Where the device is — camping, moving, and being found

5G Systems Notes · Reference · Mobility Concept map · Device state · Identity · Hub

A device spends nearly all of its life CM-IDLE: registered, reachable, and connected to nothing. This note is what it does in that state — how it chooses a network, how it chooses a cell, how it moves between cells without telling anyone, and how the network finds it again when something arrives.

In one line. Idle mode is built on a single trade — how coarsely the network is allowed to know where you are. Know it precisely and the device must report constantly; know it loosely and every page must be broadcast over a wide area. The TAI list is the dial, and almost every other mechanism here — reselection rules broadcast rather than ordered, paging occasions derived from an identifier, hysteresis and mobility-state scaling — exists to keep both sides of that trade cheap.

Concepts defined here. PLMN selection · Cell selection · Cell reselection · Tracking area · Paging

The concepts this note covers

Each concept has a page of its own. This note is the narrative — the group read as one argument, with the connective tissue that a page-per-concept cannot carry. The pages are the definitions, and each one shows what to learn before it.

Concept	What it is	Needs	Primary clause
Cell reselection	Ranking, priorities and hysteresis — how a camped device moves	1	TS 38.304 §5.2.4
Cell selection	The S criterion — the inequality a device must satisfy to camp	2	TS 38.304 §5.2.3.2
Paging	Waking a device that is not listening, and the ten bits that decide when	3	TS 38.304 §7.1, TS 23.501 §5.9.4
PLMN selection	Choosing a network before choosing a cell	1	TS 23.122 §4
Tracking area	The granularity at which the core knows where you are	1	TS 23.501 §5.3.2.3

Which to read. Come here to see how these ideas hang together; go to a term page when you want one definition, its prerequisites, and everything that depends on it. The concept map indexes all 118, and its hierarchy puts them in learning order.

Network first, then cell

PLMN selection — TS 23.122 §4. The order is the point: cell selection finds the best radio, PLMN selection decides which radios are even eligible. A device camps on the strongest suitable cell of a permitted network, and permission is decided first.

Automatic mode works down a priority order — the HPLMN, then the User Controlled PLMN selector on the USIM, then the Operator Controlled list, then anything else by signal strength. Manual mode presents the list and lets the user choose — and the ordering above is exactly why manual mode has to exist, because the automatic order encodes the operator's preferences.

Forbidden PLMNs are remembered on the USIM after certain rejection causes, so a device in range of a network it may not use stops trying.

What it reads to do any of this: the PLMN identity — MCC and MNC — is broadcast in SIB1, so a device learns a cell's network from system information after acquiring the SSB and PBCH, before any connection exists.

The inequality a cell must satisfy

Cell selection — TS 38.304 §5.2.3.2. One of the few places in this folder where behaviour is fixed by an explicit inequality rather than a procedure.

$$ \begin{align} S_{\text{rxlev}} &= Q_{\text{rxlevmeas}} - \left(Q_{\text{rxlevmin}} + Q_{\text{rxlevminoffset}}\right) - P_{\text{compensation}} - Q_{\text{offsettemp}} \tag{1.1} \\ S_{\text{qual}} &= Q_{\text{qualmeas}} - \left(Q_{\text{qualmin}} + Q_{\text{qualminoffset}}\right) - Q_{\text{offsettemp}} \tag{1.2} \end{align} $$

Equation 1: The cell selection criterion S of TS 38.304 clause 5.2.3.2, which is fulfilled when both quantities are positive. Srxlev is a received power margin and Squal a received quality margin, both in dB. Requiring both rejects a cell that is strong but badly interfered - high RSRP with poor RSRQ, which is the normal condition at the centre of a dense deployment.

Qrxlevmeas is measured RSRP and Qqualmeas is measured RSRQ, both from the SSB; Qrxlevmin and Qqualmin are broadcast in SIB1, SIB2 and SIB4.

Pcompensation is the term that reaches into the RF front end, and it is the reason this section is in a folder that also contains a front-end layer.

For FR1 it is max(PEMAX1 − PPowerClass, 0), where PEMAX1 is the maximum uplink power the cell permits and PPowerClass is "the maximum RF output power of the UE (dBm) according to the UE power class as defined in TS 38.101-1".

So if the cell expects 26 dBm and this device's power amplifier manages 23, the device raises its own bar for that cell by 3 dB. It refuses to camp somewhere it could hear perfectly well, because it knows the cell could not hear it.

This is a downlink measurement corrected by an uplink hardware limit. A device that camped on the strongest cell it could receive would sit in cells it cannot reach and discover this only at random access. Pcompensation moves that discovery to before camping, using a number that comes from the power class — a front-end property. It is one of the cleanest seams in this folder between layers 1 and 2.

And it vanishes in FR2: "For FR2, Pcompensation is set to 0." Millimetre-wave links are beamformed at both ends, so a single scalar power class no longer captures the link budget.

Moving without telling anyone

Cell reselection — TS 38.304 §5.2.4. The idle-mode counterpart of handover, and the essential difference is that nobody orders it.

	Handover	Reselection
Device state	RRC_CONNECTED	RRC_IDLE or RRC_INACTIVE
Decided by	the network, from reported measurements	the device, from broadcast rules
Signalling	reports, then a reconfiguration order	none

Table 1: Handover against reselection. An idle device is not in a conversation with anyone, so there is no connection over which to report measurements or receive an order - the network broadcasts the rules instead and each device applies them itself. Millions of devices change cell continuously and the network never hears about it.

Two mechanisms. Frequency priorities — a higher-priority frequency is reselected whenever a cell on it is merely good enough, a lower-priority one only when the current frequency has gone bad, which is how an operator steers idle devices onto a preferred band without talking to any of them. And ranking within equal priority, by the R criterion with per-cell offsets and hysteresis.

What stops it oscillating. Hysteresis (Qhyst) makes the serving cell count for more than it measures, and a timer (TreselectionRRC) requires a neighbour to stay better for a period. Without both, a device on a cell boundary would ping-pong — and every reselection means re-reading system information, and a registration if the tracking area changed.

Measurement is skipped when it is not needed — §5.2.4.2 lets the device stop measuring neighbours entirely while the serving cell is comfortably above SIntraSearchP and SIntraSearchQ. A phone with good signal does not scan, which is a substantial part of why standby is measured in days.

And it scales its timers by its own speed — §5.2.4.3 defines mobility states (normal, medium, high), inferred by the device from how many reselections it has recently made.

How coarsely the network knows

Tracking area — TS 23.501 §5.3.2.3. Every cell broadcasts a TAI; a registered device holds a TAI list. Inside the list it says nothing; crossing out of it, it registers.

TAI list	Registration load	Paging load
Large	low — boundaries crossed rarely	high — every page broadcast over many cells
Small	high — a registration at every boundary	low — few cells to reach

Table 2: The trade the whole of idle mode is built on. Both costs are paid in the same currency - radio and signalling capacity - so the optimum depends on how much devices move against how often they are reached. It is the same trade periodic registration makes on the time axis, made here on the space axis.

The list is per-device, and that is the clever part. It is not a fixed partition of the map into zones: the AMF gives this device a set chosen for it. A device that repeatedly crosses the same boundary can be given a list containing both sides, and the ping-ponging registrations stop — without changing anything for anyone else. Two devices standing next to each other may hold different lists.

Being found

Paging — TS 38.304 §7.1. A packet arrives at the UPF, which buffers it and raises a Downlink Data Notification to the SMF; the SMF tells the AMF; the AMF pages every cell in the TAI list; the device answers with a service request.

The device monitors one paging occasion per DRX cycle and sleeps the rest. Which occasion is its occasion is computed:

$$ \left(\text{SFN} + \text{PF}_{\text{offset}}\right) \bmod T = (T \ \mathrm{div}\ N)\cdot\left(\text{UE\_ID} \bmod N\right), \qquad i_s = \left\lfloor \frac{\text{UE\_ID}}{N} \right\rfloor \bmod N_s \tag{2} $$

Equation 2: The paging frame and paging occasion of TS 38.304 clause 7.1. T is the DRX cycle, N the number of paging frames within it and Ns the occasions per frame, all broadcast. UE_ID is the only device-specific input.

with UE_ID = 5G-S-TMSI mod 1024, per the same clause.

mod 1024 is the ten least significant bits, and that closes the seam exactly. TS 23.501 §5.9.4 requires the AMF to ensure "the 10 Least Significant Bits of the 5G-TMSI are evenly distributed". TS 38.304 §7.1 is why.

Allocate those bits sequentially and a batch of devices activated together would share paging occasions, concentrating load into a few moments of each cycle and leaving the rest idle. Allocate them evenly and the load spreads across all 1024.

This is the clearest core-to-RAN seam in the folder, and unlike most it has an arithmetic answer.

Two kinds of paging. CN-initiated, from the AMF, for a device in RRC_IDLE; and RAN-initiated, from the base station, for a device in RRC_INACTIVE whose context it still holds — answered by resuming rather than re-establishing. A device receiving CN-initiated paging while in RRC_INACTIVE "moves to RRC_IDLE and informs NAS": the core paging it means the core does not believe it is connected, and the device's view must yield.

Beams cost nothing here. In multi-beam operation the device "assumes that the same paging message and the same Short Message are repeated in all transmitted beams" — the network sweeps, and the device need not have been tracked.

Sources

Document	Clause	What it gives
TS 38.304 v19.3.0	5.2.3.2, 5.2.4, 7.1	The S criterion including Pcompensation; reselection priorities, ranking and mobility states; the paging frame and occasion formulae
TS 23.122 v19.7.0	4	PLMN selection, the selector lists, and higher-priority PLMN search
TS 23.501 v19.7.0	5.3.2.3, 5.3.3.2, 5.9.4	Tracking areas and the TAI list; CM-IDLE behaviour; the ten-bit requirement
TS 38.101-1 v19.4.0	6.2.1	The UE power class that Pcompensation is measured against

Table 3: The clauses this reference note stands on. TS 38.304 is a RAN specification rather than a core one, which is why it is at v19.3.0 alongside TS 38.331 rather than in the v19.7.0 core snapshot - idle-mode behaviour is a radio procedure even though what it is in service of is a core-network concern.

cd ~/Documents/md-engine/"Courses (RAW)/5G Topics"
pdftotext -layout ts_138304v190300p.pdf - | grep -n -A40 "^5.2.3.2 *Cell Selection Criterion"
pdftotext -layout ts_138304v190300p.pdf - | grep -n -B4 -A10 "5G-S-TMSI mod 1024"
pdftotext -layout ts_123501v190700p.pdf - | grep -n "10 Least Significant Bits"

5G Systems Notes · Reference · Mobility Top · Concept map · Hub