NR Random Access: How a UE Gets Its First Grant

Every uplink transmission in NR is scheduled. The gNB decides who transmits, on which resources, with which modulation, and signals that decision in a grant. This is what keeps the uplink orthogonal and the interference predictable.

Which leaves one obvious problem: the UE needs a grant to transmit, and it needs to transmit to ask for a grant. Random access is the one place in the specification where that circularity is broken, and almost every design choice in the procedure follows from having to break it safely.

---

The one unscheduled transmission

The escape is a set of resources the network reserves in advance and lets any UE transmit on without asking: the PRACH. Because nobody is scheduling it, two things follow immediately.

The first is that transmissions on it can collide. The network cannot prevent that, so it has to detect and resolve it afterwards — which is what most of the four-step procedure is for.

The second is that the UE has no timing advance yet. It knows the downlink timing from the SSB, but not how far away it is, so its uplink transmission arrives at the gNB late by an unknown amount up to the round-trip propagation delay. The preamble is designed around that uncertainty: it is a long sequence with a cyclic prefix and a guard period sized so that a late arrival still lands inside the detection window.

The four steps

Msg1 — the preamble

The UE picks one of 64 preamble sequences and transmits it on a PRACH occasion. That is the entire content of Msg1. It carries no identity, no request, and no data — it is a token that says someone is here.

The preambles are partitioned. Some are reserved for contention-free use, and the contention-based set is split into groups A and B, where group B signals that the UE has a larger Msg3 to send and would like a bigger grant. That is the only information the UE can convey at this point: one bit, encoded in which half of the preamble set it chose from.

There is a second, less obvious piece of signalling here. In a beamformed cell the PRACH occasions are associated with SSBs, so which occasion the UE transmits on tells the gNB which downlink beam the UE could hear. The gNB needs that to know where to point the response. Get this association wrong in configuration and access fails in a way that looks like a coverage problem but is not.

Msg2 — the random access response

The gNB detects the preamble and responds with a RAR. Three things in it matter:

• a timing advance command, which is the whole reason the UE could not transmit anything useful before now;
• an uplink grant for Msg3;
• a TC-RNTI, a temporary identity to address the rest of the exchange with.

The RAR is addressed to an RA-RNTI derived from the time and frequency position of the PRACH occasion — not from anything about the UE. This is the key to understanding what happens next: the gNB is not answering a device, it is answering a slot. Every UE that used that occasion decodes the same response.

Msg3 — the first message with a name on it

Msg3 is the first transmission the UE is actually scheduled for, and the first that identifies it. For a UE coming from idle it carries an RRC setup request containing either the 5G-S-TMSI or, if the UE has no identity yet, a randomly drawn 39-bit value.

That random value is doing real work. It is the tiebreaker for the collision the network cannot otherwise see.

Msg4 — contention resolution

The gNB echoes back the identity it received in Msg3. A UE that sees its own identity has won the exchange and promotes its TC-RNTI to a C-RNTI. A UE that sees a different one knows it collided, drops everything, and starts again.

Why contention resolution is not optional

It is tempting to read Msg4 as an acknowledgement. It is not — it is an arbitration result.

Two UEs that pick the same preamble on the same occasion are, to the gNB, indistinguishable. It detects one preamble. It sends one RAR. Both UEs believe the grant is theirs and both transmit Msg3 on the same resources.

Usually that collision destroys both, and both time out and retry. Occasionally one is received cleanly — capture effect, because one UE is closer or louder — and the network proceeds happily with a device that is now in a conversation the other UE also thinks it is having. Msg4 is what stops that: only one identity comes back, and the loser finds out unambiguously.

Remove contention resolution and the failure is not a dropped connection, it is two devices sharing one C-RNTI. That is why the step exists even though it costs a round trip.

Contention-free access

When the network already knows which UE is coming, it can skip all of this. It assigns a dedicated preamble in advance — in a handover command, or by a PDCCH order — and that preamble is not in the contention-based set. Nobody else will use it, so detection is unambiguous, and the procedure ends at Msg2.

This is the path used for handover, for beam failure recovery, and for re-establishing uplink synchronisation on a UE that has gone out of sync. It is worth noticing how much of the four-step procedure is dedicated to a problem that only exists when the network does not yet know who is calling.

Two-step RACH

Release 16 added a two-step variant that folds Msg1 and Msg3 into a single MsgA: the preamble, followed by a PUSCH payload on resources tied to that preamble. The network answers with MsgB, which either resolves contention and succeeds outright, or falls back to sending a normal RAR and continuing as four-step.

The saving is one round trip. On a mid-band cell that is a few milliseconds, which matters for a UE waking from inactive to send a small packet — exactly the traffic pattern RRC_INACTIVE was introduced for.

The cost is real, though, and it is why two-step did not simply replace four-step. The UE transmits payload before it has a timing advance and before its power has been validated by a ramping procedure. That is tolerable when the propagation delay is small or the UE already has a valid timing advance from a recent connection. In a large cell with a cold UE it is not, and the network keeps four-step available for exactly that case.

Preamble formats and what they buy

The preamble format sets the sequence length, the subcarrier spacing and the guard period, and those together set the cell radius the format supports.

The pattern is the same trade that runs through the whole air interface. A long preamble with a long guard period tolerates a large unknown propagation delay, so it covers a large cell — and it occupies a lot of uplink time to do it. A short format costs almost nothing and stops working as soon as the round trip exceeds its guard period.

Format 3 is worth knowing about specifically: it repeats the sequence four times, which buys detection energy rather than range, and it exists for cells where the link budget rather than the geometry is the constraint.

What goes wrong in practice

Access failures that are really beam failures. If the SSB-to-RACH-occasion mapping is misconfigured, the UE transmits on an occasion associated with a beam it cannot actually hear well, or the gNB answers on the wrong one. The symptom is preamble detections with no completed procedures, which reads like interference and is not.

Power ramping masking coverage problems. The UE raises its power on each retry up to a configured maximum. A cell whose access works only on the third or fourth attempt is not healthy — it is passing a test it should be failing, and the counter to look at is the attempt distribution rather than the success rate.

Contention that is actually congestion. A high collision rate with a correctly sized preamble set usually means too few RACH occasions for the arrival rate, not too few preambles. The knob most often reached for is the wrong one.

---

The mental model

Random access exists to break one circularity: you need a grant to transmit and a transmission to get a grant.

Msg1 carries no identity. The gNB is answering a PRACH occasion, not a device, which is exactly why contention can happen at all.

Msg4 is arbitration, not acknowledgement. Without it, a collision can end with two UEs sharing one identity.

Contention-free access skips most of the procedure, because most of the procedure exists to work out who is calling.

Two-step trades a round trip for transmitting before you are timed. Good for a warm UE in a small cell, wrong for a cold one in a large one.

The procedure looks elaborate for what it achieves, and it is — but nearly every step is there to make an unscheduled transmission safe in a system that otherwise schedules everything.

Further reading

• 3GPP TS 38.321 — MAC protocol specification, random access procedure
• 3GPP TS 38.211 §6.3.3 — preamble sequence generation and formats
• 3GPP TS 38.213 §8 — physical layer random access procedures
• 3GPP TS 38.331 — RACH-ConfigCommon and RACH-ConfigDedicated
• ShareTechnote — 5G RACH, for message-by-message log traces and register-level configuration detail