5G Connected Mode Mobility (Xn Handover)

Introduction

Connected Mode Mobility in 5G is known as a Handover, and opposed to Idle Mode Mobility where the UE decides when to reselect to a neighboring cell based on network provided configurations, Handovers are decided by the Radio Access Network. A UE in Idle Mode uses SIB2 to determine when the UE should measure for particular cells (Intra Frequency, Inter Frequency, or LTE), and SIBs 3, 4, and 5 provide configured neighbors with offsets, biases, and thresholds for defined neighbor cells.

For UE Connected Mode mobility, rather than using System Information, the RAN configures the UE with rules to send the network measurements based on different scenarios or Measurement Events.

  • RRC Reconfiguration (Downlink – gNB to UE)
  • Measurement Report (Uplink – UE to gNB)

The RRC Reconfiguration message provides the UE with measurement reporting criteria based on measurement events, the UE sends Measurement Reports to the gNB for the gNB to determine when the UE should handover from the source gNB (Current serving cell) to the target gNB (measured neighbor cell). Based on the measurement values provided by the UE, the source gNB will choose to conduct Handover preparation with target gNB, subsequently followed by Handover execution by sending an RRC Handover command to the UE, during the entire process the source and target gNB coordinate with the 5G Core to switch the user plane path incrementally before the target gNB becomes fully responsible for exchanging user plane data with the UE and the 5G Core.

Measurement Events

There are a list of measurement events defined for 5G. These measurement events are configured by the network and sent to the UE in the RRC Reconfiguration message.

  • Event A1 (Serving becomes better than threshold)
    • Used to cancel a handover that is in progress when the UE moves towards a better coverage area of its current serving cell.
  • Event A2 (Serving becomes worse than threshold)
    • Used to trigger a blind mobility handover since it does not involve neighbor measurements. It may also be used to trigger neighbor measurements.
  • Event A3 (Neighbor becomes offset better than SpCell)
    • Used to trigger a handover from the serving cell to a neighbor cell.
  • Event A4 (Neighbor becomes better than threshold)
    • Used to trigger a handover when the coverage of the serving cell is not the factor causing the handover, and is likely due to capacity issues.
  • Event A5 (SpCell becomes worse than threshold1 and neighbor becomes better than threshold2)
    • Used to trigger a handover when serving cell becomes worse than the defined threshold 1 and the neighbor cell becomes better than the defined threshold 2.
  • Event A6 (Neighbour becomes offset better than SCell)
    • Used in carrier aggregation scenarios

Depending on the event, there are certain configured parameters that influence the behavior and effectiveness of the defined event.

  • Threshold
    • Defines the UE measurement value that will trigger the configured event. The reported value is mapped to an RSRP dBm, RSRQ dB, or SINR dB value. For example, RSRP: 54 = -103 to -102
  • Offset
    • Defines the offset relative to the serving cells measurement. This signaled value is * .5 and is added to the serving cell measurement.
  • Hysterisis
    • Defines the value added or subtracted from the serving or neighbor cell depending on the event and whether the event is being triggered or cancelled.
  • Time-to-Trigger
    • Time that defined event criteria must be met in order for the UE to execute a Measurement Report (event triggered).
  • Report Interval
    • Time interval between Measurement Reports if the reportAmount exceeds 1.
  • Report Amount
    • Number of Measurement Reports the UE will generate.
reportConfigId : 1
          reportConfig : reportConfigNR
          reportConfigNR
            reportType : eventTriggered
            eventTriggered
              eventId : eventA2
              a2-Threshold
                MeasTriggerQuantity : rsrp
                rsrp : 54
              reportOnLeave : false
              hysteresis : 4
              timeToTrigger : ms320
              rsType : ssb
              reportInterval : ms5120
              reportAmount : r1
              reportQuantityCell
                rsrp : true
                rsrq : true
                sinr : true
              maxReportCells : 1
              includeBeamMeasurements : false
reportConfigId : 2
          reportConfig : reportConfigNR
          reportConfigNR
            reportType : eventTriggered
            eventTriggered
              eventId : eventA3
              a3-Offset
                MeasTriggerQuantityOffset : rsrp
                rsrp : 6
              reportOnLeave : false
              hysteresis : 2
              timeToTrigger : ms640
              useAllowedCellList : false
              rsType : ssb
              reportInterval : ms480
              reportAmount : infinity
              reportQuantityCell
                rsrp : true
                rsrq : true
                sinr : true
              maxReportCells : 1
              includeBeamMeasurements : false
              reportAddNeighMeas: setup
reportConfigId : 3
          reportConfig : reportConfigNR
          reportConfigNR
            reportType : eventTriggered
            eventTriggered
              eventId : eventA1
              a1-Threshold
                MeasTriggerQuantity : rsrp
                rsrp : 54
              reportOnLeave : false
              hysteresis : 4
              timeToTrigger : ms320
              rsType : ssb
              reportInterval : ms5120
              reportAmount : r1
              reportQuantityCell
                rsrp : true
                rsrq : true
                sinr : true
              maxReportCells : 1
              includeBeamMeasurements : false
reportConfigId : 5
          reportConfig : reportConfigNR
          reportConfigNR
            reportType : eventTriggered
            eventTriggered
              eventId : eventA5
              a5-Threshold1
                MeasTriggerQuantity : rsrp
                rsrp : 41
              a5-Threshold2
                MeasTriggerQuantity : rsrp
                rsrp : 51
              reportOnLeave : false
              hysteresis : 2
              timeToTrigger : ms320
              useAllowedCellList : false
              rsType : ssb
              reportInterval : ms480
              reportAmount : infinity
              reportQuantityCell
                rsrp : true
                rsrq : true
                sinr : true
              maxReportCells : 1
              includeBeamMeasurements : false
              reportAddNeighMeas: setup

Report Configurations can be added (reportConfigToAddModList
) or removed (reportConfigToRemoveList) with additional RRC Reconfiguration messages.

Measurement Objects

Measurement objects are used to notify the UE of the time and frequency locations of SSB to measure.

measConfig identifies a list of measObjects, where measObjectNR are 5G SSBs. The following two examples are sent in different RRC Reconfiguration messages where measObjects can be added (measObjectToAddModList) or removed (measObjectToRemoveList). 

measConfig
    measObjectToAddModList
      MeasObjectToAddModList : 
        [0 ] : 
          measObjectId : 1
          measObject : measObjectNR
          measObjectNR
            ssbFrequency : 126510
            ssbSubcarrierSpacing : kHz15
            smtc1
              periodicityAndOffset : sf20
              sf20 : 0
              duration : sf1
            referenceSignalConfig
              ssb-ConfigMobility
                deriveSSB-IndexFromCell : true
            quantityConfigIndex : 1
            offsetMO
            freqBandIndicatorNR : 71
measConfig
    measObjectToAddModList
      MeasObjectToAddModList : 
        [0 ] : 
          measObjectId : 2
          measObject : measObjectNR
          measObjectNR
            ssbFrequency : 126490
            ssbSubcarrierSpacing : kHz15
            smtc1
              periodicityAndOffset : sf20
              sf20 : 0
              duration : sf1
            referenceSignalConfig
              ssb-ConfigMobility
                deriveSSB-IndexFromCell : true
            quantityConfigIndex : 1
            offsetMO
            freqBandIndicatorNR : 71

Measurement Identifiers

Measurement Identifiers correlate a Measurement Event with a Measurement Object. The UE sends a Measurement Report to the gNB with the defined measId. Measurement Identifiers can be sent in multiple RRC Reconfiguration messages and can be added (measIdToAddModList) or removed (measIdToRemoveList). 

measIdToAddModList
      MeasIdToAddModList : 
        [0 ] : 
          measId : 1
          measObjectId : 1
          reportConfigId : 1
        [1 ] : 
          measId : 2
          measObjectId : 1
          reportConfigId : 2
measIdToAddModList
      MeasIdToAddModList : 
        [0 ] : 
          measId : 3
          measObjectId : 1
          reportConfigId : 3
        [1 ] : 
          measId : 4
          measObjectId : 1
          reportConfigId : 4
        [2 ] : 
          measId : 5
          measObjectId : 2
          reportConfigId : 5

The following diagram shows the relationship between measId, measObject, and reportConfig for the given configurations.

Measurement Reports

Measurement Reports are triggered when the UE meets the Measurement Event trigger.

In this example, the UE begins being served on SSB NR-ARFCN 126510, PCI 268.

The first Measurement Report sent by the UE in this scenario is for EventA2. The UE references measId: 1 in this Measurement Report which correlates to measObjectId: 1 for SSB NR-ARFCN 126510 and reportConfigId: 1 for eventA2.

The Measurements for the serving cell are

  • RSRP -107
  • RSRQ -15
  • SINR -2

The eventA2 threshold is -103, so the event is triggered since the UE measures the serving cell at -107 dBm RSRP. Consequently, the UE may be triggered to conduct a blind handover, or more likely in this case, measure neighbors for potential handover.

measurementReport
  measResults
    measId : 1
    measResultServingMOList
      MeasResultServMOList : 
        [0 ] : 
          servCellId : 0
          measResultServingCell
            physCellId : 268
            measResult
              cellResults
                resultsSSB-Cell
                  rsrp : 50
                  rsrq : 57
                  sinr : 42

NR RRC A2 Event Serving becomes worse than threshold. 
Serving. 
RSRP: (50) -107 dBm 
RSRQ: (57) -15.0 dBm 
SINR: (42) -2.0 dB. 
Threshold. 
RSRP: (54) -103 dBm.

Following eventA2, the UE sends another Measurement Report referencing measId: 2 which correlates to measObject: 1 serving cell SSB NR-ARFCN 126510 PCI 268, and reportConfigId: 2 for eventA3.

The UE measures the serving cell at

  • RSRP -116
  • RSRQ -21
  • SINR -9

And the UE measures the neighbor PCI 114 at

  • RSRP -107
  • RSRQ -14
  • SINR -.5
measurementReport
  measResults
    measId : 2
    measResultServingMOList
      MeasResultServMOList : 
        [0 ] : 
          servCellId : 0
          measResultServingCell
            physCellId : 268
            measResult
              cellResults
                resultsSSB-Cell
                  rsrp : 41
                  rsrq : 45
                  sinr : 28
    measResultNeighCells
      measResultNeighCells : measResultListNR
      measResultListNR
        MeasResultListNR : 
          [0 ] : 
            physCellId : 114
            measResult
              cellResults
                resultsSSB-Cell
                  rsrp : 50
                  rsrq : 59
                  sinr : 45

NR RRC A3 Event Neighbor becomes offset better than SpCell. Serving. 
RSRP: (41) -116 dBm 
RSRQ: (45) -21.0 dBm 
SINR: (28) -9.0 dB. 
Neighbor. 
NR-ARFCN: 126510, 
PCI: 114 
RSRP: (50) -107 dBm 
RSRQ: (59) -14.0 dBm 
SINR: (45) -0.5 dB.

Handover Preparation

The gNB receives the Measurement Report and makes the decision to conduct an Intra Frequency Handover from PCI 268 to PCI 114. This type of handover is known as an Xn based handover, where the UE changes serving cells from source gNB to target gNB via the Xn interface that connects multiple gNB. The Xn Control Plane uses the Xn Application Protocol (XnAP) and the Xn User Plane uses GTP-U.

XnAP Handover Request (Source gNB to Target gNB)

Unfortunately I do not have any XnAP logs to show the messaging between the source gNB and the target gNB.

XnAP Handover Request Acknowledge (Target gNB to Source gNB)

The target gNB receives the Handover Request message and conducts Admission Control to ensure that the gNB can provide resources to the UE upon handover. The target gNB then sends the Handover Request Acknowledge message to the source gNB over the Xn interface, completing the Handover Preparation phase.

The Handover Request Acknowledge message gives the source gNB information for forwarding user plane data to the target gNB by providing GTP-U TEID and IP Addresses. The message also carries the “Target NG-RAN Node to Source NG-RAN Node Transparent Container” which includes the HandoverCommand message. The HandoverCommand message encapsulates the RRC Reconfiguration message that will be sent from the source gNB to the UE.

Handover Execution

RRC Reconfiguration (Source gNB to UE)

The RRC Reconfiguration message is sent to the UE from the source gNB, where the spCellConfig specifies “reconfigurationWithSync” for the handover procedure to the target gNB. This message also includes Random Access parameters to be used during the handover with the target gNB.

rrcReconfiguration

spCellConfig
  reconfigurationWithSync
    spCellConfigCommon
      physCellId : 114
      downlinkConfigCommon
        frequencyInfoDL
          absoluteFrequencySSB : 126510
          frequencyBandList
            MultiFrequencyBandListNR : 
              [0 ] : 71
          absoluteFrequencyPointA : 125478
          scs-SpecificCarrierList : 
            [0 ] : 
              offsetToCarrier : 0
              subcarrierSpacing : kHz15
              carrierBandwidth : 79
                initialDownlinkBWP
                  genericParameters
                    locationAndBandwidth : 21450
                    subcarrierSpacing : kHz15
                  pdcch-ConfigCommon
                    SetupRelease : setup
                    Setup
                      controlResourceSetZero : 7
                      searchSpaceZero : 8
                            
                              

NR 5G ML1 Search HO Acquisition Request

Target ARFCN : 126510
Target PCI : 114
Band : n71
SSB Bitmask : 0x4000000000000000
HO Type : Nr2nr Non Blind Ho Skip Acq
Sub-carrier Spacing : 15 kHz
Duplex Mode : FDD
SSB period : 20 ms
Max SSB Number : 4

XnAP SN Status Transfer (Source gNB to Target gNB)

Immediately following the transmission of the RRC Reconfiguration to the UE, the source gNB sends the SN Status Transfer message to the target gNB. This message provides PDCP sequence number information. Now the source gNB can forward downlink data to the target gNB to be buffered.

Random Access & RRC Reconfiguration Complete (UE to Target gNB)

The UE will conduct Random Access using the Contention Free Random Access method, which is a 2-step RACH. Once the procedure is successful, the UE will send the RRC Reconfiguration Complete message. The UE is now connected to the target gNB, though the target gNB still receives forwarded downlink data from the source gNB, but sends uplink data from the UE to the UPF. This concludes the Handover Execution phase.

NR 5G MAC RACH Trigger

RachTrigger : 
  [0 ] : 
    Frame : 259
    Sub-Frame : 3
    Slot : 0
    SCS : 0
    CRNTI : 26130
    RACH Reason : HANDOVER
    Carrier ID : 0
    First Active UL BWP : 1
    Active DL BWP : 1
    UL RACH Rsrc. Present : 1
    DL RACH Rsrc. Present : 1
    Duplex Mode : FDD
    Connection Type : SA
    RACH Contention : MIXED_MODE
    Msg1 SCS : 1.25 kHz
    Msg1 FDM : 1
    Msg1 Freq Start : 3
    PRACH Config Index : 44

NR 5G MAC RACH Attempt

Num Attempt : 1
Power Ramping Count : 1
SSB ID : 1
CSI RS ID : 0
Carrier ID : 0
RACH Result : Success
Contention Type : Contention Free
RACH Msg Bitmask : 0x03
Msg1 SCS : 1.25 kHz
Msg2Scs : 15 kHz
UL BWP SCS : 15 kHz
Power Limited : 0
RACH Msg1
  System Time
    Frame : 260
    SubFrame : 1
    Slot : 0
    SCS : 30 KHz
  Symbol Start : 0
  Preamble Format : Format1
  PRACH Config : 44
  Uroot : 553
  RA ID : 16
  FDM : 0
  Cyclic Shift V : 167
  N_Cs : 167
  RA RNTI : 15
  Regular path loss : 130
  RAR Window Start SFN
    Frame : 260
    SubFrame : 4
    Slot : 0
    SCS : 15 KHz
  RAR Window End SFN
    Frame : 261
    SubFrame : 4
    Slot : 0
    SCS : 15 KHz
  Backoff Duration : 0
RACH Msg2
  SFN
    Frame : 260
    SubFrame : 6
    Slot : 0
    SCS : 15 KHz
  Max Backoff Duration : 0
  T-RNTI : 26130
  TA Value : 15
  Result : (1) RAPID_MATCH
  SCS : (0) 15 KHz
  RAID Received : 16

NR 5G RRC Configuration Info

RRC Controller State : Connected
Connectivity Mode : SA
Num Active SRBs : 2
Num Active DRBs : 2
MN MCG DRB IDs : 
  2
  1
NR 5G Serving Cell Info : 
  [0 ] : 
    CC ID : 0
    Cell ID : 114
    DL ARFCN : 126900
    UL ARFCN : 136100
    SsbArfcn : 126510
    Band : 71
    Band Type : Sub6
    DL Carrier Bandwidth : BW 15 MHz
    UL Carrier Bandwidth : BW 15 MHz
    SCS : 15Khz
    DL Max MIMO : 2
    UL Max MIMO : 1
Radio Bearer Info : 
  [0 ] : 
    RB ID : 1
    Termination Point : MN
    DL RB Type : SRB
    DL RB Path : NR
    DL ROCH Enabled : False
    DL Cipher Algorithm : AES (NEA2)
    DL Integrity Algorithm : AES (NEA2)
    UL RB Type : SRB
    UL RB Path : NR
    UL Primary Path : None
    UL ROCH Enabled : False
    UL Cipher Algorithm : AES (NEA2)
    UL Integrity Algorithm : AES (NEA2)
    UL PDCP Dup Activated : False
  [1 ] : 
    RB ID : 2
    Termination Point : MN
    DL RB Type : SRB
    DL RB Path : NR
    DL ROCH Enabled : False
    DL Cipher Algorithm : AES (NEA2)
    DL Integrity Algorithm : AES (NEA2)
    UL RB Type : SRB
    UL RB Path : NR
    UL Primary Path : None
    UL ROCH Enabled : False
    UL Cipher Algorithm : AES (NEA2)
    UL Integrity Algorithm : AES (NEA2)
    UL PDCP Dup Activated : False
  [2 ] : 
    RB ID : 1
    Termination Point : MN
    DL RB Type : DRB
    DL RB Path : NR
    DL ROCH Enabled : False
    DL Cipher Algorithm : AES (NEA2)
    DL Integrity Algorithm : AES (NEA2)
    UL RB Type : DRB
    UL RB Path : NR
    UL Primary Path : None
    UL ROCH Enabled : False
    UL Cipher Algorithm : AES (NEA2)
    UL Integrity Algorithm : AES (NEA2)
    UL PDCP Dup Activated : False
  [3 ] : 
    RB ID : 2
    Termination Point : MN
    DL RB Type : DRB
    DL RB Path : NR
    DL ROCH Enabled : False
    DL Cipher Algorithm : AES (NEA2)
    DL Integrity Algorithm : AES (NEA2)
    UL RB Type : DRB
    UL RB Path : NR
    UL Primary Path : None
    UL ROCH Enabled : False
    UL Cipher Algorithm : AES (NEA2)
    UL Integrity Algorithm : AES (NEA2)
    UL PDCP Dup Activated : False

Handover Completion

The Handover Completion phase is a backend procedure so that the target gNB (now the serving cell) can exchange uplink and downlink data with the UPF without the need for downlink data being forwarded from the previous serving cell.

Once the connection between the target gNB and the UPF are setup, the target gNB sends the source gNB the UE Context Release message, which will allow the source gNB to free the resources that had been allocated to the UE.

Leave a Reply

Discover more from

Subscribe now to keep reading and get access to the full archive.

Continue reading