A UE needs a value for every timer before it can start that timer. Some values are fixed in the specification, but many of them come from the network. The network uses two different paths for them: RRC broadcasts the radio link timers in SIB2, and the MME sends the NAS timers in NAS messages to each UE.

I'll start with a short map of which message carries which timer. Then I'll look at the RRC timers and constants in SIB2, with their ASN.1, and at the NAS timers in ATTACH ACCEPT and TRACKING AREA UPDATE ACCEPT.

• Which message carries each timer value ?
• RRC Timers and Constants in SIB2
• NAS Timers in ATTACH ACCEPT and TRACKING AREA UPDATE ACCEPT
• Reference

Which message carries each timer value ?

When a log shows an unexpected timer value, the first question is where the UE got that value. The table below answers it for the timers you will meet most often in LTE.

The two rows of the table follow two different paths, and the difference matters when you troubleshoot. The first row is broadcast. Every UE that camps on the cell reads the same SIB2, so every UE in that cell uses the same T300, T301, T310, T311, N310 and N311. The second row is dedicated. The MME sends T3402, T3412 and T3423 to one UE in its own NAS message, so two UEs in the same cell can run with different values.

The paths also differ in scope. A SIB2 value can change when the UE reselects to another cell. A NAS timer value stays with the UE until a later NAS message from the MME replaces it.

• RRC timers are per cell : check SIB2 of the serving cell when you need the value of T300, T301, T310 or T311.
• NAS timers are per UE : check the last ATTACH ACCEPT or TRACKING AREA UPDATE ACCEPT sent to that UE.
• The table is a short list : the two sections below add the other messages and IEs that carry timer values in the current releases.

RRC Timers and Constants in SIB2

SIB2 carries these values in the IE ue-TimersAndConstants. Five of them control radio link failure and re-establishment, and T300 controls connection setup. The table below lists what each one does, based on 36.331 v19.3.0 clauses 7.3 and 7.4.

Let's follow a radio link failure through the table. The UE counts N310 consecutive out-of-sync indications and starts T310. If N311 consecutive in-sync indications arrive, T310 stops and the link has recovered. If T310 expires, the UE declares radio link failure and, with security activated, starts re-establishment. Then T311 limits the search for a suitable cell, and T301 limits the wait for the answer to RRCConnectionReestablishmentRequest.

The ASN.1 below is the current definition. The first six fields are the Release 8 set, and the extension groups add longer values.

Following is based on 36.331 v19.3.0 (Release 19)

UE-TimersAndConstants ::=           SEQUENCE {
    t300                                ENUMERATED {
                                            ms100, ms200, ms300, ms400, ms600, ms1000, ms1500,
                                            ms2000},
    t301                                ENUMERATED {
                                            ms100, ms200, ms300, ms400, ms600, ms1000, ms1500,
                                            ms2000},
    t310                                ENUMERATED {
                                            ms0, ms50, ms100, ms200, ms500, ms1000, ms2000},
    n310                                ENUMERATED {
                                            n1, n2, n3, n4, n6, n8, n10, n20},
    t311                                ENUMERATED {
                                            ms1000, ms3000, ms5000, ms10000, ms15000,
                                            ms20000, ms30000},
    n311                                ENUMERATED {
                                            n1, n2, n3, n4, n5, n6, n8, n10},
    ...,
    [[  t300-v1310                      ENUMERATED {
                                            ms2500, ms3000, ms3500, ms4000, ms5000, ms6000, ms8000,
                                            ms10000}        OPTIONAL,   -- Need OR
        t301-v1310                      ENUMERATED {
                                            ms2500, ms3000, ms3500, ms4000, ms5000, ms6000, ms8000,
                                            ms10000}        OPTIONAL    -- Need OR
    ]],
    [[  t310-v1330                          ENUMERATED {ms4000, ms6000}
                                                            OPTIONAL    -- Need OR
    ]],
    [[  t300-r15                        ENUMERATED {ms4000, ms6000, ms8000, ms10000, ms15000,
                                            ms25000, ms40000, ms60000}  OPTIONAL        -- Cond EDTorPUR
    ]]
}

The extension groups need a short note each. E-UTRAN includes t300-v1310, t301-v1310 and t310-v1330 only in the BR version of the SIB. A UE that supports CE mode B uses these extended values, if present, and ignores the value without the suffix. The last field, t300-r15, is used only for EDT for mobile originating calls and for UL data transmission using PUR.

In RRC_CONNECTED, the network can replace the SIB2 values for one UE. It sends rlf-TimersAndConstants-r9 in RadioResourceConfigDedicated. If the field is set to release, the UE goes back to the values in ue-TimersAndConstants of SIB2. T300 is not part of this IE, because T300 only runs during connection establishment.

Following is based on 36.331 v19.3.0 (Release 19)

RLF-TimersAndConstants-r9 ::=           CHOICE {
    release                                 NULL,
    setup                                   SEQUENCE {
        t301-r9                             ENUMERATED {
                                                ms100, ms200, ms300, ms400, ms600, ms1000, ms1500,
                                                ms2000},
        t310-r9                             ENUMERATED {
                                                ms0, ms50, ms100, ms200, ms500, ms1000, ms2000},
        n310-r9                             ENUMERATED {
                                                n1, n2, n3, n4, n6, n8, n10, n20},
        t311-r9                             ENUMERATED {
                                                ms1000, ms3000, ms5000, ms10000, ms15000,
                                                ms20000, ms30000},
        n311-r9                             ENUMERATED {
                                                n1, n2, n3, n4, n5, n6, n8, n10},
        ...
    }
}

• N310 and T310 together set the RLF detection time : a UE with N310 = n1 and T310 = ms0 declares RLF on the first out-of-sync indication.
• T300 is the only connection setup timer in the list : the other three timers and both constants belong to radio link failure and re-establishment.
• A dedicated value overrides SIB2 : so a connected UE can run with RLF timers that differ from those broadcast in its cell.

NAS Timers in ATTACH ACCEPT and TRACKING AREA UPDATE ACCEPT

The NAS timers in the table above are only the three oldest ones. In 24.301 v20.0.0, ATTACH ACCEPT and TRACKING AREA UPDATE ACCEPT carry seven timer IEs, and three reject messages carry timer values too. The table below collects them.

Each IE uses one of three formats from 24.008. The GPRS timer is one octet of value with a 3 bit unit and a 5 bit value. The GPRS timer 2 adds a length octet in front of the same value octet. The GPRS timer 3 has its own unit table, with units from 2 seconds to 320 hours, so T3412 extended value can express a periodic TAU of many days.

The page Timer - EPS Mobility Management - UE Side explains what each of these timers does on the UE side, and decodes the default T3412 and T3402 values bit by bit.

• T3412 value is the only mandatory timer IE : it is mandatory in ATTACH ACCEPT and optional in TRACKING AREA UPDATE ACCEPT.
• T3412 extended value comes with T3412 value : the MME includes T3412 value in TRACKING AREA UPDATE ACCEPT if it includes T3412 extended value.
• Reject messages carry back-off timers : T3346 in ATTACH REJECT, TRACKING AREA UPDATE REJECT and SERVICE REJECT tells the UE how long to wait under congestion.

Reference

• 3GPP TS 36.331 v19.3.0 - clause 5.3.10.7, clause 6.3.2 RLF-TimersAndConstants, clause 6.3.6 UE-TimersAndConstants, clause 7.3 Timers and clause 7.4 Constants
• 3GPP TS 24.301 v20.0.0 - clause 8.2, message contents of ATTACH ACCEPT, ATTACH REJECT, SERVICE REJECT, TRACKING AREA UPDATE ACCEPT and TRACKING AREA UPDATE REJECT
• 3GPP TS 24.008 v20.0.0 - clauses 10.5.7.3, 10.5.7.4 and 10.5.7.4a, GPRS Timer, GPRS Timer 2 and GPRS Timer 3