Almost every RRC procedure in LTE is guarded by a timer. A timer starts when the UE sends or receives a message, and it stops when the expected answer arrives. If the timer expires first, the UE takes a fixed recovery action. So when a log shows a UE falling back to RRC_IDLE or starting re-establishment, the first question is which timer expired.

This page lists the RRC timers of 36.331 clause 7.3. It starts with the original timers, then adds the timers of later releases, and finally follows the timers that handle a radio link failure.

• What do the original RRC timers do ?
• Which timers have later releases added ?
• How do T310, T311 and T301 take the UE from a radio problem to RRC_IDLE ?
• Reference

What do the original RRC timers do ?

Let's start with the timers of the early releases. Most of them guard connection setup and re-establishment, and three of them release access barring. Each row reads left to right: the event that starts the timer, the events that stop it, and the action at expiry.

Following table is from 36.331 7.3 Timers (Informative)

It is the early version of the table. In 36.331 v19.3.0 the table is in clause 7.3.1, and several of these rows now carry extra conditions, which are listed below the table.

Now compare these rows with v19.3.0. The timer numbers and the expiry actions are the same, but later features added start and stop events. The first change is in T300. It now also starts on RRCConnectionResumeRequest and RRCEarlyDataRequest. RRCConnectionResume, RRCEarlyDataComplete and RRCConnectionRelease for UP-EDT also stop it. The second change is in T302. It also starts on RRCConnectionRelease with waitTime. The third is in T304. It also starts on conditional reconfiguration execution. At expiry, a UE with a DAPS bearer and no RLF in the source PCell starts the failure information procedure instead.

T310 changed the most. It now refers to the PCell, and it also stops when the UE starts the MCG failure information procedure. At expiry with security active, the UE starts either the MCG failure information procedure or re-establishment. Finally, T321 now also stops when the UE detects that the cell does not broadcast SIB1. The barring timers T302, T303 and T305 and the priority timer T320 also gained stop events for EDT and PUR. Only T301 and T311 are unchanged.

• Every row has a start, a stop and an expiry action : the expiry action tells you what the UE does when the expected message never comes.
• T300, T301 and T311 guard connection setup and re-establishment : their expiry ends in the actions of 5.3.3.6 or in RRC_IDLE.
• T302, T303 and T305 release access barring : the UE informs upper layers about barring alleviation when they expire or stop.
• The early table is still valid in outline : the current rows add Resume, EDT, conditional handover, DAPS and MCG failure information cases.

Which timers have later releases added ?

The timer list grew with every release, because each new feature needed its own guard or its own prohibit timer. The list is long, but most rows belong to a single feature. A UE runs a timer only when the network has configured the feature that uses it.

The table below lists the timers that 36.331 v19.3.0 adds to the early table. The start and expiry entries are shortened from clause 7.3.1, so check the clause for the exact stop conditions.

Look at the T34x rows. Their expiry action is No action, and that is not an error in the table. These are prohibit timers. The UE starts one when it sends a UEAssistanceInformation report of a given type. While the timer runs, the UE does not send another report of that type, so the timers limit how often the UE reports.

Two notes under the table in clause 7.3.1 also matter. Only the timers marked NOTE1 apply to NB-IoT. These are T300, T301, T309, T310, T311, T317, T318, T322, T326 and T390. And clause 7.3.2 says that a timer with the value zero starts and expires at once, unless the procedure text says otherwise.

• New features brought new timers : CS fallback, dual connectivity, ACDC, RRC_INACTIVE, NTN and UE assistance each added their own.
• The T34x timers are prohibit timers : they have no expiry action and only limit how often the UE sends UEAssistanceInformation.
• NB-IoT uses a short subset : only the ten timers marked NOTE1 apply to it.
• A timer value of zero expires at once : so a configured value of 0 is not the same as no timer.

How do T310, T311 and T301 take the UE from a radio problem to RRC_IDLE ?

The timers in the tables are easier to understand as a chain. A radio link failure is the most common case in a field log, and it uses four timers in sequence. So let's follow one UE from the first out-of-sync indication to RRC_IDLE.

The first step is detection. Layer 1 reports out-of-sync and in-sync indications to RRC. After N310 consecutive out-of-sync indications for the PCell, the UE starts T310. It does this only while none of T300, T301, T304, T311 and T316 is running. If N311 consecutive in-sync indications arrive while T310 runs, the UE stops T310 and keeps the connection without any signalling.

The second step is the failure itself. The UE declares radio link failure when T310 expires. It also declares it on T312 expiry, on a random access problem from MAC, or when RLC reaches the maximum number of retransmissions. T312 is the early exit. The network enables it for a measurement with useT312, so a UE that has already triggered a measurement report can give up on the serving cell sooner than T310 allows.

The third step is recovery. With AS security active, the UE starts re-establishment and starts T311 while it searches for a suitable cell. When it selects a cell, it stops T311, starts T301 and sends RRCConnectionReestablishmentRequest. If T311 expires, or T301 expires, or the selected cell becomes unsuitable, the UE goes to RRC_IDLE. Without AS security the UE skips re-establishment and goes to RRC_IDLE directly.

The values come from SystemInformationBlockType2. Its ue-TimersAndConstants carries t300, t301, t310, n310, t311 and n311. The network can override the radio link values for one UE with rlf-TimersAndConstants-r9 in RadioResourceConfigDedicated. So when you compare a log with the table, check the dedicated values first.

• T310 is the grace period : the UE waits for N311 in-sync indications before it gives up on the PCell.
• T312 shortens the wait : it runs only after a measurement report, so a UE that is already leaving the cell fails faster.
• T311 limits the cell search and T301 limits the answer : either expiry sends the UE to RRC_IDLE.
• Security decides the path : without AS security there is no re-establishment, and radio link failure leads straight to RRC_IDLE.
• Dedicated values override SIB2 : rlf-TimersAndConstants-r9 replaces the broadcast values for one UE.

Reference

• 3GPP TS 36.331 v19.3.0 : Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Resource Control (RRC); Protocol specification. Clause 7.3.1 Timers, 7.3.2 Timer handling, 7.4 Constants, 5.3.7 RRC connection re-establishment and 5.3.11 Radio link failure related actions.