diff --git a/common/utils/telnetsrv/telnetsrv_ci.c b/common/utils/telnetsrv/telnetsrv_ci.c
index 8fcea82fd2..ba3062178f 100644
--- a/common/utils/telnetsrv/telnetsrv_ci.c
+++ b/common/utils/telnetsrv/telnetsrv_ci.c
@@ -37,6 +37,7 @@
 #include "openair2/LAYER2/nr_rlc/nr_rlc_oai_api.h"
 #include "openair2/LAYER2/nr_rlc/nr_rlc_ue_manager.h"
 #include "openair2/LAYER2/nr_rlc/nr_rlc_entity_am.h"
+#include "openair2/LAYER2/NR_MAC_gNB/mac_proto.h"
 
 #define TELNETSERVERCODE
 #include "telnetsrv.h"
@@ -167,7 +168,27 @@ int rrc_gNB_trigger_f1_ho(char *buf, int debug, telnet_printfunc_t prnt)
   gNB_RRC_UE_t *UE = &ue->ue_context;
   nr_HO_F1_trigger_telnet(RC.nrrrc[0], UE->rrc_ue_id);
   prnt("RRC F1 handover triggered for UE %u\n", UE->rrc_ue_id);
+  return 0;
+}
 
+int force_ul_failure(char *buf, int debug, telnet_printfunc_t prnt)
+{
+  if (!RC.nrmac)
+    ERROR_MSG_RET("no MAC/RLC present, force_ul_failure failed\n");
+  int rnti = fetch_rnti(buf, prnt);
+  NR_UE_info_t *UE = find_nr_UE(&RC.nrmac[0]->UE_info, rnti);
+  nr_mac_trigger_ul_failure(&UE->UE_sched_ctrl, UE->current_UL_BWP.scs);
+  return 0;
+}
+
+int force_ue_release(char *buf, int debug, telnet_printfunc_t prnt)
+{
+  force_ul_failure(buf, debug, prnt);
+  int rnti = fetch_rnti(buf, prnt);
+  NR_UE_info_t *UE = find_nr_UE(&RC.nrmac[0]->UE_info, rnti);
+  NR_UE_sched_ctrl_t *sched_ctrl = &UE->UE_sched_ctrl;
+  sched_ctrl->ul_failure_timer = 2;
+  nr_mac_check_ul_failure(RC.nrmac[0], UE->rnti, sched_ctrl);
   return 0;
 }
 
@@ -175,6 +196,8 @@ static telnetshell_cmddef_t cicmds[] = {
     {"get_single_rnti", "", get_single_rnti},
     {"force_reestab", "[rnti(hex,opt)]", trigger_reestab},
     {"get_reestab_count", "[rnti(hex,opt)]", get_reestab_count},
+    {"force_ue_release", "[rnti(hex,opt)]", force_ue_release},
+    {"force_ul_failure", "[rnti(hex,opt)]", force_ul_failure},
     {"trigger_f1_ho", "[rrc_ue_id(int,opt)]", rrc_gNB_trigger_f1_ho},
     {"", "", NULL},
 };