NRF9160 EMM reject #11 behavior (mfw 1.3.2)

[plotkin1996]

Hi,

I have observed a strange behavior when manually selecting wrong PLMN. I get EMM reject cause 11/PLMN not allowed as expected, but then the modem is stuck in CEREG state 2/trying to register forever, without reporting e. g. registration denied. This also leads to increased power consumption as we are still attached to a base station that doesn't grant PSM.

Background: I am working with implementing fallback/workaround mechanisms for cases when a roaming operator is not granting PSM or the manually selected PLMN is out of coverage. I have been testing if the fallback handles the case when the manually selected PLMN rejects the UE and discovered elevated power consumption. Here is an equivalent command sequence from the at client app:

at+cpsms=1,"1001000",,"00000000"
OK
at%xmodemsleep=1,500,10240O
%XMODEMSLEEP: 4K
at+cnec=24OKat+cereg=5
OK
at+cscon=3
OK
at+cops=1,2,"24202" //Our SIM is from 24201/telenor, I force select telia.
OK
at+cfun=1
%XMODEMSLEEP: 4,0
OK
+CEREG: 2
+CSCON: 1,7,4
+CNEC_EMM: 11 //Reject message comes through
+CEREG: 2,"09C5","020C7B16",7,0,11 //But we are still attached
%MDMEV: SEARCH STATUS 2
+CSCON: 0,7,4 //Modem is stuck in what looks like cDRX until application force a disconnect
at+cereg?
+CEREG: 5,2 //Looks like we are no longer attached to the base station, but I still RX spikes on the power profiler

Granted, the case is a bit artificial (purposefully selecting wrong PLMN), but I'm concerned if this will also trigger if e. g. the SIM card subscription is not yet activated. I'd rather put device offline for a duration than draining the battery in such cases.

So my questions are:

• Why the modem doesn't enter sleep after reject/search status 2 with no attach?
• Does being stuck in CEREG=2 with radio on only happens with manual PLMN select, or is it something I might encounter "in the wild"?
• Is there any documentation for modem state flow? From reading AT command docs I'd expect the modem to end up in CEREG=3 and radio down.

Edit: here is the modem trace:

1055.trace-2022-10-07T13-58-18.553Z.bin

I observed the issue on NCS 2.0.2 (but this is on the modem firmware side).

Edit 2: here are longer logs, with MDEV on, data profile 0 and low-power periodic search configuration.

*** Booting Zephyr OS build v3.0.99-ncs1-1
***The AT host sample started
AT+CFUN?
+CFUN: 0
OK
AT%XDATAPRFL?
%XDATAPRFL: 2
OK
AT%XDATAPRFL=0
OK
AT%MDMEV=1
OK
AT%PERIODICSEARCHCONF=0,0,0,1,"0,10,40,,5","1,300,600,1800,1800,3600"
OK
at+cpsms=1,"1001000",,"00000000"
OK
at%xmodemsleep=1,500,10240
O%XMODEMSLEEP: 4K
AT+CFUN?+CFUN: 0
OK
at+cnec=24
OK
at+cereg=5
OK
at+cscon=3
OK
at+cops=1,2,"24202"
OK
at+cfun=1
%XMODEMSLEEP: 4,0
OK
+CEREG: 2
+CSCON: 1,7,4
+CNEC_EMM: 11+CEREG: 2,"09C5","020C7B16",7,0,11
%MDMEV: SEARCH STATUS 2
+CSCON: 0,7,4
at+cereg?
+CEREG: 5,2OKat
+cfun?+CFUN: 1OK
at+cereg?
+CEREG: 5,2
OK

trace-2022-10-17T10-45-11.014Z.bin

[Øyvind]

Hello, 

I have been assigned your case but will not be able to provide any answers until next week. In the meantime can you please provide what nRF Connect SDK version you are working with, and a modem trace for when the issue occurs.

Thank you!

Kind regards,
Øyvind

[Øyvind]

Hello again, did not see that you had added the modem trace on Friday. How long did you let the modem trace run? To verify, what modem FW are you running on your device?

Anyway, the network gives a reject cause 11 - This EMM cause is sent to the UE if it requests service, or if the network initiates a detach request, in a PLMN where the UE, by subscription or due to operator determined barring, is not allowed to operate. 

CEREG: 2 – Not registered, but UE is currently trying to attach or searching an operator to register to

Thanks. Still looking into the modem trace.

Kind regards,
Øyvind

[Øyvind]

Yes, please provide a longer modem trace. Ensure to reset board after starting modem trace, and have at lest 5-10 minutes after reject.

[Øyvind]

Discussing the issue in our team, you could try to use the following AT commands

Data profile %XDATAPRFL

Modem domain event notification %MDMEV

Periodic cell search configuration %PERIODICSEARCHCONF

[plotkin1996]

Ok, I'll try those with a longer trace and post it here.

[plotkin1996]

Hi again. Sorry, for the delay was sick last week. Have uploaded new the trace. Also I looked into the decoding from Trace Collector V2 and it looks like it's still listening for SIBs after detach.

[Øyvind]

No worries! It's that time of year, as I am also struggling with a cold at the moment.

Will need to forward to our modem team and get back to you. 

Kind regards,
Øyvind

[Øyvind]

By the way, after getting reject, did you try setting AT+COPS back to automatic select? I.e. AT+COPS=0 

[plotkin1996]

Yes, then the behavior is back to normal, but that's not a feasible solution for devices out in the field. I could detect EMM #11 in application firmware and reset AT+COPS from there, but what I wonder about is if there is possibly any other edge cases where such behavior comes up. I. e. I can't rely on CEREG: 2 state being transient.

[Øyvind]

I've discussed the issue with our nRF91 team.

If there's an issue with the subscription, error cause would most likely be 8 (EPS services and non-EPS services not allowed) or 7 (EPS services not allowed). With these causes, UE would indicate +CEREG: 0 and enter deep sleep, until the UICC is replaced or the modem is switched off and on. Cause 11 which was received in this case is more like a sign of a missing roaming agreement between the SIM's home network, and the attempted network.

Basically, there is no need to worry about the "SIM card subscription not yet activated" case, because the network provided error code (and its handling) would be different in that case. 

The main reason for why the devices is stuck in CEREG:2 and not shifting is due to manual selection of PLMN. You should be using automatic PLMN selection.

Is there any documentation for modem state flow? From reading AT command docs I'd expect the modem to end up in CEREG=3 and radio down.

Maybe too technical but there's a mobility management main state transition diagram in https://www.etsi.org/deliver/etsi_ts/124300_124399/124301/14.10.00_60/ts_124301v141000p.pdf , Figure 5.1.3.2.2.7.1: EMM main states in the UE

Hope this provides some answers. 

Kind regards,
Øyvind