LTE/NR 中的常见timer【原创】

目录

1.背景

2.总结结论

2.1 正常类控制timer

2.2 异常类控制timer

3. timer详细解释

T3410/T3510

T3412（TAU周期定时器）

T3411（attach/tau被拒后尝试重新接入时间）+T3402（attach/tau5次被拒禁一段时间）

T3247

T3245

---

1.背景

        实网分析终端被拒等问题，经常遇到各类cause，其会对应不同的终端限制行为，起相应的不同timer block住attach/TAU/RAU等行为。查找已有资料后理解没有很深，自行总结本文用于梳理现象，如有错误敬请指正，原创不易，转载请注明出处。

        本文用于记录协议Ts 24.301及Ts 24.501中的timer及其对应行为。

---

2.总结结论

2.1 正常类控制timer

• T3410：从attach req到attach accept/reject的时间
• T3510：从attach accept到attach complete的时间
• T3412：进入idle态后周期更新TAU的时间

2.2 异常类控制timer

按严厉程度排序

• T3245：卡片被置为无效卡类
  • 触发条件：
  • "forbidden PLMN list"=#11/#35 + "forbidden PLMNs for attach in S101 mode" + "forbidden PLMNs for GPRS service"=#14
  • 或卡片置为ps域/cs域/cs+ps域 invalid sim
  • 时间级别：12~24hrs
• T3247：无完整性保护被拒类
  • 触发条件：
  • #3, #6, #7, #8, #11, #12, #13, #14, #15, #31 or #35被拒，且无完整性保护
  • 时间级别：30~60mins
• T3411/T3402：attach失败类
  • 触发条件：
  • attach除了如下cause的其他cause：#3/#6/#8/#7/#11/#35/#12~15/#22/#25/#42/#31
  • TAU除了如下cause的其他cause：#3/#6/#8/#7/#11/#35/#12~15/#22/#25/#42/#31/#9/#10/#40（多3个）
  • attach成功，但是收到cause是#16/17
  • 时间级别：5次以内对应T3411=10s，5次后对应T3402=12mins

---

3. timer详细解释

T3410/T3510

协议原文：

In state EMM-DEREGISTERED, the UE initiates the attach procedure by sending an ATTACH REQUEST message to the MME, starting timer T3410 and entering state EMM-REGISTERED-INITIATED.

Upon receiving the ATTACH ACCEPT message, the UE shall stop timer T3410.

Upon receipt of the GUTI REALLOCATION COMPLETE message, the MME shall stop the timer T3450 and consider the new GUTI as valid and the old GUTI as invalid

---

T3412（TAU周期定时器）

• start条件：网络发给UE（ATTACH accept/TAU accept）
  • 进入连接态->重置
  • 进入idle态->重新开始

协议原文：24.301 CH 5.3.5

Timer T3412 is reset and started with its initial value, when the UE changes from EMM-CONNECTED to EMM-IDLE mode. Timer T3412 is stopped when the UE enters EMM-CONNECTED mode or the EMM-DEREGISTERED state.

->进入连接态重置，退出连接态再计时

---

T3411（attach/tau被拒后尝试重新接入时间）+T3402（attach/tau5次被拒禁一段时间）

T3411

• 触发条件：attach/TAU超时(T3410超时) 或 attach/TAU reject，用于下一次重发attach/TAU req的间隔，一般为10s
  • -attach除了如下cause的其他cause：#3/#6/#8/#7/#11/#35/#12~15/#22/#25/#42/#31，如#19
  • -TAU除了如下cause的其他cause：#3/#6/#8/#7/#11/#35/#12~15/#22/#25/#42/#31/#9/#10/#40（多3个）
  • -attach成功，但是收到cause是#16/17，timer按照失败处理
• 触发动作：仅当接入次数<5次，禁10s再接入

T3402

• 触发条件：attach/TAU reject = 5次
  • -attach除了如下cause的其他cause：#3/#6/#8/#7/#11/#35/#12~15/#22/#25/#42/#31
  • -TAU除了如下cause的其他cause：#3/#6/#8/#7/#11/#35/#12~15/#22/#25/#42/#31/#9/#10/#40（多3个）
  • -attach成功，但是#16/#17，timer按照失败处理
  • -attach成功，但收到#22，不论T3411/3410状态，直接起T3402
• 触发动作：接入次数到5次，禁12mins再接入

相关协议原文：

T3411触发条件：

At attach failure due to lower layer failure, T3410 timeout or attach rejected with other EMM cause values than those treated in subclause 5.5.1.2.5.

At tracking area updating failure due to lower layer failure, T3430 timeout or TAU rejected with other EMM cause values than those treated in subclause 5.5.3.2.5

5.5.1.2.5：The UE shall take the following actions depending on the EMM cause value received in the ATTACH REJECT message.

#3/#6/#8/#7/#11/#35/#12~15/#22/#25/#42/#31

触发动作：

ATTACH ACCEPT and the attempt counter is less than 5 as described in subclause 5.5.1.2.4A and 5.5.1.2.6A.

TRACKING AREA UPDATE ACCEPT and the attempt counter is less than 5 as described in subclause 5.5.3.2.4A and 5.5.3.2.6A.

5.5.1.2.4A：

If the tracking area updating attempt counter is less than 5:

- the UE shall start timer T3411, shall set the EPS update status to EU1 UPDATED and shall enter state EMM-REGISTERED.NORMAL-SERVICE. When timer T3411 expires the normal tracking area updating procedure for EPS services and "SMS only" or the combined tracking area updating procedure for EPS services and "SMS only" is triggered.

If the tracking area updating attempt counter is equal to 5:

- the UE shall start timer T3402, shall set the EPS update status to EU1 UPDATED and shall enter state EMM-REGISTERED.NORMAL-SERVICE. When timer T3402 expires the normal tracking area updating procedure for EPS services and "SMS only" or the combined tracking area updating procedure for EPS services and "SMS only" is triggered.

T3402触发条件：

多了一句：

ATTACH ACCEPT with EMM cause #16 or #17 and the attempt counter is equal to 5 for CS/PS mode 2 UE, or ATTACH ACCEPT with EMM cause #22, as described in subclause 5.5.1.3.4.3

5.5.1.3.4.3：

#22 (Congestion)

The UE shall stop the timer T3410 if still running. The tracking area updating attempt counter shall be set to 5. The UE shall start the timer T3402

目的：

定时器T3402和T3411为防止终端持续接入异常网络的时间。类似梯度放大机制。

当前5次attach/TAU失败，每次给终端10s复活时间；当5次尝试次数满足后，拉大惩罚时间至12mins。

从实际含义上来讲，一方面T3402+T3411保证了网络接入的最小容忍时间，另一方面该timer保证了终端位置区更新的定期更新周期。

T3402和T3411两个定时器时长由网络参数设置，并通过TAU response和Attach Accept消息发送给UE。

注：关于T3411额外注意

it would be important not to send RRC Connection Release before T3411 expires.

来自 https://www.sharetechnote.com/html/Handbook_LTE_T3411_T3402.html>

解释：正常的顺序是attach/tau要在RRCrelease之前做完，如果配置搞错导致attach还没有complete就先release了会有报错

---

T3247

• 输入：UE被LTE以cause#3, #6, #7, #8, #11, #12, #13, #14, #15, #31 or #35被拒，attach过程中完整性保护都不做，或者鉴权被拒，鉴权过程没有完整性保护
• 输入：UE被NR以#3, #6, #7, #11, #12, #13, #15, #27, #31, #62, #72 or #73被拒，且不做完整性保护
• 输出：T3247起，禁当前TA 30~60mins
• 输出：针对#12/#13/#15，还可以继续搜LTE/NR（因为其他TA没有被禁）
• 超时行为：删掉所有被禁的TA list（of "forbidden tracking areas for regional provision of service and of "forbidden tracking areas for roaming"）

协议原文：

24.301 5.3.7b

If the UE receives an ATTACH REJECT, TRACKING AREA UPDATE REJECT or SERVICE REJECT message without integrity protection with EMM cause value #3, #6, #7, #8, #11, #12, #13, #14, #15, #31 or #35 before the network has established secure exchange of NAS messages for the NAS signalling connection, the UE shall start timer T3247 (see 3GPP TS 24.008 [13]) with a random value uniformly drawn from the range between 30 minutes and 60 minutes

2) if the EMM cause value received is #12, #13 or #15, the UE shall additionally proceed as specified in subclauses 5.5.1, 5.5.3 and 5.6.1;

24.301 5.4.2.5

Upon receipt of an AUTHENTICATION REJECT message,

b) if the message is received without integrity protection, the UE shall start timer T3247 (see 3GPP TS 24.008 [13]) with a random value uniformly drawn from the range between 30 minutes and 60 minutes

->对应的含义为：如果是#12/#13/#15，还是有机会搜其他TA，禁只禁当前TA

- otherwise, the UE shall search for a suitable cell in another tracking area or in another location area according to 3GPP TS 36.304

Upon expiry of timer T3247, the UE shall

- remove all tracking areas from the list of "forbidden tracking areas for regional provision of service" and the list of "forbidden tracking areas for roaming",

---

T3245

• 输入
  • "forbidden PLMN list"=#11/#35 + "forbidden PLMNs for attach in S101 mode" + "forbidden PLMNs for GPRS service"=#14
  • ps域/cs域/cs+ps域卡片置为invalid sim
• 输出：起T3245（12~24hrs）

协议原文：

When the UE adds a PLMN identity to the "forbidden PLMN list", the "forbidden PLMNs for attach in S101 mode" list, or the "forbidden PLMNs for GPRS service" list or sets the USIM as invalid for non-EPS services or EPS services or both, and timer T3245 (see 3GPP TS 24.008 [13]) is not running, the UE shall start timer T3245

---

---