracking area according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C]; and as a UE implementation option, the UE may perform registration attempt over the non-3GPP access, if non-3GPP access is available, the UE is not registered over non-3GPP access yet, and the USIM is not considered invalid for 5GS services over non-3GPP access;
• if the 5GMM cause value is received over non-3GPP access, the UE shall:
• set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete the 5G-GUTI, last visited registered TAI, TAI list and ngKSI for non-3GPP access. Additionally, if a registration procedure was performed, the UE shall reset the registration attempt counter and if a service request procedure was performed, reset the service request attempt counter; and
• enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE. As a UE implementation option, the UE may perform registration attempt over the non-3GPP access if another access point for non-3GPP access is available, or if 3GPP access is available, the UE is not registered over 3GPP access yet, and the USIM is not considered invalid for 5GS services over 3GPP access, perform registration attempt over the 3GPP access;
• if the 5GMM cause value received is #11, #36 or #73 and the UE is not in its HPLMN or EHPLMN, in addition to the UE requirements specified in clause 5.5.1 and 5.6.1:
• if the message was received via 3GPP access and if the PLMN-specific attempt counter for the PLMN sending the reject message has a value less than a UE implementation-specific maximum value, the UE shall increment the PLMN-specific attempt counter for the PLMN; or
• if the message was received via non-3GPP access and if the PLMN-specific attempt counter for non-3GPP access for the PLMN sending the reject message has a value less than a UE implementation-specific maximum value, the UE shall increment the PLMN-specific attempt counter for non-3GPP access for the PLMN;
• if the 5GMM cause value received is #27, the UE shall proceed as specified in clauses 5.5.1 and 5.6.1. Additionally, if the PLMN-specific N1 mode attempt counter for the respective access type and for the PLMN sending the reject message has a value less than a UE implementation-specific maximum value, the UE shall increment this counter for the PLMN;
• if the 5GMM cause value received is #72, the UE shall proceed as specified in clauses 5.5.1 and 5.6.1. Additionally, if the PLMN-specific N1 mode attempt counter for non-3GPP access for the PLMN sending the reject message has a value less than a UE implementation-specific maximum value, the UE shall increment this counter for the PLMN;
• if the 5GMM cause value received is #31 for a UE that has indicated support for CIoT optimizations, the UE may discard the message or alternatively the UE should:
• set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2);
• store the current TAI in the list of "5GS forbidden tracking areas for roaming", memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for non-integrity protected NAS reject message; and
• search for a suitable cell in another tracking area according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C]; and
• if the 5GMM cause value received is #62, the UE may discard the message or alternatively the UE should:
• set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2);
• store the current TAI in the list of "5GS forbidden tracking areas for roaming", memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for non-integrity protected NAS reject message; and
• search for a suitable cell in another tracking area according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C].
• if the 5GMM cause value received is #80, the UE shall proceed as specified in clauses 5.5.1. If the PLMN-specific attempt counter of the PLMN which sent the reject message for the UE determined PLMN with disaster condition has a value less than a UE implementation-specific maximum value, the UE shall increment the PLMN-specific attempt counter of the PLMN which sent the reject message for the UE determined PLMN with disaster condition.

Upon expiry of timer T3247, the UE shall:

• remove all tracking areas from the list of "5GS forbidden tracking areas for regional provision of service" and the list of "5GS forbidden tracking areas for roaming", which were stored in these lists for non-integrity protected NAS reject message;
• set the USIM to valid for 5GS services for 3GPP access, if:
• the counter for "SIM/USIM considered invalid for GPRS services" events has a value less than a UE implementation-specific maximum value;
• set the USIM to valid for 5GS services for non-3GPP access, if:
• the counter for "USIM considered invalid for 5GS services over non-3GPP access" events has a value less than a UE implementation-specific maximum value;
• set the USIM to valid for non-EPS services, if:
• the counter for "SIM/USIM considered invalid for non-GPRS services" events has a value less than a UE implementation-specific maximum value;
• for each PLMN-specific attempt counter that has a value greater than zero and less than a UE implementation-specific maximum value, remove the respective PLMN from the extension of the "forbidden PLMNs" list if the UE is not registered on the PLMN for the disaster roaming services;

NOTE 2A: As an implementation option, the UE removes the PLMN where it is currently registered for disaster roaming service from list of extension of the "forbidden PLMNs" when the UE determines that the disaster condition has ended as specified in 3GPP TS 23.122 [5].

• for each PLMN-specific attempt counter for non-3GPP access that has a value greater than zero and less than a UE implementation-specific maximum value, remove the respective PLMN from the list of "forbidden PLMNs for non-3GPP access to 5GCN";
• re-enable the N1 mode capability for 3GPP access and, for each PLMN-specific N1 mode attempt counter for 3GPP access that has a value greater than zero and less than a UE implementation-specific maximum value, remove the respective PLMN from the list of PLMNs where N1 mode is not allowed for 3GPP access (see 3GPP TS 23.122 [5]);
• re-enable the N1 mode capability for non-3GPP access and, for each PLMN-specific N1 mode attempt counter for non-3GPP access that has a value greater than zero and less than a UE implementation-specific maximum value, remove the respective PLMN from the list of PLMNs where N1 mode is not allowed for non-3GPP access;
• if the UE is supporting A/Gb mode or Iu mode, perform the actions as specified in 3GPP TS 24.008 [12] for the case when timer T3247 expires;
• if the UE is supporting S1 mode, perform the actions as specified in 3GPP TS 24.301 [15] for the case when timer T3247 expires;
• initiate a registration procedure, if still needed, dependent on 5GMM state and 5GS update status, or perform PLMN selection according to 3GPP TS 23.122 [5]; and
• for each PLMN-specific attempt counter of the PLMN which sent the reject message for the UE determined PLMN with disaster condition that has a value greater than zero and less than a UE implementation-specific maximum value, consider the PLMN which sent the reject message is available for disaster roaming service for the respective UE determined PLMN with disaster condition.

When the UE is switched off, the UE shall, for each PLMN-specific attempt counter that has a value greater than zero and less than the UE implementation-specific maximum value, remove the respective PLMN from the list of "forbidden PLMNs". When the USIM is removed, the UE should perform this action.

When the UE is switched off, the UE shall, for each PLMN-specific attempt counter for non-3GPP access that has a value greater than zero and less than the UE implementation-specific maximum value, remove the respective PLMN from the list of "forbidden PLMNs for non-3GPP access to 5GCN". When the USIM is removed, the UE should perform this action.

When the UE is switched off, the UE shall, for each PLMN-specific attempt counter of the PLMN which sent the reject message for the UE determined PLMN with disaster condition that has a value greater than zero and less than the UE implementation-specific maximum value, consider the PLMN is available for disaster roaming service for the respective UE determined PLMN with disaster condition. When the USIM is removed, the UE should perform this action.

When the PLMN is removed from the list of "forbidden PLMNs" including extension of the "forbidden PLMNs" list due to reasons specified in clause 4.4.6 or annex C in 3GPP TS 23.122 [5], the UE shall reset the PLMN-specific attempt counter for that PLMN.

NOTE 3: If the respective PLMN was stored in the extension of the "forbidden PLMNs" list, then according to 3GPP TS 23.122 [5] the UE will delete the contents of this extension when the UE is switched off or the USIM is removed.