This information is obtained from SIM/USIM and if no information is found then (if I remember correctly) GSM is searched first. Below is the complete procedure:
At power on, UE scans all supported RF channels and lists the channels with RSRP >= -110 dBm, RSCP>=-95dBm, RxLev >=-85dBm (as high quality*); and others as normal to UE NAS. For all cells found the PLMN ID is found from related SIBs. Now the UE will try to camp on last Registered PLMN (RPLMN)**, if it is not available then UE NAS layer will check the information stored in USIM and proceed in below order:
- Equivalent PLMN: it will select the network as per the list of EPLMN in order of priority
- Home PLMN: if EPLMN list is not present or is empty, it will select the HPLMN
- User Controlled PLMN Selection: Each PLMN/Access Technology combination in the "User Controlled PLMN Selector with Access Technology"(UPLMNwACT) data file in the USIM (in Priority Order).
- Operator Controlled PLMN Selection: Each PLMN/Access Technology combination in the "Operator Controlled PLMN Selector with Access Technology" (OPLMNwACT) data file in the USIM(in Priority Order)
- Other PLMN/Access Technology combinations with received high quality* signal received in the random order (physically detected)
- Other PLMN/Access Technology combinations in order of decreasing signal quality (physically detected)
The UE searches all supported access technologies before PLMN selection using last two steps 5 and 6 mentioned above.
** EF - LRPLMNSI (Last RPLMN Selection Indication) plays an important role to decide this.
- EF - LRPLMNSI = '00' The UE shall attempt registration on the last RPLMN at switch on or recovery from out of coverage.
- EF - LRPLMNSI = '01' The UE shall attempt registration either on the EHPLMN or the last RPLMN at switch on or recovery from out of coverage.
REFERENCES: 3GPP TS 36.304, TS 23.122, TS 31.102, TS 24.301
