5G NR MeasurementReport: Field Anatomy and Mobility Event Diagnosis

The 5G NR MeasurementReport is the UE-to-network message that triggers every handover, every inter-RAT measurement event, and every EN-DC secondary cell addition in a 5G NR deployment. Its content — the measured signal levels of serving and neighbor cells at the moment the trigger condition was met — is the primary source of evidence for diagnosing handover failures, ping-pong, too-late handover, and NSA connectivity issues.

Technical Reference

Field	Value
Message type	MeasurementReport (RRC UL)
Standard	3GPP TS 38.331 §6.3.4
Direction	UE to gNB (or eNB in LTE NSA)
Transport	DCCH (SRB1)
Trigger	Measurement event condition met + TTT elapsed
Event types	A1, A2, A3, A4, A5, A6, B1, B2
DIAG log code	RRC OTA — 5G NR message type 0x1C (UL-DCCH)

MeasurementReport Message Structure

A decoded MeasurementReport contains three key sections:

MeasurementReport
├── measId: <ID>                          -- which measurement triggered this report
└── measResults
    ├── measResultServingMOList           -- serving cell(s) measurement
    │   └── measResultServingCell
    │       ├── physCellId: <PCI>
    │       ├── ss-RSRP: <value>          -- mapped to dBm: value - 157
    │       └── ss-SINR: <value>          -- mapped to dB: value/2 - 23
    └── measResultNeighCells              -- neighbor cells measured
        └── measResultListNR
            └── MeasResultNR[]            -- one entry per neighbor
                ├── physCellId: <PCI>
                ├── ss-RSRP: <value>
                ├── ss-RSRQ: <value>
                └── ss-SINR: <value>

SS-RSRP unit conversion (3GPP TS 38.133 §10.1.6.1): the raw integer value in the IE maps to dBm as value - 157. A raw value of 57 corresponds to 57 - 157 = -100 dBm.

SS-SINR unit conversion (3GPP TS 38.215): the raw value maps to dB as value / 2 - 23. A raw value of 46 corresponds to 46/2 - 23 = 0 dB.

Event Types and Their Diagnostic Meaning

Event	Trigger Condition	Diagnostic Meaning
A1	Serving cell > threshold 1	Serving cell recovered; stop inter-frequency measurements (save UE battery)
A2	Serving cell < threshold 2	Serving cell degraded; start inter-frequency or inter-RAT measurements
A3	Neighbor > serving + a3Offset	Standard intra-frequency handover trigger
A4	Neighbor > threshold	Neighbor good enough; trigger inter-frequency handover or SCG add
A5	Serving < threshold 1 AND neighbor > threshold 2	Bi-conditional handover: serving poor AND neighbor acceptable
A6	Neighbor > secondary cell + a6Offset	Secondary cell replacement within CA
B1	Inter-RAT neighbor > threshold	NR cell detected in LTE NSA (triggers SCG addition); or WLAN detected
B2	Serving < threshold 1 AND inter-RAT neighbor > threshold 2	Serving poor AND fallback RAT acceptable (triggers inter-RAT handover)

Field Scenario 1: Too-Late Handover

Symptom: Radio Link Failure (RLF) shortly after a MeasurementReport.

What to look for in the log:

1. A3 event MeasurementReport is sent — neighbor SS-RSRP exceeds serving cell + a3Offset
2. gNB sends RRC Reconfiguration with handover command (or does not respond)
3. Serving cell SS-RSRP continues degrading below -100 dBm
4. RRC Connection Re-establishment or RLF follows

Diagnosis: The handover command arrived too late (high TTT) or not at all (gNB did not process the report). Check the TTT configured in measConfig — values above 320 ms at high mobility speeds cause too-late handover. Also check whether the RRC Reconfiguration with handover was received after the MeasurementReport.

Field Scenario 2: Ping-Pong

Symptom: Repeated A3 MeasurementReports alternating between two cells, with handovers in both directions.

What to look for in the log:

1. A3 report: neighbor B > serving A + a3Offset for TTT → handover to B
2. After handover: A3 report from B: neighbor A > serving B + a3Offset → handover back to A
3. Cycle repeats at short intervals (typically 1–5 seconds)

Diagnosis: The a3Offset is too small (typical cause: 0 dB instead of 3 dB). The cells’ signal levels are close enough that small fading variations trigger the event in both directions. The fix is to increase a3Offset or increase TTT. Measure the signal level spread in the MeasurementReport: if the serving and neighbor SS-RSRP values differ by less than 2 dB, ping-pong will occur with small offsets.

Field Scenario 3: B1 Event Triggering EN-DC SCG Addition

Symptom: UE is in LTE-only mode. After a B1 MeasurementReport, it transitions to EN-DC (LTE+NR).

What to look for in the log:

1. B1 MeasurementReport in LTE RRC (on SRB1 over LTE): contains NR cell NR-ARFCN, SS-RSRP, SS-SINR
2. LTE eNB sends RRC Reconfiguration with nr-SecondaryCellGroupConfig IE
3. UE sends SCGFailureInformation if the NR SCG setup fails, or begins data on NR (visible in MAC/PHY log) if successful

Diagnosis: If the B1 report is sent but no RRC Reconfiguration with SCG config follows within ~200 ms, the SCG addition was rejected by the eNB (X2/Xn interface issue with the gNB) or the NR cell is not in the neighbor list. If SCGFailureInformation follows, the SCG was attempted but failed at the NR layer.

Field Scenario 4: A2 Event with Empty Neighbor List

Symptom: A2 event fires (serving cell is poor), but no handover occurs and the UE remains on the degraded cell.

What to look for in the log:

1. A2 MeasurementReport sent: serving SS-RSRP below threshold
2. measuredResultsList for neighbor cells is empty or contains no cells above the A5 threshold 2
3. No subsequent RRC Reconfiguration with handover command
4. RLF or cell reselection follows

Diagnosis: The UE found no usable neighbor. Root causes: measurement gap not configured for inter-frequency measurement, neighbor cell ARFCN not in the measurement object list, or intra-frequency neighbor cells are physically absent. In NSA deployments, this pattern on the LTE layer often means the 5G coverage hole is paired with an LTE coverage hole — the UE loses both connections simultaneously.

Step-by-Step Field Diagnosis

Step 1 — Locate the MeasurementReport. In the RRC log, filter for UL-DCCH MeasurementReport messages. Record the measId from each report — this links the report to the specific measurement configuration (measObject + reportConfig) that triggered it.

Step 2 — Decode SS-RSRP values. Apply the formula value - 157 to convert raw integer values to dBm for all cells in the report. Record serving and all neighbor cells.

Step 3 — Identify the event type. Cross-reference the measId with the measConfig from the preceding RRC Reconfiguration (or RRC Setup) to determine whether the triggering event is A3, A5, B1, or another type. This identifies the handover or SCG trigger.

Step 4 — Check what happened after the report. Find the gNB response: RRC Reconfiguration (handover command or SCG config), or no response. A MeasurementReport with no subsequent gNB response within the T304 timer (500 ms default) is a network-side processing failure.

Step 5 — Correlate with RF Monitor. Cross-reference the SS-RSRP and SS-SINR in the MeasurementReport with the RF Monitor live reading at the same timestamp. Significant discrepancy (> 5 dB) may indicate measurement filtering is active (filterCoefficient in measConfig) and the MeasurementReport reflects a filtered (slower) estimate.

Capturing MeasurementReport in the Field

The MeasurementReport is captured via DIAG log as an RRC UL-DCCH message (5G NR OTA). In DIAG log, the message is decoded as an ASN.1 PER structure. The measId, measResultServingMOList, and measResultNeighCells are all visible in the decoded output. Cross-reference with the preceding RRC Setup Complete or RRC Reconfiguration Complete to establish the measConfig that was active at the time of the report.

Related Messages

• RRC Reconfiguration — configures measConfig (measurement objects, report configs, TTT, a3Offset, hysteresis)
• RRC Reconfiguration Complete — UE confirms handover executed
• SCGFailureInformation — reports secondary cell group failure after a B1-triggered SCG addition
• RRC Re-establishment Request — sent after Radio Link Failure when no handover command was received
• A3 event parameters — a3Offset (3GPP TS 38.331 §6.3.5), hysteresis, TTT: all configured in EventA3 IE