Default value is 12 min.
So T3402 start after 5 attach attach failures not after 5 rach failures.
If the UE is attached before, it can be configured to certain value.
UE not yet attached 
Do you mean even after UE got detached, it still remember this value?
Yes, correct.
Guys I suggest you all read the NAS timers from here:
https://www.sharetechnote.com/html/Handbook_LTE_Timer_EPS_UE.html
T3402 is a NAS timer not a MAC timer, or PHY timer.
T3402 start after 5 attach failures! attach request and attach reject
@RFSpecialist, T3402 seems like totaly governed by UE NAS.
When NAS triggers attach request, it triggers RACH first at PHY/MAC.
So altimately 5 attach failures by UE NAS is nothing but 5 rach failures by UE phy/mac.
Make sense?
No it doesn’t make sense.
Attach failure means attach reject from NAS.
So you have to receive from NAS 5 attach rejects to start T3402.
Not to fail 5 times on RACH.
@ran_core_consultant, you know better if T3402 is a NAS timer or a MAC timer, can you jump into discussion?
While @ran_core_consultant comes back, please check these references from 24.301.
Basically, attach attempt counter can be incremented for cases b,c,d,l & m.
Here, lower layer failure means being unable to send attach request due to RACH failure.
-
Ok. This is the case of initial attach. We are waiting for @ran_core_consultant to respond.
-
Secondly what if it is not initial attach?
Some one above said UE will barr the cell. After how many attempts? what is criteria of barring? -
After many rach failures, @RFSpecialist said that UE will perform reselection and not selection.
So if current cell where rach failed is stronger one, isnt UE going to stay in same cell again and again?
For Q2, what is the NAS message in this case? TAU/service request?
If it is TAU, the behavior will be same as attach. For service request, I think its different behavior. Need to refer to specs.
Service request. I refered many specs, no explicit answer I get.
How far back do I need to go back for this conversation? 
You guys been going on.
Just read past 50 messages… 
If it is for service request, I think T3417 expiry comes into picture.
A separate counter called “service request attempt counter” comes into picture.
After this count exhausts, UE needs to back off for 1min+ time. No PLMN blocking.
So UE will not send service request on any cell for 1 min, right?
Which spec is this?
Same 24.301.
Please check the exceptions too for the same behaviour in the snippet.
Struggling to follow conversation but T3402 is NAS timer.
Nothing to do with RACH stage.
How about T3417?
Is it related to rach for ordinary ps services?
To me it looks it is also for EMM idle state.
Because it is only for EMM-Idle state:
