4G/LTE - Basic Procedures

Cell ID Detection and System Information Detection

What is happening at the very first when you first power on (or Switching Airplane Mode On to Off) is to detect a cell around the UE (e.g, mobile phone). This would be the most important process happening inside of the UE in terms of celluar protocol point of view. The overall procedure of the initial detection of a cell can be described as below.

i) Frequency Aquisition

ii) Primary Sync Signal Aquisition (Slot Timing Aquired, Secondary Sync Signal Scrambling Code Aquired). From this, N_id_2 is found.

iii) Secondary Sync Signal Aquisition (Frame timing Aquired, Cell Group ID sequence aquired). From this, N_id_1 is found.

iv) with PSS(N_id_2) and SSS(N_id_1), Cell ID can be calculated

v) with Cell ID, Reference Signal Location is detected

vi) With the help of Reference Signal, PBCH (MIB) can be detected

vii) From MIB, SFN and System BW can be detected

viii) Decode PCFICH and detect how many symbols are allocated for PDCCH.

ix) Decode DCI for SIB1 from PDCCH.

x) Decode SIB1 and get the scheduling information for other SIBs

xi) Decode SIBs (other than SIB1)

One of the most important step for testing/troubleshooting around the initial registration is to check whether UE successfully complete the time-sync (step i) and ii)), but it is very hard to check this step with any kind of equipment. One way to easily check whether UE succeeded in time-sync or not is to check from UE log whether UE successfuly decoded Cell ID or not. If UE successfully detected Cell ID, it means UE successfully completed the time-sync.

One of the common questions that I got from this page was "It is possible for a UE to decode MIB without detecting reference signal ?"..i.e.. "Is reference signal a mandatory precondition for MIB decoding ?".

I think theoretically UE can decode MIB without any help of Reference Signal since all the information which is needed for decoding MIB is predefined in 3GPP specification.

I also had an experience of testing a chipset at very early development stage. At that time, an equipment and the device is directly connected at base band I/Q signal. So we can assume the signal quality is almost ideal. The chipset were able to decode MIB without detecting Reference Signal. But in reality with RF, it would be very tricky to decode MIB properly without any help of reference signal detection before it. Usually UE try to detect/estimate reference signal and configure its Equalizer properly and then try to decode MIB.

Cell Detection / Search in Python

I wrote this in a separate note here. If you are interested in DSP level of understanding on this process, I would suggest you to check out this note.

Cell Detection / Search in Matlab LTE Toolbox

Cell Search, MIB and SIB1 Recovery
LTE HDL Cell Search
downlinkSubframeOffset// Matlab LTE Toolbox Internal Function
lteDLFrameOffset
lteCellSearch
LTE Cell Search (from A/D samples to PBCH MIB decoding)

NOTE : The most fundamental function in the list would be downlinkSubframeOffset which returns the timing offset between the start of the input I/Q data and the start of the first subframe. But this is an internal function of LteToolbox and the documentation is not avilable in public. You need to install LteToolbox and look into the source code if you want to get the detailed documentation on this function.

PSS generation in Time Domain

One of the most critical procedure in the Cell detection would be PSS and SSS detection. Usually PSS detection happens in TimeDomain before it is possible to generate resource grid. But PSS sequence in 3GPP is defined as a frequency domain within the resource grid. Therefore, to detect PSS in time domain we need to generate PSS signal in time domain. This process (i.e, generate PSS in time domain) is done by downlinkSubframeOffset and overall procedure is as follows.

i) Create an empty resource grid. Usually generate resource grid with 6 RBs.

ii) Generate PSS data as specified in 3GPP

iii) Put the PSS data into the resource grid

iv) Perform OFDM modulation (this is done by lteOFDMModulate. It performs DC subcarrier insertion, inverse fast Fourier transform (IFFT) calculation, cyclic prefix insertion, and optional raised cosine windowing and overlapping of adjacent OFDM symbols of the complex symbols in the resource array, grid ).

SSS generation in Time Domain

Time Domain SSS generation is done in the same way as it does for PSS .

i) Create an empty resource grid. Usually generate resource grid with 6 RBs.

ii) Generate SSS data as specified in 3GPP

iii) Put the SSS data into the resource grid

Perform Correlation for PSS/SSS and Captured IQ

Once you have the time domain data for PSS and SSS, perform the correlation between these data and the captured IQ data to detect the exact location of PSS/SSS in the IQ data. Then from the correlation result, we can figure out the start position of subframe 0 and 5 which carries the PSS/SSS.

Cell Detection / Search in srsRAN

If you are interested in this process at the source code level of the protocol stack, I would suggest you to look into the openSource srsRAN. Following APIs can be good places for you to start. This list is from the master-branch of the code that was downloaded on Oct 8,2021

srsran_pss_generate() -> \lib\src\phy\sync\pss.c
srsran_pss_init_N_id_2() -> \lib\src\phy\sync\pss.c
srsran_pss_find_pss() -> \lib\src\phy\sync\pss.c
All functions -> \lib\src\phy\sync\gen_sss.c
srsran_sss_N_id_1() -> \lib\src\phy\sync\sss.c
srsran_sss_m0m1_diff_coh() -> \lib\src\phy\sync\find_sss.c
srsran_sync_find() -> \lib\src\phy\sync\sync.c
srsran_sync_get_cell_id() -> \lib\src\phy\sync\sync.c
srsran_sync_detect_cp() -> \lib\src\phy\sync\sync.c
sync_sss_symbol() -> \lib\src\phy\sync\sync.c
cfo_cp_estimate() -> \lib\src\phy\sync\sync.c
cfo_i_estimate() -> \lib\src\phy\sync\sync.c
srsran_ue_sync_get_sfn() -> \lib\src\phy\ue\ue_sync.c
find_peak_ok() -> \lib\src\phy\ue\ue_sync.c
track_peak_ok() -> \lib\src\phy\ue\ue_sync.c
srsran_ue_sync_run_find_pss_mode() -> \lib\src\phy\ue\ue_sync.c
srsran_ue_sync_run_track_pss_mode() -> \lib\src\phy\ue\ue_sync.c
srsran_ue_cellsearch_scan_N_id_2() -> \lib\src\phy\ue\ue_cell_search.c
srsran_ue_cellsearch_scan() -> \lib\src\phy\ue\ue_cell_search.c
get_cell() -> \lib\src\phy\ue\ue_cell_search.c
srsran_pbch_cp() -> \lib\src\phy\phch\pbch.c
srsran_pbch_get() -> \lib\src\phy\phch\pbch.c
srsran_pbch_decode() -> \lib\src\phy\phch\pbch.c
srsran_ue_mib_decode() -> \lib\src\phy\ue\ue_mib.c
srsran_ue_mib_sync_set_cell() -> \lib\src\phy\ue\ue_mib.c

Some highlights of implementation of the initial cell detection in srsRAN can be summarized as follows.

Step 1 : Find N_id_2 value as follows (\lib\examples\synch_file.c)

for (N_id_2 = 0; N_id_2 < 3; N_id_2++) {

peak_pos[N_id_2] = srsran_pss_find_pss(&pss[N_id_2], input, &peak_value[N_id_2]);

}

float max_value = -99999;

N_id_2 = -1;

int i;

for (i = 0; i < 3; i++) {

if (peak_value[i] > max_value) {

max_value = peak_value[i];

N_id_2 = i;

}

Sub Step 1 : Generate PSS signal for a given N_id_2 value both in frequency domain and time domain using srsran_pss_init_N_id_2(). srsran_pss_init_N_id_2() generate PSS first in frequency domain using srsran_pss_generate() and convert it to time domain data by ifft.

Sub Step 2 : Find the correlation peak of PSS in time domain using srsran_pss_find_pss()

Step 2 : Find N_id_1 using srsran_sss_N_id_1().

srsran_sss_N_id_1() is based on many other functions like function in \lib\src\phy\sync\gen_sss.c and functions in \lib\src\phy\sync\sss.c

Step 3 : Calculate Physical Cell ID using srsran_sync_get_cell_id().

srsran_sync_get_cell_id() calculate the cell ID using N_id_2 and N_id_1 from previous steps.