Table of Contents
2.2 Handover Decision
2.3 Handover Prodedure
2.4 Handover Interruption Time
2.5 Mobility Robustness Optimization
This document describes the handover procedure defined as EMM Case 6 in our technical document, “Eleven EMM Cases in an EMM Scenario”. This procedure is performed when a UE, while still connected to the network, moves into a cell in a TA that is in the Tracking Area Identifier (TAI) list assigned by the network. During this type of handover procedure, no Tracking Area Update (TAU) procedure is initiated. We define this type of handover as “Handover without TAU” in this document.
The “Handover without TAU” procedure is described through three companion documents. The first document is an overview of LTE handover, providing basic information about the procedure. The second and third documents explain the procedures for X2 handover and S1 handover in an intra-LTE environment, respectively.
2. Overview of LTE Handover
The greatest advantage of a wireless device (mobile device) over a wired one is that its user can travel while using services on it. This mobility has allowed users to conveniently use services in any place, whether at home or on the go, at any time they want. Because of this benefit, wireless users have already outnumbered wired phone users. Mobile subscribers can use services while on the go thanks to the fact that mobile networks support handovers. User Equipment (UE) can switch from one base station/cell to another without losing any incoming or outgoing data, and communicate with the network without interruption during such switch (i.e. by performing a handover). This ensures its user is seamlessly served no matter which cell the user is connected to. This document will describe what kinds of actions need to be taken by an LTE UE and LTE entities in order for a handover to be performed, and then briefly explain the different procedures related to those actions. The procedures related to handover are as seen in Table 1.
Table 1. Handover-related Procedures
UE has an antenna that can search multiple frequency channels over multiple bands. So, after checking many neighbor cells, it usually accesses the one with the greatest received signal strength (unless no access is allowed due to access restriction or congestion control). Then later when the received signal strength from the UE’s current serving cell is getting weak due to the UE’s travel, shadowing, etc., and the signal from a neighbor cell is getting strong, a handover is initiated. This allows the UE to access the neighbor cell, and establish a new RRC connection there.
To this end, when UE establishes an RRC connection with eNB, the eNB informs the UE in which event the received signal strength should be reported, by sending a configuration message (RRC Connection Reconfiguration message). The UE keeps track of the received signal strength of both its serving and neighbor cells. Then when one of the events specified occurs, it reports the received signal strength to the eNB through a Measurement Report message. The eNB, upon receipt of the message, decides whether to initiate a handover or not by reviewing the reported strength information and the overload status of the neighbor cells. Once decided, it performs a handover to a newly selected target cell.
Figure 1 is a simplified illustration of the measurement configuration and measurement report used by UE when measuring and reporting the strength of signals1 that it receives from cells.
Figure 1. Measurement Configuration and Measurement Report
(1) Measurement Configuration
The measurement configuration is provided by the eNB to the UE, and it indicates what measurement information needs to be reported. The eNB provides the UE with this measurement configuration through an RRC Connection Reconfiguration message when it establishes an RRC connection with the UE. The information included in the message is as follows:
• Measurement Object: provides information about E-UTRA cells to be measured by UE, including frequency channel number, Physical Cell ID (PCI) of the cells to be measured, black list cell ID, offset values for each cell, etc.
• Reporting Configuration: specifies triggering events that require UE to send a measurement report message (Triggering event)
• Measurement ID: ID that identifies measurement objects
• Quantity Configuration: indicates the values to be measured by UE2
• Measurement Gap: indicates at which interval neighbor cells are to be measured by UE
In case of intra-frequency neighbor measurement (i.e. if the neighbor cell to measure uses the same carrier frequency as the serving cell), UE can measure the neighbor cell without using measurement gaps. However, in case of inter-frequency neighbor measurement (i.e. if the neighbor cell do not use the same carrier frequency as the serving cell), UE should synchronize to the neighbor cell’s frequency first, and measure its signal strength by using measurement gaps during UL/DL idle period.
(2) Measurement Report Triggering
UE measures the signal strength of its serving cell and neighbor cells. Then it reports the results to eNB, periodically or when a measurement event is triggered as one of the reporting criteria set by the measurement configuration is satisfied. Reporting criteria for E-UTRA report include Events A1, A2, A3, A4 and A53 while ones for inter-RAT measurement report include Events B1 and B2.4 Event A3 is commonly used in triggering handovers. Figure 2 shows an example of handover triggering by Event A3, and Table 2 provides definitions of the symbols used in Event A3.
■ Event A3
When the signal strength of a neighbor cell (sum of signal strength and offset, MNbr = Mn + Ofn + Ocn) becomes greater than that of the UE’s serving cell (sum of signal strength and offset, MSer = Ms + Ofs + Ocs), AND the difference is greater than the value of A3 offset (Off), Event A3 is triggered, and the UE reports the measurement results to the eNB. Hysteresis (Hys) indicates the value of a handover margin between the serving cell and the target cell. The eNB decides to trigger a handover if A3 is triggered AND the A3 triggering criteria last longer than the time specified as Time-to-Trigger (TTT) period.
Figure 2. Measurement Event A3
Table 2. Definition of the Symbols Represented in E-UTRA Measurement
2.2 Handover Decision
When Event A3 is reported, the eNB decides what kind of handover to perform to which target cell, and then initiates a handover procedure.5 Handovers may be categorized into many different types, but they are categorized as follows for the purposes of this document:
(1) Handover Categorization 1: Whether EPC Entities are Changed or not
A handover can be categorized as one of the three kinds – intra-LTE, inter-LTE and inter-RAT handovers - depending on whether the EPC entities that UE is connected to are changed after the handover or not.
• Intra-LTE Handover
■ Intra-MME/S-GW Handover: Neither UE’s serving MME nor S-GW is changed after handover
• Inter-LTE Handover: UE’s serving MME and/or S-GW is changed after handover
■ Inter-MME Handover: UE’s serving MME is changed, but S-GW remains unchanged after handover
■ Inter-S-GW Handover: UE’s serving S-GW is changed, but MME remains unchanged after handover
■ Inter-MME/S-GW Handover: Both UE’s serving MME and S-GW are changed after handover
• Inter-RAT Handover: Handover between networks that use different radio access technology
■ UTRAN to E-UTRAN
■ E-UTRAN to UTRAN, etc.
(2) Handover Categorization 2: Whether EPC Entities are Involved or not
Depending on whether any EPC entity is involved in preparing and executing of a handover between a source eNB and a target eNB or not, an LTE handover can be either X2 handover using X2 interface or S1 handover using S1 interface. Figure 3 illustrates the two types of handovers that are performed as UE travels. Figure 4 shows how a source eNB decides on a handover type, X2 or S1, when a handover is triggered (see Figure 2).
■ X2 Handover
The X2 interface connects two eNBs. If there is an X2 connection between the eNB where the UE’s serving cell belongs (i.e. source eNB) and the eNB where the target cell belongs (i.e. target eNB), AND the X2 connection is available for handover, X2 handover is initiated. Once the handover is completed, the two eNBs communicate with each other to control the handover, without MME’s intervention.
■ S1 Handover
The S1 interface connects E-UTRAN (eNB) and EPC (i.e. MME for control messages, or S-GW for user packets). If i) there is no X2 connection between a source eNB and a target eNB, ii) there is an X2 connection, but the connection is not allowed for handover, or iii) handover preparation between a serving cell and a target cell fails, then S1 handover is initiated. Once the handover is completed, the source eNB begins to communicate with the target eNB via MME to control the handover.
Figure 3. Examples of X2 and S1 Handover
Figure 4. Decision on Handover Type
2.3 Handover Procedure
Based on the measurement configuration received, the UE reports measurement results to the eNB. Once the eNB decides, a handover is initiated. The handover procedure consists of three phases, preparation, execution and completion phases, as follows:
(1) Handover Preparation Phase
During this phase, a source eNB and a target eNB prepare for a handover. In case of X2 handover, the two directly communicate with each other through X2 signaling, and carry out a handover without MME’s intervention. On the other hand, in case of S1 handover, MME gets involved through S1 signaling.
The source eNB sends the user’s UE context (i.e. security context, QoS context, etc.) to the target eNB to check whether the target eNB is capable of providing satisfying service quality. If it is, the target eNB establishes a transport bearer (DL packet forwarding bearer) for packet forwarding. Then, it allocates C-RNTI value that the UE needs to use when accessing the eNB, and forwards the same to the source eNB. This completes the preparation phase. At this time, the DL packet forwarding bearer is either a direct tunnel connecting the two eNBs in case of X2 handover, or an indirect tunnel connecting all the three entities, i.e. the source eNB, S-GW and the target eNB, in case of S1 handover. Figure 5 shows the packet forwarding paths during this phase: UL/DL bearer traffic delivery path (two-way solid line), control message delivery path (dotted line) and DL packet forwarding path (one-way solid line).
Figure 5. Handover Preparation Phase
(2) Handover Execution Phase
During this phase, a handover is carried out. The UE disconnects the radio link from the source eNB, and connects it to the target eNB, accessing a new cell. Once the resources needed for packet forwarding between the two eNBs are allocated (i.e. a DL packet forwarding bearer), and the new resources for the UE are allocated at the target eNB (i.e. a DRB, DL S1 bearer, C-RNTI, etc.) during the preparation phase, the two eNBs are ready for a handover. Then, the source eNB orders the UE to perform a handover by sending a Handover Command message.
During the handover execution phase, the UE uses the C-RNTI that was allocated by the target eNB during the handover preparation phase. This allows the UE to access the target eNB faster. Once arrived at the source eNB, DL packets during the handover are forwarded to the target eNB through the forwarding bearer, and buffered there until the UE is completely accessed to the target eNB. This ensures no packet is lost on the way. UL packets coming from the UE are not forwarded until the UE is accessed to the target eNB successfully. Once the UE completes its radio access to the target eNB, the UL packets can be immediately forwarded to S-GW through the target eNB. Figure 6 shows the DL traffic delivery path during the handover execution phase, and the UL traffic delivery path via the target eNB after the handover execution phase.
Figure 6. Handover Execution Phase
(3) Handover Completion Phase
Once the UE completes its radio access to the target eNB successfully, the UE’s bearer path (DL S1 bearer) is now connected to the target eNB, instead of the source eNB. Once the path is switched, the forwarding bearer used in forwarding DL packets during the handover execution phase is released. As seen in Figure 7, both UL and DL traffic is delivered through the new bearer path once the handover completion phase is ended.
Figure 7. Handover Completion Phase
2.4 Handover Interruption Time
During the handover preparation phase, network entities allocate resources in advance to ensure no DL packet is lost while a handover is being executed. However, in actual handovers, a handover interruption time is inevitable. During this time, i.e. after UE disconnects its radio access from the source eNB, and before it re-connects to the target eNB completely, packets cannot be delivered between the UE and cells. Figure 8 displays an example of a handover interruption time caused during X2 handover execution phase. If this interruption lasts long, seamless services cannot be supported, and users have to suffer from poor service quality. A handover interruption time includes:
Figure 8. Handover Interruption Time
2.5 Mobility Robustness Optimization
Sometimes, Radio Link Failure (RLF) can be caused during the handover execution phase if the signal that UE is receiving from its serving or target cell cannot remain strong enough until the UE completes its radio access to the target cell. RLF is caused by many different reasons, and can be handover-related or not. If caused by a reason related to the handover execution time, RLF may occur when a handover is initiated too early or too late. If RLF is caused while a handover is being executed, UE may perform an RRC connection reestablishment procedure, and connect to its serving cell, target cell or another cell (wrong cell). RLF is also related with cell coverage. So, 3GPP standards have defined the Mobility Robustness Optimization (MRO) that helps to detect what kind of access failure was caused by intra-LTE handovers, and to enhance robustness of the handover. MRO is out of the scope of this document, and will probably be discussed through our future technical documents on LTE Self-Organizing Network (SON). In the next document, we will discuss only the handovers that are successfully performed without RLF.
This document, the first of the three companion documents on “EMM Case 6. Handover without TAU”, has so far provided the overview of LTE handover, discussing cell measurements, different handover types and handover phases. The next two documents that follow will further explain the detailed procedures for X2 and S1 handovers that are performed particularly in an intra-LTE handover.
 Netmanias Technical Document, “Eleven EMM Cases in an EMM Scenario”, October 2013.
 3GPP TS 36.300, “Evolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Universal Terrestrial Radio Access Network (E-UTRAN); Overall description”
 3GPP TS 36.331, “Evolved Universal Terrestrial Radio Access (E-UTRA); Radio Resource Control (RRC); Protocol specification”
 NMC Consulting Group Confidential Internal Report, “E2E LTE Network Design”, August 2010
1. This strength can be measured in Reference Signal Received Power (RSRP) or Reference Signal Received Quality (RSRQ).
2. The basic measurement values for E-UTRA include Reference Signal Received Power (RSRP) and Received Signaling Strength Indicator (RSSI).
3. A6 event is also included in case Carrier Aggregation (CA) is employed. However, CA is out of the scope of this document, and hence handovers involving CA will not be discussed in the EMM Case 6 handover procedure.
4. Inter-RAT handover is beyond the scope of this document, and hence will not be discussed here. See 3GPP TS 36.331 for detailed information about reporting criteria.
5. The “Handover without TAU” scenario concerns only the handovers between cells in different eNBs (inter-eNB handover). Thus this document does not discuss the ones between cells in the same eNB (intra-eNB handover).
Thanks for your wonderful documents!
Would you please post something about inter-RAT handover? I cannot figure out whether the TCP connection is closed when there is a inter-RAT handover.
Thanks for sharing nice document , Could you also share any doc on LTE secuirty ( NAS/AS ) and also how UE derives security keys during Intra/Inter HO scenarios ?
Please find link below:
1. LTE Security I: Concept and Authentication
2. LTE Security II: NAS and AS Security
thanks very much for your great share. one thing which i'm curious, after UE switched its serving enodeB, MME still has to inform PGW and PCRF to update the changing CGI, right?