Quick Reference
LTE EMM cause codes are one-byte values (0x01–0xFF) included in NAS rejection messages by the MME, defined in 3GPP TS 24.301 §9.9.3.9. Each code identifies a specific reason for Attach, TAU, or Service Request rejection and determines mandatory UE behavior (back-off timer, PLMN selection, USIM invalidation). Captured in field logs via DIAG code 0x713A.
LTE EMM Cause Codes: Field Reference
Every LTE NAS rejection — Attach Reject, Tracking Area Update Reject, Service Reject — carries an EMM cause code that determines what the device does next: search for a new cell, wait for a timer, mark the USIM as invalid, or fall back to CS. This reference covers the most field-relevant cause codes with full 3GPP TS 24.301 UE behavior and per-cause diagnosis guides.
Cause Code Quick Reference
Source: 3GPP TS 24.301 §9.9.3.9, Table 9.9.3.9.1
| Code | Hex | Name | NAS Messages | Diagnosis |
|---|---|---|---|---|
| #7 | 0x07 | EPS services not allowed | Attach Reject, TAU Reject | Full guide → |
| #11 | 0x0B | PLMN not allowed | Attach Reject, TAU Reject | Full guide → |
| #12 | 0x0C | Tracking area not allowed | Attach Reject, TAU Reject | Full guide → |
| #15 | 0x0F | No suitable cells in tracking area | Attach Reject, TAU Reject | Full guide → |
| #19 | 0x13 | ESM failure | Attach Reject | Full guide → |
| #22 | 0x16 | Congestion (T3346) | Attach Reject, TAU Reject, Service Reject | Full guide → |
Per-Cause Diagnosis Guides
Each guide covers: UE behavior per TS 24.301, root causes, field scenarios, step-by-step diagnosis, and DIAG log capture.
Triggers USIM invalidation for EPS services. No back-off timer. Applies PLMN-wide. Common with 4G-only SIMs attempting VoLTE registration or after USIM provisioning errors.
Read full guide →Writes the PLMN to the USIM's forbidden PLMN list (EF_FPLMN). Requires USIM removal to clear. Core cause in roaming disputes, PLMN consolidation, and unauthorized roaming SIMs.
Read full guide →TA-level subscription restriction. No back-off timer. UE performs PLMN/cell reselection immediately. Common in enterprise private LTE, TA-level roaming exclusions, and IoT-specific TA configurations.
Read full guide →Less severe than cause #12: UE may camp in limited service for emergency calls. TAI stored in forbidden roaming list, not forbidden TA list. Common at coverage edges and in partial roaming agreement zones.
Read full guide →Always contains an embedded ESM message container with the specific PDN failure reason (ESM #27 for unknown APN, #38 for PGW failure). Only appears in Attach Reject, not TAU Reject. Requires two-layer decode.
Read full guide →Unique among EMM causes: always carries a T3346 back-off timer (GPRS Timer 3 format, max 186 minutes). UE must not retry NAS procedures until timer expiry. Appears in dense events, maintenance windows, and S1 overload scenarios. Emergency calls are exempt.
Read full guide →UE Behavior Comparison
How each cause code affects the UE state and retry behavior per 3GPP TS 24.301 §5.5.1.2.5.
| Cause | USIM validity | Back-off timer | List affected | Emergency service |
|---|---|---|---|---|
| #7 | Invalidated for EPS | None | USIM EPS validity flag | Yes |
| #11 | Unchanged | None | EF_FPLMN on USIM | Yes |
| #12 | Unchanged | None | Forbidden tracking areas | Yes |
| #15 | Unchanged | None | Forbidden TAs for roaming | Yes (limited service) |
| #19 | Unchanged | None | None (PDN-level only) | Yes |
| #22 | Unchanged | T3346 (up to 186 min) | None (timer only) | Yes (exempt from T3346) |
Capturing EMM Cause Codes in the Field
Capture LTE NAS EMM plain OTA incoming messages in real time. Every Attach Reject, TAU Reject, and Service Reject is decoded with the EMM cause IE value, TAI, and embedded ESM container (for cause #19).
Track EMM state machine transitions (EMM-DEREGISTERED, EMM-REGISTERED, EMM-REGISTERED-INITIATED) correlated with cause codes. Confirms UE behavior: PLMN search, limited service camp, or back-off timer start.
Read EF_FPLMN content after cause #11 to verify the PLMN was written. Confirm EF_EPSLOCI (EPS location information) is deleted after cause #7. USIM-level verification closes the feedback loop on NAS behavior.
GPS-correlate EMM rejections to map the exact geographic boundary of TA-level restrictions (cause #12, #15) or PLMN-level exclusions. Produces audit maps for network acceptance and roaming validation.
Frequently Asked Questions
An EMM (EPS Mobility Management) cause code is a numeric value included in NAS rejection messages (Attach Reject, TAU Reject, Service Reject) by the MME (Mobility Management Entity). It identifies the specific reason why the LTE registration or service request was refused. Cause codes are defined in 3GPP TS 24.301 §9.9.3.9, Table 9.9.3.9.1.
EMM cause codes appear in NAS layer messages captured in the DIAG log, specifically in DIAG log code 0x713A (LTE NAS EMM plain OTA incoming). The decoded message shows the EMM cause IE as a one-byte field in the Attach Reject, TAU Reject, or Service Reject message.
EMM cause #19 (ESM failure) is the most common in field deployments because it covers all APN and PDN connection failures — missing APN, PGW unreachable, PDN type mismatch — which represent a broad class of provisioning and infrastructure issues. Cause #11 (PLMN not allowed) is the most common in roaming diagnostics.
Yes. EMM cause codes are generated by the MME based on the subscriber's HSS profile and the cell's tracking area. Cause #15 (No suitable cells in tracking area) or cause #12 (Tracking area not allowed) can affect only specific TAs, while cause #7 (EPS services not allowed) applies to the PLMN-wide subscription. Two cells in different TAs of the same PLMN can return different cause codes for the same USIM.