• 5G Handover

    December 22, 2019 edwin 5G, LTE, Mobility, Wireless

    5G Handover

    4G LTE handover was called X2 and S1, in 5G NR are called XN and N2

    5G has come close to standardization with many news from Verizon and T-Mobile regarding deployments and acquisitions specially with NOKIA.


    NOKIA logo

    5G Systems

    The new elements in 5G are gNB, AMF, UPF, which are using new interfaces as the XN and N2 interface to link the AMF with gNB and vice versa, replacing X2 and S1 AP interfaces.

    There are also several other components as follows:

    • gNB : Refers to the Base Station, like in the old LTE, the eNodeB
    • NR: Refers to the “New Radio” technology
    • NG-RAN: NG-RAN is Next Generation Radio Access Network. This consists of gNB and ng-ENB.
    • AMF Access and Mobility Management Function AF Application Function
    • UPF User Plane Function
    • NGC: Next Generation Core


    There in 5G the handover is called Xn Handover and N2 Handover

    • As the UE sends the measurement reports and the Source gNB detects that a handover is required, then it connects with the Target gNB to start a switch
    • The UE does a handover and connects to theTarget gNB That has already switched the tunnels to the target
    • The UE forwards as part of the handover process, This is called RRC

    The NG-RAN sends the UE Notification message to report the current RRC state for the UE (i.e. RRC Inactive state or RRC Connected state). The current UE location information (i.e. TAI + Cell Identity) is always included when RRC state information is reported.

    • Thru this, the UE can then handoff fast and all the data is available for you.

    How is the difference from the X2 Handover

    The differences are subtle, and the main difference is that the X2 handover. We server that Location Information is mandatory, but it was after LTE
    Rel-13 as well. The changes are minimum and this facilitates the understanding of all functions including AMF / UPF in 5G. In TS 38.423 V.15, the Xn-AP commands are shown, which is a similar document to the X2-AP specification.

    Technical Specification from 3GPP TS 123.502

    If the Location Reporting InformationIE is included in the HANDOVER REQUEST message, then the target NG-RAN node should initiate the requested location reporting functionality as defined in TS 38.413 [5].

    Similarly this is shown in TS 123.502 with

    1. Target NG-RAN to AMF: N2 Path Switch Request (List of PDU Sessions To Be Switched with N2 SM Information, List of PDU Sessions Rejected with a rejection Cause per PDU Session, UE Location Information)

    4G LTE Systems

    In the 4G LTE System, we would have an ENodeB, MME, S-GW, PDN-GW, as common elements of the network, hence the X2 and S1 interfaces were used for handover.

    In this design, X2 handover facilitates handoff between eNodeBs and relies on the MME for S1-AP handoff only.

    In 5G, things have changed a bit:

    As shown in the figure, the gNB has other entities and interfaces such as ch Xn interface, NG-C/U, and in the infrastructure called (NGC) no longer (EPC) we observe the AMF/UPF duality that resembles the MME/S-GW on LTE.

    In comparison, UEs are the same, different radios, on one end LTE, and into the future a 5G radio.

    What are the main actors for handover on LTE

    • ♠ eNodeB – or the Base Station, contains the RF and all IP-level connectivity to the MME/S-GW/PDN-GW to create and maintain connectivity between the RF and EPC-Bearer or Tunnels to the outside world.
    • ♠ S-GW: Refers to a component that connects the eNodeB with the PDN-GW and is usually a router that sends the tunnel to the PDN-GW with data from the eNodeB or the UE
    • ♠ PDN-GW: Functions as the anchor or the home of the network, is the main NAT/Routing GW to the internet and keeps track of all tunnels for each UE on the network, and knows how to forward packets to the UEs.
    • ♠ MME: The Mobility Management Entity, handles mobility in general, required for the S1-AP handover, and handles many mobility functions coordinating with the PDN-GW/S-GWs.

    There are multiple specifications related to handover on LTE and defined by ETSI/3GPP organizations.

    PDF TS 136.331
    PDF TS 136.300
    PDF TS 129.275

  • X2 Handover in LTE: A Tutorial

    X2 Handover:  How does it work?

    An X2 Handover is used by LTE as well as S1 handovers for User Equipment (“UE”) or mobile phone mobility.

    First and foremost,  LTE and 5G both share an ALL-IP Architecture. In the past, in UMTS systems or even older systems, mobility consisted in several layers of IuB interfaces from the RNC to the NodeBs.  It is not then an ALL-IP network as expected.

    We will not go over Tracking Area Updates and Tracking Area Indentifiers as that’s will be discussed in a later post.

    In UMTS, the Radio Network Controller (RNC) manages hundreds of NodeBs, all interconnected using the IuB interface and RNC to RNC uses the IuR Interface. The SGSN or Serving GPRS Support Node is in charge of setting up the internet link or GTP-U tunnel from the SGSN tot he RNC. However the IP link will not move although an you can switch from NodeBs, meaning that any soft-handover or hand-handovers that occur between NodeBs does not affect the GTP-U link form the internet to the UE.

    UMTS Network

    In LTE, on the other hand there are many changes, one is that eNodeB is the end-point of the IP link, making it an ALL-IP network. This change requires some redesign to the protocols and specially the insertion of “hard handovers” plus X2 and S1AP Handover protocols that are now based on IP Mobility.   As shown in the figure below, X2 interfaces communicate eNodeBs, and S1 links from eNodeBs to S-GWs and S1-MME to the MME. The MME is the Mobility Management Entity which tracks the UE and does paging, as well as updates.

    LTE X2 Interface

    As you can observe, the X2 Interface is key for handoff as this interface is used not only to detect adjacent eNodeBs but also to exchange information as interference and others.



    The X2 handover will be illustrated as follows:

    The UE has to be in RRC_CONNECTED stated not in RRC_IDLE where a process called “Cell Reselection” i used. Lets Start with 1-6 Steps:

    Step 1: Handover Command

    As opposed to others, we will start with the Handover Command, which is the an RRC Connection Reconfiguration Message that contains a field called “MobilityConttrolInfo” this field contains the Physical Cell ID to handover to, as well as a list of neighbor cells with their associated “Cell Individual Offsets” that are used for A3, A5 and other events.

    Handover Command

    The Handover Command forces the switch from a previous cell to the next cell. Handover can only occur

    In this example a Handover Command was issued to connect to eNodeB with ID=1.

    An RRC Connection Reconfiguration message may follow with a list of Cell IDs, in this example, 2, 3, and maybe 4, to add to the list to monitor for a measurement report to be created.

    Mobility Control Info Structure

    This structure can be found in the specification as follows:

    Mobility Control Info

    Step 2 : Measurement Reports and Events

    As we know, LTE specification defines several reports. In this example we will focus on A5 and A3 events, that are programmed using the Cell Individual Offsets and Frequency offsets found in the specification.   Since the device is in “Connected State”  Layer 3 filtering is applied to the measurements made by the UE.

    The filtering algorithm may use different coefficients that the eNodeB sets as default.

    L3 Interfaces


    Events and measurements

    The state machine inside the UE, is configured by the rrcConnectionReconfiguration message to track all the eNodeBs provided and its frequencies, including applying SIB4 blocks that are submitted by the eNodeB to the target.

    In a way the eNodeB is predicting the next state to follow reporting A5 and A3 Events to the eNodeB.

    X2 handover Measurement Reports


    Now it is known by the eNodeB that Handover might be required and decides based on all the events or measurement reports, where to Handoff the UE too, and creates a HANDOVER REQUEST to a a Target eNodeB or the one with ID=2.

    X2 handover Handover Request

    STEP 4: Allocation of resources in Target eNodeB

    Now that Handover Request is moving forward, a setup for tunnels is created to the Target such that all internet traffic will start flowing tot he Target eNodeB with Cell ID =2


    X2 handover Handover Resources Allocated

    Once this is successful a Handover Acknolwedgement is made to the source and packets start going to the Target, similarly, Downlink and Uplink tunnels start being moved to the target eNodeB with Cell ID = 2


    STEP 5.  Handover Command to Switch to Target

    Exactly as in STEP 1, a Handover Command (in an rrcConnection Reconfiguration message) containing the Target ID = 2 is issued from the Source, also at some point another rrcConnection Reconfiguration message will contain all neighbor nodes with its respective Cell Individual Offests and this process will continue.

    X2 handover Handover Command


    STEP 6.  All is switch to the Target and MME is updated of the move.

    As a final step of handover, the path switch is complete which is a process called “Late Path Switch” that generates all traffic to move from the Source to the Target eNodeB in its totality.


    X2 handover Handover Completion

    You can hire us for consulting for your 4G or 5G Project.

    We have R&D Labs with wireless capabilities for IOT, Mobile, Emulation

    Hands-on Experts in Computer Communications, Networking, Cloud, Network Function Virtualization (NFV), Edge Computing, Smartphones, and all your strategic intellectual property needs.

  • Smartphone Expert Witness

    Our team of engineers have worked in companies like Motorola Mobility,  Microsoft, Blackberry, Nokia, and many other phone manufacturers.  Dr. Edwin Hernandez has licensed some of his technologies to major phone manufacturers. ...
  • Introduction Big Data in RF Analysis

    Big Data in RF Analysis

    Big Data provides tools and a framework to analyze data, in fact, large amounts of data. Radio Frequency, RF, provides  amounts of information that depending n how it is modeled or created, its analysis fits many statistical models and is in general  predicted using passive filtering techniques.

    The main tools for Big Data include statistical aggregation functions,  learning algorithms, and the use of tools. There are many that can be purchased but many that are free but may require certain level of software engineering.  I love Python and specially the main modules used in python are:

    • Pandas
    • SciPy
    • NumPy
    • SKLearn

    and, there are many more used for the analysis and post-processing of RF captures.

    Drive Test and Data Simulation

    In general, many drive test tools are used to capture RF data form LTE/4G, and many other systems. As vendors, we can find Spirent, and many others, and we can capture RF from multiple base stations and map those to Lat/Long in a particular area covered by many base stations.  It’s obvious that drive test cannot cover the entire area, as  expected extrapolation and statistical models are required to complete the drive test.

    In a simulator, just as in MobileCDS and other simulators, specially those in “Ray Tracing,” the simulator uses electromagnetic models to compute the RF received by an antenna.


    Big Data Processing for a Massive Simulation

    Unstructured data models are loaded with KML and other 3D simulation systems that include polygons and buildings that are situated on top of a google earth map or any other map vendor.  The intersection of the model with the 3D database produces the propagation model that needs massive data processing, Map-Reduce and Hadoop to handle the simulation.

    HADOOP and MAP Reduce for RF Processing

    The data is then stored in unstructured models with RF information, that include the Electromagnetic field, frequency, time, delay, error, and other parameters that are mapped to each Lat/Log or x,y, z coordinates in the plane being modeled.  The tools are usually written in Python and parallelization can be done in multiple hadoop nodes and processing of CSV/TXT files with all the electromagnetic data and the 3D map being rendered.


    As you can see the Hadoop/GlusterFS is our choice, as we don’t see that much value for HDFS or the Hadoop Data File System are the ones that handle all the files and worker systems.  As you can tell, we are fans of GlusterFS and processing of all Hadoop cluster nodes is managed in a massive processing network of high-performance networks and 10Gb Fiber network.

    Big Data models: OLTP and OLAP  Processing

    The OLTP and OLAP data models definitions can be found online:

    ” – OLTP (On-line Transaction Processing) is characterized by a large number of short on-line transactions (INSERT, UPDATE, DELETE). The main emphasis for OLTP systems is put on very fast query processing, maintaining data integrity in multi-access environments and an effectiveness measured by number of transactions per second. In OLTP database there is detailed and current data, and schema used to store transactional databases is the entity model (usually 3NF).


    – OLAP (On-line Analytical Processing) is characterized by relatively low volume of transactions. Queries are often very complex and involve aggregations. For OLAP systems a response time is an effectiveness measure. OLAP applications are widely used by Data Mining techniques. In OLAP database there is aggregated, historical data, stored in multi-dimensional schemas (usually star schema). “


    We have different research areas:

    • Analysis of data for handover protocols,
    • Data mining for better antenna positioning,
    • Machine learning techniques for better PCRF polices and more