PLMN selection — which network to use
A PLMN (Public Land Mobile Network) is identified by a Mobile Country Code (MCC) and Mobile Network Code (MNC). The UE's SIM card contains the home PLMN (HPLMN) and optionally a list of preferred and forbidden PLMNs. SIB1 provides up to 12 PLMNs that this cell serves.
| Priority | Type | Description | Our case |
|---|---|---|---|
| 1st | RPLMN | Last registered PLMN (from NV memory) | 244-05 ← match ✓ |
| 2nd | EPLMN | Equivalent PLMNs (from previous registration) | 244-91 (if stored) |
| 3rd | HPLMN | Home PLMN from IMSI (MCC+MNC on SIM) | 244-05 |
| 4th | User list | PLMNs in user-defined preferred list | — |
| 5th | Any VPLMN | Any available PLMN (roaming) | — |
PLMN matching — our example
// SIB1 PLMN list (from our cell): Entry 1: MCC=244, MNC=05 → 244-05 (Elisa Finland) Entry 2: MCC=244, MNC=91 → 244-91 (Elisa MVNO) // UE SIM card: HPLMN: MCC=244, MNC=05 → 244-05 // Match check: SIB1 entry 1 (244-05) == HPLMN (244-05) → MATCH ✓ // Cell accepted for camping // Roaming example — UE with UK SIM (MCC=234, MNC=30): SIB1 entry 1 (244-05) ≠ HPLMN (234-30) SIB1 entry 2 (244-91) ≠ HPLMN (234-30) → No match → Cell rejected for this UE
Cell barring — MIB and SIB1 checks
Before PLMN matching, the UE already checked cellBarred in the MIB. There are additional access restrictions in SIB1:
Unified Access Control (UAC)
5G NR introduced UAC — a unified barring mechanism that replaces the patchwork of access barring schemes from LTE. UAC allows the network to control access at a fine granularity based on access categories and access identities.
Access categories
Each access attempt is assigned an access category (0–9+) and one or more access identities (0–15). The network broadcasts barring information per category in SIB1.
| Category | Access type | Example |
|---|---|---|
| 0 | Emergency | Emergency calls — never barred |
| 1 | Exception (high priority) | MT-IMS voice, location services |
| 2 | MO-signalling | RRC connection for signalling |
| 3 | MO-data | RRC connection for user data ← our case |
| 4 | MO-IMS registration | VoNR registration |
| 5 | MO-V2X | Vehicle-to-X communication |
| 7 | SMS | SMS over NAS |
UAC barring check procedure
For each access category, the network broadcasts a barring factor p (0 to 1) and a barring time T. The UE draws a random number and compares:
// From SIB1 for access category 3: barringFactor = p95 ← 95% probability of access allowed barringTime = s4 ← 4 seconds if barred // UE draws random number rand ∈ [0, 1): rand = 0.43 // Check: rand = 0.43 < barringFactor = 0.95 → ACCESS ALLOWED ✓ // Barred case (rand = 0.97): rand = 0.97 ≥ barringFactor = 0.95 → ACCESS BARRED → UE starts timer: T_barring = 4 × (0.7 + 0.6×rand2) = ~3.9 seconds → After timer: retry barring check
Camped state — what it means
After passing all checks — S-criterion, PLMN, cell barring, UAC — the UE is camped on the cell. In the camped state:
The UE monitors paging occasions (derived from SFN and IMSI) to detect incoming calls or network-initiated connections. It also checks for a new TAC: our cell's TAC = 500. If this differs from the UE's last registered TAC, the UE must perform a Registration procedure with the AMF before it can receive or make calls.