What the device is doing — NAS, and the state machines above the radio

The stack note ends at RRC, which is the top of the access stratum — everything about the radio. This note is the layer above that: the protocol between the device and the core, and the three state machines that between them answer is this device known, is it reachable, and is it connected right now.

In one line. A device's condition is not one state but three, on three different timescales: 5GMM is the device's own view and changes on procedures; RM is registration, and changes on a scale of hours; CM is whether a signalling connection exists, and changes on a scale of seconds. The normal condition of almost every phone is RM-REGISTERED and CM-IDLE — known to the network, connected to nothing — and the entire idle-mode design exists to make that state cheap.

The concepts this note covers

Each concept has a page of its own. This note is the narrative — the group read as one argument, with the connective tissue that a page-per-concept cannot carry. The pages are the definitions, and each one shows what to learn before it.

The stratum boundary

NAS — TS 24.501. The name is the definition: everything not in the access stratum, the access stratum being RRC and everything below.

NAS travels inside RRC over the air and inside N2 beyond it, and neither leg reads it. That is why N1 is drawn as a reference point between the device and the AMF although no such link physically exists.

And it is separately ciphered — TS 23.501 §6.2.1 gives the AMF "NAS ciphering and integrity protection" — so NAS is protected between the device and the core, independently of the PDCP ciphering protecting it over the radio. A compromised base station sees neither.

Two protocols inside it

5GMM, mobility management, which the AMF reads; and 5GSM, session management, which the AMF forwards without reading to the SMF.

The device's own state machine

5GMM — TS 24.501 §5.1.3.2. Six main states, in the specification's own words:

The substates are where the reality is. 5GMM-DEREGISTERED alone has nine, and their names are a tour of everything that can be wrong: NORMAL-SERVICE, LIMITED-SERVICE, ATTEMPTING-REGISTRATION, PLMN-SEARCH, NO-SUPI, NO-CELL-AVAILABLE, eCALL-INACTIVE, INITIAL-REGISTRATION-NEEDED.

"No service" on a phone is not one condition. NO-CELL-AVAILABLE means there is no radio; PLMN-SEARCH means there is radio and the device is looking for a network it may use; NO-SUPI means there is no usable subscription; LIMITED-SERVICE means a cell was found that will carry emergency calls only. The device distinguishes all of these and the user interface collapses them into one symbol.

Session management, carried but not read

5GSM — TS 24.501 §6.1.3. The transparency is stated from both ends: the AMF gets "Transparent proxy for routing SM messages", the SMF gets "Termination of SM parts of NAS messages".

A device has one 5GMM state and one 5GSM state machine per PDU session — so the two cannot be one thing, because they do not have the same cardinality.

The cost is a routing problem the specification has to solve. If the AMF cannot read the message, how does it know which SMF to send it to? By the PDU Session ID in the 5GMM envelope around the 5GSM payload. The outer layer carries just enough routing information for the inner layer to stay opaque — the same trick as a GTP-U header.

Registered, and connected

RM state — TS 23.501 §5.3.2.2 — and CM state — §5.3.3.2 — are easy to confuse and answer different questions.

Deregistered does not mean nothing is remembered. §5.3.2.2.2: "some parts of UE context may still be stored in the UE and the AMF e.g. to avoid running an authentication procedure during every Registration procedure." Reachability is forgotten; trust is not — which is why switching a phone off and on does not require a full 5G AKA run.

CM against RRC, and the state invented between them

Why RRC_INACTIVE was invented. Going from idle to connected costs a full random-access exchange, an RRC setup, a service request and a security handshake — tens of milliseconds and a burst of signalling. For traffic that is frequent but tiny — a messaging keepalive, a sensor reading — that cost dominates everything. RRC_INACTIVE lets the device sleep like an idle one and resume rather than re-establish, keeping the core-side connections in place throughout.

It is the state that makes bursty low-rate traffic affordable, and it is why the CM and RRC ladders do not line up one-to-one.

Becoming known

Registration — TS 24.501 §5.5.1, TS 23.502 §4.2.2.2. Nothing can happen until it has succeeded. The chain runs cell selection → initial access → Registration Request (SUCI or 5G-GUTI, Requested NSSAI, capabilities) → AMF selection, possibly re-routed by the NSSF → authentication → subscription retrieval → Registration Accept (Allowed NSSAI, TAI list, a fresh 5G-GUTI).

The step that is easy to skip past is subscription retrieval, because the UDM is not only asked who is this — it is told which AMF is now serving them ("UE's Serving NF Registration Management"). Registration is as much about the network learning where to find you as about you being admitted.

Three reasons to do it again, per TS 23.501 §5.3.2.1: periodically "in order to remain reachable"; upon mobility, leaving the TAI list; and to update capabilities.

Periodic registration is a liveness check with a real cost. Every registered device checks in on a timer whether or not it has anything to say, or the AMF cannot tell a device that left from one quietly camped. Short timer, and a network of millions of idle devices signals continuously for nothing; long timer, and the AMF holds stale contexts. It is the same trade as the TAI list size, made on the time axis rather than the space one.

Coming back

Service request — TS 24.501 §5.6.1. Used in both directions, and the symmetry is the point: the network cannot deliver to an idle device, so it pages, and the device then runs exactly the procedure it would have run had it initiated. Downlink delivery is uplink establishment with a wake-up call in front of it.

Not every session is reactivated — the device names which it wants active.

That distinction is the whole economy of idle mode. A PDU session is core-network state — an address, an anchor, a set of rules — and it survives hours of idleness costing nothing but memory. The expensive parts, a radio connection and an N3 tunnel, exist only while there is traffic. Your phone keeps its IP address all day and holds a radio connection for seconds at a time.

What this particular device can do

UE capability — TS 38.306, carried by TS 38.331. Most features in the specification are optional, so the network must ask.

Capabilities appear throughout this folder without being named as such: the tXrY grammar of SRS antenna switching is supportedSRS-TxPortSwitch; the peak data rate formula of TS 38.306 §4.1.2 is computed from capabilities. So a "5G phone" has no single speed — the number quoted is that formula evaluated for that device's declared set.

Capability signalling grew big enough to need a function of its own: TS 23.501 §6.2.21 defines the UCMF to store and dictionary-encode capability sets so an identifier can be passed instead of the whole structure. A network function whose entire purpose is to stop re-signalling something that never changes is a fair measure of how much optionality the standard carries.

Sources

cd ~/Documents/md-engine/"Courses (RAW)/5G Topics"
pdftotext -layout ts_124501v190700p.pdf - | grep -n -A30 "^5.1.3.2.1.2 *Main states"
pdftotext -layout ts_123501v190700p.pdf - | grep -n -A14 "^5.3.3.2.2 *CM-IDLE state"
pdftotext -layout ts_124501v190700p.pdf - | grep -nE "^5\.1\.3\.2\.1\.3\.[0-9]+ "