2G 3G 4G Registration

Process
Application Note

80000NT11696A Rev 4
2023-09-26
Released
Confidential

Technical Documentation
 2G 3G 4G Registration Process
Application Note

Contents
Contents ................................................................................................................................................................................. 2
1 Applicability Table ............................................................................................................................................ 3
2 Introduction......................................................................................................................................................... 4
2.1 Scope 4
2.2 Audience 4
2.3 Contact Information, Support 4
2.4 Conventions 4
2.5 Terms and conditions 5
2.6 Disclaimer 5
3 Main Registration Flow ...................................................................................................................................... 6
4 2G & 3G modules Registration Flow ............................................................................................................ 7
4.1 2G & 3G PDP context 8
5 4G modules Registration Flow ........................................................................................................................ 9
5.1 4G PDP context 12
6 RAT/PLMN selection .........................................................................................................................................13
6.1 Automatic selection 13
Roaming registration on VPLM 14
How to delete EFLOCI file in the USIM 14
How to delete EFLOCI file with simWISE 16
Forbidden PLMN in USIM 16
Forbidden PLMN with simWISE 17
6.2 GERAN Frequency scan and cell selection 18
6.3 UTRAN Frequency scan and cell selection 19
6.4 EUTRAN Frequency scan and cell selection 20
6.5 EUTRAN Cat.M and NB-IoT selection (Platform ID 30 – 37 - 43) 21
6.6 CS/PS Mode of Operation for EPS (Platform ID 20 – 25 – 30 – 37 – 39 - 43 - 44) 23
6.7 Network Reject Causes 26
7 PDP Context activation and deactivation .................................................................................................27
8 Acronyms and Abbreviations ...................................................................................................................28
9 Related Documents .......................................................................................................................................30
10 Document History ..........................................................................................................................................32

80000NT11696A Rev 4 Page 2 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

1 Applicability Table

Table 1: Applicability Table

Products Platform Version ID
GE866-QUAD
16
GL865 Series
GE910 Series 13 - 16
GL865-QUAD V4 34
GE310-GNSS 35
UL865 Series
UE910 Series
12
UE866 Series
HE910 Series
LE910 Series 20 – 25 – 39 -44
ME910 Series
ML865 Series 30 -37
ME310 Series
NE310H2
26
NL865H2
NE310L2 43

Note: Platform Version ID is a reference used in the document. It identifies the

different SW versions, e.g. 13 for SW version 13.xx.xxx, 16 for SW version 16.xx.xxx,
etc.

80000NT11696A Rev 4 Page 3 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

2 Introduction
2.1 Scope
Scope of this document is to give an overview and basic flow for Telit module
registration. It is an indication that need to be adapted to the customer needs.

2.2 Audience
This document is intended for Telit customers, especially system integrators, about to
implement their applications using the Telit modules family.

2.3 Contact Information, Support

For technical support and general questions, e-mail:
• [email protected]
• [email protected]
• [email protected]
• [email protected]
• [email protected]

Alternatively, use: https://www.telit.com/contact-us/

Product information and technical documents are accessible 24/7 on our website:
https://www.telit.com

2.4 Conventions
Note: Provide advice and suggestions that may be useful when integrating the
module.
Danger: This information MUST be followed, or catastrophic equipment failure or
personal injury may occur.
ESD Risk: Notifies the user to take proper grounding precautions before handling
the product.
Warning: Alerts the user on important steps about the module integration.

All dates are in ISO 8601 format, that is YYYY-MM-DD.

80000NT11696A Rev 4 Page 4 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

2.5 Terms and conditions

Refer to https://www.telit.com/hardware-terms-conditions/.

2.6 Disclaimer
THE MATERIAL IN THIS DOCUMENT IS FOR INFORMATIONAL PURPOSES ONLY. TELIT
CINTERION RESERVES THE RIGHT TO MAKE CHANGES TO THE PRODUCTS DESCRIBED
HEREIN. THE SPECIFICATIONS IN THIS DOCUMENT ARE SUBJECT TO CHANGE AT THE
DISCRETION OF TELIT CINTERION WITHOUT PRIOR NOTICE. THIS DOCUMENT IS
PROVIDED ON “AS IS” BASIS ONLY AND MAY CONTAIN DEFICIENCIES OR INADEQUACIES.
TELIT CINTERION DOES NOT ASSUME ANY LIABILITY FOR INFORMATION PROVIDED IN
THE DOCUMENT OR ARISING OUT OF THE APPLICATION OR USE OF ANY PRODUCT
DESCRIBED HEREIN.
TELIT CINTERION GRANTS A NON-EXCLUSIVE RIGHT TO USE THE DOCUMENT. THE
RECIPIENT SHALL NOT COPY, MODIFY, DISCLOSE, OR REPRODUCE THE DOCUMENT
EXCEPT AS SPECIFICALLY AUTHORIZED BY TELIT CINTERION.
TELIT CINTERION AND THE TELIT CINTERION LOGO, ARE TRADEMARKS OF TELIT
CINTERION AND ARE REGISTERED IN CERTAIN COUNTRIES. ALL OTHER REGISTERED
TRADEMARKS OR TRADEMARKS MENTIONED IN THIS DOCUMENT ARE THE PROPERTY
OF THEIR RESPECTIVE OWNERS AND ARE EXPRESSLY RESERVED BY TELIT CINTERION
(AND ITS LICENSORS).

80000NT11696A Rev 4 Page 5 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

3 Main Registration Flow

POWER ON
&
CONFIGURATION

Yes Bad signal

No
Loop

Yes
No “Check_n
No
CHECK NETWORK NETWORK et_timer” SHUTDOWN
REGISTRATION REGISTRATION is or others
expired?

Yes

Yes

“data_ser
ACTIVATE DATA Yes
CHECK DATA vice_timer
REGISTRATION
SERVICE AND ” is
No SEND DATA No expired?

Yes Yes No

80000NT11696A Rev 4 Page 6 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

4 2G & 3G modules Registration Flow

(PLATFORM ID 10 – 12 – 13 – 16 – 34 - 35)

80000NT11696A Rev 4 Page 7 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

4.1 2G & 3G PDP context

In case of PDP activation failure, verify AT#CEER error cause as defined by 3GPP TS 24.008.

80000NT11696A Rev 4 Page 8 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

5 4G modules Registration Flow

(PLATFORM ID 20 -25 – 26 - 30 – 37 – 39 – 43 – 44)

80000NT11696A Rev 4 Page 9 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

80000NT11696A Rev 4 Page 10 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

80000NT11696A Rev 4 Page 11 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

5.1 4G PDP context

In case of PDP activation failure, verify AT#CEER error cause as defined by 3GPP TS 24.008.

80000NT11696A Rev 4 Page 12 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

6 RAT/PLMN selection
6.1 Automatic selection

The search order during RAT/PLMN selection is determined by either the module setting
(NV parameters) and files in the (U)SIM card, which have higher priority.
The module should select last registered PLMN (LRPLMN) or equivalent PLMN (if it is
available) using all access technologies that the MS is capable of.
As reported in the 3GPP 23.122 [1], section 4.4.3.1, if there is no LRPLMN, or if registration
is not possible due to the PLMN being unavailable or registration failure at switch on or
recovery from lack of coverage, the module should selects and attempts registration on
PLMNs if available and allowable using all access technologies that the module is capable
in the following order:

I. either the HPLMN (if the EHPLMN list is not present or is empty) or the highest
priority EHPLMN that is available (if the EHPLMN list is present);
II. each PLMN/access technology combination in the "User Controlled PLMN Selector
with Access Technology" data file in the SIM (in priority order);
III. each PLMN/access technology combination in the "Operator Controlled PLMN
Selector with Access Technology" data file in the SIM (in priority order); (Steering
SIMs only)
IV. other PLMN/access technology combinations with received high quality signal in
random order;
V. other PLMN/access technology combinations in order of decreasing signal quality.

High quality signal is defined by:

• 3GPP TS 43.022 [2] for the GSM radio access technology as a signal level (RSSI)
stronger than -85 dBm;
• 3GPP TS 25.304 [6] for the UMTS radio access technology as a signal level (RSCP)
stronger than -96 dBm;
• 3GPP TS 36.304 [9] for the LTE radio access technology as a signal level (RSRP)
stronger than -110 dBm;
In ii and iii, the MS should limit its search for the PLMN to the access technology or access
technologies associated with the PLMN in the appropriate PLMN Selector with Access
Technology list (User Controlled or Operator Controlled selector list).

80000NT11696A Rev 4 Page 13 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

Roaming registration on VPLM

If the module is in a VPLMN (Visitor PLMN), it shall periodically search for its HPLMN or a
higher priority PLMN/access technology combination listed in II and III as defined in the
RAT/PLMN selection chapter. Specific timer may be stored in the USIM.
In steps I, II and III of subclause 4.4.3.1.1 the MS shall limit its attempts to access
PLMN/access technology combinations of the same country as the current serving
VPLMN.
More information can be found on 3GPP 23.122 [1] section “4.4.3.3 In VPLM”.

How to delete EFLOCI file in the USIM

In the particular scenario where the module is tested on country A and deployed on
country B, in order to skip point (I.) the last registered PLMN (LRPLMN) can be deleted (for
all the other cases, deleting the LRPLMN may result in longer registration times, since the
module will have to perfom a full RF scan).

The last registered PLMN is stored in a USIM field (EFLOCI - Location Information -
Identifier: '6F7E'). 3 methods are possible:
1) Using AT+CSIM and opening a USIM logical channel

AT+CSIM=14,"00A40804022F00" //SELECT FILE with FCP template [12]

+CSIM:
76,"62228205422100200183022F00A506C00140DE01008A01058B032F060380020020
8801F09000"
OK
AT+CSIM=10,"00B2010420" //READ RECORD
+CSIM:
68,"61124F10A0000000871002FFFFFFFF89060400FFFFFFFFFFFFFFFFFFFFFFFFFF9000"
OK

On FCP template returned by the previous select the 4F is the Application identifier-AID
tag and it is followed by the length of AID; In the example it is 4F10 so length is 0x10 (16
Bytes ) [13]

The string out from previous +CSIM in blue (AID) is 16 bytes after 4F10;

80000NT11696A Rev 4 Page 14 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

Now it is possible to open a logical channel with the USIM;

AT+CCHO="A0000000871002FFFFFFFF89060400FF"
+CCHO: 2 // could be 1 2 3
AT+CGLA=2,18,"02A4080C047FFF6F7E"
+CGLA: 4,"9000"
OK

First parameter (2) and first byte of APDU (02) is the number returned by +CCHO in red;

AT+CGLA=2,32,"02D600000BFFFFFFFFFFFFFFFFFFFFFF"
+CGLA: 4,"9000" // EFLOCI deleted

First parameter (2) and first byte of APDU (02) is the number returned by +CCHO. You can
verify the EFLOCI content with:

AT+CGLA=2,10,"02B000000B"
+CGLA: 26," FFFFFFFFFFFFFFFFFFFFFF9000"
OK

Last bytes are status SW1 SW2: 9000 = SUCCESS;

To close the logical channel (+CCHO: 2):

AT+CCHC=2
OK

Note: It could happen that between first +CSIM and second one, module access
the USIM and this is something that can’t be blocked. To get the AID to be used with
+CCHO the two +CSIM must be sent in a fast sequence and, if the AID is not
returned (so an extra USIM access happened in between) they must be sent again.

Once the AID of a USIM is known the two +CSIM are no more required.
2) Using AT+CRSM. (not supported by HE910/UE910/UL865/UE866)
It is possible to read the field in 28542 (‘6F7E’ file in decimal format) on the USIM and then
clear it out the LRPLMN).

80000NT11696A Rev 4 Page 15 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

AT+CRSM=176,28542,0,0,11 // Reads EFLOCI field (28542 is 6F7E in decimal format)

+CRSM: 144,0,A80B7CDB22F210D5BDFF00 //PLMN info

OK

AT+CRSM=214,28542,0,0,11,FFFFFFFFFFFFFFFFFFFFFF //Write EFLOCI field (in this case

we're erasing the file)
+CRSM: 144,0

OK

AT+CRSM=176,28542,0,0,11 // Read the field again

+CRSM: 144,0,FFFFFFFFFFFFFFFFFFFFFF

OK

How to delete EFLOCI file with simWISE

Module with simWISE service enabled, and VSIM profile selected shall delete the EF_LOCI
file with the dedicated command:

AT#VSIMEDITSIMDATA=0

Forbidden PLMN in USIM

The EF_FPLMN is a file contained in any SIM/USIM which includes up to four Forbidden
PLMNs (FPLMN). It is read by the module as part of the USIM initialization procedure and
indicates PLMNs which the module shall not automatically attempt to access.

A PLMN is written in the EF if a network rejects a Location Update with cause # 11 - “PLMN
not allowed”.

80000NT11696A Rev 4 Page 16 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

In case the FPLM list is full, the rejection of a further PLMN with cause # 11 will cause new
FPLMN to be stored in 4th position, shifting the ones in the list, causing the previous
content of the 1st position to be lost.
Since roaming agreements can change, it could be necessary to delete the FPLMN list from
time to time, to avoid module not using PLMNs that are no more forbidden.
This can be done using the AT#FPLMN command. Refer to Telit AT Command Guides for
more information and availability of this command.

Note: Another option is to force a manual registration with

AT+COPS=1,2,”MCCMNC” (e.g. AT+COPS=1,2,”22201”). In this case the module will
try to register to the selected PLMN even if stored in the FPLMN list.

Forbidden PLMN with simWISE

Module with simWISE service enabled, and VSIM profile selected shall delete the
EF_FPLMN file with the dedicated command:

AT#VSIMEDITSIMDATA=1,FFFFFFFFFFFFFFFFFFFFFFFF

80000NT11696A Rev 4 Page 17 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

6.2 GERAN Frequency scan and cell selection

The MS should search for a network at lack (or loss) of coverage - i.e. if the received signal
strength or quality is no longer sufficient to camp on the registered network. The state
Loss of coverage is achieved, if in the current cell the path loss criterion (C1, GSM) or the
criterion for a downlink signalling failure (GSM) are fulfilled or the cell selection criterion S
is NOT fulfilled (UMTS) and a cell reselection is not possible - i.e. there is no suitable cell
available in the registered network.
The module scans all the RF channels for the specific technology:

For GSM:
• 3GPP TS 03.22. (Release 99) or TS 43.022 [2] (Release 4 and higher)
Chapter 4.5 ‘Cell selection process’
• 3GPP TS 05.08. (Release 99) or TS 45.008 [3] (Release 4 and higher)
Chapter 6.5 ‘Downlink signalling failure’
Chapter 6.6.2 ‘Path loss criteria and timings for cell reselection’

According to 3GPP TS 43.022 [2], in normal cell-selection state MS has no prior knowledge
of which RF channels are BCCH or CPBCCH carriers.
The module lists the channels from the strongest to the weakest to see which are BCCH
or CPBCCH carriers (3GPP paragraph 3.2.1 require to list up to 30 GSM850/900 and 40
DCS1800/PCS1900 channels.
The first BCCH or CPBCCH carrier found which is from a suitable cell and on which there
is a normal priority indication is taken and that cell is camped on.
If at least the number, given in subclause 3.2.1, of the strongest RF channels have been
tried and the only suitable cells found have low priority indication the module shall camp
on the strongest of these cells.
If, after searching the number of RF channels given for each frequency band, with the
strongest received signal level, a BCCH or CPBCCH carrier has been found but no suitable
cell of the selected PLMN has been found, the module can stop the attempt to find a
suitable cell of the selected PLMN.

Telit 2G modules (Platform ID 13 - 16) is compliant with what specified in the 3GPP
standard, since it scans all RF channels in the system (174 in E-GSM and 374 for DCS 1800)
and lists the channels by power strength. Then the Telit algorithm starts decoding up to
60 GSM850/900 + 80 DCS1800/PCS1900 channels. The first BCCH or CPBCCH carrier
found which is from a suitable cell and on which there is a normal priority indication is
taken and that cell is camped on.
If at least the number, given in subclause 3.2.1, of the strongest RF channels have been
tried and the only suitable cells found have low priority indication the module shall camp
on the strongest of these cells.

80000NT11696A Rev 4 Page 18 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

If, after searching the number of RF channels (30 GSM900 and 40 DCS1800 by 3GPP, 60
and 80 in Telit module algorithm implementation), given for each frequency band, with the
strongest received signal level, a BCCH or CPBCCH carrier has been found but no suitable
cell of the selected PLMN has been found, the module can stop the attempt to find a
suitable cell of the selected PLMN.
The modules support a special AT command to change the number of channels in low
(850/900) and high (1800/1900) bands that will be decoded after frequency scan. It could
be required to increase the number of channels decoded in specific network scenarios
where GSM frequencies are refarmed to LTE or in any other case where LTE saturates the
GSM bands.

AT#SERCHLIM =<GSMSearchLim>,<DCSPCSSearchLim>
Where:
• <GSMSearchLim>: setting the ARFCN number search limit for GSM 850 and GSM
900 bands. Default value is 60 and lower limit is 40. Upper limit is the maximum
GSM ARFCN number available for the specific product.
• <DCSPCSSearchLim>: setting the ARFCN number search limit for DCS 1800 and
PCS 1900 bands. Default value is 80 and lower limit is 60. Upper limit is the
maximum DCS/PCS ARFCN number available for the specific product.

Note: On 3G and 4G modules (Platform ID 12 - 20 – 25 - 30 – 37) the command is

not required even if they support 2G fallback. The channel list is decoded using the
maximum number of ARFCN channels available.

6.3 UTRAN Frequency scan and cell selection

The UE shall scan all RF channels in the UTRA bands according to its capabilities to find
available PLMNs. On each carrier, the UE shall search for the strongest cell and read its
system information, in order to find out which PLMN the cell belongs to. If the UE can read
one or several PLMN identities in the strongest cell, each found PLMN (see the PLMN
reading in [5]) shall be reported to the NAS as a high quality PLMN (but without the RSCP
value), provided that the following high quality criterion is fulfilled:

• For an FDD cell, the measured primary CPICH RSCP value shall be greater than or
equal to -95 dBm
• For a TDD cell, the measured P-CCPCH RSCP shall be greater than or equal to -84
dBm.

80000NT11696A Rev 4 Page 19 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

Found PLMNs that do not satisfy the high quality criterion, but for which the UE has been
able to read the PLMN identities are reported to the NAS together with the CPICH RSCP
value for UTRA FDD cells and P-CCPCH RSCP for UTRA TDD cells.
The quality measure reported by the UE to NAS shall be the same for each PLMN found
in one cell. The search for PLMNs on the rest of the carriers may be stopped on request
of the NAS. The UE may optimise this search by using stored information of carrier
frequencies and optionally also information on cell parameters, e.g. scrambling codes,
from previously received measurement control information elements.
Once the UE has selected a PLMN, the cell selection procedure shall be performed in
order to select a suitable cell of that PLMN to camp on.
Different types of measurements are used in different RATs and modes for the cell
selection and reselection. The performance requirements for the measurements are
specified in 3GPP TS 25.133 [4] and 3GPP TS 34.123.

For UTRAN:
• 3GPP TS 25.304 [6]
Chapter 5.2 ‘Cell selection and reselection in idle mode’
• 3GPP TS 25.133 [4]
Chapter 4.2 ‘Cell Re-selection’

6.4 EUTRAN Frequency scan and cell selection

The UE shall scan all RF channels in the E-UTRA bands according to its capabilities to find
available PLMNs. On each carrier, the UE shall search for the strongest cell and read its
system information, in order to find out which PLMN(s) the cell belongs to. If the UE can
read one or several PLMN identities in the strongest cell, each found PLMN (see the PLMN
reading in [8]) shall be reported to the NAS as a high quality PLMN (but without the RSRP
value), provided that the following high quality criterion is fulfilled:

• For an E-UTRAN cell, the measured RSRP value shall be greater than or equal to -
110 dBm.

Found PLMNs that do not satisfy the high quality criterion, but for which the UE has been
able to read the PLMN identities are reported to the NAS together with the RSRP value.
The quality measure reported by the UE to NAS shall be the same for each PLMN found
in one cell. The search for PLMNs may be stopped on request of the NAS. The UE may
optimise PLMN search by using stored information e.g. carrier frequencies and optionally
also information on cell parameters from previously received measurement control
information elements. Once the UE has selected a PLMN, the cell selection procedure
shall be performed in order to select a suitable cell of that PLMN to camp on.

80000NT11696A Rev 4 Page 20 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

UE shall perform measurements for cell selection and reselection purposes as specified
in 3GPP TS 36.133 [7]

For E-UTRAN (cat.M or higher, NB-IoT):

• 3GPP TS 36.304 [9]
Chapter 5.2 Cell selection and reselection

The Radio Access Technology (RAT) to operate can be configured with AT+WS46.

6.5 EUTRAN Cat.M and NB-IoT selection (Platform ID 30 – 37 -

43)

The dual-mode Cat M1/NB1/NB2 modules offer the possibility to work on enhanced
machine-type communication (eMTC) and Narrowband IoT (NB-IoT) technologies.

In order to optimize network registration time, related AT commands can be used to set
the IoT searching sequence, RAT(s) to be searched, PLMN under LTE RAT, and preferred
bands.

AT#WS46=<LTE_technology>,<2G_priority>

The device is configured as one of (0) M1 only, (1) NB1/NB2 only, (2) M1 preferred, or (3)
NB1/NB2 preferred device.
<2G_priority> is available from FW version 30.01.xx0 & 37.00.xx4 and it allows to set 2G
has preferred.

To limit the scan time specific bands can be enabled with AT#BND and AT#IOTBND
commands.

Note: Specially on WW variants, it could be required to limit the bands used on a

specific region (NA, LATAM, EMEA, APAC) because of the high numbers of band
supported by the module.

At power up, during very first registration (module/SIM system never registered before on
a specific country) the device does a full scan over the applicable RF bands for the
preferred system (AT#WS46) and, if unavailable, for the other systems.

80000NT11696A Rev 4 Page 21 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

Full scan can take several tens of minutes depending on number of RAT(s) and bands
enabled (up to 210 seconds to scan a single NB-IoT band with AT#SNRSET=2).
To keep first registration time short it could be required to limit the number of RAT(s) and
bands used by the device or choose a PLMN in manual selection.
If the device camps on HPLMN in the non-preferred system, it will perform periodic
searches for the priority system in the foreground every 60 minutes (IRAT timer). Telit
developed a dedicated command to customize the IRAT timer:
AT#IRATTIMER (available from 30.00.xx9 and 37.00.xx2).

The IRAT timer doesn’t run if the device camps on VLPMN. In that case it will start a new
scan, when the module goes in OOS (out-of-service) or when the HPLMN search timer
present in the SIM expires.

When OOS in the camped RAT/system, the device will move to the next combination i.e.
RPLMN with the next RAT, depending on the preferred RAT order. If the RPLMN is not
found in any technology the module will perform a full scan searching for any available
PLMN in the preferred RAT and different bands before switching to another RAT.

Warning: After a network detach (e.g. shutdown) the last RAT and last PLMN
(RPLMN) are saved in NV parameter in the module. At next power on, the module
will search for last RAT/RPLMN used, even if not preferred. This implementation
allows to keep the registration time as short as possible.

Warning: There is no idle or connect state mobility across M1 and NB1 systems.
(i.e. Inter-RAT mobility, not supported.)

Warning: Only in Platform ID 37, when AT#WS46 <LTE technology> is changed

before a power cycle, the RAT selection will not follow the last RAT order, but the
preferred RAT order.

To change the SNR level used when scanning the NB-IoT network, the following command
can be used:
AT#SNRSET (available from 30.00.xx9 and 37.00.xx2).

It sets a specifc NV item “snr_level_scan_scope” in the module:

• 1: UE tries SNR level 0 band scan (about 30s per active band - fastest scan time –
lower coverage, SNR value > 0 dB);

80000NT11696A Rev 4 Page 22 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

• 2: UE tries SNR level 0 and level 1 band scan (up to seven times of the time under
SNR level 0 per active band – default – medium coverage, SNR value ranges from 0
to -9 dB);
• 3: UE tries SNR level 0, level 1, and level 2 band scan (up to twenty times of the
time under SNR level 0 per active band - slowest scan time – highest coverage,
typical SNR value is about -12 dB).

6.6 CS/PS Mode of Operation for EPS (Platform ID 20 – 25 – 30 –

37 – 39 - 43 - 44)
The CS/PS mode of operation defined by AT+CEMODE sets the operation mode of the UE
and the way it attach to a network. (refer to par.4).
CEMODE=0 : PS mode 2 of operation. The UE registers only to EPS services, and UE's
usage setting is "data centric". A module set to "Data centric" does not disable the E-
UTRAN capability if voice services cannot be obtained. Voice Domain Preference for E-
UTRAN is "IMS PS voice only", UE is configured to prefer SMS over IP networks.

CEMODE=1 : CS/PS mode1 of operation. The UE registers to both EPS and non-EPS
services, and the UE's usage setting is "voice centric". It means that it shall always try to
ensure Voice service.
A CSFB and an IMS/CS-voice capable UE set to "Voice centric" unable to obtain voice
service in E-UTRAN (e.g. CSFB and IMS voice are not supported or the configured
preferences on how to handle voice services prevent usage of any available voice services),
shall disable the E-UTRAN capability, which results in re-selecting GERAN or UTRAN.
Without 2G/3G fallback, a module that is no VoLTE capable could be not able to attach to
any network.

CEMODE=2 : CS/PS mode 2 of operation. The UE registers to both EPS and non-EPS
services, and the UE's usage setting is "data centric". A module set to "Data centric" does
not disable the E-UTRAN capability if voice services cannot be obtained. Upon receiving
combined EPS/IMSI attach accept or combined TA/LA Update accept with "SMS-only"
indication, a data centric UE stays in the current RAT and is not allowed to use CSFB. Upon
receiving combined EPS/IMSI attach accept or combined TA/LA Update accept with "CSFB
Not Preferred" indication , a data centric UE stays in the current RAT and is allowed to use
CSFB for voice service.

CEMODE=3 : PS mode 1 of operations. The UE registers only to EPS services, and UE's
usage setting is "voice centric". It means that it shall always try to ensure Voice service.
Voice Domain Preference for E-UTRAN is "IMS PS voice only", UE is configured to prefer
SMS over IP networks.

80000NT11696A Rev 4 Page 23 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

In general:
• A UE set to "Data centric" does not disable the E-UTRAN capability if voice services
cannot be obtained. Upon receiving combined EPS/IMSI attach accept or combined
TA/LA Update accept with "SMS-only" indication, a data centric UE stays in the
current RAT and is not allowed to use CSFB. Upon receiving combined EPS/IMSI
attach accept or combined TA/LA Update accept with "CSFB Not Preferred"
indication, a data centric UE stays in the current RAT and is allowed to use CSFB.
• A UE set to "Voice centric" shall always try to ensure that Voice service is possible. A
CSFB and an IMS/CS-voice capable UE set to "Voice centric" unable to obtain voice
service in E-UTRAN (e.g. CSFB and IMS voice are not supported or the configured
preferences on how to handle voice services prevent usage of any available voice
services), shall disable the E-UTRAN capability, which results in re-selecting GERAN
or UTRAN. The E-UTRAN capability is re-enabled by the UE under the conditions
described in 3GPP TS24.301 [11]

80000NT11696A Rev 4 Page 24 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

Attach request: AT+CEMODE vs AT+CEVDP (not for NB-IoT)

CEVDP: 1 CEVDP: 2 CEVDP: 3 CEVDP: 4

CEMODE: 0 EPS attach. EPS attach. EPS attach. EPS attach.

PS mode 2 Data centric Data centric Data centric Data centric
CS voice only CS voice preferred. IMS PS voice IMS PS Voice only
preferred
IMS PS Voice as
secondary CS Voice as
secondary.

CEMODE: 1 combined combined combined combined

EPS/IMSI attach EPS/IMSI attach. EPS/IMSI attach. EPS/IMSI attach.
CS/PS mode 1
Voice centric. Voice centric. Voice centric. Voice centric.
CS voice only CS voice preferred, IMS PS voice IMS PS Voice only
preferred,
IMS PS Voice as
secondary CS Voice as
secondary

CEMODE: 2 combined combined combined combined

EPS/IMSI attach. EPS/IMSI attach. EPS/IMSI attach. EPS/IMSI attach.
CS/PS mode 2
Data centric. Data centric. Data centric. Data centric.
CS voice only CS voice preferred, IMS PS voice IMS PS Voice only
preferred,
IMS PS Voice as
secondary CS Voice as
secondary

CEMODE: 3 EPS attach. EPS attach. EPS attach. EPS attach.

PS mode 1 Voice centric. Voice centric. Voice centric. Voice centric.
CS voice only CS voice preferred, IMS PS voice IMS PS Voice only
preferred,
IMS PS Voice as
secondary CS Voice as
secondary

80000NT11696A Rev 4 Page 25 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

6.7 Network Reject Causes

The network registration process (location update, attach) and PDP activation can fail for
different reasons.
The registration response message may provide an indication of whether the roaming
network accepted or rejected the registration request message from the UE. In some
examples, the registration response message may provide one or more cause indications,
which may signal reasons for the acceptance or rejection of the UE’s registration request.
A cause indication may be a permanent reject cause, which may have adverse effects for
the UE, such as providing limited service for the UE or forcing a universal subscriber
identity module (USIM) as invalid. In addition, the permanent reject cause may trigger the
UE to operate in a lower RAT (e.g., operate in 3G versus 4G).
AT#CEER execution command causes the TA to return a numeric code which offers the
user of the TA a report of the reason for:
• the last unsuccessful PS attach or unsuccessful PDP context activation;
• the last PS detach or PDP context deactivation.
Those reject causes are defined and described in the 3GPP TS 24.008 [10]

AT#CEERNET execution command causes the TA to return a numeric code which should
offer the user of the TA a report for the last mobility management (MMGMM/EMM) or
session management (SM/ESM) procedure not accepted by the network.
Additional info:
• The following error codes are valid for mobility management (MM/GMM) or session
management (SM), i.e. for 2G and 3G networks.
• In 4G network the <code>s meanings are included in tables 9.9.4.4.1 (for ESM
causes) and 9.9.3.9.1 (for EMM cause) of 3GPP TS 24.301 Release 9.

AT#CEERNETEXT enables/disables the URC presentation and gets the last reject error
information from the network including the AcT and PLMN (MCC/MNC)

Telit recommends that the host controlling the modem defines the proper retry/reboot
scheme for reject causes 2, 7, 11, 14, 30, 33, 34, 38.

80000NT11696A Rev 4 Page 26 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

7 PDP Context activation and deactivation

PDP activation and deactivation timeouts are defined by 3GPP 24.008 [10] and they
involves 2 NW timers.

When an application tries to active a PDP context (e.g. AT#SGACT=1,1) module sends an
“ACTIVATE PDP CONTEXT REQUEST” and network timer T3380 (30s) is started waiting for
a PDP CONTEXT ACCEPT or REJECT.
In case of no network response this procedure is repeated 4 times, i.e. on the 5th expiry
of timer T3380 the module will release all resources allocated and abort the procedure.
Total timeout is 5 x 30s = 150s

In case of PDP deactivation (e.g. AT#SGACT=1,0), module sends a “DEACTIVATE PDP

CONTEXT REQUEST” and network timer T3390 (8s) is started waiting for a DEACTIVATE
PDP CONTEXT ACCEPT.
This procedure is repeated 4 times, i.e. on the 5th expiry of timer T3390 the module will
release all resources allocated and erase the PDP context data.
Total timeout is 5 x 8s = 40s

In 4G the initial default bearer is activated during the EPS attach procedure on cid1 (refer
to AT+CGDCONT). In this case AT#SGACT=1,1 doesn’t activate a new PDP, but it routes the
data traffic to the default bearer.

Note: PDP deactivation is performed in backgroud after the OK. Check AT#SGACT?
to verify the status, before a new activation of the same CID.

Note: In case PDP activation on CIDx is failing, while USB port is connected to an
external device/PC running Windows or Linux O.S., verify that WWAN port is not
enabled, taking control of that specific PDP context.

80000NT11696A Rev 4 Page 27 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

8 Acronyms and Abbreviations

Table 2: Acronyms and Abbreviations
Acronym Definition
3GPP Third Generation Partnership Project
AID Application Identifier
APDU Application Protocol Data Unit
BCCH Broadcast Control Channel
C1 Path loss criterion parameter
CCPCH Common Control Physical Channel
CID Context Identifier
CPBCCH Compact Packet Broadcast Control Channel
CPICH Common Pilot Channel
DCS Digital Cellular System
EF Elementary File (SIM/USIM)
EHPLMN Equivalent Home Public Land Mobile Network
EUTRAN Evolved UMTS Terrestrial Radio Access Network
FDD Frequency Division Duplex
FPLMN Forbidden Public Land Mobile Network
GERAN GSM EDGE Radio Access Network
GSM Global System Mobile
HPLMN Home Public Land Mobile Network
LOCI LOCation Information
LRPLMN Last Registered Public Land Mobile Network
LTE Long Term Evolution
MCC Mobile Country Code
MNC Mobile Network Code
MS Mobile Station
NAS Non-Access Stratum
NB Narrow Band
PCS Personal Communications Service
PDP Packet Data Protocol
PLMN Public Land Mobile Network
RAT Radio Access Technology
RF Radio Frequency
RSCP Received Signal Code Power
RSRP Reference Signal Received Power
SNR Signal to Noise Ratio
TDD Time Division Duplex
UE User Equipment
UMTS Universal Mobile Telecommunication System
USB Universal Serial Bus
(U)SIM Universal Subscriber Identity Module
UTRA UMTS Terrestrial Radio Access

80000NT11696A Rev 4 Page 28 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

Acronym Definition
UTRAN UMTS Terrestrial Radio Access Network
VPLMN Visited Public Land Mobile Network
VSIM Virtual Subscriber Identity Module
WWAN Wireless Wide Area Network

80000NT11696A Rev 4 Page 29 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

9 Related Documents
Referenced documents in this Application Note
Table 3: Referenced Documents
Ref. Code Document Title
[1] 3GPP TS 23.122 Non-Access-Stratum (NAS) functions related to Mobile Station
(MS) in idle mode
[2] 3GPP TS 43.022 Functions related to Mobile Station (MS) in idle mode and group
receive mode
[3] 3GPP TS 45.008 Radio subsystem link control
[4] 3GPP TS 25.133 Requirements for support of radio resource management (FDD)
[5] 3GPP TS 25.331 Radio Resource Control (RRC); protocol specification
[6] 3GPP TS 25.304 User Equipment (UE) procedures in idle mode and procedures
for cell reselection in connected mode
[7] 3GPP TS 36.133 Requirements for support of radio resource management
[8] 3GPP TS 36.331 E-UTRA; Radio Resource Control (RRC) - Protocol Specification
[9] 3GPP TS 36.304 Evolved Universal Terrestrial Radio Access (E-UTRA); User
Equipment (UE) procedures in idle mode
[10] 3GPP TS 24.008 Mobile Radio Interface Layer 3 specification, Core Network
Protocols - Stage 3
[11] 3GPP TS 24.301 Non-Access-Stratum (NAS) protocol for Evolved Packet System
(EPS); Stage 3
[12] ETSI TS 102 221 Smart Cards; UICC-Terminal interface; Physical and logical
characteristics
[13] ETSI TS 101 220 Smart Cards; ETSI numbering system for telecommunication
application providers

80000NT11696A Rev 4 Page 30 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

Refer to https://dz.telit.com/ for current documentation and downloads.

Table 4: Telit Related Documents
Document Code Document Title
80446ST10707A LE910 V2 SERIES AT Commands Reference Guide
80378ST10091A HE910/UE910/UL865/UE866 AT Commands Reference Guide
80529ST10815A ME910C1/NE910C1/ML865C1 AT Commands Reference Guide
80000ST10025A 2G AT Commands Reference Guide
80502ST10950A LE910C1 AT Commands Reference Guide
80617ST10991A ME310G1/ME910G1/ML865G1 AT Commands Reference Guide
1VV0301611 NE310H2 NL865H2 AT Commands Reference Guide
80585ST10926A GL865-QUAD V4 AT Commands Reference Guide
80598ST10945A GE310-GNSS AT Commands Reference Guide
80000ST10028A Telit IP Easy User Guide
1VV0300784 Modules Software User Guide 2G 3G 4G

80000NT11696A Rev 4 Page 31 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

10 Document History

Table 5: Document History

Revision Date Changes
4 2023-09-26 New document template
Updated Applicability Table
Added NOTES on paragraph 4 and 5 flow charts
Updated paragraph 6.1: AT+CSIM example
Updated paragraph 6.5: RAT and PLMN selection
Added AT+CEMODE vs AT+CEVDP table on paragraph 6.6
Updated pagragraph 9 Related documents
3 2021-09-07 Modified paragraphs 3 and 4 flow charts and update notes
Updated paragraph 5.5
2 2021-01-26 Modified paragraphs 3 and 4 flow charts
Updated legend on paragraphs 4.1
Added new paragraphs 5.1.1, 5.2, 5.3, 5.4, 5.5, 6, 7, 8, 9 and
10
1 2018-0618 Added new method to delete EF_LOCI in 5.1.2
New paragraphs 5.1.2, 5.1.4, 5.1.5, 5.2
0 2018-06-03 First issue
From Mod.0818 Rev.11

80000NT11696A Rev 4 Page 32 of 33 2023-09-26

 2G 3G 4G Registration Process
Application Note

© Telit 2023 All rights reserved.

Technical Documentation
80000NT11696A Rev 4 Page 33 of 33 2023-09-26