A UE with a valid USIM knows about more PLMNs than it can register on. Some come from the IMSI, some from files the operator wrote, and one from the last time the UE was switched on. Before it can camp on a cell it has to put them in an order. That order is what this page is about.

• Which PLMN identities does the UE have to choose from?
• In what order does the UE actually try them?
• What changes in manual selection mode?
• Reference

Which PLMN identities does the UE have to choose from?

Every item in the list below is a file on the USIM, or something read out of one. The names are easy to confuse, because three of the six end in the same three letters and two of those differ only by a leading O. So it is worth settling what each file actually holds before asking which one the UE tries first.

i) PLMN from IMSI (Home PLMN)

ii) Last Registered PLMN(Recorded in EF_LOCI)

iii) PLMNs listed in EF_EHPLMN(Equivalent HPLMN)

iv) PLMNs listed in EF_HPLMNwAct(Home PLMN with Access Technology)

v)  PLMNs listed in EF_PLMNwAct(PLMN with Access Technology, User Controlled PLMN selector with Access Technology)

vi) PLMNs listed in EF_OPLMNwAct(Operator Controlled PLMN with Access Technology)

Two of the six are not lists of preferred PLMNs at all, and that is worth settling first. EF_LOCI holds location information rather than a PLMN list. 31.102 gives it three contents in eleven bytes: a TMSI, a Location Area Information field, and a location update status. The ME reads the last registered PLMN out of the MCC and MNC inside that LAI.

EF_HPLMNwAct is the other one. It does carry the HPLMN code, but 31.102 clause 4.2.54 describes it as the HPLMN code or codes together with the respected access technology. 23.122 gives it no place in the priority order. Requirement f) of clause 4.4.3.1.1 says only that the file may be used to optimise the procedure, which makes it a hint about which radio to search first.

The three that genuinely rank PLMNs are EF_EHPLMN, EF_PLMNwAct and EF_OPLMNwAct. All three are optional files, so a USIM can leave any of them out, and 23.122 says what to do in each case. The table below maps the page's six entries onto the files and onto the clause that consumes them.

The six entries are not six steps of one ordered list. One of them runs before that list, one is an optimisation hint, and only four take a position in the order.

• The user outranks the operator, and the home network outranks the user : the User Controlled selector sits at ii) and the Operator Controlled selector at iii). The HPLMN or EHPLMN takes i), ahead of both.
• wAct means access technology, not priority : the suffix says the file pairs each PLMN with the radios it should be searched on. 23.122 requirement c) tells the MS to limit its search that way at steps ii) and iii).
• EF_LOCI is unlike the other four : it is the only mandatory file of the five, and the only one that holds no PLMN list. The RPLMN comes out of the LAI inside it.
• The EHPLMN list can contain the HPLMN : 31.102 clause 4.2.84 allows the HPLMN code derived from the IMSI to appear as an EHPLMN entry. That is why 23.122 treats the two as one step.
• Optional means the UE has to cope without them : four of the five files are optional, each gated on a USIM service number. Only EF_LOCI is always there.

The question is which of these PLMNs has highest priority for cell selection ? The answer is described in 3GPP 23.122 4.4.3.1.1.

In what order does the UE actually try them?

Here is the part that is easy to get wrong. Clause 4.4.3.1.1 is an ordered list, and the last registered PLMN is not in it. The RPLMN is tried earlier still, in the clause above, and the ordered list only runs once that first attempt has failed.

23.122 clause 4.4.3.1.0 sets the scene. At switch on, or on recovery from lack of coverage, the MS selects the registered PLMN or an equivalent PLMN if one is available. It uses every access technology it is capable of. NOTE 1 of that clause lets the search stop as soon as one is found. The MS reaches the ordered list only when there is no registered PLMN, or registration fails, or the PLMN is unavailable.

One exception is worth knowing, because it changes what a switch-on log looks like. An MS in automatic mode may find coverage of an EHPLMN. It may then register there and never go back to the registered PLMN. The same applies to the HPLMN when the EHPLMN list is absent or empty. 23.122 makes this operator controlled by SIM configuration. 31.102 clause 4.2.86 is where that control sits. The file is EF_LRPLMNSI, identifier '6FDC', a single byte described as an indication to the ME for the selection of the RPLMN or the home network at switch on.

When the fall-through does happen, and the UE is in automatic mode, this is the order clause 4.4.3.1.1 gives.

• i) HPLMN or highest priority EHPLMN : the HPLMN if the EHPLMN list is not present or is empty, otherwise the highest priority EHPLMN that is available.
• ii) User Controlled PLMN Selector with Access Technology : each PLMN and access technology combination in that file on the SIM, in priority order.
• iii) Operator Controlled PLMN Selector with Access Technology : the same, from the SIM or from the ME. Requirement p) picks the ME copy when it was last written by steering of roaming, and the SIM copy otherwise.
• iv) other PLMNs with a high quality signal, in random order : random is deliberate, and NOTE 1 leaves the definition of high quality to the access stratum specification.
• v) other PLMNs in order of decreasing signal quality : requirement h) orders them within each access technology, and leaves the order between access technologies to the implementation.
• v-0) the operator controlled lower selection-priority list : steps iv) and v) skip this list, and it is picked up last. Its own Priority leaf decides whether it is read in order or at random.

The order is easier to hold as a shape than as a list, because the branch at the top is what the list itself never shows. Figure 1 puts the two clauses side by side, with the registered PLMN check standing ahead of both selection modes.

Figure 1. The branch at the top is the one the numbered list hides. A UE that comes back from a tunnel and re-registers on the same network never reaches step i) at all.

• The RPLMN is not step zero of the list, it is a different clause : clause 4.4.3.1.0 handles it, and clause 4.4.3.1.1 never mentions it. Reading the numbered list as the whole answer puts the RPLMN in the wrong place.
• Steps i) to iii) are lookups, steps iv) to v-0) are a scan : the first three read a file and search for named PLMNs. The last three take whatever is on the air and sort it.
• Random order at iv) is a requirement, not an accident : it stops every UE in one place from choosing the same visited network.
• An EHPLMN can override the return to the RPLMN : the operator decides, through EF_LRPLMNSI. A UE doing this goes to the home network at switch on, rather than to the network it last used.
• Requirement f) is why EF_HPLMNwAct never appears in the order : it shortens the search at step i) instead of adding a step. NOTE 2 lets the MS stop as soon as the HPLMN or the top EHPLMN is found.

What changes in manual selection mode?

Automatic mode chooses. Manual mode only offers. The same order appears in 23.122 clause 4.4.3.1.2, but there it sets what the user is shown first. The set of PLMNs it covers is wider than the automatic one as well.

That wider set is what matters when you read a handset's network list. Clause 4.4.3.1.2 has the MS indicate whichever PLMNs are available on all supported access technologies, and it names what that includes. The forbidden PLMNs list is in there. So is the forbidden PLMNs for GPRS service list, and so are PLMNs which only offer services the MS does not support. Automatic mode would never select any of them.

Step i) also behaves differently. In automatic mode the MS takes the highest priority available EHPLMN and stops. In manual mode an optional data field on the SIM decides whether the user is shown only that one, or all available EHPLMNs in priority order. When the field is absent, only the highest priority one is presented.

Below step i) the two clauses converge. Steps ii) to v-0) are worded the same way, and clause 4.4.3.1.2 then applies requirements h), j), k), l) and p) of clause 4.4.3.1.1 by reference rather than restating them. NOTE 1A adds one operator option: subject to home operator policy, an MS in manual mode may choose not to present the operator controlled lower selection-priority list at all.

One last piece exists only in manual mode, because only manual mode shows anything to a person. The HPLMN may put extra free text about the available PLMNs on the SIM, covering preferred partner, roaming agreement status and supported services, and the MS shall show it. The MS may also indicate whether an available PLMN sits on the EHPLMN list, the Forbidden list, the User Controlled list or the Operator Controlled list, or on none of them.

• Manual mode shows PLMNs it would never select : forbidden PLMNs appear in the list a user scrolls through. Seeing a network there says nothing about whether registration will be accepted.
• The order is a display order, not a selection order : the MS still sorts i) to v-0), but the choice at the end is the user's.
• Two EHPLMN behaviours exist, and a SIM field picks between them : one available EHPLMN shown, or all of them in priority order. Absent field means one.
• Manual mode carries the automatic requirements by reference : h), j), k), l) and p) of clause 4.4.3.1.1 all still apply, so the access technology and capability filters do not relax.

Reference

• 23.122 : 3GPP - Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode, v20.0.0. Clause 4.4.3.1.0 (general), clause 4.4.3.1.1 (automatic network selection mode procedure) and clause 4.4.3.1.2 (manual network selection mode procedure).
• 31.102 : 3GPP - Characteristics of the Universal Subscriber Identity Module (USIM) application, v19.5.0. Clause 4.2.5 (EF_PLMNwAcT), 4.2.53 (EF_OPLMNwAcT), 4.2.54 (EF_HPLMNwAcT), 4.2.84 (EF_EHPLMN), 4.2.86 (EF_LRPLMNSI) and the EF_LOCI clause.