LTE EMM Cause #22: Congestion and T3346 Back-off Timer — NAS Field Guide

LTE EMM cause #22 (“Congestion”) is the network’s NAS-layer mechanism for instructing the UE to back off from registration attempts during periods of core network overload. It differs from radio-layer congestion, which is handled by the RRC and MAC layers. When the MME receives more attach or TAU requests than it can process, it uses cause #22 together with the T3346 back-off timer to distribute load over time.

Understanding cause #22 is essential for distinguishing between network-side and radio-side congestion during dense-area drive tests — a distinction that changes the remediation entirely.

Technical Reference

Field	Value
Cause code	#22 (decimal) / 0x16 (hexadecimal)
IE name	EMM cause
Standard	3GPP TS 24.301 §9.9.3.9, Table 9.9.3.9.1
NAS messages	Attach Reject, TAU Reject, Service Reject
Back-off timer	T3346 (GPRS timer 3, range 0–11 160 s)
UE state after	EMM-DEREGISTERED (wait for T3346)

The T3346 Timer Mechanism

When the MME sends cause #22, it includes a T3346 value IE encoding the duration of the mandatory back-off period. The format is GPRS timer 3 (3GPP TS 24.008 §10.5.7.4a): 5 bits for the value, 3 bits for the unit.

Timer units and their multipliers:

Unit bits (MSB)	Multiplier	Max value
000	10 minutes	310 minutes (5.2 h)
001	1 hour	31 hours
010	10 hours	310 hours
011	2 seconds	62 seconds
100	30 seconds	930 seconds
101	1 minute	31 minutes
110	320 hours	deactivated
111	deactivated	—

If no T3346 value IE is present in the Attach Reject, the UE selects a random value between 0 and 12 minutes (per TS 24.301 §5.5.1.2.5). Operators can omit the IE to let UEs spread their retry attempts randomly — a technique used during sudden overload events when the MME cannot predict how long the congestion will last.

UE Behavior After Receiving Cause #22

Per 3GPP TS 24.301 §5.5.1.2.5:

• Set EPS update status to EU2 NOT UPDATED (less severe than EU3 used for causes #7, #11)
• Start timer T3346 with the value indicated in the T3346 value IE (or a random value if absent)
• Not initiate attach, TAU, or service request procedures while T3346 is running
• Exception: emergency attach is always permitted regardless of T3346 state
• When T3346 expires, the UE may initiate a new attach or TAU procedure normally

EU2 vs EU3: Unlike causes #7 or #11 (which set EU3 ROAMING NOT ALLOWED), cause #22 sets EU2 NOT UPDATED. The UE retains its stored GUTI, TAI list, and USIM EPS validity — recovery is automatic after T3346 expiry.

Field Scenarios

Dense event coverage. Concerts, sporting events, and city-center gatherings generate thousands of simultaneous LTE Attach Requests that can saturate the MME’s signaling plane. The MME distributes T3346 values across affected UEs to stagger retry attempts. In drive test logs, this manifests as large bursts of Attach Rejects with cause #22, each carrying different T3346 values.

Network maintenance or failover. MME failover during planned maintenance can temporarily reduce attach processing capacity. Cause #22 is used to shed load while the standby MME comes online. The T3346 values in this case are typically short (30–60 seconds) to restore service quickly.

EMM congestion control (ECC). 3GPP TS 23.401 §4.3.5.8.3 defines EMM congestion control: the MME can proactively apply T3346 to UEs matching a specific traffic category (device type, APN, DNN) even before overload thresholds are reached, as a preventive measure.

Step-by-Step Field Diagnosis

Step 1 — Confirm cause #22 in the Attach Reject. In the decoded NAS message, locate the EMM cause IE (type 0x53) with value 0x16. Check for the presence of the T3346 value IE (type 0x5F in the Attach Reject).

Step 2 — Decode the T3346 timer value. Extract the GPRS timer 3 byte. Apply the unit multiplier to obtain the back-off duration in seconds. This value is what the network instructs the UE to wait before retrying.

Step 3 — Correlate with concurrent attach attempts. In the surrounding trace, count how many UEs in the same cell are receiving cause #22 during the same time window. A cluster of cause #22 rejections from different UEs on the same cell confirms MME-level congestion, not a per-USIM issue.

Step 4 — Compare with RRC-layer behavior. Radio congestion would produce RACH failures (RRC_IDLE camp failures) or scheduling grant starvation (low PDSCH throughput with high BLER). If RF KPIs are nominal while cause #22 is received, the congestion is purely at the NAS/core level.

Step 5 — Check for T3346 absent. If the Attach Reject carries cause #22 without a T3346 value IE, the MME is delegating the back-off duration to the UE (random 0–12 minutes). This is typically observed during sudden overload when the MME cannot estimate recovery time.

Capturing Cause #22 in the Field

DIAG log code 0x713A (LTE NAS EMM plain OTA incoming) captures the full Attach Reject PDU including the T3346 value IE. The decoded message tree shows the GPRS timer 3 field with its unit and value components in separate sub-fields, making the back-off duration immediately readable without manual calculation.

Correlating the cause #22 timestamp with cell-level RACH contention statistics (from the eNB or gNB OM data) and the UE’s RSRP/SINR at that moment confirms whether the congestion is NAS-origin or radio-origin.

Related Cause Codes

• Cause #17 — Network failure (general failure, T3411 timer, not T3346)
• Cause #22 in 5GS NAS — 5GS MM cause #22 (TS 24.501 §9.11.3.2), same T3346 mechanism
• Cause #35 — Requested service option not authorized in this PLMN (access restriction, not congestion)