The term Cell Selection Criterion can be somewhat vague, since cell selection may be considered from several different perspectives and may involve multiple criteria. In a broad sense, whether a UE can select a particular cell is influenced by several fundamental factors. First, the signal transmitted by the cell must be strong enough and have sufficient quality for the UE to detect and recognize the cell. Second, the PLMN associated with the cell must be acceptable to the UE according to its PLMN selection rules and subscription information. Finally, the type of service provided by the cell and the UE's ability or permission to use that service must also be considered. Therefore, cell selection can broadly be viewed in terms of signal strength and quality criteria, PLMN selection criteria, and service type criteria.

Followings are the details I want to talk about in this note.

• Reading the S-criterion : what Srxlev and Squal actually are
• Every term in the equation, and where it comes from
• A worked example, and the same cell failing
• The SIB1 fields that carry these parameters
• Qoffsettemp : the penalty the network never signals directly
• Field value to real value : the mapping table
• When a cell is detected but never used

In short, cell selection would be influenced by following factors.

• i) Is the cell transmitting power strong enough to be recognized/detected by the UE ? (Signal Strength/Quality Criteria)
• ii) Is the PLMN of the cell acceptable to the UE ? (PLMN selection criteria)
• iii) Is the service type of the cell acceptable to the UE ? (Service Type criteria)

It is worth noticing how those three split up before we go on, because only the first of them is what this page is about. Criteria ii) and iii) are what separate a suitable cell from a merely acceptable one on the Cell Selection page - they are about permission, not about radio. Criterion i), the one below, is the only condition that both suitable and acceptable cells have to satisfy. A cell that fails the S-criterion is not usable for anything at all, not even an emergency call.

But in most of the situation when we say "Cell Selection Criteria",  it is likely to say the first criteria (Signal Strength/Quality Criteria). This signal quality criterion as descrbed in 38.304 - 5.2.3.2 as follows.

According to this criterion, UE would not start registration even though it sucessfully detected a cell and even decoded MIB and SIBs unless the Srxleve > 0 and Squal > 0. So if a device does not even initiate the PRACH process even when it successfully decoded all the MIB and  SIBs, checking on this criteria would be a good first step for the troubleshooting. (Of course, this is not the only issues for this case. there may be USIM issue and Band Indicator Issue, PLMN issues etc).

Reading the S-criterion : what Srxlev and Squal actually are

The two equations in the first picture are short, but almost everything that confuses people about them comes from one detail in the second picture. Look at the first two rows of that table :

     Srxlev   Cell selection RX level value  (dB)
     Squal    Cell selection quality value   (dB)

dB, not dBm. Srxlev is not a power. It is a margin - the number of dB by which this cell exceeds the minimum the network says is acceptable. That is why the test is "> 0" and not "> some threshold": the threshold has already been subtracted inside the equation. An Srxlev of 0 dB means the cell is sitting exactly on the limit, and 25 dB means you have 25 dB in hand.

Once you read it that way the whole first equation becomes one sentence :

  Srxlev = Qrxlevmeas - ( Qrxlevmin + Qrxlevminoffset ) - Pcompensation - Qoffsettemp
             |             |                                  |                 |
       what I measure  what the cell demands       what my own radio    a temporary
        (RSRP, dBm)      (from SIB1, dBm)          costs me (dB)        penalty (dB)

  Squal  = Qqualmeas  - ( Qqualmin  + Qqualminoffset )  - Qoffsettemp
             |             |                                                    |
       what I measure  what the cell demands                          the same penalty
        (RSRQ, dB)       (from SIB1, dB)

Read left to right : take what I measured, subtract what the cell requires, subtract what my own hardware costs me, subtract any penalty I have earned on this cell. If anything is left over, the cell is usable.

Why there are two gates and not one

The criterion is Srxlev > 0 AND Squal > 0, and both halves have to pass. They are not measuring the same thing, and the table in the second picture says so explicitly :

RSRP tells you how loud the cell is. RSRQ tells you how much of what you are receiving is actually this cell rather than everything else. A cell can easily be loud and useless - a lab with a strong interferer, or a dense urban site with heavy neighbour overlap - and in that case Srxlev is comfortably positive while Squal goes negative. That single case is why 3GPP did not settle for one equation.

NOTE : notice from the first picture that Pcompensation appears only in Srxlev, never in Squal. That is not an oversight, and the next section explains why.

Every term in the equation, and where it comes from

This is the second picture rewritten as a lookup table, with the source of each value added. The definitions are as 38.304 words them.

NOTE : Qrxlevminoffset is not a general safety margin, and this is probably the most commonly misread row of that table. It is not applied all the time. Per the definition, it applies only while the UE is camped on a visited PLMN and is doing its periodic search for a higher priority PLMN. Its job is to make the UE slightly fussier about a roaming cell at exactly the moment it is looking for a better home network, so it does not abandon a good cell for a marginal one. In a normal domestic attach, this term is simply not there and drops out of the equation.

Pcompensation : an uplink term hiding inside a downlink criterion

Every other term in Srxlev is about the downlink - what the UE can hear. Pcompensation is not. It is about whether the UE can talk back, and it is the most interesting term in the equation :

  Pcompensation = max( P_EMAX1 - P_PowerClass , 0 )                         [dB]

      P_EMAX1        the maximum uplink power the cell allows, from p-Max in SIB1
      P_PowerClass   the maximum output power the UE can actually produce

  and when the UE supports additionalPmax in NR-NS-PmaxList :

  Pcompensation = max(P_EMAX1 - P_PowerClass, 0)
                  - ( min(P_EMAX2, P_PowerClass) - min(P_EMAX1, P_PowerClass) )   [dB]

Take the usual case first. A power class 3 handset can produce 23 dBm, and the cell broadcasts p-Max = 23 dBm. Then max(23 - 23, 0) = 0, the term vanishes, and Srxlev is decided purely by the downlink. This is why most people never think about Pcompensation - in most networks it is zero.

Now suppose the cell demands more than the UE can give: p-Max = 26 dBm against a 23 dBm handset. Then Pcompensation = 3 dB, and the UE knocks 3 dB off its own assessment of the cell before deciding whether to camp.

The logic behind this is worth stating plainly, because it explains the whole term. A cell you can hear but cannot reach is useless. The downlink might be perfectly strong - the gNB has a big amplifier and a tall mast - while the UE's little transmitter cannot close the link in the other direction. Without Pcompensation the UE would happily camp on such a cell, then fail every random access attempt. The term is a deliberate handicap that pushes the UE towards cells it can actually complete a two-way link with.

And now the note from the previous section answers itself : Squal has no Pcompensation term because Squal is built on RSRQ, which is a ratio of received quantities. Uplink power budget has nothing to do with it. Only the absolute-level test needs the correction.

A worked example, and the same cell failing

Numbers make this concrete. Take a plausible domestic cell and a power class 3 handset :

  Broadcast in SIB1                     Measured by the UE
    q-RxLevMin        = -60                  RSRP (Qrxlevmeas) = -95 dBm
      -> Qrxlevmin    = -60 x 2 = -120 dBm   RSRQ (Qqualmeas)  = -12 dB
    q-QualMin         = -18 dB
    p-Max             =  23 dBm              UE power class 3 -> P_PowerClass = 23 dBm
    q-RxLevMinOffset  = absent -> 0 dB       not roaming, no higher-priority PLMN search
    connEstFailOffset = no penalty active -> Qoffsettemp = 0 dB

  Pcompensation = max(23 - 23, 0) = 0 dB

  Srxlev = -95 - ( -120 + 0 ) - 0 - 0 =  +25 dB   > 0  PASS
  Squal  = -12 - (  -18 + 0 )     - 0 =   +6 dB   > 0  PASS

                                     -> the cell satisfies the S-criterion

25 dB of level margin and 6 dB of quality margin. Now change one thing only - put an interferer next to the UE so the cell is just as loud but much dirtier. RSRP does not move ; RSRQ collapses :

  RSRP (Qrxlevmeas) = -95 dBm   unchanged
  RSRQ (Qqualmeas)  = -20 dB   was -12 dB

  Srxlev = -95 - ( -120 + 0 ) - 0 - 0 =  +25 dB   > 0  PASS
  Squal  = -20 - (  -18 + 0 )     - 0 =   -2 dB   < 0  FAIL

                    -> the criterion is AND, so the cell is rejected

This is the case worth remembering. The signal bar on a test tool would look excellent - 25 dB of level margin - and the UE still refuses to camp. If you are chasing a device that sees a cell, decodes everything, and then does nothing, an Srxlev that looks healthy tells you almost nothing on its own. You have to check Squal too.

One more variation, this time on the uplink side. Leave the radio conditions good and only raise the cell's p-Max above what the handset can produce :

  p-Max = 26 dBm,  UE power class 3 -> P_PowerClass = 23 dBm

  Pcompensation = max(26 - 23, 0) = 3 dB

  Srxlev = -95 - ( -120 + 0 ) - 3 - 0 = +22 dB   (was +25 dB)

Three dB of the margin is gone, and nothing about the received signal changed. On a strong cell this is invisible. On a cell right at the edge of coverage it is the difference between camping and not camping, and it will look completely inexplicable if you are only watching RSRP.

Out of the variables used in the equation, only Qrxlevmeas and Qqualmeas is the value UE really measures when it turns on and most of other parameters are determined by a specific SIB (SIB1 in LTE case) or calculated by some other predefined values.

That sentence is the practical summary of the table above, and it is worth restating as a count : of the eight symbols in the two equations, two are measured, four are broadcast, one the UE computes about itself, and one is a penalty it has earned. Only the first two change as you walk around.

The SIB1 fields that carry these parameters

Following is the part of LTE SIB1 which is related to Cell Selection Criterion and Cell Selection Procedure. Following is overall information and functionality of SIB1 information element.

SIB1 ::=        SEQUENCE {
    cellSelectionInfo                   SEQUENCE {
        q-RxLevMin                          Q-RxLevMin,
        q-RxLevMinOffset                    INTEGER (1..8)      OPTIONAL,
        q-RxLevMinSUL                       Q-RxLevMin          OPTIONAL,
        q-QualMin                           Q-QualMin           OPTIONAL,
        q-QualMinOffset                     INTEGER (1..8)      OPTIONAL
    }    OPTIONAL,   -- Need S
    cellAccessRelatedInfo               CellAccessRelatedInfo,
    connEstFailureControl               ConnEstFailureControl   OPTIONAL,
    si-SchedulingInfo                   SI-SchedulingInfo       OPTIONAL,
    servingCellConfigCommon             ServingCellConfigCommonSIB    OPTIONAL,   -- Need R
    ims-EmergencySupport                ENUMERATED {true}             OPTIONAL,   -- Need R
    eCallOverIMS-Support                ENUMERATED {true}             OPTIONAL,   -- Cond Absent
    ue-TimersAndConstants               UE-TimersAndConstants         OPTIONAL,   -- Need R

    uac-BarringInfo                     SEQUENCE {
        uac-BarringForCommon                UAC-BarringPerCatList     OPTIONAL,   -- Need S
        uac-BarringPerPLMN-List             UAC-BarringPerPLMN-List   OPTIONAL,   -- Need S
        uac-BarringInfoSetList              UAC-BarringInfoSetList,
        uac-AccessCategory1-SelectionAssistanceInfo CHOICE {
            plmnCommon                      UAC-AccessCategory1-SelectionAssistanceInfo,
            individualPLMNList              SEQUENCE (SIZE (2..maxPLMN))
                                               OF UAC-AccessCategory1-SelectionAssistanceInfo
        }   OPTIONAL
    }     OPTIONAL,   -- Need R

    useFullResumeID                     ENUMERATED {true}    OPTIONAL,   -- Need N
    lateNonCriticalExtension            OCTET STRING         OPTIONAL,
    nonCriticalExtension                SEQUENCE{}           OPTIONAL
}

The whole of cellSelectionInfo is optional, and so is almost everything inside it. Only q-RxLevMin is mandatory once the sequence is present. That tells you which half of the criterion 3GPP considers indispensable : a cell must always state a minimum RSRP, but it may decline to state a minimum quality, in which case Qqualmin defaults to negative infinity and the Squal test passes automatically.

The q-RxLevMinSUL entry is the supplementary uplink variant. If the cell has a SUL carrier and the UE supports it, Qrxlevmin is taken from this field instead - the same criterion, but referenced to the uplink the UE would actually use. It is another place where the uplink quietly influences a downlink-looking decision.

ConnEstFailureControl ::= SEQUENCE {
   connEstFailCount                    ENUMERATED {n1, n2, n3, n4},
   connEstFailOffsetValidity           ENUMERATED {s30, s60, s120, s240, s300, s420, s600, s900},
   connEstFailOffset                   INTEGER (0..15) OPTIONAL
}

Qoffsettemp : the penalty the network never signals directly

Qoffsettemp is the one term in the equation that no SIB field is named after, and the ASN.1 above is where it comes from. The three fields of ConnEstFailureControl work together as a small state machine :

  UE fails RRC connection establishment on this cell
                 |
                 v
  count reaches connEstFailCount   (n1, n2, n3 or n4 attempts)
                 |
                 v
  apply Qoffsettemp = connEstFailOffset to this cell only
     -> Srxlev and Squal both drop by that many dB
     -> the cell may now fail the S-criterion and be passed over
                 |
                 v
  keep the penalty for connEstFailOffsetValidity
                 (s30, s60, s120, s240, s300, s420, s600 or s900 seconds)
                 |
                 v
  penalty expires, Qoffsettemp returns to 0, cell is a candidate again

So this is a self-healing mechanism for a cell that answers but cannot complete a connection - an overloaded cell, a cell with a broken uplink, a cell whose PRACH configuration is wrong. Rather than letting the UE hammer at it forever, the UE marks it down for a while and looks elsewhere. Then it forgets, and tries again.

NOTE : look at the definition of connEstFailOffset quoted further down this page - if the field is not present the value of infinity shall be used. Infinity is not a subtle down-weighting. During the validity window the cell is effectively removed from consideration entirely. This is worth knowing when a device suddenly refuses to look at a cell it was using minutes earlier and there is nothing wrong with the radio conditions at all : you may be watching the tail of a connEstFailOffsetValidity timer.

Now you may have a couple of questions of q-RxLevMin. The first question of what kind of power this represents ? Is it RSSI or RSRP or RSRQ ? How the value of this IE maps to real power value (dBm) ? You can get the answers to these two questions at once from 36.331.

38.331 has a description as follows.

q-RxLevMin

The IE Q-RxLevMin is used to indicate for cell selection/ re-selection the required minimum received RSRP level in the (NR) cell. Corresponds to parameter Qrxlevmin in TS38.304. Actual value Qrxlevmin = field value * 2 [dBm].

q-RxLevMinOffset

Parameter "Qrxlevminoffset" in TS 38.304. Actual value Qrxlevminoffset = field value * 2 [dB]. If absent, the UE applies the (default) value of 0 dB for Qrxlevminoffset. Affects the minimum required Rx level in the cell.

q-QualMin

Parameter "Qqualmin" in TS 38.304, applicable for serving cell. If the field is not present, the UE applies the (default) value of negative infinity for Qqualmin.

q-QualMinOffset

Parameter "Qqualminoffset" in TS 38.304. Actual value Qqualminoffset = field value [dB]. If the field is not present, the UE applies the (default) value of 0 dB for Qqualminoffset. Affects the minimum required quality level in the cell.

connEstFailOffset

Parameter "Qoffsettemp" in TS 38.304. If the field is not present the value of infinity shall be used for "Qoffsettemp".

That first definition answers your own question directly, and the answer is worth pulling out : it is RSRP. Not RSSI, not RSRQ. The quality half of the criterion is handled separately by q-QualMin, which is referenced to RSRQ. Two different measurements, two different fields, two different gates.

Field value to real value : the mapping table

The second half of your question - how the IE value maps to a real power - has a different answer for almost every field, which is exactly the sort of thing that causes an off-by-a-factor-of-two bug in a log parser. Here they are together :

Two traps live in this table. The x 2 applies to the two Rx level fields and to nothing else, so a q-RxLevMin of -60 is -120 dBm while a q-QualMin of -18 is just -18 dB. And the three "absent" defaults all point in different directions : absent offsets mean no effect, an absent q-QualMin disables the quality gate completely, and an absent connEstFailOffset means the harshest possible penalty. Never assume a missing optional field is neutral.

When a cell is detected but never used

This is the situation your paragraph near the top describes - the UE decodes MIB and SIB1 perfectly and then simply does nothing, with no PRACH ever sent. The S-criterion is the right first suspect, and the equations tell you exactly which quantities to go and look at, in order :

The last row matters as much as the others. The S-criterion is a necessary condition, not a sufficient one. Passing it only means the radio is good enough ; the cell still has to belong to a PLMN the UE is allowed to use, in a tracking area it is allowed to be in. Those are the other two criteria you listed at the very top of this page, and they are covered on the Cell Selection page.