Timing Advance in 5G NR

1. Why Uplink Time Alignment Exists

In the downlink the gNB is the only transmitter, so everything it sends is aligned by construction. The uplink is the opposite: dozens of independent transmitters share one resource grid, and each one is a different distance away. Radio travels at roughly 300 m per microsecond, so a UE 9 km out and a UE 300 m out are separated by about 29 µs of one-way delay. If both simply transmitted at what their own clocks believe is the slot boundary, their symbols would arrive at the gNB tens of microseconds apart — far more than one cyclic prefix — and the FFT the receiver runs over symbol l would contain fragments of symbol l−1 from one UE and symbol l+1 from another.

That is not a mild degradation. OFDM's subcarrier orthogonality is a property of the integration window: it holds only if the receiver's window contains exactly one period-aligned copy of each transmitted symbol. Break the alignment and you get inter-symbol interference and inter-carrier interference simultaneously, and both scale with the misalignment, not with distance or power. A misaligned UE therefore does not merely fail to be decoded — it raises the noise floor for everyone else scheduled in the same symbols.

Timing Advance is the fix, and it is deliberately the simplest possible one. The UE derives its own timing from the downlink it receives, which is already late by one one-way delay τ. It then pulls its uplink transmission forward by N_TA, an amount the network tells it, and the network sets N_TA ≈ 2τ. The uplink then travels τ back and arrives exactly on the boundary. Near UEs get a small advance; far UEs get a large one; the gNB sees one arrival instant.

What actually invokes the mechanism is worth separating out:

Table 1. Every way a UE's uplink timing can change. Only two of these five set N_TA from nothing; the rest either adjust it or take it away.

2. The gNB Receive Window and the Cyclic Prefix Budget

The cyclic prefix is a copy of the tail of each OFDM symbol prepended to its front. Its job in the downlink is to absorb multipath delay spread; in the uplink it does that and absorbs residual timing error. A UE whose transmission arrives anywhere inside the CP is decoded cleanly, because the receiver's FFT window still sees one whole period-aligned symbol. A UE that arrives after the CP ends is not.

This is why the CP length, not the link budget, is the real constraint on how badly timing can be allowed to drift. The normal CP at 30 kHz is 2.34 µs, and that 2.34 µs must be shared between channel delay spread (often 0.5–1.5 µs in a macro cell), N_TA quantisation, and whatever residual error the closed loop has not yet corrected.

Table 2. Cyclic prefix per numerology. The last column is c·CP/2: how wrong the network's idea of a UE's range can be before the resulting round-trip error consumes the entire cyclic prefix, leaving nothing for delay spread. µ=5 and µ=6 are FR2-2, Rel-17; extended CP is defined only for µ=2.

3. T_c, N_TA, and the Formula That Ties Them Together

Timing advance is never expressed in microseconds on the wire. It is expressed in T_c, the basic NR time unit, so that one integer works unchanged across every numerology:

T_c  =  1 / (delta_f_max * N_f)                  [TS 38.211 cl. 4.1]
     =  1 / (480 000 * 4096)  s
     =  0.508 626...  ns          (~0.509 ns, or ~1.966 GHz sample rate)

N_TA =  T_A * 16 * 64 / 2^mu                     [TS 38.213 cl. 4.2]

  T_A   the value carried in the RAR (0..3846) or derived from the
        MAC CE (see below); dimensionless
  mu    numerology of the uplink transmission the command applies to
        0 = 15 kHz, 1 = 30, 2 = 60, 3 = 120, 4 = 240, 5 = 480, 6 = 960
  64    = kappa, the fixed ratio T_s / T_c
  16    the step multiplier, chosen so that one step is 16 * T_s at mu=0

For the MAC CE, T_A in the formula is the *change*:
  N_TA_new = N_TA_old + (T_A - 31) * 16 * 64 / 2^mu ,  floored at 0
  where T_A is the 6-bit field, 0..63, and 31 means no change.

Two things follow from the 16 · 64 / 2^µ factor and both matter when reading logs. First, the step is the same absolute time at 15 kHz as LTE's step was — 16·T_s ≈ 0.521 µs — which is deliberate: the quantisation was already fine enough relative to a 15 kHz cyclic prefix, so 3GPP kept it. Second, the step halves every time the numerology doubles, so the same integer T_A means a different amount of time depending on the SCS of the uplink it is applied to. A TA command value copied between two logs at different numerologies is not comparable.

The actual transmit instant combines N_TA with a second, constant term covered in §7 TS 38.211 cl. 4.3.1:

T_TA = (N_TA + N_TA_offset) * T_c

The UE begins transmitting uplink frame i exactly T_TA seconds BEFORE
the start of the corresponding downlink frame i as it observes it.

Special case: for PRACH, N_TA = 0.  The preamble is deliberately sent
with no advance -- its arrival time is the measurement.

4. Granularity and Range, Numerology by Numerology

Because the step size scales with numerology and the field widths do not, both the resolution and the maximum expressible advance depend on µ. This table is the one worth keeping to hand:

Table 3. One TA step, and the ceiling imposed by the 12-bit RAR field (T_A ≤ 3846). "Max N_TA" is a round-trip figure; the range column halves it and converts at c. µ=4 carries SSB only; µ=5 and µ=6 are FR2-2. Values rounded.

A TA value read as a distance is one of the few cheap sanity checks available on a live cell. If a UE reports RSRP consistent with 500 m and the gNB is holding N_TA equivalent to 9 km, the likely explanations are, in order: the UE is being served by a repeater or an RF-over-fibre remote radio head whose feeder delay is in the loop; the dominant path is a strong reflection rather than the line of sight; or the log is quoting a different cell's TAG. All three are real, and none of them is "the UE moved".

5. The Initial Value: the 12-Bit Timing Advance Command in the RAR

A UE arriving from RRC_IDLE has no idea how far away the gNB is, and the gNB has no idea the UE exists. The PRACH preamble breaks the deadlock because it is sent with N_TA = 0: whatever lateness the gNB measures on its arrival, relative to the nominal PRACH occasion, is the round-trip delay. The gNB quantises that into a 12-bit field and returns it in the Random Access Response.

Table 4. Every field in NR that carries a timing advance. Confusing the 6-bit relative field with the 12-bit absolute one is the classic hand-decoding mistake — a 6-bit T_A of 45 is +14 steps, not 45 steps.

The initial command must be absolute and must span the whole cell because there is nothing to be relative to. The ongoing commands can be relative and narrow because they only have to track drift. That asymmetry is the entire reason for two different field widths, and it is also why 12 bits at 15 kHz reaches 300 km one-way while a single 6-bit adjustment at the same numerology moves the UE by at most 2.5 km.

One consequence for 2-step Random Access: MSGA's PUSCH payload is transmitted before any RAR has been received, so it goes out with whatever N_TA the UE already holds — zero, for a UE coming from RRC_IDLE. That is the real reason msgA-RSRP-Threshold gates 2-step selection: the payload has to survive being untimed, which only works when the UE is close enough that its round-trip delay already fits inside the cyclic prefix.

6. Maintaining It: the Timing Advance Command MAC CE

Propagation delay is not static. A UE at 100 km/h changes its distance to the gNB by up to 27.8 m per second, which at 30 kHz is a whole TA step every 1.4 seconds. Correction therefore has to be continuous, and it has to be cheap — which is why it lives in MAC and not in RRC. There is no RRC message anywhere in NR that carries a timing advance.

6.1 The control element and its subheader

TAG Identity

Timing Advance Command

Table 5. Timing Advance Command MAC CE fields, TS 38.321 cl. 6.1.3.4.

6.2 The loop, and when the correction takes effect

The adjustment is not instantaneous. If the CE arrives in downlink slot n, the new timing applies from the beginning of uplink slot n + k + 1, where k is derived from the UE's PDSCH decoding capability N_T,1, its PUSCH preparation capability N_T,2, the largest timing advance the cell supports, and a 0.5 ms margin TS 38.213 cl. 4.2. Practically this is a few slots; it matters because uplink transmissions already in flight or already prepared use the old N_TA, and a log that shows a PUSCH with stale timing immediately after a TA command is showing correct behaviour.

6.3 The absolute variant

The relative CE cannot express a correction larger than ±32 steps, so any situation where the correct N_TA is far from the current one needs either a Random Access procedure or the absolute CE. Rel-16 introduced the latter for IAB, where a mobile-termination function must be aligned to a parent node's timing outright; Rel-17 reuses it in non-terrestrial deployments. It is carried under an extended LCID on DL-SCH rather than one of the sixty-four single-octet LCID codepoints, because those were already exhausted.

7. N_TA_offset: the Constant the UE Also Subtracts

N_TA is not the whole advance. The UE also applies a fixed, band-dependent offset N_TA_offset that has nothing to do with propagation and everything to do with the UE's own radio hardware. On a TDD carrier the UE has to physically switch its front end from receive to transmit between a downlink symbol and an uplink symbol; the offset buys the time for that switch and keeps the NR uplink timing interoperable with LTE on shared bands.

Table 6. N_TA_offset per TS 38.133 cl. 7.1.2. The network can override the band default by signalling n-TimingAdvanceOffset in ServingCellConfigCommon, whose enumeration members n0, n25600 and n39936 are these same numbers.

8. How the gNB Measures the Error, and How Often It Corrects

Nothing in the specification tells the gNB how to measure the timing error or when to issue a correction. TS 38.133 constrains the UE side (it must apply the advance it is given to within T_e) and TS 38.213 defines the arithmetic, but the measurement and the correction policy are implementation. What the specification does provide is the set of uplink signals a gNB can measure against:

Table 7. What the gNB can measure timing from. Time resolution scales with occupied bandwidth, which is why a UE holding a 4-PRB PUCCH and nothing else is tracked far less precisely than one being scheduled 100 PRB of PUSCH.

Correction cadence in practice follows from the geometry rather than from any parameter. A gNB has two independent reasons to send a CE: the measured error has grown past some fraction of the CP, or timeAlignmentTimer is about to expire and the uplink must be kept alive. The first is traffic- and mobility-dependent; the second is periodic at roughly half the timer value. Both produce CEs, and only the value distinguishes them.

9. Timing Advance Groups: pTAG, sTAG and Carrier Aggregation

One N_TA per UE is enough only if every serving cell the UE uses is the same distance away. With carrier aggregation that stops being true: cells on different bands may be radiated from different physical sites, from remote radio heads at the end of different fibre runs, or through a repeater. A Timing Advance Group is a set of serving cells that share one N_TA and one timeAlignmentTimer because they share, to within a cyclic prefix, one propagation delay.

TAG Identity

Table 8. pTAG and sTAG. The distinction is not about importance — it is about which cell the timing is referenced to, and therefore what is lost when it lapses.

10. timeAlignmentTimer and the Cost of Expiry

N_TA is a cached measurement, and the network's confidence in it decays. If a UE has not been told anything for several seconds it may have moved, changed dominant path, or been handed to a repeater. Rather than let it keep transmitting on stale timing — which would interfere with everyone else — NR gives every TAG a timeAlignmentTimer, restarted on every Timing Advance Command MAC CE and on every absolute command for that TAG, and treats expiry as loss of uplink synchronisation TS 38.321 cl. 5.2.

Table 9. timeAlignmentTimer expiry, action by action, TS 38.321 cl. 5.2. The asymmetry in the last two rows is the operationally important part.

11. Worked Arithmetic, End to End

Putting §§3–7 together for one UE, from Random Access to a maintained steady state. FR1 TDD band, 30 kHz uplink (µ = 1), UE 8.0 km from the gNB, normal cyclic prefix.

Table 10. One UE, eleven lines, from preamble to a maintained steady state. Note step 5: the initial quantisation error is far smaller than the CP, which is exactly the design intent — the step size was chosen relative to the 15 kHz CP and every higher numerology shrinks both together.

It is worth noticing what step 9 does not need. The gNB never tells the UE its new absolute timing, never re-runs Random Access, and never involves RRC. One octet of MAC control element, plus its one-octet subheader, moved a UE 600 m and cost two bytes of downlink.

12. Non-Terrestrial Networks: When 12 Bits Are Not Enough

Every number in §4 assumes the transmitter is on the ground. A low-Earth-orbit satellite at 600 km has a one-way delay of about 2 ms at zenith and more at low elevation; a geostationary satellite is 35 786 km away, giving roughly 119 ms one way and about 239 ms of round trip on the service link alone, before the gateway feeder link is counted. The largest N_TA the 12-bit field can express at 15 kHz is 2.003 ms of round trip. It is short by two orders of magnitude, and no amount of relative nudging closes that gap.

Rel-17 solves it by splitting the total advance into components and moving most of the work to the UE, which in NTN is required to have GNSS. The network broadcasts the parts only it knows; the UE computes the part only it knows.

Table 11. The Rel-17 NTN timing decomposition. The design principle is that a quantity changing at tens of microseconds per second cannot be tracked by a downlink control element — it has to be predicted, and only the UE has the position to predict it with.

ta-Common-r17

ta-CommonDrift-r17

ta-CommonDriftVariation-r17

cellSpecificKoffset-r17

ntn-UlSyncValidityDuration-r17

Table 12. Rel-17 NTN timing parameters, from NTN-Config in SIB19 and ServingCellConfigCommon. Granularities are the units the specification defines the integers in; treat the decimal approximations here as approximate.

13. Parameter Reference: ASN.1, Ranges and Effects

timeAlignmentTimer

tag-Id

n-TimingAdvanceOffset

ServingCellConfigCommon

BWP-UplinkDedicated

ta-Report-r17

ta-Common-r17

cellSpecificKoffset-r17

ServingCellConfigCommon

ephemerisInfo-r17

Table 13. Configuration that determines timing-advance behaviour. Only the first three exist in Rel-15; everything below srs-Config is Rel-17 NTN.

14. Timers and Counters

timeAlignmentTimer

ntn-UlSyncValidityDuration-r17

ra-ResponseWindow

T304

Table 14. Timers that gate uplink timing. timeAlignmentTimer is the only one whose sole job is timing advance; the others bound procedures that happen to acquire or depend on it.

Notice what is not in that table: there is no retransmission counter and no failure counter anywhere in the timing-advance mechanism. A Timing Advance Command MAC CE is protected only by the HARQ process carrying its PDSCH, and if that PDSCH is finally undecodable the CE is simply gone — MAC never learns and the gNB never finds out, because MAC control elements are not acknowledged above HARQ. The whole safety net is timeAlignmentTimer, and its granularity is hundreds of milliseconds.

15. Failure Modes and What Each One Means

Table 15. Timing-advance failure modes. Note how many are silent — the mechanism has almost no self-diagnosis, which is why the checklist in §19 leans on cross-checks rather than on error indications.

16. ASN.1 Extracts

Timing-advance configuration is small and lives in three places: the TAG definitions in the MAC cell-group configuration, the offset in the common serving-cell configuration, and — for NTN — the timing block in SIB19. Abridged from TS 38.331; ... marks omitted fields and extension markers.

MAC-CellGroupConfig ::= SEQUENCE {
    drx-Config                     SetupRelease { DRX-Config } OPTIONAL,
    schedulingRequestConfig        SchedulingRequestConfig     OPTIONAL,
    bsr-Config                     BSR-Config                  OPTIONAL,
    tag-Config                     TAG-Config                  OPTIONAL,
    phr-Config                     SetupRelease { PHR-Config }  OPTIONAL,
    skipUplinkTxDynamic            BOOLEAN,
    ...
}

TAG-Config ::= SEQUENCE {
    tag-ToReleaseList  SEQUENCE (SIZE (1..maxNrofTAGs)) OF TAG-Id  OPTIONAL,
    tag-ToAddModList   SEQUENCE (SIZE (1..maxNrofTAGs)) OF TAG     OPTIONAL
}

TAG ::= SEQUENCE {
    tag-Id                 TAG-Id,
    timeAlignmentTimer     TimeAlignmentTimer,
    ...
}

TAG-Id ::= INTEGER (0..maxNrofTAGs-1)          -- maxNrofTAGs = 4

TimeAlignmentTimer ::= ENUMERATED {
    ms500, ms750, ms1280, ms1920, ms2560, ms5120, ms10240, infinity }

ServingCellConfigCommon ::= SEQUENCE {
    physCellId                  PhysCellId                     OPTIONAL,
    downlinkConfigCommon        DownlinkConfigCommon           OPTIONAL,
    uplinkConfigCommon          UplinkConfigCommon             OPTIONAL,
    n-TimingAdvanceOffset       ENUMERATED { n0, n25600, n39936 } OPTIONAL,
    ssb-PositionsInBurst        ...                            OPTIONAL,
    tdd-UL-DL-ConfigurationCommon TDD-UL-DL-ConfigCommon       OPTIONAL,
    ss-PBCH-BlockPower          INTEGER (-60..50),
    ...,
    [[ cellSpecificKoffset-r17  INTEGER (1..1023)              OPTIONAL ]]
}

Listing 1. TAG configuration and the offset. Note that timeAlignmentTimer is a field of TAG, not of the cell group — every TAG can have a different value, and often should.

NTN-Config-r17 ::= SEQUENCE {
    epochTime-r17                    EpochTime-r17              OPTIONAL,
    ntn-UlSyncValidityDuration-r17   ENUMERATED { s5, s10, s15, s20,
                                        s25, s30, s35, s40, s45, s50,
                                        s55, s60, s120, s180, s240,
                                        s900 }                  OPTIONAL,
    cellSpecificKoffset-r17          INTEGER (1..1023)          OPTIONAL,
    kmac-r17                         INTEGER (1..512)           OPTIONAL,
    ta-Info-r17                      TA-Info-r17                OPTIONAL,
    ntn-PolarizationDL-r17           ENUMERATED { rhcp, lhcp, linear } OPTIONAL,
    ntn-PolarizationUL-r17           ENUMERATED { rhcp, lhcp, linear } OPTIONAL,
    ephemerisInfo-r17                EphemerisInfo-r17          OPTIONAL,
    ta-Report-r17                    ENUMERATED { enabled }     OPTIONAL,
    ...
}

TA-Info-r17 ::= SEQUENCE {
    ta-Common-r17               INTEGER (0..66485757),
    ta-CommonDrift-r17          INTEGER (-257303..257303)       OPTIONAL,
    ta-CommonDriftVariation-r17 INTEGER (0..28949)              OPTIONAL
}

EphemerisInfo-r17 ::= CHOICE {
    positionVelocity-r17   PositionVelocity-r17,   -- ECEF state vector
    orbitalParameters-r17  Orbital-r17             -- Keplerian elements
}

Listing 2. NTN-Config, broadcast in SIB19 and reachable in dedicated signalling. The three ta-* fields are a value and its first two derivatives, so the UE can extrapolate the common component between broadcasts instead of needing one every few milliseconds.

17. Illustrative Message Traces

17.1 Configuration the UE is working from

RRCReconfiguration
 cellGroupConfig  (masterCellGroup)
  mac-CellGroupConfig
   tag-Config
    tag-ToAddModList
      TAG [0]
        tag-Id .................... 0            -- pTAG, contains PCell
        timeAlignmentTimer ........ ms1920
      TAG [1]
        tag-Id .................... 1            -- sTAG, mmWave SCell
        timeAlignmentTimer ........ ms1280       -- shorter: faster drift
   phr-Config ................... setup
  spCellConfig
   reconfigurationWithSync
    spCellConfigCommon
     physCellId .................. 214
     n-TimingAdvanceOffset ....... n25600        -- FR1 TDD, 13.02 us
     subcarrierSpacing ........... kHz30
  sCellToAddModList
   SCellConfig [1]
    sCellIndex ................... 1
    sCellConfigDedicated
     tag-Id ...................... 1             -- this SCell is in sTAG 1
     uplinkConfig
      initialUplinkBWP
       srs-Config
        srs-ResourceToAddModList
         SRS-Resource [0]
          resourceType ........... periodic
           periodicityAndOffset .. sl40          -- every 40 slots
          usage .................. codebook

Listing 3. Two TAGs, two timers, and an SRS resource on the SCell so the gNB has something to measure sTAG 1 against. An sTAG with no uplink reference signal is a timer expiry waiting to happen.

17.2 Acquiring the initial value, then maintaining it

09:41:02.118  [MAC-DL] RAR MAC PDU, RA-RNTI 1391, RAPID 23 matched
                MAC RAR
                  Timing Advance Command ..... 205
              -- mu=1 (30 kHz): N_TA = 205 x 16 x 64 / 2 = 104960 T_c
              --                             = 53.39 us round trip
              --                             ~ 8.00 km one-way path
              -- N_TA_offset = 25600 T_c (13.02 us, FR1 TDD)
              -- T_TA = 130560 T_c = 66.41 us of total advance
09:41:02.118  [MAC]    timeAlignmentTimer(TAG 0) started, ms1920
09:41:02.122  [MAC-UL] MSG3 on PUSCH, TC-RNTI 0x4601, advance applied

09:41:02.640  [PHY-UL] PUSCH DMRS arrival  +0.11 us vs expected  (32 PRB)
              -- 0.4 steps; below the correction threshold, no CE sent

09:41:03.900  [PHY-UL] SRS arrival        +0.61 us vs expected
              -- 2.3 steps at 30 kHz; past threshold -> correct by +2
09:41:03.902  [MAC-DL] Timing Advance Command MAC CE
                LCID ....................... 61
                TAG Identity ............... 0
                Timing Advance Command ..... 33
              -- (33 - 31) x 512 = +1024 T_c = +0.52 us = +78 m of range
              -- N_TA 104960 -> 105984 T_c   (53.39 -> 53.91 us)
09:41:03.902  [MAC]    timeAlignmentTimer(TAG 0) restarted, ms1920
09:41:03.906  [MAC]    adjustment effective from UL slot n+k+1
09:41:03.908  [MAC-UL] PUSCH still using old N_TA (prepared before n+k+1)
09:41:03.910  [MAC-UL] PUSCH using N_TA 105984
09:41:04.130  [PHY-UL] PUSCH DMRS arrival  +0.09 us vs expected  -- inside T_e

09:41:04.820  [MAC-DL] Timing Advance Command MAC CE  TAG 0  T_A = 31
              -- keep-alive: no timing change, timer restarted only

Listing 4. Absolute acquisition, one real correction, and one keep-alive. The two PUSCH lines at 09:41:03.908/.910 show the n + k + 1 application delay — the first uses the old value and is correct to do so.

17.3 An sTAG lapses while the pTAG keeps running

09:52:10.004  [MAC]    SCell 1 (sTAG 1) deactivated by SCell Activation/
                       Deactivation MAC CE
              -- no UL transmissions on SCell 1 from here; SRS suspended
09:52:10.004  [MAC]    timeAlignmentTimer(TAG 1) continues to run, ms1280
09:52:11.284  [MAC]    timeAlignmentTimer(TAG 1) EXPIRED
09:52:11.284  [MAC]    TAG 1 -> uplink out of sync
                       flush HARQ buffers ........ SCell 1 only
                       release PUCCH config ...... SCell 1 (none present)
                       release SRS config ........ SCell 1
                       clear configured grants ... SCell 1
09:52:11.284  [MAC]    TAG 0 (pTAG) unaffected, timer running, 1.42 s left
09:52:11.284  [MAC-UL] PCell uplink continues normally

09:52:19.700  [MAC-DL] SCell Activation/Deactivation MAC CE -- SCell 1 on
09:52:19.700  [MAC]    TAG 1 has no valid N_TA -> SCell 1 UL unusable
09:52:19.740  [PHY-DL] PDCCH order: DCI 1_0, C-RNTI 0x4601,
                       ra-PreambleIndex 47, SSB index 3, on SCell 1
09:52:19.760  [MAC-UL] CFRA preamble 47 on SCell 1 PRACH
09:52:19.770  [MAC-DL] RAR, Timing Advance Command 218  -- absolute, TAG 1
              -- N_TA(TAG 1) = 218 x 512 = 111616 T_c = 56.77 us
              -- ~8.51 km: 510 m further than the PCell's TAG. Two TAGs
              --   were the right call.
09:52:19.770  [MAC]    timeAlignmentTimer(TAG 1) started, ms1280

Listing 5. An sTAG expiry costs one SCell and is recovered by a network-ordered contention-free Random Access on that SCell. Nothing about the PCell changes — compare the next trace.

17.4 The pTAG lapses

10:07:44.512  [MAC-DL] Timing Advance Command MAC CE  TAG 0  T_A = 34
10:07:44.512  [MAC]    timeAlignmentTimer(TAG 0) restarted, ms1920
              -- UE has no UL data; next CE will be a keep-alive

10:07:45.300  [PHY-DL] PDSCH  HARQ pid 5  attempt 1  CRC fail
10:07:45.312  [PHY-DL] PDSCH  HARQ pid 5  attempt 2  CRC fail
10:07:45.324  [PHY-DL] PDSCH  HARQ pid 5  attempt 3  CRC fail  -- gave up
              -- this PDSCH carried the keep-alive TA CE. It is now lost,
              --   and MAC will never be told.

10:07:46.432  [MAC]    timeAlignmentTimer(TAG 0) EXPIRED
10:07:46.432  [MAC]    pTAG out of sync -> ALL TAGs out of sync
                       flush HARQ buffers ........ all serving cells
                       release PUCCH config ...... all serving cells
                       release SRS config ........ all serving cells
                       clear SPS assignments ..... all
                       clear configured UL grants  all
                       N_TA released for TAG 0 and TAG 1
10:07:46.432  [MAC]    UL out of sync on SpCell -> initiate Random Access
                       trigger ................... timeAlignmentTimer expiry
                       ra-Type ................... 4-step (CBRA)
10:07:46.436  [MAC-UL] preamble 12, PRACH SFN 812 slot 19
10:07:46.446  [MAC-DL] RAR, RAPID 12, Timing Advance Command 206
              -- 206 x 512 = 105472 T_c = 53.65 us ~ 8.04 km
              -- essentially unchanged from 12 minutes ago: the UE never
              --   moved. The failure was downlink, not timing.
10:07:46.452  [MAC-UL] MSG3: C-RNTI MAC CE (0x4601) + BSR
10:07:46.462  [MAC-DL] PDCCH to C-RNTI 0x4601 -> contention resolved
10:07:46.462  [MAC]    timeAlignmentTimer(TAG 0) started, ms1920
10:07:46.462  [RRC]    no RLF: RA succeeded, connection intact

Listing 6. The most instructive failure in this document. A stationary UE in good coverage performed a full Random Access procedure because three downlink HARQ attempts failed on the PDSCH that happened to carry a keep-alive control element. The new TA value is the proof: 206 against 205 twelve minutes earlier.

18. Release Deltas: Rel-15 to Rel-18

Table 16. Timing-advance changes by release. Confirm feature presence against the UE capability exchange — see the companion 26 UE Capability document — before assuming a field exists.

19. Reading Timing Advance in Logs: A Checklist

1. Identify the numerology first. A T_A of 205 is 53.4 µs at 30 kHz and 106.8 µs at 15 kHz. Nothing else in this checklist is meaningful until you know µ for the uplink the command applies to (§4).

2. Establish whether the value is absolute or relative. A 12-bit field in a RAR, a successRAR, or an Absolute Timing Advance Command MAC CE is absolute. A 6-bit field in a Timing Advance Command MAC CE is a delta around 31. Vendor logs often print both as "TA" (§5).

3. Convert the absolute value to a distance and sanity-check it against RSRP, the cell's known geometry and any other UE in the same sector. A TA-implied distance that is consistently wrong for every UE in a sector points at feeder or repeater delay, not at mobility (§4).

4. Check `n-TimingAdvanceOffset` against the band's duplex mode. This is the cheapest check in the list and it catches the failure mode with the largest blast radius: distance-independent uplink degradation across the whole cell (§7).

5. Resolve the TAG Identity on every command. In a carrier-aggregated UE, corrections addressed to the wrong TAG, or a TAG with no uplink reference signal configured, explain single-carrier uplink problems that otherwise look inexplicable (§9).

6. Do not filter out T_A = 31. Those are keep-alives and they are the record of timeAlignmentTimer being maintained. Their absence over a period longer than the timer is the finding (§6.2).

7. When you see a `timeAlignmentTimer` expiry, look at the downlink. Check PDSCH BLER around the expiry and whether a MAC CE was in flight. The expiry is a symptom; a lost downlink control element is usually the cause (§17.4).

8. Distinguish a pTAG expiry from an sTAG expiry immediately. They cost completely different things — a service outage and a Random Access versus one SCell — and they look identical in a raw MAC log until you read the TAG Id (§10).

9. Correlate correction magnitude against allocation bandwidth. Large, oscillating corrections on a UE that only ever transmits narrowband PUCCH are measurement noise, not movement (§8).

10. For NTN, add up all four components before believing any of them. N_TA is the small residual; ta-Common and the UE's own ephemeris-based term carry almost all of the delay, and neither appears in a MAC CE (§12).

20. Glossary

21. References

• 3GPP TS 38.213 — Physical layer procedures for control. Clause 4.2 (uplink transmission timing: the N_TA formula, the relative MAC CE arithmetic, and the n + k + 1 application rule), clause 4.1 (timing reference), clause 8 (random access, where the initial command originates).
• 3GPP TS 38.211 — Physical channels and modulation. Clause 4.1 (T_c and κ), clause 4.3.1 (uplink frame timing: T_TA = (N_TA + N_TA_offset)·T_c, and N_TA = 0 for PRACH), clause 4.2 (numerologies and cyclic prefix lengths).
• 3GPP TS 38.321 — MAC protocol specification. Clause 5.2 (maintenance of uplink time alignment, timeAlignmentTimer and the expiry actions), clause 6.1.2 (R/LCID subheader for fixed-size control elements), clause 6.1.3.4 (Timing Advance Command MAC CE), clause 6.1.3 (Absolute Timing Advance Command MAC CE), clause 6.2.3 / 6.2.3a (MAC RAR and the MSGB RAR variants), Table 6.2.1-1 (DL-SCH LCID values).
• 3GPP TS 38.133 — Requirements for support of radio resource management. Clause 7.1.2 (UE transmit timing: the T_e requirement and the N_TA_offset table), clause 7.1.1 (timing advance adjustment accuracy).
• 3GPP TS 38.331 — RRC protocol specification. TAG-Config, TAG, TAG-Id, TimeAlignmentTimer, MAC-CellGroupConfig, ServingCellConfigCommon (n-TimingAdvanceOffset, cellSpecificKoffset), NTN-Config and TA-Info (Rel-17), EphemerisInfo.
• 3GPP TS 38.300 — NR overall description. Clause 9.2.6 and clause 16 (carrier aggregation and the role of timing advance groups in it).
• 3GPP TR 38.821 — Solutions for NR to support non-terrestrial networks. The study behind the Rel-17 timing decomposition in §12.

Companion documents in this set

• 02 Radio Frame Structure — T_c, κ, numerology and the cyclic prefix arithmetic that §§2–4 build on.
• 03 Random Access — where the initial absolute command comes from, and the one trigger list that includes timeAlignmentTimer expiry.
• 05 HARQ — the buffers that a timer expiry flushes, and the Rel-17 disabled-feedback mechanism that NTN needs for the same reason NTN needs ta-Common.
• 07 MAC PDU and Control Elements — the general subheader and LCID rules that §6.1 specialises.
• 08 Scheduling — SPS and configured grants, which a timer expiry clears, and the SRS configuration the measurement loop depends on.
• 11 DRX — a sleeping UE receives no corrections, which is why DRX and timeAlignmentTimer have to be sized against each other.
• 16 RLM and RLF — where a failed post-expiry Random Access on the SpCell ends up.
• 22–25 Handover documents — the target cell's absolute TA is acquired inside T304, on the target's n-TimingAdvanceOffset.
• 26 UE Capability — how to confirm that the Rel-16 and Rel-17 features in §18 are actually supported by the UE in front of you.