5G NR › Mobility › Section 12.1
Mobility

Handover —
Switching cells without dropping the call

The UE moves away from PCI 442, signal weakens, and a neighbour cell becomes stronger. The network decides to hand over the connection. This section traces the complete Xn-based handover — from A3 event trigger through measurement report, handover command, RACH on target cell, and path switch — with exact timing and message contents.

TS 38.331 §5.4 TS 38.300 §9.2.3 TS 38.423 (Xn-AP)

Two types of handover

5G NR supports two handover paths depending on whether the source and target gNBs have an Xn interface between them:

Xn-based handover — source gNB sends handover request directly to target gNB over Xn. Faster, no AMF involvement until path switch. This is the common case for intra-operator handovers.

N2-based handover — no Xn interface. All coordination goes through AMF over N2 (NGAP). Slower but works between different operators or when gNBs are geographically distant.

This section covers Xn-based handover — the mechanism that keeps a moving UE connected with minimal interruption.

Step 1 — A3 event trigger

The handover starts when the UE measures that a neighbour cell has become better than the serving cell by more than a configured offset. This is the A3 event.

Event A3: Neighbour becomes offset better than serving. The entering condition is: Mn + Ofn + Ocn − Hys > Ms + Ofs + Ocs + Off, where Mn/Ms are neighbour/serving RSRP, O terms are offsets, Hys is hysteresis, and Off is A3 offset.
3GPP TS 38.331, Section 5.5.4.4
A3 event evaluation — our UE moving away from PCI 442TS 38.331 §5.5.4.4
// A3 parameters (from RRCReconfiguration measurement config):
A3-offset (Off) = 3 dB
Hysteresis (Hys) = 1 dB
Time To Trigger = 160 ms  ← condition must hold this long

// Measurements (UE-filtered RSRP, L3 filtered):
Ms (serving PCI 442) = −95 dBm  ← weakening as UE moves
Mn (neighbour PCI 87) = −85 dBm  ← strengthening

// A3 entering condition (simplified, no offsets configured):
Mn − Hys > Ms + Off
−85 − 1 > −95 + 3
−86 > −92  → TRUE ✓

// Condition holds for 160 ms → A3 triggered
// UE sends Measurement Report to serving gNB

Step 2 — Measurement Report

The UE sends a MeasurementReport RRC message on SRB1 to the serving gNB. It contains the measured RSRP and RSRQ for the serving and neighbour cells.

Step 3 — Handover decision and Xn Handover Request

The serving gNB receives the measurement report and decides to handover. It sends a Handover Request over Xn to the target gNB (PCI 87), including the UE's RRC context (current configuration, security keys, PDU session info).

The source NG-RAN node shall send a Handover Request message to the target NG-RAN node via the Xn interface. The Handover Request shall include the UE X2AP ID, cause, target cell ID, UE context, source-to-target transparent container, and PDU session resource handover list.
3GPP TS 38.423, Section 8.3.1

Step 4 — Target cell preparation

The target gNB (PCI 87) reserves radio resources for the UE, generates a new K_gNB* (derived from the current K_gNB and the target cell PCI), and sends a Handover Request Acknowledge back. This contains the RRCReconfiguration message that the source gNB will forward to the UE.

K_gNB* derivation — handover keyTS 33.501 §6.9.2.1
// Current K_gNB (from registration/last handover):
K_gNB = 0xA3F2...  (256-bit key)

// Target cell physical cell ID:
PCI_target = 87

// New K_gNB* for target cell:
K_gNB* = KDF(K_gNB, "NH", PCI_target, ARFCN_target)
       = 0xC7D4...  (new 256-bit key, target gNB derives same value)

// New RRC/UP keys derived from K_gNB* at target:
K_RRCint*, K_RRCenc*, K_UPenc* = KDF(K_gNB*, ...)

Step 5 — RRCReconfiguration (Handover Command)

The source gNB sends the RRCReconfiguration message to the UE on the source cell. This message tells the UE to switch to the target cell. The UE must act on this immediately — there is no response on the source cell.

Xn handover — complete message flow TS 38.300 §9.2.3, TS 38.423

Step 6 — RACH on target cell

The UE stops transmitting on the source cell immediately after receiving the handover command. It performs a contention-free RACH on the target cell using a dedicated preamble assigned by the target gNB in the RRCReconfiguration. This avoids collision with other UEs.

The timing advance from the source cell is used as a starting estimate. The target cell fine-tunes timing via the RAR if needed.

Step 7 — Path switch

After the target gNB receives the RRCReconfigurationComplete, it sends a Path Switch Request to the AMF (via N2). The AMF updates the UPF to redirect the downlink N3 tunnel from source gNB to target gNB. The UE's IP address remains the same — no PDU session interruption.

Path switch — GTP-U tunnel updateTS 23.502 §4.9.1
// Before handover:
UPF N3 tunnel → source gNB (TEID: 0x0002C4D5, IP: 10.1.1.1)

// Target gNB sends Path Switch Request to AMF:
New N3 endpoint: TEID 0x0003E5F6, IP: 10.1.2.1 (target gNB)

// AMF sends N4 Modify to UPF:
Update N3 tunnel → target gNB (TEID: 0x0003E5F6, IP: 10.1.2.1)

// After path switch:
Internet → UPF → new GTP-U tunnel → target gNB → DRB1 → UE
UE IP 192.168.1.47 unchanged ← seamless from application perspective
Handover complete — UE on new cell
Old cell          → PCI 442 (source, left behind)
New cell          → PCI 87 (target, now serving)
Interruption time → typically <30 ms for Xn handover
UE IP address    → unchanged (192.168.1.47)
Security keys    → refreshed (K_gNB* → new K_RRCenc/K_UPenc)
← PreviousPDU Session Establishment