How a device chooses a network

Every phone and IoT module picks its network by the same set of rules, written by 3GPP, the body that writes the mobile standards. The SIM supplies some of the inputs. The device makes the choice.

The order a device follows

When it switches on, a device first tries the network it last used, so it can get back online quickly. If that network is not there, it works down a list.

1. Its home network, the one that issued the SIM.
2. Networks on a list the user can set on the SIM.
3. Networks on a list the SIM’s operator sets and can update over the air.
4. Any other network with a good signal, picked at random.
5. Everything else, strongest signal first.

So a device only ranks networks by signal strength near the end. Before that, the lists on the SIM decide. This is why the lists matter so much, and why operators use them for steering.

Why doesn’t my device connect to the strongest network?

Once a device is registered, it stays on that network. It does not move just because a stronger one appears. It looks again when it loses service, when it restarts, or on a timer that checks now and then for a network higher up its list. That timer is set on the SIM. For low-power devices it can be days.

This keeps devices stable and saves battery. It also means a device can stay on a weaker network for a long time if that network is still serving it.

Networks a device will not try

If a network turns a device away with certain answers, the device adds that network to a forbidden list on the SIM. In automatic mode it will not try that network again until the list is cleared. A device that was refused once, for a reason that has since gone, can keep avoiding a working network.

Automatic and manual mode

In automatic mode the device follows the order above. In manual mode it uses only the network chosen for it. If that network fails, it does not move to another one on its own. For IoT devices, automatic mode is almost always the right choice.

Network choice affects coverage, connection time after a restart and battery use. Knowing the rules helps you read what a device is doing in the field, and why it sometimes picks a network you did not expect.

Where the rules live

PLMN selection is a non-access stratum function of the device, specified in 3GPP TS 23.122. The USIM (TS 31.102) holds the inputs the operator controls: the home PLMN in the IMSI, the Equivalent HPLMN list (EF EHPLMN), the User controlled PLMN selector with Access Technology (EF PLMNwACT), the Operator controlled PLMN selector with Access Technology (EF OPLMNwACT), the higher-priority search timer (EF HPPLMN) and the forbidden PLMN list (EF FPLMN). The access stratum (TS 36.304 for E-UTRA, TS 38.304 for NR) scans and reports the PLMNs it can find, with their signal levels.

Switch-on and recovery

At switch-on, or on recovering from lack of coverage, the device first selects the registered PLMN or an equivalent PLMN, if it is available, on any access technology it supports (TS 23.122 §4.4.3.1). Equivalent PLMNs are those the network listed as equivalent at the last registration. Only if that fails does the device run the full selection procedure.

Automatic mode order

In automatic mode the device tries PLMN and access technology combinations in this order (TS 23.122 §4.4.3.1.1):

Forbidden PLMNs are skipped. Later releases add steps for special cases.

“High quality signal” is defined by the access stratum, not by TS 23.122. For E-UTRA (TS 36.304) and NR (TS 38.304) a PLMN is reported as high quality when the measured RSRP is at least −110 dBm. PLMNs below that are reported with their measured value and fall into step v.

Staying on a network

Once registered, a device does not reselect a PLMN because another one has a stronger signal. Cell reselection within the registered PLMN carries on as normal, but a change of PLMN happens only when:

• the device loses coverage of the registered PLMN;
• registration is rejected;
• the user or application changes mode or selects a network;
• the periodic higher-priority search finds a better PLMN.

That periodic search applies only in automatic mode, and only when the device is roaming (TS 23.122 §4.4.3.3.1). It looks for networks higher in the order above, limited in general to PLMNs of the same country as the current visited network. The interval T comes from EF HPPLMN:

Either value can also be set to mean no periodic attempts at all. With the 72-hour default, an LTE-M or NB-IoT device can sit on a lower-priority network for three days before it looks for a better one.

Manual mode

In manual mode the device lists the available PLMNs, including forbidden ones, and registers only on the one selected (TS 23.122 §4.4.3.1.2). Registering successfully on a forbidden PLMN in manual mode removes it from the forbidden list. Once registered, the device does not move to another PLMN on its own, apart from a few exceptions such as equivalent PLMNs. If the selected PLMN is lost, the device camps on any acceptable cell in limited service and waits. This is why manual selection is risky for unattended devices.

Forbidden lists and reject causes

The forbidden list mostly survives power off. There are exceptions, such as a PLMN added after cause #11 without integrity protection, and entries governed by timers T3245 and T3247.

A visited network, or the home network through it, can refuse a registration with an EMM cause (TS 24.301 §5.5.1.2.5 for attach; tracking area update uses the same causes). The cause decides what the device remembers.

The lists last for different times (TS 23.122 §3.1):

• The forbidden PLMN list is stored on the SIM, with an optional extension in the device’s memory. It survives power off and moving the SIM to another device. An entry is removed when a manual selection of that PLMN leads to a successful registration, or when the list is changed, for example over the air.
• The forbidden PLMNs for GPRS service list is kept in the device and deleted at power off or SIM removal.
• Forbidden tracking area lists are deleted at power off, at SIM removal and periodically, every 12 to 24 hours.
• A USIM treated as invalid stays so until power off or SIM removal, or until timer T3245 expires where it is used.

Cause #11 therefore has the longest reach. A single refusal, for example during a roaming agreement problem, can keep a device off that network long after the problem is fixed.

Practical points for IoT

• Use automatic mode. Manual selection ties an unattended device to one network. How operators use the lists and reject causes is covered in Steering.
• Read EF FPLMN when a device avoids a network you expect it to use. With most modules this is possible by AT command. Clearing it, or a SIM refresh from the operator, restores normal behaviour.
• Remember that power cycling clears forbidden tracking areas and the GPRS list, but not the forbidden PLMN list.
• For LTE-M and NB-IoT devices, check EF HPPLMN. The 72-hour default suits battery life but slows the effect of any change to the preferred lists.