EMM timers decide how long the UE waits for an answer from the MME, and what the UE does when the MME does not answer. They also decide how often an idle UE performs a periodic tracking area update. So when a UE repeats an attach every 10 seconds, or stops all attempts for 12 minutes, one of these timers is the reason.

I'll start with the UE side table from 24.301, and then explain how to read it, which values the network can change, and what later releases have added. The network side timers are on a separate page, Timer - EPS Mobility Management - NW Side.

• EMM Timers on the UE Side
• How to read the timer table ?
• Which timer values does the network set for the UE ?
• What has changed in later releases ?
• Reference

EMM Timers on the UE Side

Let's look at the table itself first. Each row is one timer, and the columns follow the life of that timer. They give the EMM state it runs in, the event that starts it, the event that stops it, and the action the UE takes on expiry.

Following table comes from 24.301 - 10.2 Timers of EPS mobility management (Table 10.2.1: EPS mobility management timers – UE side)

Four of the timer names in the first column link to pages of their own: T3402, T3410, T3411 and T3418. Those pages go through the procedure around each timer in more detail. The NOTE rows at the bottom of the table belong to the TIMER VALUE column. The section on network controlled timer values explains them.

• Each timer runs only in the EMM states of its STATE column : for example, T3410 runs only in EMM-REGISTERED-INITIATED, that is, while an attach is in progress.
• The start event is almost always a message the UE sends : the normal stop event is the answer the UE expects from the MME.
• The ON EXPIRY column is where the UE behaviour changes : check it first when a log shows a retransmission or an aborted procedure.

How to read the timer table ?

The table is dense, and it is easier to read once the timers are sorted by the job they do. Most of them fall into five groups, and each group answers a different question about the UE.

The first group supervises a request from the UE. T3410 runs after ATTACH REQUEST, T3430 after TRACKING AREA UPDATE REQUEST, T3421 after DETACH REQUEST, and T3417 after SERVICE REQUEST. Each one starts when the UE sends the request and stops when the MME answers. On expiry, the UE retransmits DETACH REQUEST, aborts the service request, or counts an attach or TAU failure.

The second group decides when to try again. The UE keeps an attempt counter for attach and for TAU. While the counter is below 5, a failure starts T3411, and the UE retries after 10 seconds. When the counter reaches 5, the UE starts T3402 instead, and waits 12 minutes by default. This is why a UE that fails five attaches in a row often looks silent for a long time in a log.

The third group is periodic. T3412 starts when the UE leaves EMM-CONNECTED mode, and its expiry triggers a periodic TAU. T3423 is its partner for ISR. It starts when T3412 expires while ISR is activated and the UE cannot perform the TAU, for example in EMM-REGISTERED.NO-CELL-AVAILABLE. On expiry of T3423, the UE sets TIN to "P-TMSI".

The fourth group protects authentication. T3416 limits how long the UE keeps a stored RAND and RES. T3418 and T3420 start when the UE sends AUTHENTICATION FAILURE, and on their first expiry the UE considers the network as false.

The fifth group handles the end of a connection and CS fallback. T3440 gives the network time to release the signalling connection after a reject or a TAU without the "active" flag. T3417ext supervises EXTENDED SERVICE REQUEST for CS fallback. T3442 starts on SERVICE REJECT with cause #39. While it runs, the UE does not send another EXTENDED SERVICE REQUEST for mobile originating CS fallback, except for an emergency call.

• A short timer usually guards a single message : T3410, T3417, T3421 and T3430 are 15 seconds or less, because each one waits for one answer.
• A long timer usually controls the load on the network : T3402 and T3412 run for minutes, because they decide how often a UE may signal at all.
• T3411 and T3402 share one attempt counter : the counter value tells you which one the UE starts after a failure.
• T3442 blocks only mobile originating CS fallback : an emergency call and a TRACKING AREA UPDATE REQUEST are still allowed while it runs.

Which timer values does the network set for the UE ?

Several rows show NOTE instead of a number in the TIMER VALUE column. Those notes mean that the MME can replace the default value, or that the timer has no default value at all. So before comparing a log with the table, check which value the network actually sent.

The values travel in NAS messages as a GPRS timer IE. ATTACH REJECT uses the GPRS timer 2 format, which carries the same value octet with a length field in front of it. The table below lists where each network controlled value comes from, based on 24.301 v20.0.0.

The GPRS timer IE is one octet of value. Bits 8 to 6 give the unit, and bits 5 to 1 give a binary value from 0 to 31. The unit is 2 seconds for 000, 1 minute for 001 and decihours, that is 6 minutes, for 010. The code 111 means that the timer is deactivated.

Let's decode two common values. The default T3412 of 54 minutes is 9 decihours, so the octet is unit 010 and value 01001, which is 0x49. The default T3402 of 12 minutes is unit 001 and value 01100, which is 0x2C. When 31 decihours is not long enough, the MME adds the T3412 extended value IE, which uses the GPRS timer 3 format and a longer unit.

The page Timer & Constants and RRC/NAS Message puts these NAS timers next to the RRC timers that come from SIB2.

• T3412 is always set by the network : ATTACH ACCEPT must carry it, so the UE uses the 54 minute default only in the case of NOTE 5.
• T3402 and T3423 fall back to a default : without a value from the network, T3402 uses 12 minutes and T3423 copies T3412.
• T3442 has no default at all : the UE starts it only when SERVICE REJECT with cause #39 carries a non-zero value.
• A deactivated T3412 means no periodic TAU : the unit code 111 switches the timer off rather than setting it to zero.

What has changed in later releases ?

The table above matches an early release of 24.301. It is a good starting point, but it is not the full list any more. 24.301 v20.0.0, Release 20, keeps every timer shown above and adds several new ones.

Some existing rows have changed first. Most supervision timers now have a second value, written in the table as WB-S1/CE mode. It applies in WB-S1 mode when the UE supports CE mode B, and in some satellite access types. In NB-S1 mode, the timer value is calculated as described in clause 4.7 of 24.301. The table below compares the two values for the timers shown on this page.

Four more differences are worth knowing when you compare the table with a current log or a current specification. The first is that T3417ext now covers only case d of clause 5.6.1.1. Case e, the mobile terminating CS fallback with "CS fallback accepted by the UE", uses a new timer T3417ext-mt of 4 seconds. The second is that EMM cause #39 is now named "CS service temporarily not available", and T3442 starts only when its value is not zero. The third is that T3416 now starts on RAND and RES stored from an EPS authentication challenge, where the table says UMTS. The fourth is that T3440 now starts in EMM-DEREGISTERED as well, and for many more EMM cause values.

The new timers are listed below. Each one belongs to a feature added after Release 9, so a UE that does not support the feature never starts it.

24.301 also uses T3324, T3346, T3245 and T3247, but defines none of them in this table. Those four timers are defined in 24.008.

• The timer names above are still valid : a current UE uses the same T3410, T3411, T3402 and T3412, so the table is still the right place to start.
• CE mode and satellite access lengthen the supervision timers : T3410 grows from 15 to 85 seconds, because repetitions make one exchange much slower.
• A timer missing from the table usually belongs to a newer feature : for example eCall only mode, service gap control or S&F satellite operation.
• Check the release before you treat a log as wrong : a recent UE correctly uses T3417ext-mt and the new cause #39 name, although the table does not show them.

Reference

• 3GPP TS 24.301 v20.0.0 - clause 10.2, Table 10.2.1, EPS mobility management timers - UE side, and clause 8.2, message contents
• 3GPP TS 24.008 v20.0.0 - clause 10.5.7.3, GPRS Timer, and clause 10.5.7.4a, GPRS Timer 3