A roaming UE camps on a VPLMN because it could not find anything better when it selected a PLMN. That situation can change while the UE stays there, for example when it moves back into coverage of its home network. 23.122 therefore makes a roaming UE in Automatic mode look again, at regular intervals, for a PLMN of higher priority. Let's go through what the UE searches for first, and then how often it searches. The PLMN order used here is the one explained in PLMN Selection - Automatic vs Manual.
What does a UE on a VPLMN keep searching for ?
The search does not look at every PLMN on the air. It looks only at the PLMNs that rank above the current VPLMN in steps i to iii of Automatic mode. These are the HPLMN or EHPLMN and the PLMNs in the two selector lists on the USIM. The periodic search runs only in Automatic mode, and only while the UE is roaming.
If UE has camped on to the cell with VPLMN and is in IDLE mode, it has to perform following procedures
- i) periodically attempts to obtain service on its HPLMN (if the EHPLMN list is not present or is empty) or one of its EHPLMNs (if the EHPLMN list is present)
- ii) (if failed in previous step) periodically attempts to a higher priority PLMN/access technology combinations listed in ‘User Controlled PLMN Selector’ or ‘Operator Controlled PLMN Selector’
23.122 clause 4.4.3.3.1 adds several limits to this search, and they matter when you test roaming. The first limit is the country. The UE tries only the higher priority PLMN/access technology combinations of the same country as the current VPLMN. So a UE roaming abroad does not return to its HPLMN across a border just because the HPLMN signal reaches it. The specification has exceptions only for satellite access and for shared MCCs.
The second limit is the equivalent PLMN list. If the UE holds an "Equivalent PLMNs" list, it selects a new PLMN only when that PLMN ranks higher than the equivalent PLMNs of the same country. If the highest priority PLMN available is the current VPLMN or one of its equivalent PLMNs, the UE stays where it is. And if the search finds no HPLMN, EHPLMN or higher priority PLMN, the UE also remains on the VPLMN.
The third limit is the state of the UE. The periodic attempts happen only in idle mode, or in 5GMM-CONNECTED mode with RRC inactive indication for 5GS. They are also not made while the UE has an emergency registration, an emergency PDN connection or an emergency PDU session. A UMTS UE in CELL_DCH with an ongoing call therefore waits for idle mode before the next attempt.
The search only looks upward : The UE compares candidates with the current VPLMN and its equivalent PLMNs. A PLMN of the same or lower priority never triggers a change.The search stays inside the country : Steps i to iii are limited to PLMNs of the same country as the serving VPLMN, apart from the satellite and shared MCC exceptions.Manual mode has no such search : A user who selected the VPLMN by hand stays on it. The periodic attempts are defined for Automatic mode only.
How often does the UE search ?
A search costs battery, because the UE has to scan other carriers. So the home operator sets how often a roaming UE runs it. The operator writes the value into the USIM, and the UE reads it from there. The same value also controls when the first search happens after the UE selects a VPLMN.
I said the term "periodically". Then how this "peridicity" is determined ?
The periodicity T minutes may be stored in the SIM (Higher Priority PLMN search period), T is either in the range 6 minutes to 8 hours in 6 minute steps or it indicates that no periodic attempts shall be made. If no value is stored in the SIM, a default value of 60 minutes is used
The USIM file is EF HPPLMN, file identifier 6F31, and it is one byte long. For an ordinary UE, the byte counts in units of 6 minutes. '00' means no periodic search, '01' means 6 minutes, '0A' means 60 minutes, and '50' means 8 hours.
The timer T is only half of the rule. The other half is the timing of the first attempt, and the diagram below shows both. The UE makes the first attempt at least 2 minutes after switch on, and at most T after it. After that, the UE makes a new attempt every T for as long as it is still on the VPLMN.
Figure 1. Timing of the higher priority PLMN search. The first attempt falls between 2 minutes and T after switch on, and each later attempt follows the previous one by T.
First attempt window : The shaded box runs from 2 minutes to T after switch on. The UE does not search in the first 2 minutes.Later attempts : Each later attempt comes T after the previous one, but only if the UE is still on the VPLMN at that time.Switch on is the reference point : By default, the window opens only after switch on. With Fast First Higher Priority PLMN search enabled, it also opens each time the UE selects a VPLMN.
Several newer rules change the value of T. An IoT UE that uses EC-GSM-IoT, Category M1 or Category NB1 reads the same byte in units of hours. For this UE, T runs from 2 hours to 240 hours, and the default is 72 hours. A MinimumPeriodicSearchTimer, from the USIM or the ME configuration, sets a floor under T. The UE may also postpone an attempt, for example in power saving mode or during eDRX.
60 minutes is only the default : An operator can write its own value into EF HPPLMN, so check the USIM before you set the test timing.'00' switches the search off : With this value, a roaming UE in Automatic mode never tries to return home by itself.The same byte means different things : An IoT UE reads the value in hours, while an ordinary UE reads it in units of 6 minutes.
Reference
- 3GPP TS 23.122 v20.0.0 : Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode
- 3GPP TS 31.102 v19.5.0 : Characteristics of the Universal Subscriber Identity Module (USIM) application