Timing Advance in LTE 4G
Why uplink timing must be advanced, how it's acquired at RACH and maintained by the Timing Advance Command MAC CE.
In the uplink, every UE sits a different distance from the eNB, so their signals take different times to arrive. Timing Advance is the trick that fixes this: the eNB tells each UE to start transmitting early — a near UE a little, a far UE a lot — so that all their bursts land aligned at the eNB's receive antenna. Get this wrong and uplink orthogonality collapses; get it right and dozens of UEs share the same subframe cleanly. This page is grounded in TS 36.321 (MAC) and TS 36.213 (physical-layer procedures).
Introduction
Timing Advance (TA) is the per-UE uplink-timing correction that keeps LTE's uplink orthogonal. Because the eNB receives every UE through one common FFT window, and radio waves take a finite time to travel, a UE must begin transmitting before the moment it would if it simply mirrored the downlink it hears — advancing by its round-trip propagation delay so its burst lands on the eNB's subframe boundary.
Where does it fit in the lifecycle? TA is born in random access: the UE's first uplink (the PRACH preamble) goes out with no advance, the eNB measures the delay, and the initial TA rides back in the Random Access Response. From then on the eNB tracks the UE and issues running corrections in a Timing Advance Command MAC CE, while the timeAlignmentTimer polices how long a stored TA can be trusted. Under carrier aggregation this generalises to per-TAG timing.
Why it matters: a stale or wrong TA does not just hurt one UE — a misaligned burst spills across the FFT window and interferes with other UEs sharing the subframe. So TA is both a coverage mechanism (it bounds cell radius) and an interference-control mechanism, and it is a frequent suspect whenever uplink throughput or access reliability degrades with distance or mobility.
On this page
Why timing advance is needed
In plain words: imagine a choir where the singers stand at different distances from a single microphone. If everyone starts on the same beat, the far singers reach the mic late and the sound arrives smeared. The conductor's fix is to tell the far singers to start early — the further away, the earlier — so every voice hits the microphone on the beat. Timing Advance is that instruction: the eNB is the mic, each UE is a singer, and the TA command tells each one exactly how early to start.
Concretely, LTE's uplink is orthogonal only if every UE's subframe boundary lines up at the eNB antenna, because the receiver samples one common FFT window shared across all UEs. Propagation delay breaks that: a UE 10 km away is delayed ~33 μs each way. Without correction, near and far UEs would arrive smeared apart, spilling across the window boundary into neighbouring symbols and destroying the orthogonality that keeps them separated. TA restores it by advancing each UE's transmission by its own round-trip delay.
Why Uplink Timing Has To Be Advanced
LTE uplink is orthogonal in the frequency domain (SC-FDMA): each UE is assigned its own resource blocks, and the eNB's receiver assumes that every UE's subframe boundary lines up at the instant the signal reaches the antenna. That assumption is the whole basis of the FFT window — the receiver samples one common window and expects every UE's symbols to sit inside it, sharing one cyclic prefix budget. But radio waves travel at a finite speed — roughly 3.3 μs per kilometre, each way. A UE 10 km from the eNB sees its signal delayed by about 33 μs on the way up; a UE right under the tower has almost no delay. If both simply transmitted on the downlink timing they receive, their bursts would arrive at the eNB smeared apart in time, spilling across the FFT window boundary into neighbouring symbols and destroying the orthogonality that keeps the UEs separated.
A per-UE time offset, signalled by the eNB, that tells the UE to begin its uplink transmission before the moment it would if it simply mirrored the downlink timing it receives. The offset is denoted N_TA and expressed in units of the basic time unit T_s.
To compensate the round-trip propagation delay so that transmissions from UEs at different distances all arrive time-aligned at the eNB, preserving uplink orthogonality and keeping every UE inside a common cyclic prefix and FFT window.
The eNB measures how early or late a UE's uplink arrives and sends a Timing Advance Command — first in the Random Access Response, then as running corrections in a MAC control element — that the UE applies to its transmit timing.
The intuition worth carrying: a far UE must "fire early" so its slower-arriving signal catches up to the near UE's. The correction is essentially the whole round trip, not just the one-way delay. Here is why. The UE has only one clock reference: the downlink it receives, which is already delayed by the one-way trip on the way down. When the UE transmits, its signal is delayed again by the one-way trip on the way up. So relative to the eNB's absolute timing, an uncorrected uplink would land two one-way delays — one full round trip — late. The eNB therefore commands the UE to advance by the round-trip delay, so the two effects cancel and the burst arrives exactly on the eNB's subframe boundary.
The core equation of intent: the timing advance a UE applies equals its round-trip propagation delay. Downlink arrives one-way-late; uplink adds another one-way-late; advancing by the sum lands the burst on time at the eNB.
Initial Timing Advance — from the Random Access Response
The very first uplink a UE ever sends — the PRACH preamble during random access — goes out with no timing advance, because the UE has no idea of its distance yet. The preamble is deliberately built with a long cyclic prefix and guard time so it can absorb the full unknown round-trip delay of a UE anywhere in the cell. From the received preamble, the eNB measures that delay (essentially, how far the preamble slid inside the guard region) and computes the correction the UE needs.
It ships that correction back in the Random Access Response (Msg2), inside a MAC RAR that carries an 11-bit Timing Advance Command. This field is an index T_A in the range 0 to 1282. Because the UE has no stored offset at this point, the value is treated as an absolute timing offset, set from scratch. The UE turns the index into a physical offset with the mapping below.
step = 16 · T_s ≈ 0.52 μs · max N_TA = 1282 × 16 · T_s ≈ 0.667 ms
So the granularity of one step is 16·T_s ≈ 0.52 μs, and the largest correction the field can express is 1282 × 16 · T_s ≈ 0.667 ms of round-trip time. That single 0.52 μs step is not an arbitrary number — it is one sixteenth of the smallest useful sample duration in the 30.72 MHz LTE sampling grid, chosen so the correction is fine enough that residual misalignment stays comfortably inside the normal cyclic prefix. Because the field is 11 bits with this wide range, the initial value is a full absolute offset — quite different from the small relative nudges used afterwards.
Anchor number: one Timing Advance Command step in LTE is 16·T_s ≈ 0.52 μs. Since radio takes about 3.3 μs/km round trip, one step corresponds to roughly 78 m of change in the UE-to-eNB distance. Memorise the pair "0.52 μs per step, ~78 m per step" — almost every TA arithmetic question falls out of it.
A subtlety worth stating: what the RAR delivers is the timing advance, but the UE's actual transmit offset also folds in a fixed quantity N_TA,offset that accounts for the frame-structure difference between downlink and uplink. In FDD LTE this offset is zero, so N_TA from the command is the whole story; it becomes relevant in TDD and, later, in NR where different bands and duplex modes carry different fixed offsets. For LTE FDD you can safely reason with N_TA alone.
✅ Debugging steps (initial TA in the RAR)
- Confirm a RAR (Msg2) was received in-window and that its 11-bit
Timing Advance Commandwas actually applied before Msg3. - Sanity-check the TA index against the expected cell range — ~78 m per step; a wildly large value on a small cell hints at a false correlation peak or interference.
- Verify Msg3 arrived time-aligned at the eNB (Msg3 CRC pass); a Msg3 CRC failure right after a valid RAR often means the TA was not applied.
- For TDD or NR, confirm the correct
N_TA,offsetis being added; a missing offset shifts every burst by a fixed amount.
⚠ Common causes of failure (initial TA)
- eNB mis-measures the preamble delay under low SINR or high PRACH interference, so the initial TA is wrong.
- UE applies the RAR TA late or not at all, so Msg3 lands outside the FFT window and fails CRC.
- Preamble format's CP/guard too short for the true round-trip, so the delay cannot be measured accurately at all (UE too far for the chosen format).
- Wrong or missing
N_TA,offsetin TDD/NR, biasing every uplink burst.
Maintaining TA — the Timing Advance Command MAC CE
A connected UE keeps moving, and its distance keeps changing, so a single initial value goes stale within seconds at vehicular speeds. As the eNB keeps receiving the UE's uplink — normal PUSCH/PUCCH transmissions, or dedicated SRS (Sounding Reference Signal) — it continuously measures arrival timing and issues corrections whenever the UE has drifted past a fraction of the cyclic prefix.
These running corrections travel in the Timing Advance Command MAC CE, a MAC control element identified by its own logical channel ID (LCID) in the MAC subheader of a downlink MAC PDU. Unlike the initial RAR command, this one is only 6 bits and is a relative adjustment: the index T_A runs 0 to 63, and the UE updates its stored offset around a mid-point of 31.
So T_A = 31 means "no change", values above 31 push the timing earlier (the UE is moving away and its round trip is growing), and values below 31 pull it later (the UE is moving closer), in the same 16·T_s steps. The command therefore spans roughly −16 μs (T_A = 0, i.e. −31 steps) to +16.5 μs (T_A = 63, i.e. +32 steps) of adjustment per command. Small, frequent nudges keep the UE aligned without ever having to resend the full 11-bit value — the absolute offset is set once by the RAR, then only ever incremented or decremented.
Notice the design economy: the same 16·T_s step underlies both commands, so the RAR and the MAC CE speak the same unit. The only differences are the field width (11 bits absolute vs 6 bits relative) and the reference point (from zero vs around a running value). This is the classic "coarse acquire, fine track" split that shows up throughout radio-layer control.
| Aspect | Initial TA (acquisition) | TA maintenance (tracking) |
|---|---|---|
| Carrier | Timing Advance Command in the Random Access Response (Msg2) | Timing Advance Command MAC CE in a downlink MAC PDU |
| Field size | 11 bits | 6 bits |
Index range T_A | 0 … 1282 | 0 … 63 |
| Nature | Absolute (set from zero) | Relative (centred on 31 = no change) |
| Mapping | N_TA = T_A × 16 · T_s | N_TA,new = N_TA,old + (T_A − 31) × 16 · T_s |
| Step size | 16 · T_s ≈ 0.52 μs | 16 · T_s ≈ 0.52 μs (same) |
| Range of one command | 0 … ≈ 0.667 ms | ≈ −16 … +16.5 μs |
| Measured from | PRACH preamble arrival | PUSCH / PUCCH / SRS arrival |
| When used | Once, entering connected state | Repeatedly, throughout the connection |
Two commands, two jobs: the 11-bit Timing Advance Command in the RAR sets an absolute initial value (index 0–1282); the 6-bit Timing Advance Command MAC CE applies relative corrections (index 0–63, centred on 31) during the connection. Same step, different job.
Reading TA maintenance in the logs
The eNB emits a TA MAC CE whenever the measured drift exceeds its threshold. In the trace you want to see corrections that keep N_TA tracking a slow trend (the UE moving), and you want each one to restart the timeAlignmentTimer.
Representative eNB/UE log — illustrative, values vary by vendor/build:
| Field | Meaning | Example (from log) | Debugging check |
|---|---|---|---|
measSrcCe | Uplink signal the eNB timed the drift from. | SRS | If the UE stopped sending SRS/PUSCH, the eNB loses its timing reference and cannot correct. |
Ta_index | 6-bit relative index in the MAC CE (0–63). | 35 | Values >31 push earlier, <31 later, 31 = no change; a stream of extremes signals fast mobility. |
delta | (Ta_index−31) steps applied. | +4 steps | Each step ≈ 0.52 μs / ~78 m; confirm the trend matches the UE's motion. |
tagId | 2-bit Timing Advance Group the CE applies to. | 0 (pTAG) | Correction must target the right TAG under CA; a wrong tagId misaligns the wrong carrier. |
timeAlignmentTimer | Restarts on every valid TA command; expiry = out of sync. | sf1920 | Confirm each CE restarts it; a gap longer than the timer forces a fresh RACH. |
✅ Debugging steps (TA maintenance)
- Check the eNB has a live uplink reference (PUSCH/PUCCH/SRS); no reference means no corrections and eventual timer expiry.
- Confirm each TA MAC CE is decoded and applied by the UE, and that it restarts the
timeAlignmentTimer. - Trace the
N_TAtrend against UE mobility — corrections should follow a smooth trend, not jump erratically. - Under CA, verify the
tagIdin each CE routes the correction to the intended TAG.
⚠ Common causes of failure (TA maintenance)
- UE goes quiet (no SRS/PUSCH), so the eNB cannot measure drift and the timer lapses.
- TA MAC CE lost on a poor downlink, so the UE drifts uncorrected past the CP margin.
- Fast mobility outrunning the correction cadence, so uplink smears before the next CE lands.
- Wrong
tagIdunder CA, applying a correction to the wrong carrier group.
Picture It — Near and Far UEs Aligning
Two UEs, one close and one far, both want their uplink subframes to land at the eNB at the same instant. The far UE must advance its transmit start by much more than the near one, because its signal has a longer road to travel. Read the figure as time flowing left to right: the further left a UE begins its burst, the earlier it fires.
The picture also explains why the correction tracks distance so directly. Every 78 m of extra range adds one 16·T_s step to the far UE's advance. A UE crossing a cell at 120 km/h moves ~33 m/s, so its round trip changes by about one step every two-and-a-bit seconds — which is exactly the cadence at which the eNB fires Timing Advance Command MAC CEs to keep it aligned.
The timeAlignmentTimer — Staying In Sync
A TA value only stays valid while the UE keeps hearing corrections. If the UE goes quiet or the eNB stops tracking it, the stored offset slowly goes stale as the UE keeps moving — and transmitting on a stale offset would land the burst outside the eNB's window and smash into other UEs. LTE guards against exactly this with the timeAlignmentTimer, configured by RRC (in MAC-MainConfig, values expressed in subframes: sf500, sf750, sf1280, sf1920, sf2560, sf5120, sf10240, or infinity).
A per-TAG countdown timer that marks how long the UE may consider itself uplink time-aligned on that group of cells.
Transmitting on an out-of-date TA would arrive misaligned and interfere with other UEs, so the UE must stop uplink once alignment can no longer be trusted.
The timer (re)starts every time the UE receives a Timing Advance Command — from the RAR or a MAC CE. While it runs the UE is uplink-synchronised; when it expires the UE is out of sync for that TAG.
On expiry — when the UE has heard no correction for the whole timer duration — the UE declares itself uplink out-of-sync and takes a defined set of actions: it flushes its HARQ buffers, releases its PUCCH and SRS resources, clears any configured downlink assignments and uplink grants, and — crucially — must not send any uplink on the affected cells until it re-acquires timing. Because there is now no valid grant and no valid offset, the only way back is random access (RACH): the UE sends a fresh PRACH preamble, the eNB re-measures its delay, and a new RAR delivers a fresh initial TA before any uplink can resume.
One nuance often missed: receiving a TA MAC CE that commands "no change" (T_A = 31) still counts as a valid command and still restarts the timer. This lets the eNB keep an idle-but-aligned UE in sync cheaply — a periodic "31" heartbeat refreshes the timer without actually moving the UE's offset. If the eNB has genuinely nothing to send and lets the timer lapse, the release-and-RACH cost is the price of reclaiming the UE's PUCCH/SRS resources for others.
✅ Debugging steps (timeAlignmentTimer)
- Check whether the timer expired before the failure — an out-of-sync log line explains a sudden loss of uplink and a spontaneous RACH.
- Confirm the eNB was sending periodic TA CEs (including "31" heartbeats) frequently enough relative to the configured
timeAlignmentTimervalue. - Verify the UE tore down
PUCCH/SRSand grants on expiry, and re-acquired via RACH rather than transmitting on a stale TA. - Under CA, check which TAG's timer expired — pTAG expiry drops all TAGs; sTAG expiry drops only that group.
⚠ Common causes of failure (timeAlignmentTimer)
timeAlignmentTimerset too short for the traffic pattern, so a quiet UE keeps falling out of sync and re-RACHing.- eNB stops sending TA CEs/heartbeats (scheduler starvation, DL congestion), letting the timer lapse.
- UE transmits on a stale TA after expiry (bug), causing uplink interference to other UEs.
- pTAG timer expiry taking down SCell uplink unexpectedly during CA.
TA and Cell Size — Why Timing Bounds Coverage
Because the maximum advance the initial 11-bit command can express is finite, it directly caps how far a UE can be and still be served: the maximum TA sets the maximum cell radius. The largest N_TA (index 1282) is about 0.667 ms of round-trip time. Halve it for the one-way trip, multiply by the speed of light, and you get a one-way distance of roughly 100 km. That is the physical-layer ceiling on LTE cell radius imposed by timing advance alone.
Two clarifications keep this honest. First, the 11-bit RAR range is one limit, but it is not usually the binding one — the PRACH preamble format's cyclic prefix and guard time set their own ceiling on the delay the eNB can even measure, and standard preamble formats top out well below 100 km. Reaching 100 km requires the extended-cell preamble formats designed for the purpose. Second, "100 km" is the timing ceiling, not a link-budget promise; long before a UE is 100 km out, path loss has usually made the link unusable anyway. So TA defines the outer boundary of the possible, while coverage in practice is set by power and antennas.
The chain in one line: finite TA field → finite maximum N_TA (≈ 0.667 ms) → finite one-way delay (≈ 0.33 ms) → finite maximum range (≈ 100 km). Timing is why LTE cells cannot be arbitrarily large.
Timing Advance Groups — TA under Carrier Aggregation
Everything so far assumed one uplink carrier with one round-trip delay. Carrier aggregation (CA) breaks that assumption. When a UE aggregates several serving cells, those cells may be transmitted from the same site or from different bands with different propagation characteristics — and if a low band and a high band travel different paths (or a remote radio head sits at a different distance), their round-trip delays differ. A single TA value can no longer keep every carrier aligned.
Release‑11 solved this with Timing Advance Groups (TAG). Serving cells that share the same uplink timing are grouped into one TAG, and each TAG carries its own N_TA and its own timeAlignmentTimer. The eNB assigns cells to TAGs by RRC configuration, and every Timing Advance Command MAC CE now carries a 2-bit TAG Identity so the UE knows which group a correction applies to.
| TAG type | Contains | How its TA is acquired | Notes |
|---|---|---|---|
| pTAG (primary TAG) | The PCell (and any SCells sharing its timing) | From the RAR during initial random access on the PCell | TAG Id 0 by definition; always exists; timing reference for the connection |
| sTAG (secondary TAG) | One or more SCells with a different uplink timing | From a RAR obtained via an eNB-ordered random access on an SCell of that sTAG | Optional; TAG Id 1–3; only exists when SCells need a distinct TA |
The mechanics follow naturally. The pTAG always contains the PCell, and its initial TA comes from the ordinary random access the UE did to connect. An sTAG groups SCells whose timing differs from the PCell's; because a UE cannot send a spontaneous preamble on an SCell, the eNB triggers a PDCCH-ordered random access on one SCell of the sTAG, and the resulting RAR delivers that sTAG's initial TA. From then on, each TAG is maintained independently — its own MAC CE corrections, its own timer. If a pTAG's timeAlignmentTimer expires, the UE treats all TAGs as out of sync (the PCell is the anchor); if an sTAG's timer expires, only that sTAG's SCells lose uplink alignment while the PCell carries on.
Rel-11 rule of thumb: one TAG = one uplink timing = one N_TA + one timeAlignmentTimer. The PCell lives in the pTAG (TAG Id 0), acquired via normal RACH; SCells with different delay live in an sTAG, acquired via PDCCH-ordered RACH. The MAC CE's 2-bit TAG Id routes each correction to the right group.
The same idea carries straight into 5G NR, with one twist. NR keeps TAGs, pTAG/sTAG, and the timeAlignmentTimer essentially unchanged in concept, but the timing-advance step is no longer a fixed 16·T_s. Because NR supports multiple subcarrier spacings (SCS), the TA step scales with numerology: the granularity is 16·64·T_c / 2μ, so a higher SCS (larger μ) gives a proportionally finer TA step, matching its shorter symbols and tighter cyclic prefix. The command formats change accordingly (NR's initial TA index runs 0–3846), but if you understand LTE's "absolute from RAR, relative from MAC CE, per-TAG timer" model, you already understand the NR machinery — only the units breathe with the numerology.
LTE ↔ NR: the model is shared — absolute initial TA from the RAR, relative corrections in a Timing Advance Command MAC CE, a per-TAG timeAlignmentTimer, and pTAG/sTAG under CA/DC. What changes in NR: the RAR TA index widens to 0–3846 (12 bits), the step scales with numerology as 16·64·T_c / 2μ instead of a fixed 16·T_s, the basic time unit becomes T_c, and duplex/band-dependent N_TA,offset values matter more. The reasoning and debugging habits transfer directly.
Q. Where does a UE get its first timing advance, and how big is the field?
A. From the Random Access Response (Msg2), which carries an 11-bit Timing Advance Command with index 0–1282. It sets an absolute offset N_TA = T_A × 16 · T_s.
Q. How is TA maintained afterwards, and how does that command differ from the initial one?
A. Via the 6-bit Timing Advance Command MAC CE. The eNB tracks the UE's uplink (PUSCH/PUCCH/SRS) and sends relative corrections (index 0–63, centred on 31), unlike the RAR command which is an absolute 11-bit value. Both use the same 16·T_s ≈ 0.52 μs step.
Q. What happens when the timeAlignmentTimer expires?
A. The UE is no longer uplink-synchronised for that TAG: it stops all uplink, releases PUCCH/SRS and clears grants, flushes HARQ buffers, and must perform random access (RACH) to obtain a fresh TA before it can transmit again.
Q. Why does timing advance limit LTE cell radius to about 100 km?
A. The maximum N_TA is about 0.667 ms of round trip. Half that is the one-way delay (≈ 0.33 ms); times the speed of light gives ≈ 100 km. Beyond that the UE cannot be advanced enough to stay aligned.
Q. What problem do Timing Advance Groups solve, and what is the pTAG vs sTAG split?
A. Under carrier aggregation, aggregated cells can have different uplink timing. Each TAG holds cells sharing one timing, with its own N_TA and timer. The pTAG (TAG Id 0) contains the PCell, acquired via normal RACH; an sTAG groups SCells with different delay, acquired via PDCCH-ordered RACH. Introduced in Rel-11.
Q. How does NR's timing advance differ from LTE's?
A. The concept (RAR-absolute, MAC-CE-relative, per-TAG timer, pTAG/sTAG) is the same, but NR's TA step scales with subcarrier spacing (16·64·T_c / 2μ) instead of a fixed 16·T_s, so higher SCS gets a finer step, and the initial index runs 0–3846.
Summary
Timing Advance is the correction that keeps LTE uplink orthogonal: each UE fires early by its own round-trip delay so every burst lands inside the eNB's one shared FFT window. Acquire it once as an absolute 11-bit value in the RAR (N_TA = T_A×16·T_s, step ≈ 0.52 μs ≈ 78 m), then track it with small relative 6-bit MAC-CE corrections around a midpoint of 31, each of which restarts the timeAlignmentTimer.
When you debug a TA-related problem, locate the phase: an initial-TA problem shows as Msg3 failing right after a valid RAR; a maintenance problem shows as drift outrunning the corrections or the eNB losing its uplink reference; a timer problem shows as a spontaneous out-of-sync and re-RACH after a quiet period. Remember the two ceilings TA imposes — the ~100 km cell-radius limit from the finite field, and the per-TAG independence under carrier aggregation — and the same reasoning carries into NR, where only the units scale with numerology.
Where timing advance connects
Timing advance is born in random access, carried by MAC control elements, gates the retransmission machinery once the UE falls out of sync, and scales into NR with numerology. Follow these threads next.