Amarisoft

LTE HO(Handover) - Intra Frequency

This tutorial shows how to test LTE to LTE Handover in Intra Frequency with a commercial phone. This tutorial also shows how to configure Measurement Report and how to trigger measurement report.  Handover is a procedure of cell change during the connected mode and usually occurs as described below.

NOTE In live network, all of these steps would happen, but in lab test environement there are cases where we skip step 1,2 and just perform Step 3 directly. The case where step 1,2,3 are involved is called 'measurement based  handover' and the case where Step 1,2 are skipped and step 3 is directly performed is called Blind handover. Amarisoft callbox support both measurement based handover and blind handover.

In terms of frequencies of current cell and target/destination cell, the handover can be categorized into two types as below

Table of Contents

Introduction

LTE to LTE handover, specifically the Intra Frequency Handover, is a critical procedure within Long Term Evolution (LTE) mobile communication systems that ensures seamless connectivity and quality of service as a user equipment (UE), such as a commercial phone, moves between different eNodeBs (evolved Node Bs) or cells operating on the same frequency. This process is fundamental to maintaining ongoing sessions—such as voice calls or data transfers—without interruption, even as the UE transitions from the coverage area of one cell to another. Handover in LTE is executed while the device remains in a connected mode, leveraging a sophisticated mechanism involving measurement configuration, reporting, and command signaling through the Radio Resource Control (RRC) protocol. The eNodeB orchestrates the handover by instructing the UE to assess radio conditions, report measurements, and, when appropriate, initiates the cell change procedure with all necessary parameters for successful re-establishment in the target cell. The significance of handover operations is underscored by their impact on user experience, network performance, and overall mobility management in the LTE architecture. In practice, handovers are categorized as either measurement-based—relying on real-time signal quality reports from the UE—or blind, where the network commands a cell change without prior measurement feedback. Understanding and testing these handover mechanisms, especially using commercial devices in a controlled environment, is essential for network engineers and testers to validate interoperability, optimize mobility strategies, and ensure robust service delivery in both live and laboratory settings.

Summary of the Tutorial

This tutorial describes the procedure to test LTE Intra-cell Handover using a callbox and UE setup. The main focus is on configuring the test environment, setting up the required parameters, and executing the handover procedure by manipulating cell parameters and monitoring system behavior.

Note: When configuring measurement events in meas_config_desc, actual RRC signaling may vary depending on configuration and implementation. Carefully review documentation on meas_config_desc for LTE and NR as required, especially for complex scenarios such as ENDC.

Test Setup

Test setup for this tutorial is as shown below.  

TestSetup Callbox UE 2sdr 01

Key Configuration Parameters

Followings are important configuration parameters for this tutorial. You may click on the items for the descriptions from Amarisoft documents.

Configuration

I used the enb-2cell-ho-intra.cfg which is copied and modified from enb-2cell-ho.cfg.

LTE HO Intra Config 01

I also used mme-ims.cfg as it is.

LTE HO Intra Config 02

Configure enb-2cell-ho-intra.cfg  as below.

In this test, N_CELL should be set to a value greater than 1 because handover requires more than one cell. In this example, N_CELL is set to 2, so the callbox creates two LTE cells: one serving cell and one target cell.

The TDD value is set to 0, which means this test is configured for FDD operation. N_RB_DL is set to 25, so the LTE channel bandwidth is 5 MHz. Both downlink and uplink antenna numbers are set to 1, so this is a SISO configuration.

CHANNEL_SIM is set to 0, which means the internal channel simulator is disabled. NG_ENB is also set to 0, so this configuration is for normal LTE eNB operation, not ng-eNB operation.

LTE HO Intra Config 03

I added ncell_list to the configuration of the first cell. This list defines the neighbour cells that can be used for handover.

In this example, the first cell is configured with n_id_cell: 1. This is the serving cell where the UE initially camps and connects. Inside ncell_list, the second cell is added as the neighbour cell by setting n_id_cell: 2. This means the first cell knows the second cell as a possible handover target. For this test, both the serving cell and the target cell use the same downlink EARFCN. In the FDD case, both cells are configured with dl_earfcn: 3350. Because the source cell and target cell use the same frequency, this test is an intra-frequency handover test. The neighbour cell entry also includes cell_id and tac information for the target cell. These values are used by the network to identify the target cell during the handover procedure.

LTE HO Intra Config 04

I also added ncell_list to the configuration of the second cell. This is needed when the UE may hand over back from the second cell to the first cell.

In this example, the second cell is configured with n_id_cell: 2. This can become the serving cell after the first handover. Inside ncell_list of the second cell, the first cell is added as the neighbour cell by setting n_id_cell: 1. This means the second cell knows the first cell as a possible handover target. For this intra-frequency handover test, the second cell and its neighbour cell use the same downlink EARFCN. In the FDD case, both are configured with dl_earfcn: 3350. This means the UE does not need to change frequency when moving between the two cells. The neighbour cell entry also includes cell_id and tac information for the first cell. These values identify the target cell when the handover is performed from cell 2 back to cell 1.

LTE HO Intra Config 05

Then I added the measurement criteria using meas_config_desc. This configuration tells the eNB what kind of measurement report should be requested from the UE. Once this is configured, the UE can send a Measurement Report when the configured measurement condition is satisfied, and the eNB can use that report as a trigger for handover.

Since handover is performed in connected mode, I increased inactivity_timer to 600000. This prevents the eNB from releasing the RRC connection too early while I am adjusting the cell power level and waiting for the UE to trigger a measurement report.

In meas_config_desc, several measurement event conditions are configured. In this example, A1, A2, and A3 related parameters are defined. A1 and A2 are based on serving cell signal quality, while A3 is based on the comparison between the neighbour cell and the serving cell. For handover, A3 is commonly used because it can trigger a report when the neighbour cell becomes better than the serving cell by the configured offset.

The report type is set to rsrp, so the measurement condition is evaluated based on RSRP. The time_to_trigger value defines how long the condition should remain true before the UE sends the measurement report. This helps avoid unnecessary reports caused by short and temporary signal fluctuation.

meas_gap_config is also included in the configuration. However, even if this parameter is configured in the file, the measurement gap may not appear in the actual RRC message if it is not needed. For example, in an intra-frequency handover case, the UE can usually measure the neighbour cell on the same frequency without requiring a measurement gap.

Finally, ho_from_meas is set to true. This means the eNB is allowed to initiate handover when it receives a suitable Measurement Report from the UE. In other words, this enables measurement-based handover instead of forcing handover blindly.

LTE HO Intra Config 06

NOTE : Even if various events are explicitely configured in meas_config_desc, whether they are applied to RRC Connection Reconfiguration or not is determined by various factors. Read carefully on the description of meas_config_desc for LTE  and meas_config_desc for NR in enb document for the details. For ENDC case, the logic would become even more complicated. So it is strongly suggested to read the entire section carefully before you start testing.

Perform the test

Start the LTE service and check the basic cell configuration. Any cell configuration is OK as long as both cells are LTE cells and the required handover-related configuration is applied.

In this example, the callbox is running two LTE cells.

From the cell phy result, both cells are configured as LTE Band 7 cells with 5 MHz bandwidth. The downlink EARFCN is 3350 for both cells, and the uplink EARFCN is 21350 for both cells. Since both cells use the same downlink frequency, this confirms that the test is configured as an intra-frequency handover case.

Cell 0x001 is configured with PCI 1, and Cell 0x002 is configured with PCI 2. These different PCI values allow the UE to distinguish the two cells even though they are on the same frequency.

From the cell result, both cells also show the same TAC value, 0x0001, and the same PLMN, 00101. The PRACH root sequence index is different for each cell. Cell 0x001 uses root sequence index 204, and Cell 0x002 uses root sequence index 28. This matches the two-cell configuration prepared earlier.

At this point, the LTE service is running correctly with two intra-frequency cells, so the UE can attach to one cell and later hand over to the other cell based on the configured measurement condition.

LTE HO Intra Run 01

LTE HO Intra Run 02

Adjust the cell power before attaching the UE. In this step, I lowered the power of the second cell so that the UE camps on and attaches to the first cell first.

This was done using the cell_gain command.

In this example, I set the gain of cell 2 to -90 dB using the following command.

After applying this command, the cell command shows that cell 0x001 still has dl_gain 0.0, while cell 0x002 has dl_gain -90.0. This means the second cell is transmitted with much lower power than the first cell.

Because of this power difference, the UE is expected to detect the first cell as the stronger cell and attach to cell 0x001 first.

I used cell_gain instead of tx_gain for this test. The reason is that tx_gain changes the transmit gain at the RF port level and can also affect the broadcasted reference signal power information in SIB. If the SIB information changes, the UE may behave unexpectedly during cell selection or measurement. By using cell_gain, I can adjust the relative cell power for the test without changing the general RF transmit gain setting.

The tx_gain command shows that both TX0 and TX1 remain at the default gain value of 89.8 dB. So in this test, only the cell-level gain was changed, and the RF port transmit gain was kept unchanged.

LTE HO Intra Run 03

LTE HO Intra Run 04

Power on the UE and let it attach to the expected cell. In this test, the expected initial serving cell is the first cell because the second cell power was lowered in the previous step.

Start the trace with the t command and then power on the UE. In the trace output, check the CL column. In this example, the CL value is 001, which means the UE is connected to cell 1.

The PRACH log also shows cell=01, which confirms that the UE performed random access on the first cell. After the UE becomes connected, the trace continues to show uplink and downlink activity for the UE on cell 001.

At this point, the UE is attached to the intended source cell. This is the correct starting condition before increasing the second cell power and triggering the measurement-based handover to cell 2.

LTE HO Intra Run 05

Adjust the cell power to trigger the Measurement Report.

After confirming that the UE is connected to cell 1, change the relative power between the two cells. The purpose of this step is to make the target cell stronger than the current serving cell so that the UE satisfies the configured measurement condition.

First, I lowered the power of the current serving cell, cell 1, using the following command.

After this command, the cell command shows that cell 0x001 has dl_gain -20.0, while cell 0x002 still has dl_gain -90.0. At this moment, cell 1 is still stronger than cell 2, so handover is not expected yet.

Next, I increased the power of the target cell, cell 2, using the following command.

After this command, cell 0x001 has dl_gain -20.0 and cell 0x002 has dl_gain -10.0. This means cell 2 is now transmitted 10 dB stronger than cell 1.

Since cell 2 becomes stronger than the current serving cell, the UE should detect that the neighbour cell satisfies the configured measurement condition. If the condition remains true for the configured time_to_trigger duration, the UE should send a Measurement Report to the eNB.

This Measurement Report is then used by the eNB as the trigger to perform measurement-based handover from cell 1 to cell 2.

LTE HO Intra Run 06

LTE HO Intra Run 07

Confirm that the handover has completed properly.

After changing the cell power, check the trace output again with the t command. In this example, the CL column shows 002. This means the UE is now connected through cell 2.

This confirms that the UE has moved from cell 1 to cell 2. Since cell 2 was configured as the neighbour and target cell, this indicates that the intra-frequency handover was completed successfully.

You can also confirm it by checking that the throughput and uplink/downlink activity are now shown under cell 002. This means the user traffic is now going through the target cell after handover.

If the handover does not happen, adjust the cell power difference again. Usually, the target cell should be made strong enough compared to the serving cell so that the configured measurement condition is satisfied and maintained long enough for the UE to send the Measurement Report.

LTE HO Intra Run 08

Log Analysis

Sample Log

During the initial attach, the callbox sends the Measurement Report configuration to the UE in the RRC Connection Reconfiguration message.

In this message, check measObjectToAddModList, reportConfigToAddModList, and measIdToAddModList. These three parts define what the UE should measure, when the UE should report it, and how the measurement object and report condition are linked together.

In measObjectToAddModList, the measurement object is configured with carrierFreq 3350. This matches the intra-frequency handover test because both the serving cell and neighbour cell are using the same EARFCN. The neighbour cell information is also included so that the UE knows which cell should be measured as a handover candidate.

In reportConfigToAddModList, the report condition is configured. In this example, event A3 is used. Event A3 means the neighbour cell becomes better than the serving cell by the configured offset. This is the main condition used to trigger the Measurement Report for handover. The report quantity is set to RSRP, so the UE evaluates the condition based on RSRP measurement.

In measIdToAddModList, the measObjectId and reportConfigId are linked together. This tells the UE which measurement object should use which report configuration. In this example, measId 1 links measObjectId 1 and reportConfigId 1.

Once this RRC Connection Reconfiguration is completed, the UE has the required measurement configuration. After that, when the target cell becomes stronger than the serving cell and satisfies the A3 condition for the configured time-to-trigger, the UE should send a Measurement Report to the eNB.

LTE HO Intra Log 01

Once the cell power condition satisfies the configured measurement trigger, the UE sends a Measurement Report to the eNB.

In this example, the Measurement Report is shown in the RRC log. This confirms that the UE detected the neighbour cell according to the measurement configuration sent earlier.

In the Measurement Report message, check measResults. The serving cell measurement is shown under measResultPCell. In this example, the serving cell has rsrpResult and rsrqResult values.

More importantly, check measResultNeighCells. This field shows the measured neighbour cell result. In this example, measResultListEUTRA includes physCellId 2. This means the UE measured cell 2 as the neighbour cell and reported it to the eNB.

The neighbour cell measurement result also includes rsrpResult and rsrqResult. This is the information used by the eNB to decide whether the neighbour cell is suitable as the handover target.

If you do not see a Measurement Report containing measResultNeighCells, the handover may not be triggered. In that case, adjust the relative cell power again until the UE reports the neighbour cell. Usually this means making the target cell stronger than the serving cell by enough margin and keeping that condition long enough to satisfy the configured time-to-trigger.

Based on the configuration used in this test, the eNB will not trigger measurement-based handover unless it receives a proper Measurement Report from the UE.

LTE HO Intra Log 02

When the eNB receives the proper Measurement Report from the UE, the callbox triggers the handover.

The handover command is sent in an RRC Connection Reconfiguration message. In this message, the important field to check is mobilityControlInfo. This IE contains the information required for the UE to move from the current serving cell to the target cell.

In this example, mobilityControlInfo includes targetPhysCellId 2. This means the eNB is commanding the UE to hand over to the cell with PCI 2. This matches the intended target cell in this test.

The message also includes newUE-Identity and radioResourceConfigCommon. These parameters provide the UE with the required configuration for accessing the target cell, including PRACH configuration and other common radio resource information.

After receiving this RRC Connection Reconfiguration with mobilityControlInfo, the UE performs the handover procedure toward the target cell. Then the UE should access the target cell and send RRC Connection Reconfiguration Complete after the handover is completed.

So, in this step, the key point is to confirm that mobilityControlInfo is present and that targetPhysCellId is set to the expected target cell. In this example, targetPhysCellId is 2, so the handover command is correctly pointing to cell 2.

LTE HO Intra Log 03

RRC / NAS Signaling

RrcConnectionReconfiguration

: This is the RrcConnectionReconfiguration message sent by eNB  to configure Handover (NOTE : You would see some IEs that has a specific assigned vale here, but consider it as just an example value. Those values should vary depending on test requirement)

 

{

  message c1: rrcConnectionReconfiguration: {

    rrc-TransactionIdentifier 0,

    criticalExtensions c1: rrcConnectionReconfiguration-r8: {

      measConfig {

        ,,,

      },

      mobilityControlInfo {

        targetPhysCellId 2,

        t304 ms1000,

        newUE-Identity '003E'H,

        radioResourceConfigCommon {

          prach-Config {

            rootSequenceIndex 28

          },

          pusch-ConfigCommon {

            pusch-ConfigBasic {

              n-SB 1,

              hoppingMode interSubFrame,

              pusch-HoppingOffset 4,

              enable64QAM TRUE

            },

            ul-ReferenceSignalsPUSCH {

              groupHoppingEnabled FALSE,

              groupAssignmentPUSCH 0,

              sequenceHoppingEnabled FALSE,

              cyclicShift 0

            }

          },

          p-Max 10,

          ul-CyclicPrefixLength len1,

          pusch-ConfigCommon-v1270 {

            enable64QAM-v1270 true

          }

        },

        sameSFN-Indication-r14 true

      },

      radioResourceConfigDedicated {

        mac-MainConfig explicitValue: {

          ...

        },

        physicalConfigDedicated {

         ...

        }

      },

      securityConfigHO {

        handoverType intraLTE: {

          keyChangeIndicator FALSE,

          nextHopChainingCount 0

        }

      },

© 2025 All rights reserved | Legal notice |