Limited Service State call flows

As part of my studies I am trying to build a detailed call flow for a UE attaching to an LTE network with an un-subscribed SIM, with the result of them ending in Limited Service State.

For whatever reason tutorials and training all focus on regular Attach Requests and Tracking Area Updates, and since I don’t have access to a test lab I have not got any traces to write my own call flow up.

Does anyone have anything they can share with me?

I also want to compare a basic use-case of LSS in UMTS (using CS) vs. a basic use-case in LTE (using PS/IMS).