Timing synchronization is the first thing a UE does without help from the network. The cell broadcasts nothing that says where a symbol starts, and nothing that names the sequence it is using. The UE derives both from the raw samples, and this note follows how it does that.

• The Process in Outline
• What Each Step Produces
• Finding the Subframe Boundary
• Finding the Radio Frame Boundary
• The SFN Is Not Entirely in the MIB
• Cyclic Prefix Correlation : One Common Technique
• Reference :

The Process in Outline

At very high level, the process of Timing Synchronization can be described as follows. The three steps below are the view a protocol engineer needs. The diagram further down adds two more underneath them, and those two run first. Both describe the same few milliseconds of work, seen from different depths in the stack.

•   i) UE decode Primary sync with three different Primary Sync Sequence and figure out which sequence is assigned for the cell and obtain the primary time sync.
•   ii) Apply the primary sync sequence for decoding the Secondary Sync code and figure out which sequence is assigned for the cell.

This Sync detection is done every 5 ms. (You will understand this time interval if you look at the LTE Downlink frame structure explained at DL FrameStructure section)

As I mentioned in previous section, three different sequences are used as the primary sync signal and there is a one-to-one mapping between each of the three sequences and the cell ID within the cell identity group. After a UE detect this cell-identity group, it can determine the frame timing. From this cell identity group, the UE also figure out which pseudo-random sequence is used for generating the reference signal in the cell.

•   iii) Once this timing sync get established, UE can decode MIB and figure out SFN number since MIB carries SFN number.

If you go into a little bit further details, you would need a couple of additional steps as follows (step (1) and step (2)). To detect PSS and SSS, you need to get the data with a sequence of specific resource elements accurately. To accurately extract the data from a specific resource elements, you need to know the exact symbol boundary (starting sample and ending sample of an OFDM symbol). Once you detect the exact symbol boundary, you can detect the frequency offset (a kind of frequency error) to further compenstate the signal. In some sense, these two steps are more difficult than PSS, SSS detection.

• Four boxes run down the diagram, joined by one arrow each. They read (1) Find Symbol Boundary – CP Correlation, (2) Determine Frequency Offset, (3) Detect PSS (Primary Sync Signal) and (4) Detect SSS (Secondary Sync Signal).
• The boxes carry two colours, and the split is the point of the drawing. Steps (1) and (2) are green. Steps (3) and (4) are yellow.
• The green pair works on raw time domain samples, and neither step produces any information about the cell. The yellow pair works on resource elements, and between them they produce the cell identity.
• The numbered list higher up this page begins at the yellow pair. The green pair is what the paragraph above the diagram calls the additional steps.

What Each Step Produces

The diagram above names four steps and says nothing about what each one hands to the next. That is the part worth knowing, because the four steps fail in different ways. A step that cannot produce the number the next step needs takes that next step down with it.

The table below gives each step its input, its output and the symptom of its failure.

36.211 clause 6.11 is where the last two rows come from. It defines 504 physical-layer cell identities, grouped into 168 groups of three. The primary synchronization signal carries the identity within a group. The secondary one carries the group number.

That matches what the step list above already says. Three primary sequences map one to one onto the identity inside the group, and the group itself arrives with the secondary signal. Neither signal gives the PCI on its own, and the UE needs both.

The two green steps are different in kind, and the table shows why. They produce numbers about the receiver rather than about the cell. A sample index and a frequency correction say nothing about which cell is transmitting. A fault in either one therefore looks like a cell that is not there at all.

• The first two steps produce nothing about the cell : they produce a sample index and a frequency correction, both of which describe the receiver.
• Neither synchronization signal carries the PCI on its own : 36.211 splits it into a group of 168 and an identity of three, and the UE needs both halves.

Finding the Subframe Boundary

The symbol boundary sits at one end of this page and the frame number at the other. Two rungs sit between them, and the first is the subframe one. Knowing where a symbol starts says nothing about which symbol it is, and the primary synchronization signal is what narrows that down.

36.211 clause 6.11.1.2 places the primary synchronization signal in the last OFDM symbol of slots 0 and 10 for frame structure type 1. Those two positions are half a radio frame apart, which is the 5 ms interval the step list above already names.

Finding that peak does more than mark a repeating tick. The PSS symbol sits at a fixed position inside the frame structure, so the sample index of the peak converts straight into the sample index where a subframe begins. The offset between the two is a constant the receiver already knows. From that point the UE can cut the captured stream into subframes and into slots, and it also knows that the subframe it found is either subframe 0 or subframe 5.

What PSS does not tell the UE

What the UE has not found is which of the two positions it is sitting on. Clause 6.11.1.1 builds the PSS from a Zadoff-Chu sequence, and its root index comes from Table 6.11.1.1-1. That table holds three entries. The roots are 25, 29 and 34, one for each identity within the cell identity group.

Nothing in that generation depends on the subframe. Both instances inside a radio frame therefore carry the same sequence. The correlation peak looks identical at the two of them. The UE ends this step holding the subframe boundary and a two way question about where the frame begins. Five milliseconds is what stays ambiguous, rather than what the step resolved.

The diagram below puts that whole step in one picture, from the samples on the left of the process to the question it cannot answer.

Figure 1. The three root sequences identify the cell, not the position in the frame. Both PSS instances in a radio frame are identical, so detection ends with the subframe boundary fixed and only the half-frame still open.

TDD puts the signal somewhere else

The same clause treats frame structure type 2 differently. A receiver written for one structure will not find PSS in the other. For type 2 the primary synchronization signal is mapped to the third OFDM symbol of subframes 1 and 6. The spacing is still half a radio frame, so the ambiguity that follows is the same one.

• PSS fixes the subframe boundary, and 5 ms is what stays ambiguous : the same sequence is sent twice per radio frame, so both instances look alike.
• The three root indices identify the cell, not the position : 25, 29 and 34 map onto the identity within the group and carry no timing.

Finding the Radio Frame Boundary

The two way question PSS leaves has to be settled before anything that counts frames can begin. The secondary synchronization signal settles it, and the mechanism is worth seeing. It is the reason SSS is built from a pair of sequences rather than from one.

36.211 clause 6.11.2.1 makes the secondary synchronization signal an interleaved concatenation of two length-31 binary sequences. One sentence in that clause does the work this section is about. The combination of the two sequences differs between subframes.

The SSS carried at the first PSS position is therefore not the SSS carried at the second. A UE that detects which combination is present learns which half of the radio frame it is in. The two way question closes there. That is the frame timing the step list above says the UE determines at this point.

The diagram below follows the same step through, and it starts where Figure 1 stopped.

Figure 2. The SSS closes the question the PSS left open. Its two sequence combinations differ between the half-frames, so one detection fixes the radio frame boundary and the cell identity group together.

Why SSS cannot be read before PSS

The same clause adds a dependency that explains the order of the steps. The concatenated sequence is scrambled with a scrambling sequence given by the primary synchronization signal. SSS cannot be descrambled until PSS has been detected, which is why step ii above opens by applying the primary sequence.

One signal doing two jobs

SSS carries two independent things at once, and they are easy to confuse. The pair of length-31 sequences encodes the cell identity group, which is one of 168. The order the pair appears in encodes which half-frame it is. The first is a fact about the cell and the second is a fact about time.

That separation has a diagnostic behind it. A UE can read the group correctly and the order wrongly. It then holds the right PCI and a frame boundary 5 ms out. Everything the UE schedules by frame number is then 5 ms adrift, while the cell identity in the log looks perfectly healthy.

The table below puts the whole ladder in one place.

Reading the last column downward is the useful part. Each rung removes exactly one unknown and hands the rest to the rung below it. The first row is also the only one with no clause against it. That is the point the section on correlation peaks further down this page makes at length.

• SSS removes the last 5 ms of ambiguity : the sequence combination differs between subframes, so the two halves stop looking alike.
• The cell identity and the half-frame come from the same signal by different means : the pair of sequences carries the group, and their order carries the timing.
• A correct PCI does not prove correct frame timing : the group can be right while the order is wrong, which puts the frame boundary 5 ms out.

The SFN Is Not Entirely in the MIB

Step iii above closes the sequence by decoding the MIB for the frame number, and the MIB does carry it. It carries eight bits of it. The SFN runs to ten, and where the other two come from is worth knowing on a page about timing.

36.331 describes systemFrameNumber as the eight most significant bits of the SFN, and it says plainly where the rest are. The P-BCH has a 40 ms transmission interval, which spans four radio frames. The position inside that interval supplies the two least significant bits.

The mapping is fixed, and the table below is all of it.

36.331 clause 5.2.1.2 is what creates those four positions. The MIB uses a fixed 40 ms period. Its first transmission sits in subframe #0 of the radio frames where SFN mod 4 = 0, and repetitions sit in subframe #0 of the others. Four radio frames therefore carry four copies of one MIB.

So a UE that decodes the MIB has not finished reading the frame number. It also has to know which of the four copies it decoded, and that knowledge comes from the timing work the rest of this page describes.

The dependency runs in both directions, which the step list does not show. Timing synchronization is what makes MIB decoding possible. Part of the frame number is then carried by that timing rather than by the message.

• The MIB carries eight of the ten SFN bits : the other two are the position of the decoded copy inside the 40 ms interval.
• Timing does not merely enable the MIB, it carries part of its content : a UE with the right bits and the wrong copy has the wrong frame number.

Cyclic Prefix Correlation : One Common Technique

You may use different techniques for detecting the symbol boundary, but one of the common techniques being used is to use the property of Cyclic prefix. As you know, Cyclic Prefix is a copy of a sequence of data from the ending part of an OFDM symbol. It means that the correlation between a cyclic prefix and the ending part of a symbol should be very large comparing to other region as illustracted below.

< Fig 3 : a case when the correlation window is located exactly in Cyclic Prefix and the ending part of the symbol >

<Fig 4 : a case when the correlation window is not at the position of Cyclic Prefix and the ending part of the symbol>

• The two figures draw the same thing twice, and one thing differs between them. A green bar marks one correlation window and a yellow bar marks the other, with a bracket labelled Correlation Window joining the pair.
• In Fig 3 the green bar sits at the start of the red section of the waveform and the yellow bar sits at its end. The arrow on the right reads High Correlation.
• In Fig 4 the green bar sits inside the blue section and the yellow bar part way along the red one. The arrow on the right reads Low Correlation.
• What changes between the two pictures is where the pair of bars sits along the waveform. Sliding that pair is the search the paragraph below describes.

Using this properly, if you find the point where you get the highest correlation while you are sliding down the two correlation windows along the captured time domain data. You can find the symbol boundary.

Following is an example of plotting these correlations while sliding the windows sample by sample. You can obviously see the peaks with the interval of one OFDM Symbol (this is from the 5 Mhz BW LTE Downlink data sampled at 7.62 Mhz sampling rate).

• The vertical axis is labelled r and runs from 0 to 0.04, with its middle tick at 0.02. The horizontal axis is the sample index and runs past 14000, ticked every 2000.
• The trace is drawn in red with the tips of the peaks in a darker line. The peaks reach roughly 0.02 to 0.03, while the rest of the trace sits near 0.005.
• The peaks repeat at a constant spacing from one end of the record to the other. That regularity is the property the paragraph above relies on.
• The peaks are not all the same height, and the trace between them is far from flat. That is the noise the section below the plot goes on to discuss.

So far so good ? Sound simple ?

Maybe. But nothing goes like textbook in real engineering. Even though the cyclic prefix should be identical to the ending part of a symbol, in reality it would not be exactly same because different noise (or fading) has been applied while the signal is generated and travels through the signal path. So the correlation peak may now show up exactly at the expected point. Also the peak value may not be at only one point.. you may see similar high correlation around several samples around the peak. So you would have some errors of the location of the peaks in several samples.

The accuracy of these correlation peak would be more accurate as the length of correlation window gets longer. It means you may have pretty good accuracy in wider bandwidth because CP length is longer in wider bandwidth. However, the accuracy of the correlation gets poorer as system bandwidth gets narrower since CP length gets shorter.

Therefore, in real implementation, you would need some additional tricks to compensate this kind of errors.

• Cyclic prefix correlation is one technique among several : the section opens by saying so, and no specification names a method for this step.
• The peak locates the boundary to within a few samples : noise and fading widen it, which is what the closing paragraph means by additional tricks.

Reference :

[1] 3GPP TS 36.211 Physical Channel and Modulation

[2] Jung-In Kim et al, SSS Detection Method for Initial Cell Search in 3GPP LTE FDD/TDD Dual Mode Receiver

[3] Synchronization and Cell Search  

[4] An improved Synchronization signal detection algorithm in LTE 230

[5] Design and Analysis of an Efficient Primary Synchronization Signal Detector

[6] Cell Search and Uplink Synchronization in LTE

[7] Wireless Synchronization Preamble Detection Scheme Using Bispectra-Based Statistics in the Presence of Stationary Noise  

[8] 3GPP TS 36.331 Radio Resource Control (RRC) Protocol specification, v19.3.0. Clause 5.2.1.2 carries the 40 ms MIB schedule, and the MasterInformationBlock field descriptions give systemFrameNumber its eight bits and the two implicit ones.