State of Field Testing 2026: What LTE, 5G NSA, and 5G SA Deployments Reveal

2026 was positioned as the year 5G Standalone would graduate from launch to operational maturity. Operators in Europe, the Gulf, and parts of Africa moved from 5G SA announcement to live customer traffic. Private network deployments accelerated under enterprise connectivity mandates. And yet the gap between what marketing KPIs report and what field instruments actually observe remains substantial.

This article documents five findings that recur consistently across LTE, 5G NSA, and 5G SA field campaigns in 2026. They are not theoretical. They are observable from Layer 3 message captures and RRC decode logs in live networks. Each one has direct implications for how field testing must be structured this year.

Finding 1: VoLTE Persists in 5G Networks

The narrative entering 2026 was that VoNR (Voice over New Radio) would progressively replace VoLTE as 5G SA coverage expanded. The field reality is more complicated.

SRVCC (Single Radio Voice Call Continuity) is still a hard requirement wherever 5G SA coverage is not contiguous with LTE. A voice call established on a VoNR path must be transferred to LTE as soon as the device leaves continuous 5G SA coverage, which in most current deployments is the rule rather than the exception. This alone creates a strong operator incentive to keep IMS anchored on the LTE path.

More significantly, handset diversity is a genuine constraint. Device support for NR SA radio does not imply VoNR IMS capability. A substantial portion of the LTE-capable, NR-SA-capable device base in 2026 does not support VoNR procedures, and operators cannot guarantee a VoNR experience across their subscriber base without per-device capability validation.

The field evidence is visible in IMS signaling logs. On devices camped on 5G NR in NSA mode, the SIP REGISTER message originating from the IMS client is processed over the LTE bearer, not over the NR path. The device reports 5G in its UI. The IMS registration proceeds on the 4G core. Reference: 3GPP TS 24.229 covers IMS session handling; VoLTE over NR IMS Registration is described in the associated GSMA IR.92 and IR.94 profiles.

Field implication: VoLTE troubleshooting skills and SIP/IMS decoder access remain mandatory in 5G field test teams, not legacy capabilities that can be deprioritized.

Finding 2: 5G SA Registration Failures Cluster Around Provisioning

In established LTE networks, registration failures typically indicate radio coverage issues. The dominant failure mode is at the RRC layer: the device cannot establish a physical channel, cannot read SIB1, or cannot complete the random access procedure. The diagnostic instinct is to look at RF KPIs first.

In 5G SA rollouts, this instinct produces the wrong answer. The dominant observable failure type is at the NAS layer, not the radio layer.

Two cause codes account for the majority of 5G SA registration failures observed during rollout campaigns:

• Cause #43: N1 mode not allowed (3GPP TS 24.501 §9.11.3.2): the UDM does not have a 5G SA subscription provisioned for this IMSI. The AMF cannot grant 5G SA service regardless of radio conditions.
• Cause #72: DNN not in slice (3GPP TS 24.501 §9.11.3.2): the requested Data Network Name is not authorized within the S-NSSAI context for this subscriber. A core provisioning mismatch, not a coverage gap.

Both failure types share a critical property: they are invisible to RF-layer analysis. A drive test route that maps SS-RSRP at -85 dBm across an area with 30% 5G SA registration failures will show no anomaly on the coverage map. The UE is reaching the AMF. The AMF is rejecting at the NAS layer. The root cause is in the UDM subscriber profile.

This is not a niche scenario. In rapid rollout campaigns where SIM provisioning, UDM configuration, and network activation proceed in parallel across thousands of subscribers, NAS-layer provisioning failures are structurally expected during the first weeks of live traffic. Detecting and quantifying them requires NAS decode, not just RF measurement.

Finding 3: The URLLC Slice Promise vs. the 5QI Reality

Private 5G network deployments in 2026 increasingly include URLLC slice commitments in their service agreements. An SST=2 slice designation is configured, acceptance testing is completed against RF and throughput KPIs, and the network is handed over to the enterprise customer with a latency SLA attached.

The problem is at the QoS layer. A significant number of private 5G deployments in 2026 carry the correct slice label (SST=2, URLLC) but allocate 5QI 9 as the QoS flow identifier. 5QI 9 is defined in 3GPP TS 23.501 §5.7.4 as a GBR=0, non-delay-critical QoS class with a default maximum data burst volume of not applicable and a packet delay budget of 300 ms. This is eMBB best-effort classification.

The URLLC-specific 5QI identifiers, including 5QI 80 (10 ms packet delay budget, non-GBR) and 5QI 82 (10 ms, GBR), require explicit configuration in the SMF QoS policy and correct mapping in the UPF. When this mapping is absent or misconfigured, the SMF falls back to a default 5QI assignment and the session establishes successfully with the wrong QoS profile.

Field detection requires decoding the PDU Session Establishment Accept message at the NAS layer. The QoS Rules IE inside this message carries the 5QI value assigned by the network to the established session. A session on SST=2 carrying 5QI 9 is a confirmed misconfiguration: the slice is labeled URLLC, but the traffic is handled as best-effort. The latency SLA has no enforcement mechanism at the network level.

Reference: 3GPP TS 23.501 §5.7.4 defines the 5QI table. The distinction between standardized 5QI values and operator-specific values above 128 is material for private network deployments.

Finding 4: NSA SCG Instability Remains the Dominant 5G Throughput Complaint

In 5G NSA deployments, the most frequent field complaint is not coverage absence. It is throughput instability combined with the observation that the 5G indicator on the device repeatedly appears and disappears.

The root mechanism is Secondary Cell Group (SCG) failure. When the NR secondary cell fails to maintain radio link quality, the UE reports failure via the SCGFailureInformation message defined in 3GPP TS 38.331 §6.3.4. The two dominant failure types observed in field captures are:

• t310-Expiry: the UE counts N310 consecutive out-of-sync indicators from the SCG physical layer, starts timer T310, and does not receive N311 consecutive in-sync indicators before T310 expires. This indicates a sustained signal quality degradation on the NR secondary cell, even if brief in absolute duration.
• randomAccessProblem: the random access procedure on the NR secondary cell fails. This can occur during beam reacquisition after NR coverage interruption or after a period of HARQ retransmission exhaustion.

Both failure types produce the same user experience: 5G drops to 4G for a period of seconds, then 5G reappears as the SCG is re-added. The failure is transient enough to be dismissed by RF KPI averaging but repeating enough to degrade any latency-sensitive application.

The diagnostic implication is that SCG failure logging must be continuous and geographically correlated. Sampled KPI collection, which captures a snapshot at each measurement point, will systematically undercount SCG failures that occur between samples. Timestamp-continuous Layer 3 logging is required to capture failure sequences accurately.

Finding 5: Measurement Report Analysis Reveals Systematic Handover Tuning Gaps

Handover performance in 5G NR networks is directly controlled by two parameters visible in RRC Reconfiguration messages: a3Offset and Time-to-Trigger (TTT). Both are frequently observed in field captures at their default values, indicating they have not been optimized for the deployment environment.

a3Offset at 0 dB (default): Event A3 triggers a measurement report when a neighbor cell exceeds the serving cell by a3Offset. At 0 dB, any neighbor cell measurement momentarily above the serving cell triggers a report. In dense urban deployments where adjacent cells produce overlapping coverage, this generates ping-pong handovers: the UE is handed to a neighbor cell, finds the source cell stronger again within seconds, and is handed back. Reference: 3GPP TS 38.331 §6.3.5 defines Event A3 and the a3Offset parameter.

TTT above 320 ms at vehicle speeds above 60 km/h: TTT defines how long the A3 condition must be satisfied before a MeasurementReport is sent. At 60 km/h, a vehicle traverses approximately 16 meters per second. A TTT of 320 ms means the A3 condition must hold for over 5 meters of travel. At TTT values of 640 ms or higher, the UE has already moved through significant coverage geometry before the handover sequence even begins, resulting in late handover. The user experiences a brief service interruption at the cell edge rather than a seamless transition.

Both parameters are visible in the reportConfigNR IE of the RRCReconfiguration message. A field capture that decodes RRC Reconfiguration with a3Offset=0 and TTT=1024ms in a highway deployment has found a handover tuning issue without requiring any access to the network management system.

What This Means for Field Testing in 2026

Three structural implications follow from these findings.

NAS decode is mandatory, not optional. Findings 2 and 3 are both NAS-layer phenomena. An RF-only field test will not detect cause code #43, will not detect cause code #72, and will not reveal a 5QI 9 assignment on an SST=2 slice. These failures are invisible to signal strength measurements. Any acceptance test methodology for 5G SA or private 5G that does not include NAS layer decode is structurally incomplete.

5QI verification must be part of every URLLC acceptance test. The existence of an SST=2 slice in the network configuration does not confirm URLLC QoS delivery. The 5QI value reported in the PDU Session Establishment Accept is the only field-verifiable confirmation that the latency policy is actually applied. This check should be a mandatory line item in any private 5G acceptance checklist.

SCG failure logging must be continuous. Sampled drive test data underrepresents transient failures by design. SCG failures on the order of 5 to 15 seconds duration, occurring once every few minutes, will be missed by measurement intervals of 30 seconds or longer. For NSA deployments where “5G keeps dropping” is the complaint, the diagnostic evidence is in the failure message sequence, not in the average KPI.

Related Cause Codes and Diagnostic Tools

Understanding the failure types described in this article requires access to cause code references and protocol decode capability. The following resources are directly relevant:

• LTE EMM Cause Codes reference for LTE NAS reject interpretation
• 5G MM Cause Codes reference for 5G SA registration reject analysis, including cause #43 and #72
• VoLTE SIP Error Codes reference for IMS registration and session failure diagnosis
• Private 5G and URLLC testing methodology for 5QI verification and slice acceptance test procedures

Field testing in 2026 is no longer primarily about coverage maps. The questions that matter are: why is 5G SA rejecting this subscriber, is this URLLC slice actually delivering 10 ms latency, why does 5G drop every two minutes on this route. All of them require Layer 3 visibility that RF metrics cannot provide.

The gap is not in coverage. It is in diagnostic depth.