UEsim LTE Handover - LTE to LTE
The overall callbox logic and 3GPP related with UEsim Handover is same as in Commercial UE handover. The main focus on this tutorial is to highlight on UEsim side configuration for LTE to LTE handover. Since the configuration on UEsim for handover can be a little bit complicated, I would like you to have some big picture on the call box and UEsim configuration and relationship between them as illustrated below.
What I want to highlight is that you need to configure multiple cells not only in eNB side, but also in UEsim side. In commercial UE, you don't have to care about this since all of those configuration is done internally.
- LTE to LTE Handover IntraFrequency (Commercial UE)
- LTE to LTE Handover InterFrequency (Commercial UE)
- LTE to NR Handover (UEsim)
Table of Contents
- UEsim LTE Handover - LTE to LTE
- Introduction
- Summary of the Tutorial
- Test Setup
- Key Configuration Parameters
- Test 1 : LTE to LTE Interband/Interfrequency Handover / Triggered by eNB Power Change
- Test 2 : LTE to LTE Intraband/Interfrequency Handover / Triggered by eNB Power Change
- RRC / NAS Signaling
- RrcConnectionReconfiguration - Measurement Configuration
- RrcConnectionReconfiguration - Enabling Measurement Gap
- RrcConnectionReconfiguration - Handover
- Tips
Introduction
LTE (Long Term Evolution) handover is a critical mechanism within cellular networks that enables User Equipment (UE) to maintain seamless connectivity while transitioning between different cells or base stations (eNodeBs) during mobility scenarios. In commercial network deployments, handover procedures are abstracted from the end user, with all relevant configurations handled internally by the device and the network infrastructure. However, when working with UEsim (User Equipment Simulator) and callbox test environments, a deeper understanding and explicit configuration of handover parameters become essential. UEsim platforms are employed to emulate real UE behavior for network validation, protocol conformance, and performance testing. In these scenarios, test engineers must manually define cell parameters, mobility settings, and handover triggers not only on the eNB side but also within the UEsim software itself. This approach provides granular control and transparency over the handover process, enabling detailed analysis of LTE mobility management, radio resource control, and interoperability between simulated and real network components. Mastery of UEsim configuration for LTE to LTE handover is fundamental for developers, testers, and researchers aiming to validate network reliability, optimize mobility performance, and ensure compliance with 3GPP standards in controlled laboratory environments.
-
Technology Context
- LTE is a 3GPP-defined wireless broadband standard widely adopted for high-speed mobile communication.
- Handover is a process enabling continuous service as UEs move across different network cells, crucial for user experience and service reliability.
- UEsim platforms simulate real device behavior, allowing controlled experimentation and validation of network procedures such as handover.
- Callboxes act as programmable network emulators, facilitating comprehensive test scenarios for various network conditions and configurations.
-
Relevance and Importance
- Understanding and configuring UEsim for LTE handover is essential for testing network interoperability, performance optimization, and protocol conformance.
- Explicit configuration of multiple cells on both the eNB and UEsim sides enables precise control over handover scenarios, which is not possible with commercial UEs where configurations are hidden.
- This knowledge is invaluable for engineers developing, testing, or troubleshooting LTE networks and devices.
-
Learning Outcomes
- Gain a comprehensive understanding of how LTE to LTE handover is orchestrated and managed with UEsim and callbox environments.
- Learn how to configure multiple cells and mobility parameters on the UEsim platform to emulate realistic handover conditions.
- Develop skills to analyze, validate, and optimize handover procedures for LTE networks using simulation tools.
- Acquire insight into the architectural relationship between UEsim, callboxes, and network infrastructure components during mobility scenarios.
-
Prerequisite Knowledge
- Familiarity with LTE architecture, including concepts such as eNodeB, UE, and cell configuration.
- Basic understanding of radio access network mobility management and 3GPP standards.
- Experience with UEsim or similar test tools and callbox environments is beneficial but not mandatory.
- General competence with network testing methodologies and protocol analysis tools is recommended for optimal learning.
Summary of the Tutorial
This tutorial describes procedures for testing LTE to LTE interband and intraband interfrequency handover using Amarisoft Callbox and UEsim. The focus is on measurement-based handover triggered by eNB (callbox) cell power changes and demonstrates both configuration and operational steps, including log analysis and tips for manual triggering.
-
Test Setup
- The test setup requires connecting at least two SDR cards on both the Callbox and UEsim sides. Appropriate antenna connections are mandatory for both sides to ensure two-cell operation.
-
Key Configuration Parameters
- Configuration involves parameters such as ncell_list (neighbor cell list), meas_config_desc (measurement configuration), meas_gap_config, ho_from_meas, cell_groups, and ue_list. Key measurement event thresholds (a1, a2, a3) and hysteresis/timers should be set according to desired handover conditions.
-
Test 1: LTE to LTE Interband/Interfrequency Handover (Triggered by eNB Power Change)
-
Configuration Steps:
- Configure the eNB with two cells, ensuring N_CELL is set to 2.
- For each cell, set the neighbor cell in ncell_list to enable handover between the two.
- In cell_default, set meas_config_desc to trigger handover based on specific measurement reports. Adjust inactivity_timer and RSRP thresholds as required by UEsim sensitivity.
- UE configuration must match dl_earfcn and bandwidth with the Callbox cell settings.
-
Test Execution:
- Verify cell configuration using the 'cell phy' and 'cell' commands.
- Optionally, log SIB messages for a short period using 'log bcch' to verify correct system information broadcast.
- Adjust cell powers via 'cell_gain' (not 'tx_gain') to avoid unexpected UE behavior due to SIB1 reference power changes.
- Power on the UE and wait for initial attach completion.
- Manually tweak cell power to cross measurement thresholds and trigger the measurement report and subsequent handover.
- Confirm that the handover occurred by observing the change in the cell index (CL column) on the UEsim console.
-
Log Analysis:
- Check for RRC Connection Reconfiguration messages containing correct measurement configuration for both source and target cells.
- Verify that measurement reports for events a2 and a3 are triggered and received as expected.
- Confirm that the handover is executed after the appropriate measurement report and that UE initiates access to the target cell.
-
Configuration Steps:
-
Test 2: LTE to LTE Intraband/Interfrequency Handover (Triggered by eNB Power Change)
-
Configuration Steps:
- Configure eNB with two TDD cells (N_CELL set to 2), each referencing the other in ncell_list.
- Set meas_config_desc to trigger handover when the expected measurement report is received. Adjust a2 RSRP or other measurement parameters for easier triggering based on test setup.
- Match UE cell configuration (frequency, bandwidth, duplex mode) to the eNB's configuration.
-
Test Execution:
- Verify correct cell configuration with 'cell phy' and 'cell' commands.
- Optionally, briefly log SIB messages using 'log bcch' for verification.
- Adjust cell power with 'cell_gain' to trigger measurement events.
- Power on the UE, wait for initial attach, then adjust power to trigger measurement report and handover.
- Confirm the handover by monitoring the CL column on UEsim console.
-
Log Analysis:
- On eNB: Check that measurement configuration, gap support, and inter-frequency measurement are present; verify handover triggering based on measurement reports.
- On UEsim: Enable detailed "Cell meas" logging to monitor measurement values, filtered measurements, and entry conditions for measurement events, facilitating troubleshooting for handover issues.
-
Configuration Steps:
-
Tips
- You can force handover from the screen command line using the "handover" command, regardless of measurement conditions or cell power. Always check the current RAN UE ID before issuing the command to ensure the correct UE is targeted.
Note: For both tests, it is critical to align cell and UE configuration, validate neighbor cell lists, and adjust measurement thresholds to accommodate the UEsim’s radio characteristics. The procedures rely on dynamically controlling cell power to trigger measurement events, which in turn initiate the handover process as per standard LTE methodologies.
Test Setup
Test setup for this tutorial is as shown below. (
The callbox and UEsim are connected with four RF cables between the first SDR card of each machine. For this tutorial that is not enough. Each side runs two cells on rf_port 0 and rf_port 1. The second SDR card of each machine has to be connected as well.
Key Configuration Parameters
Followings are important configuration parameters for this tutorial. You may click on the items for the descriptions from Amarisoft documents.
- ncell_list : In this link, you would get the descriptions for all the items listed below
- rat
- cell_id
- n_id_cell
- dl_earfcn
- tac
- meas_config_desc : In this link, you would get the descriptions for all the items listed below
- a1_report_type
- a1_rsrp
- a1_hysteresis
- a1_time_to_trigger
- a2_report_type
- a2_rsrp
- a2_hysteresis
- a2_time_to_trigger
- a3_report_type
- a3_offset
- a3_hysteresis
- a3_time_to_trigger
- meas_gap_config
- ho_from_meas
- cell_groups
- ue_list
Test 1 : LTE to LTE Interband/Interfrequency Handover / Triggered by eNB Power Change
This test is to show how to test LTE to LTE handover triggered by cell power change from callbox (eNB).
Configuration
I used the enb-2cell-ho-b7-b3.cfg on gNB which is copied and modified from enb-2cell-ho.cfg
For the core network I used mme-ims.cfg, the default configuration, without any change.
I used the ue-ho-LL.cfg on gNB which is copied and modified from ue-2cc.cfg
In enb-2cell-ho-b7-b3.cfg , the configuration is done as follows. Since this is a scenario that requires 2 cells, you need to set N_CELL to 2.
TDD is 0, so both cells are FDD. N_RB_DL is 100, that is 20 MHz. N_ANTENNA_DL is 2 and N_ANTENNA_UL is 1. CHANNEL_SIM is 0 and NG_ENB is 0, so the channel simulator and ng-eNB are not used.
This is the configuration of the first cell. It is important to note that you need to specify the second cell (n_id_cell : 2) into ncell_list(Neighbour cell list) configuration.
The first cell uses rf_port 0, cell_id 0x01, tac 0x0001 and n_id_cell 1. With TDD set to 0, the #else branch applies. dl_earfcn is 3100, a DL center frequency of 2655 MHz in band 7. The TDD branch is not used in this test.
In ncell_list, the neighbour is n_id_cell 2 with dl_earfcn 1575. This is the second cell. Its cell_id is 0x1a2e002, the eNB_ID 0x1a2e0 followed by cell_id 0x02. Its tac is 1. The tac_5gc line is used only when NG_ENB is 1.
This is the configuration of the second cell. It is important to note that you need to specify the first cell cell (n_id_cell : 1) into ncell_list(Neighbour cell list) configuration.
The second cell uses rf_port 1, cell_id 0x02, n_id_cell 2 and root_sequence_index 28. dl_earfcn is 1575, a DL center frequency of 1842.5 MHz in band 3. So the handover in this test goes from band 7 to band 3.
Its ncell_list points back to n_id_cell 1 with dl_earfcn 3100 and cell_id 0x1a2e001. With each cell listed in the other's ncell_list, the UE can be handed over either way.
In cell_default configuration, I set meas_config_desc to trigger the handover only when the expected measurement report is recieved. I also increased the value for inactivity_timer just to give user enough time to tweak cell power to trigger appropriate measurement report.
inactivity_timer is 180000 ms. This is not mandatory. I set the timer to a large value to keep the connection without IP traffic. You may instead flow some IP traffic, such as a continuous ping, and leave this value as it is.
In meas_config_desc, a1_rsrp and a2_rsrp are both -60 dBm, with hysteresis 0 and time_to_trigger 640. Under eutra_handover, a3_offset is 6, with hysteresis 0 and time_to_trigger 480. I set these values so that the DUT, UEsim in this case, can report a2 and a3 without breaking the radio link.
meas_gap_config is "gp0". ho_from_meas is true, so the eNB initiates a handover when a suitable measurement report is received.
In ue-ho-LL.cfg, the configuration is done as follows. Since this is a scenario that requires 2 cells, you need to set N_CELL to 2.
TDD is 0 to match the FDD cells on the callbox, and CELL_BANDWIDTH is 20. N_ANTENNA_DL is 2, N_ANTENNA_UL is 1 and UE_COUNT is 1. CHANNEL_SIM is 0, so the UE channel simulator is not used.
In cell_groups, multi_ue depends on CHANNEL_SIM and UE_COUNT. With CHANNEL_SIM 0 and UE_COUNT 1, the last #else branch applies. multi_ue is set to true there, with false left as a comment.
This is the cell configuration of the first cell. It does not require any specific configuration. You only neet to set dl_earfcn and bandwidth to match the configuration of the first cell on Callbox.
dl_earfcn is 3100, a DL center frequency of 2655 MHz in band 7. This is the same as the first cell on the callbox. bandwidth comes from CELL_BANDWIDTH. global_timing_advance is -1, so the timing advance from the first received RAR is used. The position, antenna and ref_signal_power block under CHANNEL_SIM is not used in this test.
The second cell is set the same way. dl_earfcn is 1575, a DL center frequency of 1842.5 MHz in band 3, to match the second cell on the callbox. The CHANNEL_SIM block is not used here either.
This is the configuration of the first ue. It does not require any specific configuration. You only neet to set dl_earfcn and bandwidth to match the configuration of the second cell on Callbox.
The UE has imsi 001010123456789 and K 00112233445566778899aabbccddeeff. as_release is 13 and ue_category is 13. ue_count comes from UE_COUNT, which is 1. The CHANNEL_SIM block with cell_index, position and the awgn channel is not used in this test.
Perform the Test
Check if the cell is configured as intended. You can check these out with 'cell phy' and 'cell' command.
cell phy shows two LTE cells with 20 MHz bandwidth and 15 kHz SCS. Cell 0x001 is band 7 on DL ARFCN 3100 and UL ARFCN 21100. Cell 0x002 is band 3 on DL ARFCN 1575 and UL ARFCN 19575. Both use 2 DL antennas and 1 UL antenna.
The cell command shows the same two cells with TAC 0x0001 and PLMN 00101. Cell 0x001 has pci 1 and cell 0x002 has pci 2. dl_gain is 0.0 for both before any change.
This is not mandatory, but I would recommend to log SIB messages for a short time and stop so that you can confirm all the sibs for each cells. But I would not recommend you to capture the SIB log all the time since it may make it difficult to analyze other RRC / NAS messages. So I would just collect SIB log just a few seconds at the beginning and stop logging. You can do it with 'log bcch' command.
log bcch=1 turns the BCCH logging on. log bcch=0 turns it off again after a few seconds.
Then adjust the cell power of each cell with 'cell_gain'. The exact cell power you need to set would vary depending on your test setup. I would suggest you to use cell_gain instead of tx_gain in this case because if you change the cell power with tx_gain, the reference power broadcast in SIB1 changes and UE may behave differently from what you expect.
I set cell_gain 1 -20 and cell_gain 2 -50, so that the UE camps onto cell 1 first. You may tweak these values for your own test setup.
You can confirm on the result of cell power changes done by cell_gain from the result of 'cell' command. You can confirm on it under dl_gain column.
dl_gain now reads -20.0 for cell 0x001 and -50.0 for cell 0x002. Cell 1 is 30 dB stronger than cell 2.
Power on UE on UE sim. In this test, I wanted to make it sure that only one UE attempt to camp on. So I did 'power_on 1'.
UEsim opens RF0 at 2655 MHz DL in band 7 and RF1 at 1842.5 MHz DL in band 3. These match the two cells on the callbox. It reports SIB found for both Cell 1 and Cell 0 before power_on 1.
Wait until the initial attach is complete.
In the 't' trace on the callbox, PRACH is received on cell 01 with snr 28.8 dB. The UE then appears under CL 001 with RNTI 003d. This confirms that the initial connection is done with cell 1.
Then tweak the cell power to trigger measurement report and handover. You cannot check if the result of the measurement report in 't' output (trace log), but if the measurement report comes in as expect and handover is properly done, you would see that cell ID under 'CL' column change to the destination cell.
I set cell_gain 2 -10 to increase the power of cell 2. Cell 2 is then 10 dB above cell 1. That meets the a3 condition, which needs cell 2 to be 6 dB higher than cell 1 in this configuration. After the handover, CL changes to 002 and the RNTI changes to 003e.
You can confirm handover on UEsim console (screen window) as well. Once the handover is complete, you see that the cell index under 'CL' column switches to the target cell.
In the UEsim trace, CL is 00 with RNTI 003d and RSRP about -87.6 dBm before the handover. After the handover CL is 01 with RNTI 003e and RSRP about -75.4 dBm. UEsim counts the cells from 0, so CL 00 is cell 1 and CL 01 is cell 2.
Log Analysis
Since this test is for Handover based on measurement report, check if eNB transmits RRC Connection Reconfiguration with measurement configuration and see if the contents of the messages are all set as intended.
First check measObjectToAddModList and see the frequency of both the source and target cells are configured.
This is the RRC connection reconfiguration sent after UE capability information. measObjectId 1 has carrierFreq 3100 and measObjectId 2 has carrierFreq 1575. Both use allowedMeasBandwidth mbw100.
reportConfigId 1 is event A1 with a1-Threshold threshold-RSRP 80, hysteresis 0 and timeToTrigger ms640. The value 80 comes from a1_rsrp -60 in the eNB configuration.
Here you see that event a2 and a3 are configured.
reportConfigId 2 is event A2 with a2-Threshold threshold-RSRP 80 and timeToTrigger ms640. reportConfigId 3 is event A3 with a3-Offset 6, reportOnLeave FALSE and timeToTrigger ms480. These match a2_rsrp, a3_offset and the time_to_trigger values in meas_config_desc.
Now check out measIDToAddModList and see if the measurement conditions are configured as intended. Here you see a2 measurement is registered as measId 2 and a3 measurement is registered as measId3.
measId 2 links measObjectId 1 to reportConfigId 2, so a2 is checked on the serving frequency 3100. measId 3 links measObjectId 2 to reportConfigId 3, so a3 is checked on the target frequency 1575. measGapConfig is release at this point, so no measurement gap is used yet.
Now you see that UE send measurement report for a2 event indicating that Serving becomes worse than threshold.
The report comes at 17:36:01.278 with measId 2, which is a2 in this test. measResultPCell has rsrpResult 53 and rsrqResult 25. There is no neighbour cell result in this report.
With the reception of a2 event, eNB enables measurement gap that is need to perform the measurement for interRAT target cell.
Right after the report, the eNB sends RRC connection reconfiguration. measIdToRemoveList removes measId 2. measIdToAddModList adds measId 1, which links measObjectId 1 to reportConfigId 1 for event A1. measGapConfig setup has gapOffset gp0: 0, from meas_gap_config "gp0".
Now UE send measurement report for event 3 indicating that Neighbour becomes offset better than serving.
The report comes at 17:37:16.518 with measId 3, which is a3 in this test. The serving cell has rsrpResult 53 and rsrqResult 25. The neighbour, physCellId 2, has rsrpResult 63 and rsrqResult 29.
On reception of the measurement for the target cell(event a3), eNB send RRC Connection Reconfiguration for handover.
mobilityControlInfo has targetPhysCellId 2 and dl-CarrierFreq 1575, so the target is cell 2. t304 is ms1000 and newUE-Identity is '003E'H. That is the RNTI 003e seen in the trace after the handover. radioResourceConfigCommon carries the target cell settings, such as prach rootSequenceIndex 28 and referenceSignalPower -31.
With the reception of RRC Connection Reconfiguration for handover, UE triggers RACH to the destination cell for handover.
The PRACH on cell 2 comes at 17:37:16.534 with sequence_index 50 and snr 28.8 dB. The eNB allocates a new UE and sends RAR with rapid 50. Then the MAC shows CRNTI 0x003e and resuming connection of ue_id 0x0002.
Test 2 : LTE to LTE Intraband/Interfrequency Handover / Triggered by eNB Power Change
This test is to show how to test LTE to LTE handover triggered by cell power change from callbox (eNB). The main purpose of this tutorial is to introduce the measurement logging capability of Amarisoft UEsim (UE simulator) which is great helpful not only for troubleshooting but also for understanding the detailed process of measurement report before Handover.
Configuration
I used the enb-2cell-ho-b48-inter.cfg on gNB which is copied and modified from enb-2cell-ho.cfg
For the core network, I haven't changed anything and used the default configuration (mme-ims.cfg) as it is.
I used the ue-2cell-ho-b48-inter.cfg on gNB which is copied and modified from ue-2cc.cfg
In enb-2cell-ho-b48-inter.cfg, the configuration is done as follows. Since this is a scenario that requires 2 cells, you need to set N_CELL to 2. In this tutorial, I used two TDD cells (TDD 1), but you can configure it in anyway you like.
TDD is 1 and N_RB_DL is 100, that is 20 MHz. N_ANTENNA_DL is 1 and N_ANTENNA_UL is 1, unlike Test 1. CHANNEL_SIM and NG_ENB are 0.
This is the configuration of the first cell. It is important to note that you need to specify the second cell (n_id_cell : 2) into ncell_list(Neighbour cell list) configuration.
The first cell keeps cell_id 0x01, n_id_cell 1 and root_sequence_index 204. With TDD 1, the TDD branch applies, and dl_earfcn is 55940 in band 48. The rest of that comment still says 2593 MHz in band 41 and is not updated. The FDD branch is not used.
In ncell_list, the neighbour is n_id_cell 2 with dl_earfcn 55340, also in band 48. This sets the possible destination cell as a neighbour cell.
This is the configuration of the second cell. It is important to note that you need to specify the first cell cell (n_id_cell : 1) into ncell_list(Neighbour cell list) configuration.
The second cell uses rf_port 1, cell_id 0x02, n_id_cell 2 and root_sequence_index 28. Its dl_earfcn is 55340 in band 48. Both cells are in band 48 on different frequencies, so this is an intraband, interfrequency handover.
Its ncell_list points back to n_id_cell 1 with dl_earfcn 55940.
In cell_default configuration, I set meas_config_desc to trigger the handover only when the expected measurement report is recieved. Just to make it easy to configure cell power for the measurement report, I increased a2_rsrp but you can tweak the rsrp criteria in any way that suits your test setup.
a1_rsrp is -105 and a2_rsrp is -80, with -110 left as a comment. I increased a2_rsrp to trigger a2 more easily. You may tweak a1_rsrp and a2_rsrp for your test setup, or to make the test easier.
eutra_handover has a3_offset 6, hysteresis 0 and time_to_trigger 480. meas_gap_config is "gp0". ho_from_meas is true, so the eNB triggers the handover only when a proper measurement report is received.
In ue-2cell-ho-b48-inter.cfg , the configuration is done as follows. Since this is a scenario that requires 2 cells, you need to set N_CELL to 2 and I configured the cells to TDD (TDD 1) to match it to eNB configuration.
TDD is 1 and CELL_BANDWIDTH is 20. N_ANTENNA_DL is 1 and N_ANTENNA_UL is 1, the same as the callbox. UE_COUNT is 1.
This is the cell configuration of the two cells. It does not require any specific configuration. You only neet to set dl_earfcn and bandwidth to match the configuration of the first cell on Callbox.
In this file the first entry in cells has dl_earfcn 55940, for the first callbox cell. The second entry has dl_earfcn 55340, for the second callbox cell. Both take bandwidth from CELL_BANDWIDTH and use global_timing_advance -1. The comments after each dl_earfcn still name band 41 and band 40, and only the dl_earfcn values are used.
This is the configuration of the first ue. It does not require any specific configuration. You only neet to set dl_earfcn and bandwidth to match the configuration of the second cell on Callbox.
Perform the Test
Check if the cell is configured as intended. You can check these out with 'cell phy' and 'cell' command.
cell phy shows two LTE cells in band 48 with 20 MHz bandwidth and 15 kHz SCS. Cell 0x001 is on ARFCN 55940 and cell 0x002 on ARFCN 55340, in both DL and UL. Each uses 1 DL antenna and 1 UL antenna. POW reads -39 for cell 0x001 and -40 for cell 0x002.
The cell command shows pci 1 and pci 2, TAC 0x0001 and PLMN 00101. dl_gain is 0.0 for both cells before any change.
This is not mandatory, but I would recommend to log SIB messages for a short time and stop so that you can confirm all the sibs for each cells. But I would not recommend you to capture the SIB log all the time since it may make it difficult to analyze other RRC / NAS messages. So I would just collect SIB log just a few seconds at the beginning and stop logging. You can do it with 'log bcch' command.
Then adjust the cell power of each cell with 'cell_gain'. The exact cell power you need to set would vary depending on your test setup. I would suggest you to use cell_gain instead of tx_gain in this case because if you change the cell power with tx_gain, the reference power broadcast in SIB1 changes and UE may behave differently from what you expect.
In this test I set only cell_gain 2 -10. Cell 1 stays at 0 dB, so the UE camps onto cell 1 first.
You can confirm on the result of cell power changes done by cell_gain from the result of 'cell' command. You can confirm on it under dl_gain column.
dl_gain reads 0.0 for cell 0x001 and -10.0 for cell 0x002.
Power on UE on UE sim. In this test, I wanted to make it sure that only one UE attempt to camp on. So I did 'power_on 1'.
Wait until the initial attach is complete.
PRACH is received on cell 01 with seq 4 and snr 29.0 dB. The UE appears under CL 001 with RNTI 003d and DL cqi 15. The initial attach is done on cell 1.
Then tweak the cell power to trigger measurement report and handover.
First I set cell_gain 1 -10, so both cells read dl_gain -10.0. Then I set cell_gain 1 -20. Cell 1 is then 10 dB below cell 2, and the UE reports a2 and then a3.
You cannot check if the result of the measurement report in 't' output (trace log), but if the measurement report comes in as expect and handover is properly done, you would see that cell ID under 'CL' column change to the destination cell.
You can confirm handover on UEsim console (screen window) as well. Once the handover is complete, you see that the cell index under 'CL' column switches to the target cell.
After the handover, the UE is under CL 002 with RNTI 003e. DL cqi is 15 and the UL snr is about 14 to 15 dB.
Log Analysis
Here I put both eNB log and UEsim log. For overall procedure of handover, I will describe based on eNB log. But I would suggest the readers to look into UEsim log and see what is exactly going on within the UE especially during the measurement process.
eNB
Since this test is for Handover based on measurement report, check if eNB transmits RRC Connection Reconfiguration with measurement configuration and see if the contents of the messages are all set as intended.
For handover test, it is always good practice to confirm that UE support the necessary feature which is required for the handover.
The UE capability enquiry at 17:55:01.875 asks for eutra capabilities. requestedFrequencyBands-r11 lists band 48. The UE answers with UE capability information right after.
Ensure that measurement gap and inter-frequency meansurement report are supported.
supportedBandListEUTRA has bandEUTRA 48 with halfDuplex FALSE. In measParameters, interFreqNeedForGaps is TRUE, so the UE needs a measurement gap to measure the other frequency.
featureGroupIndicators includes bit 25, inter-frequency measurements and reporting in E-UTRA connected mode. Bit 13, inter-frequency handover, is also set.
First check measObjectToAddModList and see the frequency of both the source and target cells are configured.
The measurement object for the first and second cell are configured. The measObjectId 1 is for the first cell and the measObjectId 2 is for the second cell
measObjectId 1 has carrierFreq 55940 and measObjectId 2 has carrierFreq 55340. Both use allowedMeasBandwidth mbw100 and presenceAntennaPort1 FALSE.
Here you see that event a1,a2 and a3 are configured. The reportConfigID 1 is for Event A1, the reportConfigID 2 is for Event A2 and the reportConfigID 3 is for Event A3.
a1-Threshold is threshold-RSRP 35 and a2-Threshold is threshold-RSRP 60. These come from a1_rsrp -105 and a2_rsrp -80 in the eNB configuration. Both use hysteresis 0 and timeToTrigger ms640. Event A3 has a3-Offset 6, reportOnLeave FALSE and timeToTrigger ms480.
Now check out measIDToAddModList and see if the measurement conditions are configured as intended. Here you see a2 measurement is registered as measId 2 and a3 measurement is registered as measId3.
measId 2 links measObjectId 1 to reportConfigId 2, which is a2 on the serving frequency. measId 3 links measObjectId 2 to reportConfigId 3, which is a3 on the target frequency. measGapConfig is release, so no gap is used yet.
Now you see that UE send measurement report for a2 event indicating that Serving becomes worse than threshold.
The a2 report comes at 17:55:52.575 with measId 2. measResultPCell has rsrpResult 56 and rsrqResult 30.
With the reception of a2 event, eNB enables measurement gap that is need to perform the measurement for interRAT target cell.
Right after the a2 report, measIdToRemoveList removes measId 2. measId 1 is added for event A1, linking measObjectId 1 to reportConfigId 1. measGapConfig setup has gapOffset gp0: 0.
Now UE send measurement report for event 3 indicating that Neighbour becomes offset better than serving.
The a3 report comes at 17:55:53.215 with measId 3. The serving cell has rsrpResult 55 and rsrqResult 31. The neighbour, physCellId 2, has rsrpResult 66 and rsrqResult 32.
On reception of the measurement for the target cell(event a3), eNB send RRC Connection Reconfiguration for handover.
mobilityControlInfo has targetPhysCellId 2 and dl-CarrierFreq 55340. t304 is ms1000 and newUE-Identity is '003E'H. The target cell settings include prach rootSequenceIndex 28, and tdd-Config with subframeAssignment sa2 and specialSubframePatterns ssp7.
With the reception of RRC Connection Reconfiguration for handover, UE triggers RACH to the destination cell for handover.
The PRACH on cell 2 comes at 17:55:53.250 with sequence_index 32 and snr 28.3 dB. The eNB sends RAR with rapid 32. Then the MAC shows CRNTI 0x003e and resuming connection of ue_id 0x0002.
UEsim
The final decision to trigger the handover is supposed to be made by eNB, but the information required for the decision making is supposed to be collected and provided by UE. For troubleshooting for handover failure (especially due to no measurement report from UE), it is important to get access to the detailed logging capability on UE side. Amarisoft UEsim provides great logging capability for the process.
In order to collect the log for this process on UEsim, enable "Cell meas" flags in logging configuration setup as shown below.
Open the log configuration of the UE server in WebGUI. Check Cell meas in Flags and Cell meas in RRC flags, then click [Update].
Amarisoft UEsim prints various information related to RRC measurement : Measurement Result, Measurement ID entering condition etc as shown below.
(A) and (B) are Connected cell measurement refresh entries. Each lists both measurement objects: MOId 1 on ARFCN 55940 with PCI 1, and MOId 2 on ARFCN 55340 with PCI 2.
(C) is MeasId 2 entering condition for Event A2 on EARFCN 55940, PCI 1, with time to trigger 640 ms. (D) is a refresh before the a3 report. There, cell 1 is at -85.1/-85.0 dBm RSRP and cell 2 at -74.8/-74.8 dBm.
(E) is MeasId 3 entering condition for Event A3 on EARFCN 55340, PCI 2, with time to trigger 480 ms. The Measurement report at 17:55:53.186 then carries measId 3. It reports rsrpResult 55 for the serving cell and 66 for PCI 2.
(F) is MeasId 1 entering condition for Event A1 on EARFCN 55940, PCI 1, with time to trigger 640 ms.
RRC / NAS Signaling
Here I will just list required message from callbox and I haven't put the required messages from UE side. For the messages from UE, refer to the log analysis and check further with the sample log linked above.
This is the RrcReconfiguration sent by gNB to configure measurement and handover. (
RrcConnectionReconfiguration - Measurement Configuration
This is the first RRC connection reconfiguration from Test 1. It sets measObjectId 1 on carrierFreq 3100 and measObjectId 2 on carrierFreq 1575, with events A1, A2 and A3. measId 2 and measId 3 tie a2 and a3 to these objects, and the measurement gap is released.
{
message c1: rrcConnectionReconfiguration: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: rrcConnectionReconfiguration-r8: {
measConfig {
measObjectToAddModList {
{
measObjectId 1,
measObject measObjectEUTRA: {
carrierFreq 3100,
allowedMeasBandwidth mbw100,
presenceAntennaPort1 TRUE,
neighCellConfig '01'B
}
},
{
measObjectId 2,
measObject measObjectEUTRA: {
carrierFreq 1575,
allowedMeasBandwidth mbw100,
presenceAntennaPort1 TRUE,
neighCellConfig '01'B
}
}
},
reportConfigToAddModList {
{
reportConfigId 1,
reportConfig reportConfigEUTRA: {
triggerType event: {
eventId eventA1: {
a1-Threshold threshold-RSRP: 80
},
hysteresis 0,
timeToTrigger ms640
},
triggerQuantity rsrp,
reportQuantity both,
maxReportCells 1,
reportInterval ms120,
reportAmount r1
}
},
{
reportConfigId 2,
reportConfig reportConfigEUTRA: {
triggerType event: {
eventId eventA2: {
a2-Threshold threshold-RSRP: 80
},
hysteresis 0,
timeToTrigger ms640
},
triggerQuantity rsrp,
reportQuantity both,
maxReportCells 1,
reportInterval ms120,
reportAmount r1
}
},
{
reportConfigId 3,
reportConfig reportConfigEUTRA: {
triggerType event: {
eventId eventA3: {
a3-Offset 6,
reportOnLeave FALSE
},
hysteresis 0,
timeToTrigger ms480
},
triggerQuantity rsrp,
reportQuantity both,
maxReportCells 8,
reportInterval ms120,
reportAmount r1
}
}
},
measIdToAddModList {
{
measId 2,
measObjectId 1,
reportConfigId 2
},
{
measId 3,
measObjectId 2,
reportConfigId 3
}
},
quantityConfig {
quantityConfigEUTRA {
}
},
measGapConfig release: NULL
},
dedicatedInfoNASList {
'2776859E94010742013E060000F110000100445....'H
},
radioResourceConfigDedicated {
srb-ToAddModList {
{
srb-Identity 2,
rlc-Config explicitValue: am: {
ul-AM-RLC {
t-PollRetransmit ms60,
pollPDU pInfinity,
pollByte kBinfinity,
maxRetxThreshold t32
},
dl-AM-RLC {
t-Reordering ms45,
t-StatusProhibit ms0
}
},
logicalChannelConfig defaultValue: NULL
}
},
drb-ToAddModList {
{
eps-BearerIdentity 5,
drb-Identity 1,
pdcp-Config {
discardTimer infinity,
rlc-AM {
statusReportRequired TRUE
},
headerCompression notUsed: NULL
},
rlc-Config am: {
ul-AM-RLC {
t-PollRetransmit ms80,
pollPDU p64,
pollByte kB125,
maxRetxThreshold t32
},
dl-AM-RLC {
t-Reordering ms35,
t-StatusProhibit ms10
}
},
logicalChannelIdentity 3,
logicalChannelConfig {
ul-SpecificParameters {
priority 15,
prioritisedBitRate kBps8,
bucketSizeDuration ms100,
logicalChannelGroup 3
}
}
}
},
physicalConfigDedicated {
antennaInfo-r10 explicitValue-r10: {
transmissionMode-r10 tm3,
codebookSubsetRestriction-r10 '11'B,
ue-TransmitAntennaSelection release: NULL
},
cqi-ReportConfig-r10 {
nomPDSCH-RS-EPRE-Offset 0,
cqi-ReportPeriodic-r10 setup: {
cqi-PUCCH-ResourceIndex-r10 0,
cqi-pmi-ConfigIndex 44,
cqi-FormatIndicatorPeriodic-r10 widebandCQI-r10: {
},
ri-ConfigIndex 483,
simultaneousAckNackAndCQI TRUE
}
},
cqi-ReportConfigPCell-v1250 {
altCQI-Table-r12 allSubframes
}
}
}
}
}
}
RrcConnectionReconfiguration - Enabling Measurement Gap
This is the reconfiguration sent after the a2 report. It removes measId 2, adds measId 1 for event A1, and sets up the measurement gap with gapOffset gp0: 0.
{
message c1: rrcConnectionReconfiguration: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: rrcConnectionReconfiguration-r8: {
measConfig {
measIdToRemoveList {
2
},
measIdToAddModList {
{
measId 1,
measObjectId 1,
reportConfigId 1
}
},
measGapConfig setup: {
gapOffset gp0: 0
}
}
}
}
}
RrcConnectionReconfiguration - Handover
This is the handover command. mobilityControlInfo sets targetPhysCellId 2 on dl-CarrierFreq 1575, with t304 ms1000 and newUE-Identity '003E'H.
{
message c1: rrcConnectionReconfiguration: {
rrc-TransactionIdentifier 0,
criticalExtensions c1: rrcConnectionReconfiguration-r8: {
......
mobilityControlInfo {
targetPhysCellId 2,
carrierFreq {
dl-CarrierFreq 1575
},
t304 ms1000,
newUE-Identity '003E'H,
radioResourceConfigCommon {
prach-Config {
rootSequenceIndex 28
},
pdsch-ConfigCommon {
referenceSignalPower -31,
p-b 1
},
pusch-ConfigCommon {
pusch-ConfigBasic {
n-SB 1,
hoppingMode interSubFrame,
pusch-HoppingOffset 8,
enable64QAM TRUE
},
ul-ReferenceSignalsPUSCH {
groupHoppingEnabled FALSE,
groupAssignmentPUSCH 0,
sequenceHoppingEnabled FALSE,
cyclicShift 0
}
},
p-Max 10,
ul-CyclicPrefixLength len1,
pusch-ConfigCommon-v1270 {
enable64QAM-v1270 true
}
},
sameSFN-Indication-r14 true
},
radioResourceConfigDedicated {
mac-MainConfig explicitValue: {
ul-SCH-Config {
maxHARQ-Tx n5,
periodicBSR-Timer sf20,
retxBSR-Timer sf320,
ttiBundling FALSE
},
drx-Config release: NULL,
timeAlignmentTimerDedicated infinity,
phr-Config setup: {
periodicPHR-Timer sf500,
prohibitPHR-Timer sf200,
dl-PathlossChange dB3
}
},
physicalConfigDedicated {
pdsch-ConfigDedicated {
p-a dB-3
},
pucch-ConfigDedicated {
ackNackRepetition release: NULL
},
pusch-ConfigDedicated {
betaOffset-ACK-Index 9,
betaOffset-RI-Index 6,
betaOffset-CQI-Index 6
},
uplinkPowerControlDedicated {
p0-UE-PUSCH 0,
deltaMCS-Enabled en0,
accumulationEnabled TRUE,
p0-UE-PUCCH 0,
pSRS-Offset 3
},
soundingRS-UL-ConfigDedicated setup: {
srs-Bandwidth bw3,
srs-HoppingBandwidth hbw0,
freqDomainPosition 0,
duration TRUE,
srs-ConfigIndex 47,
transmissionComb 0,
cyclicShift cs4
},
schedulingRequestConfig setup: {
sr-PUCCH-ResourceIndex 0,
sr-ConfigIndex 15,
dsr-TransMax n64
},
antennaInfo-r10 explicitValue-r10: {
transmissionMode-r10 tm3,
codebookSubsetRestriction-r10 '11'B,
ue-TransmitAntennaSelection release: NULL
},
cqi-ReportConfig-r10 {
nomPDSCH-RS-EPRE-Offset 0,
cqi-ReportPeriodic-r10 setup: {
cqi-PUCCH-ResourceIndex-r10 0,
cqi-pmi-ConfigIndex 44,
cqi-FormatIndicatorPeriodic-r10 widebandCQI-r10: {
},
ri-ConfigIndex 483,
simultaneousAckNackAndCQI TRUE
}
},
cqi-ReportConfigPCell-v1250 {
altCQI-Table-r12 allSubframes
}
}
},
securityConfigHO {
handoverType intraLTE: {
keyChangeIndicator FALSE,
nextHopChainingCount 0
}
},
nonCriticalExtension {
nonCriticalExtension {
otherConfig-r9 {
powerPrefIndicationConfig-r11 release: NULL
}
}
}
}
}
}
Tips
This section has a shortcut for the handover test. The handover is forced from the eNB console, without waiting for a measurement report.
Triggering Handover from Screen Command
You can trigger the handover regardless of measurement configuration / report or cell power. You can force eNB to triggger handover by screen command "handover" as shown below.
I set cell_gain 1 -20 and cell_gain 2 -30. Cell 1 is just a little higher than cell 2. The UE camps onto cell 1 first, but cell 2 is still connectable.
On UEsim, power_on 1 turns on one UE. RF0 runs in band 7 and RF1 in band 3, the same as in Test 1.
In the 't' trace on the callbox, PRACH is received on cell 01. The UE appears under CL 001 with RNTI 003d, so it is camped onto cell 1.
The command is handover 1 2 1575. 1 is the UE ID (RAN UE ID), 2 is the PCI of the target cell, and 1575 is the EARFCN of the target cell. In the next trace the UE is under CL 002 with RNTI 003e, so it has switched to cell 2.
