Subframe Number, SFN and HFN
In any communication, one of the most important requirement would be that the transmitter and reiver operate at the same tempo, more technically speaking that the transmitter and reciever should operates in synchronized mode.
Speaking in laymen's terminology, the transmitter and reciever has it's own clock and they have to synchronize the clock before the communication starts.
What kind of clock they have in LTE ? Like our analog wrist clock, LTE clock has two arms. One arm ticks every 10 ms and the other arm ticks every 1 ms. Again as in the wrist clock, each of ticks has specific numbers and the numbers has a certain range.
In LTE, the arm ticking in 10 ms interval has numbers between 0 and 1023 and these numbers are called SFN (System Frame Number) and the other arm ticking in 1 ms interval has numbers between 0 and 9, and this number is called subframe number. When subframe number hits the max value (i.e, 9), it goes back to 0 and SFN number get increased by 1. When SFN number hits the max value (i.e 1023), it goes back to 0.
UE and eNB need to maintain the synchnronization on subframe number and SFN during the whole communication period.
Based on Subframe and SFN definition, you may notice that the longest time span for the timing synchronization without resetting to 0 is 1023 SFN. It is 1024 x 10 ms, which is 10240 ms (=10240 subframe = 10.24 sec). Most of timing related parameters (e.g, Idle mode DRX, Connected Mode DRX, BSR Report period etc) are configured within this max timiing value.
However, as LTE evolves, especially as LTE tries to cover MTC or IoT related features it turned out that this max time span is not big enough to schedule all the timing related parameters (e.g, eDRX, PSM configuration). To support this kind of new requirement, LTE has introduced another timer(clock) called HFN (Hyper Frame Number or Hyper SFN). HFN is a timer at the next level to SFN. HFN ranges between 0 and 1023 and the value increases by 1 when SFN reaches 1023 and reset to 0.
Summary of Timers
How to Synchronize these timers between UE and eNB ?
Before the transmitter (eNode B) and the reciever (UE) in LTE start communicating each of other they have to set these two clock arms to be the same number and this synchronization happens during cell search and timing synch process. In short, they synchronize the tempo (exact time the arm ticks) by cell search and timing sync and UE get SFN sync from MIB which carries SFN number in it. How UE can get synchronized for HFN ? It can synchronize the HFN based on HFN value in SIB1.
Subframe Synchronization : This is done by detecting synchronization signal (PSS and SSS). As you would know of, PSS and SSS is located in subframe 0 and 5 in legacy LTE and LTE BL/CE (LTE-NB Synchronization signal (NPSS and NSSS) is different from legacy LTE and LTE BL/CE). In legacy LTE and LTE BL/CE, if UE detects PSS/SSS it is considered that the subframe is subframe 0 or 5. Then how UE can figure out whether it is subframe 0 or 5. The answer lines in the contents of SSS. You would notice from Symbol Generation of SSS section that the SSS sequence data is different between subframe 0 and 5.
SFN Synchronization : SFN Synchronization is done by PBCH (MIB). eNB transmit SFN value at every PBCH and UE can synchronize its SFN number from this value.
HFN Synchronization : SFN Synchronization is done by hyperSFN IE in SIB1. eNB can transmit hyperSFN in every SIB1 and UE can synchronize its SFN from this number.