T3410 and T3450 are the timer involved in Initial Attach procedure. The two timers sit on opposite sides of the attach. T3410 runs in the UE and waits for the network to answer the ATTACH REQUEST. T3450 runs in the MME and waits for the UE to confirm the ATTACH ACCEPT. So each side supervises the one answer that it needs to complete the attach. Let's look at what each timer supervises, and then at what each side does when its timer expires.

• What do T3410 and T3450 supervise?
• What does the UE do when T3410 expires?
• What does the MME do when T3450 expires?
• Reference

What do T3410 and T3450 supervise?

An attach has three NAS messages, and two of them need an answer. The UE needs an answer to ATTACH REQUEST, and the MME needs an answer to ATTACH ACCEPT. The third message, ATTACH COMPLETE, needs no answer. So the attach needs exactly two supervision timers, one on each side.

T3410: This timer is started when the UE (User Equipment) sends an Attach Request to the network. The T3410 timer sets a deadline for the network to respond to the Attach Request. If the network doesn't respond before the T3410 timer expires, the UE concludes that the Attach Request has failed and may choose to try again. The duration of the T3410 timer is 15 seconds. It does not depend on the network's configuration, and only NB-S1 mode and WB-S1/CE mode use a longer value.

T3450 is the timer that starts when the network sends an "Attach Accept" message to the user equipment (UE). The network starts this timer after sending the "Attach Accept" message and stops it when an "Attach Complete" message is received from the UE. If the network doesn't receive the "Attach Complete" message before the T3450 timer expires, the network may resend the "Attach Accept" message and restart the timer. This process can be repeated until a maximum number of retransmissions is reached.

The diagram below shows the two possible endings of an attach. In the upper sequence the network accepts the attach, and in the lower sequence it rejects it. T3410 covers the gap between Attach Request and the answer in both sequences. T3450 appears only in the upper one, because a reject needs no confirmation.

T3410 ends at the network answer, whether it is an accept or a reject. T3450 exists only when the answer is an accept. The drawing puts both brackets on the network side, but T3410 runs in the UE.

• Upper sequence : Attach Request, Attach Accept and Attach Complete. The T3410 bracket ends where Attach Accept is sent, and the T3450 bracket starts there and ends at Attach Complete.
• Lower sequence : Attach Request and Attach Reject. The T3410 bracket ends at Attach Reject, and no second timer follows.
• What the drawing leaves out : the EMM common procedures between Attach Request and Attach Accept. Authentication, security mode control and identification can all run while T3410 is running.

That last point matters when you read a log. T3410 must cover the whole exchange, not only one round trip. The MME may run authentication and security mode control before it accepts the attach. Each of those procedures is supervised by the MME's own T3460 or T3470, and all of that time counts against T3410.

The table below puts the two timers side by side, with the values from 24.301 Tables 10.2.1 and 10.2.2. The WB-S1/CE value applies to a UE in CE mode A or CE mode B that supports CE mode B, and to MEO and GEO satellite access. The NB-S1 value is the normal value plus 240 s, from clause 4.7.

Note the second row. T3450 is not an attach-only timer. The MME uses it for every message that assigns a new temporary identity, because the UE must confirm that it stored the identity.

Check out following notes for further details on UE and Network Timers

• Timer (RRC)
• Timer (EPS Mobile Management - UE Side)
• Timer (EPS Mobile Management - Network Side)
• Timer & Constant and RRC/NAS Message

• Each side supervises one answer : the UE waits for ATTACH ACCEPT or ATTACH REJECT, and the MME waits for ATTACH COMPLETE.
• T3410 has a fixed value : 15 s, or 85 s in WB-S1/CE mode and 255 s in NB-S1 mode.
• T3410 covers the common procedures too : authentication and security mode control run inside the T3410 window.
• T3450 follows every identity assignment : ATTACH ACCEPT, TRACKING AREA UPDATE ACCEPT with a new identity and GUTI REALLOCATION COMMAND.

What does the UE do when T3410 expires?

A T3410 expiry means that the UE heard nothing useful from the network. The UE cannot tell whether the request was lost, the network is overloaded, or the answer was lost. So 24.301 treats the expiry as one of the abnormal cases in clause 5.5.1.2.6, and the UE simply counts it as a failed attempt.

On expiry, the UE aborts the attach procedure and releases the NAS signalling connection locally, if one exists. Then it increments the attach attempt counter, unless the counter is already 5. The attach for emergency bearer services is the exception, because the UE does not count it.

Next, the counter decides the wait. Below 5, the UE starts T3411 and moves to EMM-DEREGISTERED.ATTEMPTING-TO-ATTACH. When T3411 expires, it sends a new ATTACH REQUEST and starts T3410 again. At 5, the UE deletes its GUTI, TAI list, last visited registered TAI, list of equivalent PLMNs and KSI, and it starts T3402. The T3411, T3402 page follows this counter in detail.

So with default values and a silent network, the UE sends five ATTACH REQUEST messages about 25 s apart. Each gap is 15 s of T3410 and 10 s of T3411. After the fifth failure, the UE waits 12 min for T3402 by default.

T3410 does not only stop on expiry or on an answer. Three other events matter in a log. First, an AUTHENTICATION REJECT stops T3410 together with the other EMM timers. Second, when the UE rejects an authentication challenge with cause #20, #21 or #26, it stops T3410 while it waits for the network. If the network then passes a new challenge, the UE starts T3410 again. Third, the lower layer failures and cell changes of clause 5.5.1.2.6 end the attempt before T3410 expires.

• A T3410 expiry is a failed attempt : the UE aborts the attach and increments the attach attempt counter.
• The counter chooses the next timer : T3411 below 5 attempts, and T3402 at 5.
• A silent network gives a regular pattern : five ATTACH REQUEST messages about 25 s apart, then a 12 min pause.
• An authentication failure pauses T3410 : the UE stops it after #20, #21 or #26 and starts it again if the network passes the next challenge.

What does the MME do when T3450 expires?

On the network side the problem is different. By the time T3450 runs, the MME has already accepted the UE and sent it a new GUTI. If ATTACH COMPLETE does not arrive, the MME does not know whether the UE ever received that GUTI. So it retransmits first and gives up only later.

On the first expiry, the MME retransmits ATTACH ACCEPT and restarts T3450. It repeats this four times. On the fifth expiry, the MME aborts the attach procedure and enters EMM-DEREGISTERED. If the ATTACH ACCEPT carried a new GUTI, the MME keeps both the old and the new GUTI valid for a while. This covers the case where the UE never stored the new GUTI and comes back with the old one.

Let's add up the time for the default values. Five T3450 periods of 6 s give 30 s from the first ATTACH ACCEPT to the abort. In NB-S1 mode each period is 246 s, so the MME can wait more than 20 min before it gives up.

Three collisions change this sequence. First, if the same ATTACH REQUEST arrives again after ATTACH ACCEPT was sent, the MME resends ATTACH ACCEPT and restarts T3450, but it does not count this as a retransmission. If the new request carries different IEs, the MME aborts the old attach and runs the new one. Second, a TRACKING AREA UPDATE REQUEST before ATTACH COMPLETE stops T3450. The MME considers the new GUTI valid and rejects the TAU with cause #10 "implicitly detached". Third, a DETACH REQUEST before ATTACH COMPLETE aborts the attach, and the MME runs the detach.

A lower layer failure is the one case without any retransmission. If the connection fails before ATTACH COMPLETE arrives, the MME aborts the attach locally and enters EMM-DEREGISTERED. It does not resend ATTACH ACCEPT.

• T3450 retransmits four times : the fifth expiry aborts the attach, 30 s after the first ATTACH ACCEPT with default values.
• The MME keeps two GUTIs after an abort : the old and the new GUTI stay valid until the MME can release the old one.
• A repeated ATTACH REQUEST is not a retransmission : the MME resends ATTACH ACCEPT without counting it.
• A lower layer failure ends the attach at once : the MME does not resend ATTACH ACCEPT.

Reference

[1] 3GPP TS 24.301 v20.0.0 - clause 4.7 and 4.8, NAS timers in NB-S1 and WB-S1/CE mode, clause 5.4.2.7, Authentication abnormal cases, clause 5.5.1.2, Attach procedure for EPS services, and Tables 10.2.1 and 10.2.2