Why handover is the hardest thing a network does
A 5G connection looks effortless from the outside — you walk down a street streaming a video and nothing skips. Underneath, the network is performing one of its most delicate manoeuvres several times a minute: it is detaching a live, ciphered, HARQ-buffered radio connection from one cell and re-attaching it to another, while data keeps flowing, and it has to do it in tens of milliseconds with zero packet loss. That manoeuvre is handover, and it is where mobility, radio, transport and the core all have to agree in real time. When it works you never notice. When it is mis-tuned, it is the single biggest source of dropped calls, stalled video and angry drive-test reports.
The reason handover is hard is that the decision and the execution happen at exactly the worst moment — the cell edge, where radio quality is collapsing. The network must measure a neighbour, decide, signal the UE, prepare the target, hand over the security context and the data, and have the UE re-synchronise to the new cell, all before the old link dies. 5G NR is built around make-before-break: the target is prepared and resources reserved before the UE leaves the source, so the gap is as short as a single RACH to the target. Release 16 went further with DAPS (keep both links alive during the switch) and conditional handover (let the UE pull the trigger itself), precisely because the classic “report → command” exchange is so fragile in bad radio.
Handover is a relay baton pass at full sprint. The incoming runner (target cell) is brought up to speed and her hand is open before the baton (your connection) arrives — that is make-before-break. The pass happens in the exchange zone (the cell overlap). Pass too late and the lead runner stumbles past the zone (too-late handover, radio-link failure); pass too early and the baton is fumbled back (too-early handover, ping-pong). The whole art is timing the pass to the zone.
Where this lives in 3GPP. The overall mobility model is in TS 38.300. The measurement configuration, events and RRC procedures are in TS 38.331. The inter-gNB Xn signalling is TS 38.423 (XnAP); the core-coordinated N2/NG signalling is TS 38.413 (NGAP). NSA / multi-connectivity mobility is TS 37.340. Keep those open and any handover question traces to its source.
The measurement engine — events A1–A6, B1/B2
Handover starts with the UE measuring. The gNB configures what to measure and when to report through MeasConfig in an RRC Reconfiguration: measurement objects (which carrier/SSB or CSI-RS to measure), reporting configurations (event-triggered or periodic), quantities (RSRP, RSRQ, SINR), and an L3 filter that smooths the raw L1 samples so a momentary fade does not trigger a handover. The events themselves are a compact alphabet — learn them once and every mobility feature reads clearly.
| Event | Fires when… | Typical use |
|---|---|---|
| A1 | Serving becomes better than a threshold | Stop inter-freq/inter-RAT measurements (back in good coverage) |
| A2 | Serving becomes worse than a threshold | Start measurements; trigger coverage-based actions |
| A3 | Neighbour becomes an offset better than the SpCell | Intra-frequency handover (the workhorse) |
| A4 | Neighbour becomes better than a threshold | Inter-frequency HO; load balancing |
| A5 | SpCell worse than threshold1 and neighbour better than threshold2 | Coverage-triggered inter-frequency handover |
| A6 | Neighbour becomes an offset better than a SCell | Carrier-aggregation SCell management |
| B1 | Inter-RAT neighbour better than a threshold | NSA: trigger NR SgNB addition; inter-RAT HO |
| B2 | Serving worse than t1 and inter-RAT better than t2 | EPS fallback; inter-RAT coverage HO |
Two knobs hide inside every event. Hysteresis is a dead-band added to the entry/exit conditions so the event does not chatter around the threshold, and time-to-trigger (TTT) is how long the condition must hold continuously before the UE reports. Together they are your anti-ping-pong filter — and your too-late-handover risk if you set them too high. We tune them in Chapter 10.
A3 & A5 decoded — offset, hysteresis, time-to-trigger
A3 is the event that drives most intra-frequency handovers, so it is worth knowing to the letter. Its entering condition from TS 38.331 is:
Read it as: “the neighbour, after all its offsets, beats the serving cell plus the a3-offset, by more than the hysteresis, for at least TTT milliseconds.” The cell-individual offset (Ocn/Ocp) is the per-cell-pair lever you use to make one specific neighbour easier or harder to hand into — the heart of pair-wise mobility tuning. The diagram below shows the whole geometry as a UE walks from the source toward the target.
A5 is the coverage-triggered cousin: it needs the SpCell to fall below an absolute threshold (threshold1) and a neighbour to rise above another absolute threshold (threshold2). Because A5 uses absolute thresholds rather than a relative offset, it is the right tool for “get off this dying frequency onto that good one” — typical for inter-frequency or coverage-layer handovers, where a purely relative A3 could keep you on a sinking carrier just because the neighbour on the same carrier is also weak.
Tune A3 and watch the handover point move
Drag the a3-offset, hysteresis and time-to-trigger and see the crossover, the report point and the ping-pong window redraw in real time — the fastest way to build mobility intuition. Lifetime access — ₹999 / $9.99.
Open the 5G mobility labThe handover taxonomy — intra-gNB, Xn, N2
Once the UE reports, which handover runs depends on where the target lives relative to the source. The split-RAN architecture (CU/DU) adds an internal layer too.
| Type | Target relative to source | Signalling | Core involvement |
|---|---|---|---|
| Intra-DU | Same DU, same CU | Internal (F1 untouched) | None |
| Inter-DU / intra-CU | Different DU, same CU | F1 (UE context to new DU) | None |
| Inter-gNB Xn | Different gNB, Xn link exists | XnAP Handover Request/ACK | Path Switch only (end) |
| Inter-gNB N2 (NG) | Different gNB, no Xn / AMF change | NGAP via AMF | AMF coordinates throughout |
| NSA (EN-DC) | NR secondary leg under LTE master | X2-C / SgNB procedures (37.340) | Split MN/SN |
The decision tree is simple: stay inside one gNB if you can (cheapest, no core involvement); use Xn whenever a direct link to the target gNB exists; fall back to N2 only when there is no Xn or the AMF/UPF must change. Most well-planned networks run the overwhelming majority of handovers over Xn, with N2 reserved for boundary and inter-vendor cases.
The Xn handover call flow, step by step
This is the procedure you will trace most often. It has three phases — preparation, execution, completion — and the genius of make-before-break is that the target is fully ready before the UE is ever told to move.
What actually moves — and why no packets drop
Three details make the magic work. SN Status Transfer (step 6) hands the target the PDCP sequence numbers and hyper-frame numbers so the new cell continues counting exactly where the old one stopped — no duplicated or skipped PDCP PDUs. Data forwarding tunnels the in-flight downlink packets the source had buffered to the target so they are not lost during the gap. And the Path Switch (steps 9–10) is what finally tells the UPF to send fresh downlink to the target instead of the source — deliberately last, so the data path only moves once the UE is confirmed on the new cell. The UE's T304 timer bounds the whole execution: it starts when the UE receives the reconfigurationWithSync and, if RACH to the target does not complete before it expires, the handover is declared failed and the UE goes to RRC re-establishment.
The N2 (NG) handover — when the AMF runs it
When there is no Xn link between the two gNBs, or the handover needs a different AMF or UPF, the core takes over. The shape is the same three phases, but every inter-gNB message is relayed by the AMF, which is why N2 handover is slower and is the fallback rather than the default.
| Phase | Message (NGAP, TS 38.413) | From → To |
|---|---|---|
| Preparation | Handover Required | Source gNB → AMF |
| Preparation | Handover Request | AMF → Target gNB |
| Preparation | Handover Request Acknowledge | Target gNB → AMF |
| Execution | Handover Command | AMF → Source gNB → UE |
| Execution | RACH + Handover Confirm (RRCReconfigComplete) | UE → Target gNB |
| Completion | Handover Notify | Target gNB → AMF |
| Completion | UE Context Release | AMF → Source gNB |
N2 also chooses between direct and indirect data forwarding. Direct forwarding sends the source's buffered downlink straight to the target if a transport path exists; indirect forwarding routes it through the UPF when the two RANs cannot reach each other directly — common across vendor or operator boundaries. If the UPF changes, the AMF involves the SMF to set up the new N3 tunnels as part of the same procedure.
Xn vs N2 in one line. If your inter-gNB handover success looks fine on Xn but a particular cell pair underperforms, check whether that pair is falling back to N2 because the Xn link is missing or mis-configured — N2's extra round trips through the AMF widen the interruption and raise the failure rate at the cell edge.
NSA EN-DC mobility — SgNB add/change & PSCell
Most of the world's first 5G was — and much still is — NSA EN-DC: an LTE eNB as the master node (MN) anchoring control, with a 5G gNB as the secondary node (SN) bolted on for throughput. Mobility in NSA is split across two planes, and confusing them is the single most common NSA troubleshooting mistake.
- The LTE anchor moves by LTE handover. The MN (eNB) is handed over using the normal LTE X2/S1 procedures — the NR leg is released and re-added around it.
- The NR leg is managed as a Secondary Cell Group (SCG). A B1 event (an NR neighbour rises above an absolute threshold) tells the MN to add 5G. The MN then runs SgNB Addition; later SgNB Modification changes SCG bearers, SgNB Change moves the UE to a different gNB, and SgNB Release drops the NR leg. Movement of the NR primary cell within the SN is a PSCell change.
The practical upshot: an NSA UE has two mobility processes running at once, and they have separate KPIs. A 5G “handover” problem in NSA is very often actually an SgNB Change or PSCell-change problem, or an LTE-anchor handover that drags the NR leg with it. Always confirm which plane you are debugging before touching parameters.
Conditional handover (CHO) & DAPS
Classic handover has one fatal weakness: the measurement report and the handover command both travel over the air at the exact moment radio is worst. Lose either and the handover fails. Release 16 added two features that attack this directly.
Conditional handover (CHO)
CHO decouples decision from execution. The network prepares one or more candidate targets in advance and gives the UE an execution condition (an A3/A5-style threshold) for each. The UE keeps measuring and, the instant a candidate satisfies its condition, it executes the handover to that cell by itself — no report, no waiting for a command. The fragile over-the-air exchange is gone; the only thing left to do at the edge is the RACH to the already-prepared target. CHO slashes handover and radio-link failures for high-speed and cell-edge users, at the cost of reserving resources in several candidates until one is chosen.
DAPS — Dual Active Protocol Stack
DAPS goes after the interruption gap itself. Instead of releasing the source before acquiring the target, the UE keeps the source link alive and carrying data while it accesses the target, switching the uplink only once the target is ready. The result is a near–zero-millisecond interruption — valuable for ultra-low-latency and real-time services. DAPS is more demanding on the UE (two active stacks) and is applied selectively.
“If your drive test shows failures clustered exactly at the cell edge where reports should fire, you don't have a parameter problem — you have an architecture problem. That is precisely what conditional handover was designed to remove.”
— the case for CHO on every high-mobility layerFailure analysis — too-late, too-early, wrong-cell, ping-pong
When handover KPIs dip, Mobility Robustness Optimization (MRO) gives you a precise vocabulary for how it failed — and each type points at a different fix. They are inferred mainly from RLF reports the UE logs and uploads after a failure, plus per-cell-pair counters.
Underneath these classifications sit the concrete failure points: a preparation failure (the target rejects admission — no resources, or it cannot serve the requested bearers), an execution failure (T304 expires because RACH to the target never completed), and plain RLF on either side. The MRO type tells you the direction to tune; the failure point tells you the mechanism.
Counters, KPIs & the optimization playbook
Every vendor exposes the same logical counters under different names (Ericsson pmHoPrep…/pmHoExe… families, Huawei intra/inter-gNB HO counters, Nokia/ZTE equivalents). Map yours onto this model and the KPI maths is portable.
HO execution success = (RRCReconfigComplete on target) / (HO commands sent)
Overall HO success = prep success × execution success
Ping-pong rate = (returns to source within T) / (total HOs)
SgNB Addition success (NSA) = (SgNB Add ACK & complete) / (SgNB Add attempts)
| Symptom | Likely cause | Action |
|---|---|---|
| Too-late HO / edge RLF | a3-offset, TTT or hysteresis too high; coverage hole | Lower a3-offset / TTT; add CIO toward the neighbour; fix coverage; consider CHO |
| Too-early HO / quick return | Offset / TTT too aggressive | Raise a3-offset / TTT / hysteresis on that pair |
| HO to wrong cell | Bad CIO or missing/incorrect neighbour relation | Correct CIO; audit ANR / neighbour list |
| High ping-pong | Hysteresis/TTT too low; heavy cell overlap | Raise hysteresis & TTT; tune overlap / tilt |
| Low prep success on one pair | Target admission / capacity; missing Xn → N2 fallback | Check target load & bearers; provision the Xn link |
| Low exec success | T304 expiry — RACH to target failing | Check target PRACH/coverage; verify TA; widen T304 cautiously |
| High-speed layer failing | Reports/commands lost at the edge | Deploy conditional handover (and DAPS where supported) |
| NSA 5G drops | SgNB Change / PSCell change, not SA HO | Tune B1 threshold & SCG mobility, not LTE HO params |
The golden trade-off. Every anti-ping-pong move (raise offset / TTT / hysteresis) pushes you toward too-late handover, and every too-late fix pushes you toward ping-pong. You are always balancing the two — per cell pair, per speed profile. Mobility load balancing and CHO widen the window in which both can be satisfied, which is why they matter on busy, fast layers.
Frequently asked questions
What is the difference between Xn and N2 handover?
Xn handover prepares the target directly between the two gNBs and only touches the core for a final Path Switch. N2 (NG) handover is coordinated by the AMF (Handover Required → Handover Request → Handover Command) and is used when there is no Xn link or the AMF/UPF must change. Xn is faster and is the default; N2 is the fallback.
How is the A3 event calculated?
A3 fires when Mn + Ofn + Ocn − Hys > Mp + Ofp + Ocp + Off holds for the whole time-to-trigger — the neighbour, after its offsets, beats the serving cell by more than the a3-offset plus hysteresis. The cell-individual offset (Ocn/Ocp) is the per-pair tuning lever.
What does T304 do?
T304 is the UE's handover execution timer. It starts when the UE receives the reconfigurationWithSync; if RACH to the target does not complete before it expires, the handover fails and the UE goes to RRC re-establishment.
Why is no data lost during handover?
SN Status Transfer carries PDCP sequence/hyper-frame numbers so counting continues seamlessly, data forwarding tunnels the source's in-flight downlink to the target, and the UPF Path Switch happens last — only after the UE is confirmed on the target.
How is NSA mobility different?
NSA splits mobility: the LTE master moves by LTE handover, while the NR leg is added/changed/released as a secondary cell group (B1 triggers SgNB Addition; PSCell change moves the NR primary). They have separate KPIs — a 5G NSA drop is often an SgNB/PSCell problem, not an SA handover.
What is conditional handover and when should I use it?
CHO pre-prepares candidate targets and lets the UE execute when a condition is met, removing the fragile edge-of-cell report/command exchange. Use it on high-speed and cell-edge layers to cut handover and radio-link failures.
Handover is where a network proves it can keep a promise — carry a live connection across a boundary without the user ever knowing. Master the events that trigger it, the Xn and N2 flows that execute it, the NSA split, and the failure vocabulary, and you can read any mobility KPI and know exactly which knob to turn. For the procedure the handover depends on, see the companion deep dive on the random access procedure — every handover ends with a RACH to the target.