5G NR & 5G Core

Why 5G: generations and use cases

Each mobile generation solved the biggest limitation of the one before it. 5G is the first generation designed from day one for three very different kinds of traffic instead of "faster phones only".

The three 5G service families

These targets come from the ITU IMT-2020 requirements. No single deployment hits all of them at once; they define the design envelope. Other targets include mobility up to 500 km/h and much better energy efficiency per bit.

What is genuinely new versus LTE

• Flexible numerology instead of LTE's fixed 15 kHz subcarrier spacing and 1 ms TTI.
• Lean carrier: no always-on cell-specific reference signal (CRS); reference signals are sent only when needed, which saves energy and reduces interference.
• Beam-based design from the start, including initial access, which makes mmWave usable.
• New channel coding: LDPC for data channels, Polar codes for control channels (LTE used Turbo and convolutional codes).
• Wide carriers: up to 100 MHz in FR1 and 400 MHz in FR2, with bandwidth parts so a UE does not need to use all of it.
• Cloud-native core with control/user plane separation, a service-based interface, slicing and edge UPFs.
• New RRC state RRC_INACTIVE and a new user-plane layer SDAP.

NSA vs SA deployment options

3GPP defined several "options" for combining LTE, NR, the EPC and the 5GC. Operators mostly used two: Option 3 family (NSA) first, then Option 2 (SA).

NSA (Option 3 family) and EN-DC

In NSA the UE is attached to the EPC through LTE. LTE carries all control signalling (RRC and NAS). NR is added as extra capacity through EN-DC (E-UTRA NR Dual Connectivity).

• MN / MCG: the LTE eNB is the Master Node and serves the Master Cell Group (PCell plus any LTE SCells).
• SN / SCG: the NR en-gNB is the Secondary Node and serves the Secondary Cell Group (PSCell plus NR SCells).
• X2 connects eNB and en-gNB (X2-C for control, X2-U for user data). The en-gNB has no NG interface to a 5GC.
• The EPC needs upgrades: the MME must understand the UE's "DCNR" capability, enforce the subscription restriction "NR as secondary RAT not allowed", and support higher bit rates (extended APN-AMBR).

Bearer types and where the split happens

With a split bearer, one PDCP entity feeds two RLC legs (LTE and NR). In uplink, the network configures a primary path and a threshold (ul-DataSplitThreshold): below it the UE sends only on the primary path; above it the UE may use both legs.

How NR gets added (SgNB Addition)

1. LTE attach The UE attaches on LTE, advertising EN-DC capability and band combinations. The eNB broadcasts upperLayerIndication-r15 in SIB2 so the UE knows NR is available in the area.
2. B1 measurement The eNB configures an inter-RAT NR measurement. When an NR cell exceeds the B1 threshold, the UE sends a measurement report.
3. SgNB Addition Request The eNB asks the en-gNB over X2. The gNB admits the UE and returns an NR RRC configuration (SCG config) in the Addition Request Acknowledge.
4. RRC reconfiguration The eNB sends an LTE RRCConnectionReconfiguration with the embedded NR configuration. The UE applies it and replies Complete; the eNB sends SgNB Reconfiguration Complete to the gNB.
5. Random access on PSCell The UE performs RACH on the NR PSCell and syncs to the SSB beam.
6. Path switch For Option 3x, the eNB sends an E-RAB Modification Indication to the MME so the S-GW moves the S1-U tunnel to the gNB.

UE            eNB (MN)          en-gNB (SN)         MME / S-GW
 |  LTE attach   |                   |                     |
 |<------------>|<------------------------------------>  |
 |  MeasReport B1|                   |                     |
 |------------->| SgNB Addition Req |                     |
 |               |----------------->|                     |
 |               | SgNB Add Req Ack  |                     |
 |               |<-----------------| (NR SCG config)     |
 | RRCConnReconf (nr-Config)         |                     |
 |<-------------|                   |                     |
 | RRCConnReconfComplete             |                     |
 |------------->| SgNB Reconf Compl |                     |
 |               |----------------->|                     |
 |   RACH on NR PSCell               |                     |
 |--------------------------------->|                     |
 |               |  E-RAB Modification Indication (3x)     |
 |               |--------------------------------------->|
 |               |           S1-U now terminates at gNB    |

SCG failure

If NR fails (radio link failure on the SCG, T310 expiry, reconfiguration failure, sync failure) the UE does not drop the connection. It keeps LTE, suspends the SCG and sends SCGFailureInformationNR to the eNB, which can release or re-add the SN. Repeated SCG failures cause ping-pong adds and releases, a very common field issue.

SA (Option 2)

In SA the gNB connects to the 5GC over NG (N2 for control to the AMF, N3 for user plane to the UPF). NR carries RRC and NAS itself. SA is required for native 5G features: network slicing, RRC_INACTIVE, VoNR, URLLC, edge UPFs and SSC modes.

5G Core service-based architecture

The 5GC replaces the EPC's big boxes with smaller network functions (NFs). Control-plane NFs expose services as REST-style APIs (HTTP/2 + JSON, defined in OpenAPI, usually over TLS) on a common Service-Based Interface (SBI). Any NF can be a consumer or producer, and they find each other through the NRF. NFs are designed to run as cloud-native microservices on containers.

The main network functions

Other NFs you may hear about: SCP (Service Communication Proxy, routes SBI traffic, like a service mesh), SEPP (Security Edge Protection Proxy, secures roaming signalling on N32), CHF (charging), NWDAF (network data analytics), BSF (binding support, finds which PCF serves a session), N3IWF (untrusted non-3GPP access such as Wi-Fi, the 5G version of the ePDG), UDSF (unstructured data storage for stateless NFs).

Reference points (interfaces)

In the SBA view, N8, N10, N11 and the others are simply service calls such as Namf_Communication, Nsmf_PDUSession, Nudm_SDM, Npcf_SMPolicyControl. N1, N2, N3, N4, N6, N9 and Xn remain classic point-to-point interfaces.

             NSSF   NEF   NRF   PCF   UDM   AUSF   AF
               |     |     |     |     |     |     |
  ============ Service-Based Interface (HTTP/2, JSON) ============
                     |                    |
                    AMF ------ N11 ------ SMF
                   /  |                    |
               N1 /   | N2                 | N4 (PFCP)
                 /    |                    |
   UE ~~~ radio ~~~ gNB ------ N3 ------- UPF ------ N6 ------ Data Network
                                (GTP-U)          (internet, IMS)

Design principles

• CUPS (Control and User Plane Separation): SMF controls, UPF forwards. UPFs scale independently and can sit at the network edge for MEC with low latency.
• AMF / SMF split: mobility and session logic are separate, so one UE can have several PDU sessions handled by different SMFs, possibly in different slices.
• Stateless NFs where possible, keeping state in UDSF/UDR so instances can fail over.
• Access-agnostic core: the same AMF serves 3GPP and non-3GPP (Wi-Fi via N3IWF) access.
• Discovery over configuration: an AMF asks the NRF for an SMF that supports a given DNN and S-NSSAI instead of using static tables.

Roaming: home-routed versus local breakout

A roaming PDU session is either home-routed (HR) or local breakout (LBO). IMS voice almost always uses HR, the 5G counterpart of S8HR (see IMS roaming).

• Home-routed: the visited network has a V-AMF, V-SMF and usually a V-UPF; the home network keeps the H-SMF and H-UPF (the IP anchor). V-SMF and H-SMF talk over N16; V-UPF and H-UPF over N9. The IMS P-CSCF stays at home. Media trombones; emergency, visited LI and a local ATCF have the same S8HR drawbacks.
• LBO: visited SMF and UPF only, N6 in the VPLMN. Faster media, local emergency and LI, but every partner needs a roaming interconnect. Rare for the IMS DNN.
• Control-plane SBI between operators is protected by SEPP on N32, not by Diameter like LTE roaming.

RAN split: CU and DU

The gNB itself can be split into a Central Unit (CU: RRC, SDAP, PDCP) and Distributed Units (DU: RLC, MAC, high PHY) connected by F1. The CU can be further split into CU-CP and CU-UP over E1. Open RAN (O-RAN) standardises these splits so different vendors can be mixed.

Registration and PDU session call flows

On SA, getting a phone online takes two NAS procedures. Registration (5GMM, handled by the AMF) replaces the LTE Attach and makes the UE known and reachable. PDU Session Establishment (5GSM, handled by the SMF) gives it an IP connection to a Data Network. Unlike LTE, registration does not automatically create a data connection; the UE asks for PDU sessions separately (it can include them in the same signalling burst).

State machines

RRC_INACTIVE is special: the radio is idle-like but the core still sees the UE as CM-CONNECTED.

Registration types

• Initial registration at power on or when entering 5GS.
• Mobility registration update when entering a tracking area outside the registration area, or when capabilities or requested slices change.
• Periodic registration update when timer T3512 expires, to show the UE is still alive.
• Emergency registration for emergency services, possible with limited service (even without a valid subscription).

Initial registration step by step

1. RRC setup The UE sends RRCSetupRequest, receives RRCSetup and returns RRCSetupComplete carrying the NAS Registration Request (SUCI or 5G-GUTI, requested NSSAI, UE capabilities, registration type).
2. AMF selection The gNB selects an AMF (using the GUAMI in the 5G-S-TMSI if known, or the requested NSSAI) and forwards the NAS message in NGAP Initial UE Message.
3. Identity and authentication The AMF selects an AUSF, which asks the UDM for an authentication vector. The UDM's SIDF deconceals the SUCI into the SUPI. 5G-AKA or EAP-AKA' runs: Authentication Request (RAND, AUTN) and Response (RES*). The AUSF verifies RES* on behalf of the home network.
4. NAS security Security Mode Command / Complete activates NAS integrity and ciphering with keys derived from K_AMF.
5. UDM registration The AMF registers itself as serving AMF (Nudm_UECM_Registration) and fetches subscription data (Nudm_SDM_Get), including subscribed S-NSSAIs.
6. Slice and policy If needed, the AMF queries the NSSF for the Allowed NSSAI (or reroutes to another AMF set). It creates an access and mobility policy association with the PCF, which may push URSP to the UE.
7. Initial Context Setup The AMF sends NGAP Initial Context Setup Request with the security key for the gNB. The gNB runs AS SecurityModeCommand and RRCReconfiguration.
8. Registration Accept carries the 5G-GUTI, the TAI list (registration area), Allowed and Rejected NSSAI, periodic timer, and 5GS network feature support (for example "IMS voice over PS supported", which the UE needs for VoNR). The UE replies Registration Complete. A voice-centric UE that does not see IMS voice (and cannot fall back) will disable N1 mode and try EPS; a data-centric UE stays on 5GS. That usage setting is a UE policy, not this network bit.

UE           gNB           AMF          AUSF         UDM        PCF / NSSF
 | RRCSetupReq  |             |             |            |            |
 |----------->|             |             |            |            |
 | RRCSetup     |             |             |            |            |
 |<-----------|             |             |            |            |
 | RRCSetupComplete + Registration Request (SUCI, NSSAI) |            |
 |----------->| InitialUEMessage          |            |            |
 |              |----------->| Nausf_UEAuth |            |            |
 |              |             |----------->| Nudm_UEAU (SUCI -> SUPI) |
 |              |             |             |---------->|            |
 | Authentication Request / Response (5G-AKA, RES*)      |            |
 |<=========================>|<---------->|            |            |
 | NAS Security Mode Command / Complete    |             |            |
 |<=========================>|             |            |            |
 |              |             | Nudm_UECM_Registration, Nudm_SDM_Get   |
 |              |             |------------------------->|            |
 |              |             | Nnssf / Npcf AM policy (if needed)     |
 |              |             |-------------------------------------->|
 |              | InitialContextSetupRequest |           |            |
 |              |<-----------|             |            |            |
 | AS SecurityModeCommand, RRCReconfiguration|            |            |
 |<-----------|             |             |            |            |
 | Registration Accept (5G-GUTI, TAI list, Allowed NSSAI, IMS VoPS)    |
 |<=========================|             |            |            |
 | Registration Complete     |             |            |            |
 |=========================>|             |            |            |

PDU Session Establishment step by step

1. UE request The UE sends UL NAS Transport containing PDU Session Establishment Request: PDU session ID, DNN (the 5G name for APN, for example internet or ims), S-NSSAI, PDU session type (IPv4, IPv6, IPv4v6, Ethernet, Unstructured) and SSC mode.
2. SMF selection The AMF discovers a suitable SMF through the NRF (by DNN and S-NSSAI) and calls Nsmf_PDUSession_CreateSMContext.
3. Subscription and policy The SMF checks session subscription with the UDM and creates an SM policy association with the PCF (Npcf_SMPolicyControl_Create), which returns QoS and charging rules.
4. UPF selection and N4 The SMF selects a UPF (possibly an edge UPF) and sends a PFCP Session Establishment Request with packet detection, forwarding, QoS enforcement and usage reporting rules. It allocates the UE IP address (or IPv6 prefix).
5. N1N2 transfer The SMF calls Namf_Communication_N1N2MessageTransfer: the N2 part (QoS profiles, UPF uplink tunnel endpoint) goes to the gNB and the N1 part (PDU Session Establishment Accept with QoS rules, session-AMBR, IP address, DNS and P-CSCF addresses in ePCO) goes to the UE.
6. Radio resources The AMF sends NGAP PDU Session Resource Setup Request. The gNB configures DRBs and SDAP mapping with RRCReconfiguration and delivers the NAS Accept.
7. Downlink path The gNB returns its downlink tunnel endpoint in the Setup Response. The AMF forwards it with Nsmf_PDUSession_UpdateSMContext, and the SMF updates the UPF over N4. Traffic now flows both ways.

UE          gNB          AMF          SMF          PCF          UPF
 | PDU Session Est. Request (DNN, S-NSSAI, type)          |            |
 |=========================>| CreateSMContext           |            |
 |             |             |----------->| SMPolicyCreate            |
 |             |             |             |----------->|             |
 |             |             |             | PFCP Session Establishment |
 |             |             |             |------------------------>|
 |             |             | N1N2MessageTransfer (N2 QoS + N1 Accept) |
 |             |             |<-----------|             |             |
 |             | PDUSessionResourceSetupReq |             |             |
 |             |<-----------|             |             |             |
 | RRCReconfiguration (DRB, SDAP) + NAS PDU Session Est. Accept         |
 |<-----------|             |             |             |             |
 |             | PDUSessionResourceSetupRsp (DL TEID)     |             |
 |             |----------->| UpdateSMContext           |             |
 |             |             |----------->| PFCP Session Modification |
 |             |             |             |------------------------>|
 |<=================== user data over DRB / N3 GTP-U ================>|

SSC modes

Service Request and paging

When a CM-IDLE UE has uplink data, it sends a Service Request to move to CM-CONNECTED and reactivate the user plane of its PDU sessions. For downlink data, the UPF buffers or notifies the SMF, which asks the AMF to page the UE in its registration area; the UE answers with a Service Request.

Common 5GMM and 5GSM reject causes

5G security: SUPI, SUCI and authentication

5G fixes a long-standing privacy weakness: in 2G to 4G the permanent IMSI could be sent in clear text over the air, so "IMSI catchers" could track users. 5G never sends the permanent identity unencrypted.

Identifiers

SUCI can be calculated by the USIM or by the modem (ME), as configured on the SIM. If the SIM has no home network public key provisioned, the null scheme is used and the SUCI effectively reveals the MSIN, which is allowed but loses the privacy benefit. The SIDF (Subscription Identifier De-concealing Function) inside the UDM holds the private key and recovers the SUPI.

Authentication

• 5G-AKA: an evolution of EPS-AKA. The UE verifies the network with AUTN and returns RES*. The AUSF in the home network verifies the result, so the home operator gets proof the UE was present, not only the visited network (increased home control).
• EAP-AKA': the same AKA math inside the EAP framework; useful for non-3GPP access and private networks. Other EAP methods (for example EAP-TLS) are allowed for private networks.
• Key hierarchy: K (in USIM and UDM/ARPF) to CK/IK to K_AUSF to K_SEAF to K_AMF, which yields NAS keys (K_NASint, K_NASenc) and K_gNB, which yields RRC and user-plane keys.
• Algorithms: NEA1/NIA1 (SNOW 3G), NEA2/NIA2 (AES), NEA3/NIA3 (ZUC). NEA0/NIA0 are null algorithms (NIA0 allowed only for emergency calls without authentication).
• User-plane integrity protection is new in 5G (optional, negotiated per PDU session). LTE only ciphered the user plane.
• Roaming: SEPP proxies protect inter-operator SBI signalling on N32, replacing the weakly protected SS7/Diameter interconnect.

QoS flows and 5QI

LTE gave each QoS class its own EPS bearer with its own GTP tunnel. 5G uses a flatter model: a PDU session has one N3 tunnel, and inside it the traffic is divided into QoS flows, each tagged with a 6-bit QFI (QoS Flow Identifier) in the GTP-U header.

The mapping chain

Application packets (SDFs, matched by 5-tuple / app filters)
        |  UPF (downlink) uses PDRs;  UE (uplink) uses QoS rules
        v
   QoS flow  (QFI, with 5QI, ARP, GFBR/MFBR ...)      <-- set by SMF from PCF policy
        |  SDAP layer in gNB and UE
        v
   Data Radio Bearer (DRB)   -- one DRB may carry several QoS flows
        |
        v
   PDCP / RLC / MAC / PHY over the air

• Downlink: the UPF classifies packets with Packet Detection Rules and marks the QFI. The gNB maps QFI to a DRB using its SDAP configuration.
• Uplink: the UE uses QoS rules (received from the SMF) to put packets into QoS flows, then SDAP maps them to DRBs.
• Reflective QoS: the UE can derive uplink rules by mirroring downlink packets marked with the RQI bit, reducing signalling.
• Every PDU session has a default QoS rule and default QoS flow (usually non-GBR, 5QI 9 for internet, 5QI 5 for IMS).

QoS parameters

Important 5QI values

The QoS characteristics of 5QI 1 to 9 intentionally match LTE QCI 1 to 9, which makes interworking with EPS (EPS fallback, N26 handover) straightforward: the SMF+PGW-C maps QoS flows to EPS bearers.

Do not invert the IMS 5QIs. 5QI 1 is conversational voice (GBR). 5QI 5 is IMS signalling on the default QoS flow of the IMS PDU session. 5G uses a different priority-level scale than LTE (5QI 5 is 10, 5QI 1 is 20; lower is higher priority), but the relationship is the same: SIP is scheduled ahead of other default/non-GBR traffic such as 5QI 9, while voice quality is protected by the GBR reservation. See IMS & VoLTE for the QCI table and the same trap.

Policy chain for a voice call

P-CSCF (AF) --N5 / Rx--> PCF --N7--> SMF --N4--> UPF (marks QFI)
                                        |
                                        +--N11/N2 via AMF--> gNB  (admits GBR flow,
                                                                  maps to voice DRB)

NR air interface: numerology, frames and spectrum

NR is OFDM-based like LTE (CP-OFDM in both directions, with optional DFT-s-OFDM in uplink for better power efficiency at cell edge). The big difference is flexibility: one radio design has to work from 600 MHz to 71 GHz and from IoT to URLLC.

Numerology

Numerology µ sets the subcarrier spacing: SCS = 15 × 2^µ kHz. A wider spacing gives shorter OFDM symbols, so a 14-symbol slot is shorter and latency drops. It also tolerates the higher phase noise and Doppler of mmWave. The cost is a shorter cyclic prefix, which handles less delay spread, so low bands use narrow SCS and high bands use wide SCS.

Frame structure

• Frame = 10 ms, split into 10 subframes of 1 ms each (fixed for all numerologies, which keeps LTE/NR timing aligned).
• Slot = 14 OFDM symbols with normal CP (12 with extended CP). The number of slots per subframe is 2^µ.
• Mini-slots (non-slot-based scheduling, 2, 4 or 7 symbols) let URLLC data start mid-slot without waiting for a slot boundary.
• Resource block = 12 subcarriers. A carrier has up to 275 RBs; for example 100 MHz at 30 kHz is 273 RBs.
• Slot formats mark each symbol as downlink, uplink or flexible, configured semi-statically by RRC or dynamically by DCI format 2_0.

Frame 10 ms
|--SF0--|--SF1--|--SF2--| ... |--SF9--|        each subframe = 1 ms
µ=0 : [slot 0                     ]              1 slot / SF
µ=1 : [slot 0      ][slot 1       ]              2 slots / SF
µ=3 : [s0][s1][s2][s3][s4][s5][s6][s7]            8 slots / SF
slot = 14 symbols: | 0 | 1 | 2 | ... | 13 |
                     PDCCH usually in first 1-3 symbols (CORESET)

Frequency ranges

Band numbers start with "n" for NR (n78) to distinguish them from LTE bands (B3). The ARFCN for NR is the NR-ARFCN; SSBs sit on a coarser GSCN raster so the UE can scan faster.

Bandwidth parts (BWP)

A UE does not have to process a full 100 MHz or 400 MHz carrier. The network configures up to 4 downlink and 4 uplink BWPs per serving cell, each with its own bandwidth, location and numerology; one of each is active at a time.

• Initial BWP: used during access, derived from CORESET#0 and SIB1.
• First active BWP: activated after RRC reconfiguration.
• Default BWP: a narrow BWP the UE falls back to when bwp-InactivityTimer expires, saving power.
• Switching is by DCI (fast), RRC, timer expiry or random access. Benefits: power saving, support for UEs with smaller bandwidth, and mixing numerologies on one carrier.

Duplexing and TDD patterns

Most mid-band and all mmWave NR is TDD: the same frequency alternates between downlink and uplink over time. The pattern is set in tdd-UL-DL-ConfigurationCommon.

• DDDSU at 30 kHz (2.5 ms period): 3 downlink slots, 1 special slot, 1 uplink slot. Good latency.
• DDDDDDDSUU (5 ms period): heavier downlink capacity; used by many operators.
• The special slot contains downlink symbols, a guard period for the switch and a few uplink symbols (for example 10:2:2).
• Operators in the same band must use synchronised, compatible patterns, otherwise one operator's downlink interferes with another's uplink.
• TDD enables channel reciprocity: the gNB estimates the downlink channel from uplink SRS, which helps massive MIMO.

Carrier aggregation, DSS and supplementary links

• Carrier aggregation: NR supports up to 16 component carriers (PCell + SCells). Combining low band for coverage with mid band for capacity is common. In NSA, LTE CA and NR CA can run at the same time, which is why EN-DC band combinations in UE capability matter so much.
• DSS (Dynamic Spectrum Sharing): LTE and NR share the same carrier, with the scheduler splitting resources dynamically (every 1 ms). NR must avoid LTE's CRS (rate matching) and often uses MBSFN subframes. It gives fast wide NR coverage on existing LTE spectrum, but capacity is lower than dedicated NR because of overhead.
• SUL (Supplementary Uplink): an extra low-band uplink carrier paired with a high-band TDD cell to fix cell-edge uplink.
• SDL (Supplementary Downlink): a downlink-only carrier for extra capacity.

Physical channels and signals

Channel coding: LDPC for PDSCH/PUSCH (high throughput, parallel decoding) and Polar codes for PBCH, DCI and UCI (strong for short blocks).

Initial access, beam management and massive MIMO

NR is beam-based even for initial access. At mmWave, path loss is so high that the gNB must focus energy in narrow beams, so even sync signals are swept across beams.

The SSB

• An SS/PBCH block takes 4 OFDM symbols and 240 subcarriers (20 RBs): PSS, SSS and PBCH (with the MIB and its DMRS).
• PSS (3 values) and SSS (336 values) together give the Physical Cell ID, 1008 possible PCIs (LTE had 504).
• SSBs are sent in bursts within a 5 ms half-frame, each SSB index on a different beam. The maximum per burst is 4 or 8 in FR1 and 64 in FR2. The UE assumes a 20 ms burst periodicity during initial search.
• The MIB tells the UE where to find CORESET#0 and the search space for SIB1; SIB1 carries access parameters and the RACH configuration.

Initial access

1. Cell search Scan the GSCN raster, detect PSS/SSS, get timing, PCI and the SSB index (which beam).
2. MIB and SIB1 Decode PBCH, then PDCCH in CORESET#0 and SIB1 on PDSCH.
3. Random access Send a preamble on the RACH occasion mapped to the best SSB. Because RACH occasions map to SSB indices, the gNB learns the UE's best beam from when it hears the preamble.
4. RAR, Msg3, Msg4 Random access response with timing advance and uplink grant, Msg3 carries RRCSetupRequest, Msg4 resolves contention and carries RRCSetup. Release 16 adds 2-step RACH (MsgA / MsgB) to cut latency.

Beam management

• P1 coarse beam selection with the SSB sweep, P2 gNB refines its transmit beam with CSI-RS, P3 the UE refines its receive beam.
• The UE reports L1-RSRP per beam. The network tells the UE which beam to assume for reception through TCI states (Transmission Configuration Indicator) that reference a quasi-co-located SSB or CSI-RS.
• Beam failure detection: the UE monitors beam failure detection reference signals; if the counter of beam failure instances reaches beamFailureInstanceMaxCount before the timer expires, beam failure is declared.
• Beam failure recovery: the UE finds a candidate beam above a threshold and sends a (usually contention-free) RACH on it; the gNB responds on the new beam. This is much faster than a full radio link failure and re-establishment.

Massive MIMO and beamforming

• Mid-band gNBs commonly use 32T32R or 64T64R antenna panels. Many elements let the gNB steer narrow beams (beamforming) and serve several users on the same resources (MU-MIMO).
• SU-MIMO sends several layers to one UE: up to 8 layers downlink and 4 uplink in the specification, typically 4 downlink layers on phones.
• Beamforming types: analog (phase shifters, one beam per RF chain, cheap, used at mmWave), digital (per-element baseband weights, most flexible but power-hungry), hybrid (digital precoding over a few analog-beamformed panels, the practical choice for mmWave).
• CSI feedback: the UE reports CQI, PMI (Type I or high-resolution Type II codebooks), RI (rank) and CRI. In TDD, SRS-based reciprocity can replace much of this.
• Phones have several mmWave antenna modules on different edges because a hand can block one; the modem switches modules as the grip changes.

Protocol stack and RRC states

The NR stack looks like LTE with one new layer and several changes aimed at low latency.

     Control plane                  User plane
  +---------------+
  |      NAS      |  UE <-> AMF (5GMM / 5GSM)
  +---------------+              +---------------+
  |      RRC      |  UE <-> gNB  |     SDAP      |  new in NR: QoS flow -> DRB
  +---------------+              +---------------+
  |     PDCP      |              |     PDCP      |  ciphering, integrity, ROHC,
  +---------------+              +---------------+  reordering, duplication, DC split
  |      RLC      |              |      RLC      |  TM / UM / AM, ARQ, segmentation
  +---------------+              +---------------+
  |      MAC      |              |      MAC      |  scheduling, multiplexing, HARQ
  +---------------+              +---------------+
  |      PHY      |              |      PHY      |  OFDM, LDPC / Polar, MIMO
  +---------------+              +---------------+

Signalling radio bearers: SRB0 (CCCH, before setup), SRB1 (RRC and piggybacked NAS), SRB2 (NAS, lower priority), and SRB3 (direct NR RRC between UE and the secondary gNB in EN-DC, so SCG reconfigurations need not go through the LTE master).

HARQ vs ARQ: HARQ in MAC is fast (sub-millisecond) and soft-combines failed attempts; ARQ in RLC is a slower safety net that retransmits whole segments reliably.

RRC states

How RRC_INACTIVE works

1. Suspend The gNB sends RRCRelease with suspendConfig: an I-RNTI (identity of the stored context), the RNA and a periodic RNA update timer.
2. Move The UE reselects cells freely inside the RNA without signalling; leaving the RNA triggers an RNA update.
3. Resume On uplink data or RAN paging, the UE sends RRCResumeRequest with the I-RNTI. The new gNB fetches the context from the anchor gNB over Xn (Retrieve UE Context) if needed.
4. Connected again RRCResume and RRCResumeComplete: security and bearers are restored with a few messages and no NAS signalling to the core. If the context cannot be found, the network falls back to RRCSetup.

Release 17 adds Small Data Transmission (SDT), which lets a UE send small packets in RRC_INACTIVE without fully resuming.

Power saving

• C-DRX in connected mode, idle DRX and eDRX between paging occasions.
• BWP switching to a narrow default BWP during low traffic.
• Wake-up signal (DCI format 2_6) tells the UE whether to wake for the next DRX on-duration.
• SCell dormancy and cross-slot scheduling reduce unnecessary PDCCH monitoring.
• RedCap (Reduced Capability, Release 17) NR devices for wearables and sensors: narrower bandwidth (20 MHz in FR1), fewer antennas, lower cost and power.

Voice on 5G: VoNR and EPS fallback

There is no circuit-switched domain in 5G. All voice is IMS (SIP signalling plus RTP media), exactly as in VoLTE; only the access and core underneath change. For the SIP ladder itself see IMS & VoLTE and call flows.

Voice options by deployment

VoNR requirements

• IMS PDU session on DNN ims with a default 5QI 5 QoS flow for SIP; P-CSCF addresses delivered in ePCO.
• Registration Accept must indicate "IMS voice over PS session supported over 3GPP access" in 5GS network feature support. Without it the UE will not attempt IMS voice on NR.
• Policy: the P-CSCF talks to the PCF over N5 (or Rx through interworking) so the SMF can create a 5QI 1 GBR QoS flow (and 5QI 2 for video).
• gNB voice features: admission of GBR flows, ROHC header compression, C-DRX tuned for 20 ms voice frames, configured grant (the NR cousin of LTE SPS), uplink coverage aids (PUSCH repetition / slot aggregation, the cousin of TTI bundling), RLC UM for the voice DRB, and inter-system handover to LTE when NR coverage ends.
• UE: IMS stack and modem support voice over NR; codecs AMR-WB and EVS; carrier configuration enabling VoNR; a voice-centric usage setting that will leave 5GS if IMS voice is not actually available.
• N26 for seamless VoNR to VoLTE handover when leaving NR coverage. 5G-SRVCC to 3G CS exists in Release 16 but is rarely deployed.

VoLTE versus VoNR

Full SIP, S8HR, MOS/E-model, CMR/ANBR and the LTE radio set (SPS, TTI bundling) are on IMS & VoLTE.

Voice-centric versus data-centric (5GS usage setting)

TS 24.501 gives the UE a 5GS usage setting, independent of the IMS VoPS bit in Registration Accept.

• Voice-centric: if 5GS cannot provide IMS voice (VoPS not indicated and emergency/EPS fallback not a usable substitute for normal calls), the UE disables N1 mode for that PLMN and moves to EPS, where it applies the same rule again. This is a common reason a "5G SA is live" device still camps only on LTE or NSA.
• Data-centric: the UE stays on 5GS for data even when voice is unavailable; a dial then triggers EPS fallback or fails.

EPS fallback flow

1. IMS call starts on NR The UE is registered to IMS over the NR IMS PDU session. An MO INVITE is sent (or an MT INVITE arrives after paging).
2. Voice QoS flow requested The P-CSCF asks the PCF for voice media resources over N5; the SMF asks the AMF to set up a 5QI 1 QoS flow, and the AMF sends NGAP PDU Session Resource Modify Request to the gNB.
3. gNB triggers fallback The gNB is configured for EPS fallback (or the UE or radio conditions do not support VoNR). It rejects the QoS flow with cause "IMS voice EPS fallback or RAT fallback triggered" and may first configure a B1 measurement of LTE.
4. Move to LTE Either an N2 inter-system handover (Handover Required to AMF, Forward Relocation to MME over N26, UE handed to LTE) or an RRC Release with redirection to E-UTRA, after which the UE performs a Tracking Area Update on LTE.
5. Voice bearer on LTE The combined SMF+PGW-C maps the IMS PDU session to an EPS PDN connection (same IP address, so the SIP session continues) and creates the QCI 1 dedicated bearer.
6. Call completes as VoLTE Preconditions are met, the callee is alerted, and media flows over LTE.
7. Return to 5G After the call, the eNB can release the UE with redirection or priorities toward NR ("fast return"); otherwise the UE returns only by idle-mode reselection, which can take longer.

UE        gNB        AMF       SMF+PGW-C    PCF      P-CSCF       MME       eNB
 | INVITE (over NR IMS PDU session) ----------------------->|          |         |
 |          |          |          |         |<-- N5 -----|           |         |
 |          |          |<-- request 5QI 1 --|           |           |         |
 |          | PDUSessResourceModifyReq      |           |           |         |
 |          |<--------|          |         |           |           |         |
 |          | reject: "EPS fallback triggered"          |           |         |
 |          |-------->|          |         |           |           |         |
 |   (B1 LTE meas.)   |          |         |           |           |         |
 |          | HO Required -> AMF --- N26 Forward Relocation -------->|         |
 |<== HO command / or RRCRelease with redirect to E-UTRA ==|         |         |
 |========================== attach to LTE / TAU =========================>|
 |          |          |          | create QCI 1 dedicated bearer ---->|------>|
 | 183 / PRACK / UPDATE / 180 / 200 OK continue as VoLTE                         |

Why EPS fallback is slower

• It adds an inter-RAT move to call setup: roughly a few hundred ms with handover, and often 1 to 3 seconds with redirection plus TAU.
• Without N26, the UE must attach or do PDN connectivity with a handover indication on LTE, which is slower again and risks failed calls.
• Long delays can race SIP timers, causing 408/480 or cancelled MT calls, and a poor "5G to LTE and back" user experience.

Emergency calls

If the network does not support emergency calls over NR, the Registration Accept indicates Emergency Services Fallback support and the UE sends a Service Request with an emergency fallback indication, which moves it to LTE for the emergency call. The emergency call uses a dedicated emergency PDU session (or PDN on LTE).

Network slicing

A network slice is a logical end-to-end network (RAN resources, core NFs and transport) running on shared physical infrastructure, tuned for a service type or customer. It is possible because the 5GC is software NFs that can be instantiated and selected per slice.

Identifiers

• S-NSSAI (Single Network Slice Selection Assistance Information) = SST (Slice/Service Type, 8 bits) + optional SD (Slice Differentiator, 24 bits) to separate slices of the same type (for example two enterprise eMBB slices).
• Standard SST values: 1 eMBB, 2 URLLC, 3 MIoT (massive IoT), 4 V2X, and later 5 HMTC (high-performance machine type) and 6 HDLLC. Operators can also define their own values.
• NSSAI = a list of up to 8 S-NSSAIs. Types: Configured NSSAI (provisioned in the UE per PLMN), Requested NSSAI (sent in Registration Request), Allowed NSSAI (returned in Registration Accept, valid in the registration area), Rejected NSSAI (with a cause), and Subscribed S-NSSAIs in the UDM, some marked default.

How a slice is selected

1. Registration The UE sends Requested NSSAI; the gNB may use it to pick an AMF that supports those slices.
2. NSSF The AMF checks the subscription and, if needed, asks the NSSF, which returns the Allowed NSSAI and possibly a different AMF set (the registration is then rerouted).
3. URSP The PCF sends UE Route Selection Policy rules to the UE. Each rule has a traffic descriptor (application ID, DNN, IP descriptors, connection capabilities) and one or more route selection descriptors (S-NSSAI, DNN, SSC mode, PDU session type, access type).
4. PDU session per slice When an app's traffic matches a URSP rule, the UE uses (or creates) a PDU session with that S-NSSAI. The AMF selects an SMF for that slice through the NRF, and the SMF picks slice-specific UPFs.
5. RAN enforcement The gNB applies slice-aware scheduling and admission (resource quotas or priorities per slice).

Release 16 adds Network Slice-Specific Authentication and Authorisation (NSSAA), where a third party (for example an enterprise AAA server) must approve slice access. Release 17 adds slice quotas (maximum UEs or sessions per slice) and slice-aware cell reselection.

Examples

Mobility: handovers and idle mode

Measurement events

Measurement quantities on NR are SS-RSRP, SS-RSRQ, SS-SINR (from the SSB) and CSI-RSRP/RSRQ/SINR. Hysteresis and time-to-trigger avoid ping-pong.

Xn handover (gNB to gNB directly)

1. Measurement report The UE reports an A3 event.
2. Handover Request The source gNB sends Handover Request over Xn with the UE context.
3. Admission The target reserves resources and returns an RRCReconfiguration with reconfigurationWithSync (new cell, C-RNTI, RACH resources) inside the Acknowledge.
4. Handover command The source forwards it to the UE and starts forwarding buffered data over Xn-U (SN Status Transfer keeps PDCP sequence numbers).
5. Access target The UE performs random access on the target and sends RRCReconfigurationComplete.
6. Path switch The target sends NGAP Path Switch Request to the AMF; the SMF tells the UPF to move the N3 downlink tunnel. The UPF sends end-marker packets on the old path.
7. Release The target sends UE Context Release to the source over Xn.

UE         Source gNB        Target gNB        AMF        SMF / UPF
 | MeasReport A3 |                 |               |              |
 |----------->| HO Request (Xn)  |               |              |
 |              |---------------->|               |              |
 |              | HO Request Ack (RRCReconfiguration inside)       |
 |              |<----------------|               |              |
 | RRCReconfiguration (reconfigurationWithSync)   |              |
 |<-----------| SN Status Transfer + data forwarding (Xn-U)     |
 |              |---------------->|               |              |
 |  RACH + RRCReconfigurationComplete             |              |
 |------------------------------>| Path Switch Req |              |
 |              |                 |-------------->| N4: switch N3 DL |
 |              |                 |               |------------->|
 |              |                 | Path Switch Ack |              |
 |              | UE Context Release |<------------|              |
 |              |<----------------|               |              |

N2 handover (through the AMF)

Used when there is no Xn between the gNBs, or the AMF or UPF must change. The source sends Handover Required to the AMF, the (possibly new) AMF sends Handover Request to the target, the target acknowledges, the AMF sends Handover Command to the source, the UE moves, and the target sends Handover Notify. More signalling and slightly higher interruption than Xn.

Advanced handover types

• Conditional Handover (CHO), Release 16: the network prepares one or more targets in advance with conditions; the UE executes when a condition is met, which avoids failures when the radio drops too fast to send a report.
• DAPS (Dual Active Protocol Stack) handover, Release 16: the UE keeps receiving from the source until the target is up, for near-zero interruption.
• RLF and re-establishment: after radio link failure (T310 expiry, max RLC retransmissions, RACH failure) the UE tries RRCReestablishment on a suitable cell; if the context is unavailable it falls back to a new setup.

Inter-system mobility (5GS and EPS)

• With N26: AMF and MME exchange UE context, so connected-mode handover and idle-mode moves keep sessions and the IP address with little signalling. Needed for good EPS fallback and VoNR to VoLTE continuity.
• Without N26: the UE re-registers or attaches on the other system and uses a "handover" indication in session requests to keep the IP address via the combined SMF+PGW-C anchor. Slower, and in-flight sessions may break.
• A combined SMF+PGW-C and UPF+PGW-U is the common anchor that makes PDU sessions and PDN connections map to each other.

NSA mobility

In EN-DC, mobility is driven by the LTE master. Moving between NR cells under the same eNB is a PSCell change (SN modification or SN change); an LTE handover may keep, change or release the SN. SCG failures are reported to the master without dropping the connection.

Idle mode mobility

• Cell reselection is UE-controlled using priorities and thresholds broadcast in SIBs (SIB2 serving, SIB4 inter-frequency NR, SIB5 LTE). Higher-priority layers are measured always; equal or lower priority only when serving quality drops.
• Registration area: the AMF gives the UE a TAI list (a set of tracking areas). The UE moves freely inside it and does a mobility registration update only when entering a TA outside the list. A larger list means fewer updates but a larger paging area.
• Periodic registration on T3512 expiry; if the UE is unreachable for longer, the AMF implicitly deregisters it.
• MICO mode (Mobile Initiated Connection Only): an IoT UE that is not paged at all, saving power.
• RRC_INACTIVE mobility is tracked per RAN Notification Area by the RAN, not per TA by the AMF.

Android 5G: icons, network type and data

On Android the framework has to translate modem state into what the user sees and what apps can use. This is where a lot of "no 5G icon" bugs actually live. For RIL and modem internals see Telephony, RIL & modem.

Network type vs display type

• On SA, the data registration reports NETWORK_TYPE_NR.
• On NSA, the registered network is still LTE (NETWORK_TYPE_LTE), because NAS and RRC run on LTE. The 5G icon comes from a separate override.
• TelephonyDisplayInfo (Android 11+) carries both the network type and an override network type: OVERRIDE_NETWORK_TYPE_NONE, LTE_CA, LTE_ADVANCED_PRO, NR_NSA, NR_ADVANCED (Android 12+, for mmWave or high-bandwidth NR; replaces the deprecated NR_NSA_MMWAVE). Apps listen with TelephonyCallback.DisplayInfoListener.

How the NSA icon is decided

The framework's NetworkTypeController computes the override from the NR state, physical channel configuration and carrier config.

The carrier config key 5g_icon_configuration_string maps states to icons, for example:

connected_mmwave:5G_Plus,connected:5G,not_restricted_rrc_idle:5G,not_restricted_rrc_con:None

This is why carriers differ: one shows 5G whenever the cell is 5G-capable (even in LTE idle), another only when the SCG is actually connected. Grace timers (5g_icon_display_grace_period_string and the secondary grace period) keep the icon from flickering when the SCG is released briefly. NR_ADVANCED can be driven by mmWave frequency range, aggregated bandwidth thresholds (nr_advanced_threshold_bandwidth_khz_int) or configured bands.

Enabling NSA and SA

• KEY_CARRIER_NR_AVAILABILITIES_INT_ARRAY in carrier config declares whether the carrier supports NSA, SA or both on the device.
• Allowed network types are set with setAllowedNetworkTypesForReason() using bitmasks that include NETWORK_TYPE_BITMASK_NR (user preference, carrier, power reasons combine).
• The radio HAL exposes setNrDualConnectivityState(), so the framework can disable EN-DC, for example for power or thermal reasons.
• VoNR is controlled by carrier config (KEY_VONR_ENABLED_BOOL, KEY_VONR_SETTING_VISIBILITY_BOOL) and the user toggle through TelephonyManager.setVoNrEnabled().
• NR cell info comes as CellIdentityNr (NCI, PCI, TAC, NR-ARFCN, bands) and CellSignalStrengthNr (SS-RSRP, SS-RSRQ, SS-SINR and CSI variants).

DataNetworkController basics

Since Android 13 the data stack is built around DataNetworkController (it replaced the older DcTracker).

1. Requests ConnectivityService sends network requests (INTERNET, IMS, MMS, ENTERPRISE, PRIORITIZE_LATENCY and so on) that become telephony network requests.
2. Evaluation The controller checks data enabled, roaming, default data subscription, radio state and policy, then selects a DataProfile (the APN/DNN plus, on 5G, a traffic descriptor).
3. Setup A DataNetwork state machine calls setupDataCall through the RIL with access network NGRAN or EUTRAN, the data profile and optional slice info. The response carries the interface, addresses, DNS, P-CSCF and QoS.
4. Lifecycle DataRetryManager handles back-off and retry after failures (using the 5GSM or ESM cause), and AccessNetworksManager handles transport handover between cellular and IWLAN.

Slicing on Android: URSP rules from the network map app traffic to a TrafficDescriptor (DNN, OS app ID) and NetworkSliceInfo. Apps request capabilities such as NET_CAPABILITY_ENTERPRISE, NET_CAPABILITY_PRIORITIZE_LATENCY or NET_CAPABILITY_PRIORITIZE_BANDWIDTH, and the telephony stack sets up a PDU session on the matching slice.

Handy debug commands

adb shell dumpsys telephony.registry      # ServiceState, nrState, TelephonyDisplayInfo
adb shell dumpsys carrier_config           # 5g_icon_configuration_string, NR availabilities
adb shell dumpsys phone                    # data networks, NetworkTypeController state
adb logcat -b radio                        # RIL requests, PhysicalChannelConfig, data setup

Quick revision

• 5G targets three families: eMBB (throughput), URLLC (about 1 ms, 99.999%), mMTC (1 million devices per km²).
• NSA Option 3/3a/3x uses the EPC with an LTE anchor and NR as secondary via EN-DC; SA Option 2 uses the 5GC with NR only.
• In EN-DC the eNB is Master Node (MCG) and the en-gNB is Secondary Node (SCG), linked by X2.
• Option 3 splits at the eNB PDCP, 3a splits in the core, 3x splits at the gNB PDCP (most common).
• NR addition in NSA: LTE attach, B1 report, SgNB Addition over X2, RRC reconfiguration with NR config, RACH on PSCell, E-RAB modification.
• An SCG failure keeps LTE up; the UE sends SCGFailureInformationNR.
• 5GC NFs: AMF mobility and NAS, SMF sessions and UPF control, UPF user plane, AUSF auth, UDM subscription, PCF policy, NRF discovery, NSSF slice selection, NEF exposure.
• Key interfaces: N1 NAS, N2 NGAP, N3 GTP-U, N4 PFCP, N6 to data network, N9 UPF to UPF, N11 AMF to SMF, N16 V-SMF to H-SMF, N26 AMF to MME, Xn gNB to gNB.
• SBI is HTTP/2 + JSON with NRF-based discovery; CUPS lets UPFs sit at the edge.
• Registration (AMF) replaces Attach and does not create a data session; PDU Session Establishment (SMF) does.
• Registration types: initial, mobility update, periodic (T3512), emergency.
• Registration Accept carries 5G-GUTI, TAI list, Allowed NSSAI and the IMS voice over PS indicator.
• PDU session: DNN, S-NSSAI, type (IPv4/IPv6/IPv4v6/Ethernet/Unstructured), SSC mode 1/2/3.
• SUCI hides the SUPI with ECIES and the home network public key; the SIDF in the UDM recovers it.
• 5G-AKA lets the home AUSF verify RES*; user-plane integrity protection is new in 5G.
• QoS flows (QFI) live inside one PDU session tunnel; SDAP maps flows to DRBs.
• 5QI 1 GBR conversational voice, 5QI 2 video, 5QI 5 IMS signalling (not voice), 5QI 9 default internet, 82 to 86 delay-critical GBR. Do not invert 1 and 5.
• ARP is admission and pre-emption priority, not packet treatment.
• SCS = 15 × 2^µ kHz; slots per subframe = 2^µ; 14 symbols per slot.
• FR1 is 410 MHz to 7.125 GHz (100 MHz carriers); FR2-1 is 24.25 to 52.6 GHz (400 MHz carriers, beamforming); FR2-2 is 52.6 to 71 GHz in Release 17.
• Up to 4 BWPs per direction per cell, one active; default BWP saves power.
• SSB = PSS + SSS + PBCH over 4 symbols and 20 RBs; 1008 PCIs; up to 64 beams in FR2.
• SSB-to-RACH mapping tells the gNB the UE's best beam; beam failure recovery is faster than RLF.
• LDPC for data, Polar for control; no always-on CRS in NR.
• DSS shares one LTE carrier with NR dynamically at the cost of overhead.
• SDAP is new; PDCP adds duplication; RLC drops concatenation; HARQ is asynchronous both ways.
• RRC_INACTIVE keeps context in UE and anchor gNB, core sees CM-CONNECTED, resume with I-RNTI, RAN paging in the RNA.
• VoNR needs SA, IMS PDU session, IMS VoPS indicator, 5QI 1 flows, gNB voice support (ROHC, C-DRX, configured grant, PUSCH repetition, RLC UM).
• Voice-centric UE leaves 5GS when IMS voice is not available; data-centric stays. Usage setting is not the VoPS bit.
• IMS roaming on 5G is usually home-routed (V-SMF/H-SMF on N16, N9 between UPFs), the S8HR analogue; LBO is uncommon for the IMS DNN.
• EPS fallback: gNB rejects the 5QI 1 flow, moves the UE to LTE by handover (N26) or redirection, call completes as VoLTE.
• EPS fallback is at call setup and stays IMS; SRVCC moves an active call to CS.
• S-NSSAI = SST (8 bits) + SD (24 bits); up to 8 in an NSSAI; URSP maps apps to slices.
• Xn handover ends with a Path Switch; N2 handover goes through the AMF.
• The TAI list is the registration area; leaving it triggers a mobility registration update.
• On Android NSA the network type is LTE and the 5G icon is an override from NetworkTypeController and 5g_icon_configuration_string.

Glossary

5G-AKA

5G Authentication and Key Agreement; challenge-response authentication where the home AUSF verifies the UE's RES*.

5G-GUTI

Temporary UE identity assigned by the AMF, used instead of the permanent identity after registration.

5GC

5G Core network, the service-based core used by SA.

5GMM / 5GSM

5G NAS mobility management and session management protocols.

5QI

5G QoS Identifier; an index to standard QoS characteristics such as delay budget and error rate.

AMF

Access and Mobility Management Function; terminates NAS, handles registration, paging and mobility.

ARP

Allocation and Retention Priority; decides admission and pre-emption under congestion.

AUSF

Authentication Server Function in the home network.

Beam failure recovery

Fast procedure where the UE switches to a new beam through RACH instead of declaring radio link failure.

BWP

Bandwidth Part; a sub-band of the carrier with its own numerology on which the UE operates.

CORESET

Control Resource Set; the time-frequency region where PDCCH is sent.

CUPS

Control and User Plane Separation; splitting SMF-type control from UPF forwarding.

DAPS

Dual Active Protocol Stack handover; UE keeps the source link until the target is ready.

DNN

Data Network Name; the 5G equivalent of an APN.

DRB

Data Radio Bearer carrying user data over the air.

DSS

Dynamic Spectrum Sharing; LTE and NR on the same carrier, split dynamically.

EN-DC

E-UTRA NR Dual Connectivity; the NSA mode with LTE master and NR secondary.

EPS fallback

Moving a 5G SA UE to LTE at voice call setup so the call runs as VoLTE.

FR1 / FR2

Frequency Range 1 (sub-7 GHz) and Frequency Range 2 (mmWave).

gNB

The NR base station; en-gNB when it serves as secondary node in EN-DC.

HARQ

Hybrid ARQ; fast MAC-layer retransmission with soft combining.

H-SMF / V-SMF

Home and visited Session Management Functions in a home-routed roaming PDU session, connected over N16.

I-RNTI

Identifier of a suspended UE context, used to resume from RRC_INACTIVE.

Massive MIMO

Antenna arrays with many elements for beamforming and multi-user spatial multiplexing.

MCG / SCG

Master Cell Group and Secondary Cell Group in dual connectivity.

N16

Interface between V-SMF and H-SMF for home-routed roaming session control.

N26

Interface between AMF and MME for seamless 5GS and EPS interworking.

NEF

Network Exposure Function; exposes network capabilities to external applications.

NGAP

NG Application Protocol used on N2 between gNB and AMF.

NRF

NF Repository Function; registry and discovery service for network functions.

NSA

Non-Standalone; NR added to an LTE anchor on the EPC.

NSSAI

List of S-NSSAIs; configured, requested, allowed or rejected.

NSSF

Network Slice Selection Function.

Numerology

The parameter µ that sets subcarrier spacing and slot length.

PCF

Policy Control Function; QoS, charging and UE policies.

PDU session

A connection between the UE and a data network, the 5G version of a PDN connection.

PFCP

Packet Forwarding Control Protocol on N4 between SMF and UPF.

PSCell

Primary cell of the secondary cell group.

QFI

QoS Flow Identifier carried in the GTP-U header.

RNA

RAN Notification Area; area in which an RRC_INACTIVE UE moves without notifying the network.

RRC_INACTIVE

NR RRC state with stored context allowing fast resume.

S-NSSAI

Single slice identifier made of SST and optional SD.

SA

Standalone; NR connected directly to the 5GC.

SCS

Subcarrier spacing, 15 × 2^µ kHz.

SDAP

Service Data Adaptation Protocol; maps QoS flows to DRBs.

SIDF

Subscription Identifier De-concealing Function inside the UDM.

SMF

Session Management Function; manages PDU sessions and controls UPFs.

SSB

Synchronization Signal / PBCH block used for cell search and beam selection.

SSC mode

Session and Service Continuity mode (1, 2, 3) controlling anchor UPF changes.

SUCI

Subscription Concealed Identifier; encrypted form of the SUPI.

SUPI

Subscription Permanent Identifier, usually the IMSI.

TAI list

List of tracking areas forming a UE's registration area.

TCI state

Transmission Configuration Indicator; tells the UE which reference beam to assume.

TDD

Time Division Duplex; uplink and downlink share a frequency at different times.

UDM / UDR

Unified Data Management and its repository; the 5G equivalent of the HSS.

UPF

User Plane Function; forwards user packets and enforces QoS.

URLLC

Ultra-Reliable Low-Latency Communication.

URSP

UE Route Selection Policy; rules mapping app traffic to slices, DNNs and sessions.

Usage setting

UE policy, voice-centric or data-centric, that decides whether the UE may stay on 5GS without IMS voice. Not the network IMS VoPS indication.

VoNR

Voice over NR; IMS voice carried natively on 5G SA.

Xn

Interface between gNBs for handover and dual connectivity.

Interview questions