TechWindo

SIB’s in 5G:

The Definitive Guide to SIB in 5G: Understanding System Information Blocks in Next-Generation Networks

Imagine your phone connecting to a 5G network in seconds, without you lifting a finger. That’s the magic of System Information Blocks, or SIBs, in 5G. These blocks act like hidden road signs, guiding devices to the right paths for calls, streams, and data. In 5G NR, or New Radio, SIBs make sure your gadget knows the cell’s rules from the start. They handle everything from initial access to staying connected on the move. Stick around as we unpack how these blocks keep 5G running smooth and why they matter for faster, smarter networks.

Understanding the Evolution of System Information Broadcasts

System Information Broadcasts have come a long way since early cellular days. In 5G, they adapt to new demands like crowds of connected devices and split-second responses. Let’s trace that shift.

From LTE SIBs to 5G NR SIBs

Back in LTE, from releases 8 and 9, SIBs followed a rigid setup. Each block had fixed spots for info like cell access rules or neighbor details. But 5G NR flips that script with a modular design. You can mix and match blocks to fit needs, such as linking thousands of IoT sensors or delivering video without lag.

This change stems from 5G’s big goals. Massive IoT means handling tons of low-power gadgets. Ultra-reliable low-latency communication, or URLLC, cuts delays for things like self-driving cars. Enhanced mobile broadband, eMBB, pushes high speeds for downloads. Old LTE SIBs couldn’t flex like that, so 5G NR spreads info more efficiently. Result? Networks that scale without choking on data.

Think of LTE SIBs as a one-size-fits-all menu. 5G NR offers a customizable buffet, picking only what users need. This evolution cuts waste and boosts speed.

The Core Concepts: PBCH, PDSCH, and Scheduling Information

At 5G’s heart, the Physical Broadcast Channel, or PBCH, sends the bare basics. It tells your device where to find more details, like a quick note pointing to a full map. Then comes the Physical Downstream Shared Channel, PDSCH, which carries the heavy SIB load.

Scheduling info ties it all together. The network sets when each SIB broadcasts, avoiding clashes on the airwaves. PBCH includes a short master block that outlines these schedules. Without this setup, devices would hunt blindly for info, wasting time and battery.

Picture PBCH as the front door greeter. It hands out keys to PDSCH rooms full of SIB treasures. Scheduling keeps traffic flowing, so no one waits in line.

Decoding the Essential 5G System Information Blocks (SIBs)

Now we get to the meat: what each key SIB does in 5G NR. These blocks aren’t just data dumps; they’re tailored messages for smooth operation. We’ll break down the must-know types, starting with the essentials.

SIBs in 5G come in types 1 through 9, plus extras for specific uses. They broadcast on PDSCH, scheduled via the master info block. Core ones focus on access, mobility, and cell rules. Understanding them helps engineers tweak networks for better coverage.

SIB1: The Entry Point to the Cell

SIB1 stands as the gateway to any 5G cell. It’s always there, broadcast every 80 milliseconds or so, making it easy to spot. This block packs cell selection info, like signal strength thresholds, and lists Public Land Mobile Network identities, or PLMNs, so your phone picks the right carrier.

Operators set SIB1’s periodicity based on traffic. In busy spots, they might shorten it for quicker joins. It also covers time slots for other SIBs and access barring flags to manage crowds. Without SIB1, your device couldn’t decide if a cell suits it.

Ever wonder why your phone sometimes skips a weak signal? SIB1 sets those bars. Here’s a tip: Check your carrier’s docs for their SIB1 tweaks—they often adjust for urban vs. rural needs.

• Key contents: PLMN list, cell identity, tracking area code.
• Transmission: Fixed schedule, vital for idle devices scanning.
• Config tip: Boost periodicity in high-mobility zones like highways.

SIB2: Cell Access Parameters and Common Configuration

SIB2 lays out the ground rules for talking to the cell. It details uplink and downlink frequencies, so devices tune right. Power control settings here prevent shouts from drowning out whispers, keeping chats clear.

This block configures shared channels too. Random access parameters guide how your phone requests a spot to transmit. It includes time alignment info to sync with the base station. All this ensures fair play in the spectrum.

In practice, SIB2 helps during handshakes. If power settings mismatch, connections fail. Operators fine-tune these for battery life, especially in IoT setups.

Consider it the cell’s housekeeping manual. It covers RACH configs, like preamble formats, and bandwidth parts. Solid SIB2 means fewer failed attempts when you turn on data.

SIB3/SIB4: Mobility and Neighbor Cell Configuration

Mobility keeps you connected as you roam. SIB3 handles intra-frequency moves, within the same band. It lists nearby cells on that frequency, with measurements like signal quality thresholds for handovers.

SIB4 steps to inter-frequency neighbors, across bands. This matters in diverse setups, like shifting from low to mid-band for better speed. Both include Neighbor Cell Lists, or NCLs, to speed up scans.

Why split them? Intra moves are quicker; inter needs more planning to avoid drops. In 5G, these SIBs use compact formats to save airtime. Handovers rely on this info—miss it, and your call cuts out.

• SIB3 perks: Speeds same-band shifts, cuts ping-pong effects.
• SIB4 role: Enables band hopping for coverage gaps.
• Pro insight: Dense lists in cities prevent black spots during drives.

Specialized SIBs: SIB5, SIB6, and Beyond (NR-EUTRA Mobility)

For mixed networks, SIB5 and SIB6 bridge to older tech. SIB5 guides shifts to E-UTRA, or LTE, key in Non-Standalone 5G where LTE anchors control. It lists LTE cells with priorities for fallback if 5G falters.

SIB6 targets even older GSM or UTRA nets, though less common now. These ensure backward compatibility, vital during rollouts. In NSA mode, your phone pings LTE via these SIBs for core ties.

Beyond basics, SIB7 to SIB9 handle extras like ETWS alerts or CMAS warnings. They adapt for voice over NR too. In hybrid setups, these keep service unbroken.

Think of them as escape hatches. SIB5 shines in early 5G phases, easing the jump from 4G.

SIB Scheduling, Repetition, and Redundancy in 5G

Reliable SIB delivery matters most when signals fade. 5G builds in smarts for that, from repeats to smart timing. This keeps devices in the loop, even on the edge.

Scheduling spreads SIBs over time windows, avoiding overload. Repetition blasts key info multiple times for catch-up. Redundancy adds backups, crucial for fast-moving users.

The Role of the Master Information Block (MIB)

The MIB kicks things off, sent on PBCH every 80 ms. It’s tiny, just 24 bits, covering cell basics like frame number and SIB1 location. No MIB, no path to full system info.

It signals subcarrier spacing and duplex mode too. Devices decode MIB first upon power-up. This brevity saves resources, focusing on pointers.

MIB acts as the index in a book. It directs to SIB chapters without spoiling the plot.

Optimizing SIB Transmission Parameters

Operators juggle speed and efficiency in SIB setup. SI-Window sets how long a SIB has to arrive, often 1 to 10 frames. SI-Repetition repeats broadcasts for reliability.

In dense cities with tall buildings blocking signals, crank up repeats. Say, in urban canyons, double the rate to fight echoes. This trade-off: More air use but fewer misses.

Balance quick access with low overhead. Short windows suit low-latency apps; longer ones save spectrum. Tools like network simulators help test these.

Real example: During events like concerts, operators shorten windows for instant joins. It prevents pile-ups.

Impact of SIB Configuration on Device Power Consumption

SIB monitoring drains batteries in idle mode. Longer repeats mean less frequent checks, saving juice. But it slows attachments—trade-off city.

Studies show UEs sip power with optimized SIBs. One report notes 20% less draw when periods stretch to 160 ms. In IoT, this extends life from days to months.

Your phone sleeps deeper with smart configs. Question: How often does your device wake for SIBs? Tweaks cut that, boosting standby time.

• Power saver: Extend non-critical SIB periods.
• Latency hit: Shorten for URLLC devices.
• Stat: Ericsson data pegs SIB scans at 15% of idle power.

Advanced Topics: Dynamic SIBs and SIB Modification

5G doesn’t stop at static broadcasts. Dynamic tweaks and on-demand pulls make it agile. Let’s explore these edges.

On-Demand Information Delivery via Paging Messages

Not all info needs constant airtime. Paging signals changes or rare needs, like position data for some UEs. Devices request via RACH if paged.

This cuts waste—broadcast only to those who ask. In 5G, it flags SIB updates without full rebroadcasts. Efficiency win for sparse traffic.

It’s like a waiter checking your table, not yelling the menu to all.

Handling Network Changes via SIB Updates

Networks evolve; SIBs must too. A sequence number in MIB or paging flags changes. UEs check and re-acquire updated blocks.

This process avoids chaos. Say, a tower adjusts power—new SIB reflects it fast. Detection via value tags keeps sync.

Smooth updates mean no service hiccups. In practice, it handles load shifts seamlessly.

Future Trends: SIBs in Non-Terrestrial Networks (NTN)

Satellites and drones bring new twists to 5G. NTN SIBs adapt for long delays, like adding timing offsets. Propagation over oceans demands beefier redundancy.

HAPS, or high-altitude platforms, use similar tweaks for wide coverage. Expect modular SIBs to flex more, supporting beamforming in skies.

As NTN grows, SIBs will evolve for global reach. Early trials show promise for remote areas.

Conclusion: SIBs as the Backbone of 5G Reliability

System Information Blocks form the quiet backbone of 5G NR networks. From SIB1’s cell entry to mobility aids in SIB3 and beyond, they ensure devices connect fast and stay put. We’ve seen how evolution from LTE brings flexibility for IoT, low latency, and broadband bursts. Scheduling and repeats add reliability, while dynamic updates keep things fresh—even eyeing sky-based futures.

Mastering SIB in 5G unlocks better network tweaks and device smarts. They uphold the promise of instant, everywhere connectivity. Next time your phone latches on without fuss, thank these blocks. Dive deeper: Experiment with open-source 5G tools to see SIBs in action, or chat with your carrier about their configs for peak performance.

November 29, 2025

5G Network Architecture

Introduction:

            In this blog, we will see 5G network architecture nodes, their functionality and interfaces between different nodes. it is vary important to know about all the nodes and their functionality to understand the whole concept of 5G architecture.

Below description is taken from 3gpp TS.

 

 

In Detailed:

 

Core network service based architecture:

 

 

 

AMF: Access and Mobility Management Function:- 
             Like in LTE MME, In NR AMF provide the similar services to the access network and core network component. general functions of AMF are to provide the mobility management, Authentication management, NAS related management to UE and SMF selection types of services.

 

=>Termination point for RAN Control Plane interfaces (NG2).

=>UE Authentication and Access Security procedures.

=>Mobility Management (handover Reach-ability, Idle/Active Mode mobility state. handling)

=>Registration Area management.

=>Access Authorization including check of roaming rights; 

=>Session Management Function (SMF) selection

=>NAS(non access stratum) signaling including NAS Ciphering and Integrity protection, termination of MM NAS and forwarding of SM NAS (NG1).

=>AMF obtains information related to MM from UDM.

=>May include the Network Slice Selection Function (NSSF) 

=>Attach procedure without session management adopted in CIoT implemented in EPC is defined also in 5GCN (registration management procedure) 

=>User Plane (UP) selection and termination of NG4 interface (AMF has part of the MME and PGW functionality from EPC.

 

AUSF: services Authentication Server Function:  The main function of AUSF is to provide the services for Authentication procedure and communicate directly with UDM and AMF for accessing and providing the subscriber information.

 

=>Contains mainly the EAP authentication server functionality 

=>Storage for Keys (part of HSS from EPC) 

=>Obtains authentication vectors from UDM and achieves UE authentication. 72 NF Repository Function (NRF) 

=>Provides profiles of Network Function (NF) instances and their supported services within the network 

=>Service discovery function, maintains NF profile and available NF instances. (not present in EPC world) NRF offers to other NFs the following services: 

=>Nnrf_NFManagement 

=>Nnrf_NFDiscovery 

=>OAuth2 Authorization Core network functions 73 Core network functions Network Exposure Function (NEF) 

=>Provides security for services or AF accessing 5G Core nodes 

=>Seen as a proxy, or API aggregation point, or translator into the Core Network 

Policy Control Function (PCF) 

 

=>Expected to have similarities with the existing policy framework (4G PCRF) 

=>Updates to include the addition of 5G standardized mobility based policies (part of the PCRF functionality from EPC) 

Session Management Function (SMF) :

=>DHCP functions 

=>Termination of NAS signaling related to session management 

=>Sending QoS/policy N2 information to the Access Network (AN) via AMF
=>Session Management information obtained from UDM 

=>DL data notification 

=>Selection and control of UP function 

=>Control part of policy enforcement and QoS. 

=>UE IP address allocation & management 

=>Policy and Offline/Online charging interface termination 

=>Policy enforcement control part 

=>Lawful intercept (CP and interface to LI System) Core network functions.

Unified Data Management (UDM) :

=>Similar functionality as the HSS in Release 14 EPC User Data Convergence (UDC) concept: separates user information storage and management from the front end 

=>User Data Repository (UDR): storing and managing subscriber information processing and network policies 

=>The front-end section: Authentication Server Function (AUSF) for authentication processing and Policy Control Function (PCF). Core network functions 

User Plane Function (UPF) :

=>Allows for numerous configurations which essential for latency reduction
=>Anchor point for Intra-/Inter-RAT mobility 

=>Packet routing and forwarding 

=>QoS handling for User Plane 

=>Packet inspection and PCC rule enforcement 

=>Lawful intercept (UP Collection) 

 Roaming interface (UP)

=>May integrate the FW and Network Address Translation (NAT) functions 
=>Traffic counting and reporting (UPF includes SGW and PGW functionalities) 

Application Functions (AF) 

=>Services considered to be trusted by the operator

=>Can access Network Functions directly or via the NEF 

=>AF can use the PCF interface PCF for requesting a given QoS applied to an IP data flow (e.g., VoIP). 

=>Un-trusted or third-party AFs would access the Network Functions through the NEF (same as AF in EPC) Network Slice Selection Functions (NSSF) 

=>Selecting of the Network Slice instances to a UE.

=>Determining the AMF set to be used to serve the UE.

=>The Application Function (AF) can be a mutually authenticated third party. – Could be a specific 3rd party with a direct http2 interface or a inter-working gateway exposing alternative API’s to external applications. 

=>Enables applications to directly control Policy (reserve network resource, enforce SLAs), create network Slices, learn device capabilities and adapt service accordingly, invoke other VNF’s within the network… 

=>Can also subscribe to events and have direct understanding of how the network behaves in relation to the service delivered.

 Data Network (DN):

 

=> Services offered: Operator services, Internet access, 3rd party.

November 29, 2025

5G(NR): UL Resource allocation

Resource allocation in time domain:

             When the UE is scheduled to transmit a transport block and no CSI the report, or the UE is scheduled to transmit a transport block and a CSI report(s) on PUSCH by a DCI, the Time domain resource assignment field value m of the DCI provides a row index m + 1 to an allocated table.

           Indexed row defines slot offset K2, the start symbol S and the allocation length L, and the PUSCH mapping type to be applied in the PUSCH transmission.

When the UE is scheduled to transmit a PUSCH with no transport block and with a CSI report(s) by a CSI request field on a DCI, the Time-domain resource assignment field value m of the DCI provides a row index m + 1 to an allocated table which is defined by the higher layer configured pusch-TimeDomainAllocationList in pusch-Config. 

=>  The slot where the UE shall transmit the PUSCH is determined by K2 as

=> where n is the slot with the scheduling DCI, K2 is based on the numerology of PUSCH,  and Mu PUSCH and Mu PDCCH are the subcarrier spacing configurations for PUSCH and PDCCH, respectively.

=> The starting symbol S relative to the start of the slot, and the number of consecutive symbols L counting from the symbol S allocated for the PUSCH are determined from the SLIV(start and length indicator value) of the indexed row:

The UE shall consider the S and L combinations defined in table 6.1.2.1-1 as valid PUSCH allocations

Determination of the resource allocation table to be used for PUSCH (6.1.2.1.1).                Table 6.1.2.1.1-1 defines which PUSCH time domain resource allocation configuration to apply. Either a default PUSCH time-domain allocation.

Default PUSCH time domain resource allocation A for normal CP: Table- 6.1.2.1.1-2: 

 According to table 6.1.2.1.1-2, is applied, or the higher layer configured pusch-TimeDomainAllocationList in either pusch-ConfigCommon or pusch-Config is applied. 

Definition of value j: Table 6.1.2.1.1-4: 

Table 6.1.2.1.1-4 defines the subcarrier spacing specific values j. j is used in the determination of in conjunction with table 6.1.2.1.1-2, for normal CP or table 6.1.2.1.1.-3 for extended CP, where is the subcarrier spacing configurations for PUSCH. 

Definition of value Delta (Δ): Table 6.1.2.1.1-5: 

       Table 6.1.2.1.1-5 defines the additional subcarrier spacing specific slot delay value for the first transmission of MSG3 scheduled by the RAR. When the UE transmits an MSG3 scheduled by RAR, the Δ value specific to MSG3 subcarrier spacing µPUSCH is applied in addition to the K2 value. 

November 29, 2025

5G(NR): Random Access Procedure

      we will discuss in this blog about the initial access procedure. it is also known as an initial cell search procedure. cell search is a procedure by which a UE can synchronize with the time and frequency of a cell and scan and get the cell id of a cell. The basic concept and procedure of cell searches are the same in any cellular communication system. so in 5G procedure is the same. 

Introduction:
RACH stands for Random Access Channel. This is the first message from UE to eNB when you power on just to get synchronized with the best listening cell. UE can apply the random access procedure by two types.

1- Contention based RACH Procedure (CBRA):

           It is a normal procedure, in this UE randomly select the preamble in zadoff chu sequence and send the RACH request towards the network. 

2- Contention Free RACH Procedure (CFRA)

          In this procedure network itself share the details of cell and preamble, by using this UE sends the RACH request towards the network. generally used in the handover scenario. 

1- Contention based RA

        In this UE randomly select the preamble( out of 64 preambles defined in each time-frequency in 5G). So there are some possibilities that multiple UEs can send the PRACH with the same preamble id. in this case same PRACH preamble can be reached to the network from multiple UEs at the same time. so at this stage PRACH collisions occur and this type of PRACH collision is called “Contention” and the RACH process that allows this type of “Contention” is called “Contention based” RACH Process.

2- Contention Free RA

     But there are some cases that these kinds of contention is not acceptable due to some reason (e.g., timing restriction), and these contentions can be prevented. in these scenarios, the Network itself informs each UE of exactly when and which preamble indexes it has to use for PRACH. Of course, in this case, the Network will allocate these preamble indexes so that it would not collide. This kind of RACH process is called the “Contention Free – CFRA” RACH procedure.

 The RA procedure is triggered for below events:

* For Initial access from RRC_IDLE

* For RRC Connection Re-establishment procedure

* For Handover (Contention Based or Non-Contetion Based)

* For DL data arrival during RRC_CONNECTED requiring random access procedure

* For UL data arrival during RRC_CONNECTED requiring random access procedure

* For SR failure (CBRA)
* For Beam failure recovery (CBRA or CFRA)

              As shown in the above figure, gNB (NR Base station) periodically transmits SS blocks carrying synchronization signals (PSS, SSS) and broadcast channels (PBCH) using beam sweeping. One SS block contains..

– 1 symbol PSS

– 1 symbol SSS

–  and 2 symbols PBCH.

 SSB carry one or multiple SS blocks. Both PSS and SSS combinations help to identify about 1008 physical cell identities.

   Now The UEs first listen to the SS Blocks and select an SS-Block(SSB) before selecting RA preamble. If available, the UE selects an SS Blocks for which the RSRP is reported above rsrp-ThresholdSSB for PRACH transmission, otherwise, UE selects any SSB.

UE always scans the radio signals and their measurements. so UE processes the beam measurements and detects the best beam during synchronization. so consecutively UE decodes 5G NR system information (MIB/SIB) on that beam. Minimum SI (System Informations) is carried onto the PBCH channel. 

Msg1 – PRACH Preamble:

UE find the good beam and during the synchronization process and uses this beam and attempts random access procedure by transmitting RACH preamble (Msg-1) on the configured RACH resource. The preamble is referenced with the Random Access Preamble Id (RAPID). The preamble transmission is a Zadoff-Chu sequence.

        The RA-RNTI associated with the PRACH occasion in which the Random Access Preamble is transmitted, is calculated as

=> RA-RNTI = 1 + s_id + 14 × t_id + 14 × 80 × f_Id + 14 × 80 × 8 × ul_carrier_Id

s_id(nStartSymbIndx): the index of the first OFDM symbol of the specified PRACH (0 <= s_id < 14). 
t_id(slot): index of the first slot symbol of the specified PRACH in a system frame (0 <= t_id < 80)  
f_id(nFreqIdx): the index of the the specified PRACH in the frequency domain(0 <= s_id < 8) 
ul_carrier_id (nULCarrier): UL carrier used for Msg1 transmission (0 = normal carrier, 1 = SUL carrier)

Above valuses are available in Rach request (PHY_LU_RACH_IND). in wiresharl logs it looks like as below.

Msg 2 – RAR (PDCCH/PDSCH ):

        After PRACH transmission, the Random Access Response procedure will happen. The gNB responds with RAR (“RA Response”) message(Msg-2). 

=>  A UE tried to find out a DCI Format 1_0 with CRC scrambled by the RA-RNTI corresponding to the RACH transmission. The UE looks for a message during a configured window of length ra-ResponseWindow. 

=>The RAR-Window is configured by rar-WindowLength IE in a SIB message and in Contention free rach procedure RAR window length IE is present in rrcReconfiguration with sync msg.

=>The RA-RNTI scrambled with DCI message signals the frequency and time resources assigned for the transmission of the Transport Block containing the Random Access Response message.

=>The UE detects a DCI Format 1_0 with CRC scrambled by the corresponding RA-RNTI and receives a transport block in a corresponding PDSCH. The RAR carries the 
     -timing advance
     -uplink grant and 
     -the Temporary C-RNTI assignment.

=>If UE successfully decoded the PDCCH, it decodes PDSCH carrying RAR data.

Following is the MAC PDU data structure that carries RAR(Random Access Response)

in Wireshark logs it RAR looks like.

Msg3 (PUSCH):         MSG 3 Transmission From UE to network, before sending Msg3(RRC Setup Request), UE needs to be determined below things

=> UEs need to determine which uplink slot will be used for sending the MSG3(RRC Setup request).

=> UEs will find out the subcarrier spacing for Msg3 PUSCH from the RRC parameter called msg3-scs (Subcarrier Spacing).

=>UEs will send Msg3 PUSCH on the same serving cell to which it sent PRACH.

As per 38.214
Table 6.1.2.1.1-5 defines the additional subcarrier spacing specific slot delay value for the first transmission of PUSCH scheduled by the RAR. When the UE transmits a PUSCH scheduled by RAR, the Δ value specific to the PUSCH subcarrier spacing μPUSCH is applied in addition to the K2 value.

let’s suppose RAR(Random access response) received at slot number 15 then-
MSG 3 Will be transmitted at = 15( RAR Slot)+ K2+Delta = 15+3+6=24

so UL_Config For MSG3 has been prepared by NR-MAC at Slot 24.

in Wireshark logs, it looks like

Msg4 – RRC Contention setup (PDCCH/PDSCH):

       After getting msg3(RRC Connection request) from the UE, the following things will happen before sending msg-4.

-Start ra-ContentionResolutionTimer

-If PDCCH is successfully decoded,

-decode PDSCH carrying the MAC CE

-Set C-RNTI = TC-RNTI

-discard ra-ContentionResolutionTimer

-consider this Random Access Procedure successfully completed

-UL Config Is being Prepared as per pusch_Configuration. 

CRC Status sent GNB – PHY to GNB-MAC is  PaSS. & UE gets attached successfully.

November 29, 2025

5G(NR): Frame structure( Slots and symbols Formats)

5G(NR): Numerologies and Frame structure( Slots and symbols Formats)

In this post, we will discuss about NR numerologies and frame structure. Numerology (3GPP term) is defined by Sub Carrier Spacing (SCS) and Cyclic Prefix (CP).

In LTE, there is no need for any specific term to indicate the subcarrier spacing because there is only one subcarrier spacing, which is 15KHz, but there are several different types of subcarrier spacing in NR.

Slot Structure:

       The transmission of Downlink and Uplink are organized into frames. Each frame is of 10-millisecond duration. Each frame is divided into 10 subframes of 1 millisecond, and the subframe is further divided into slots according to numerology.

In LTE, only 2 slots are available. But in NR, the number of slots varies according to the numerology. in 1 slot, the number of symbols are fixed that is 14-with normal cyclic prefix(CP) and 12-with extended CP. 

The following table summaries number of slots in a sub-frame/frame for each numerology with normal prefix.

Normal CP

Numerology = 0

Numerology 0 means 15 kHz subcarrier spacing. in this a sub-frame has only one slot available in it, it means that a radio frame contains 10 slots in it. The number of OFDM symbols are 14 within each slot.

 Numerology = 1

Numerology 1 means 30 kHz subcarrier spacing. in this configuration, a subframe is divided into 2 slots, it means a radio frame contains total of 20 slots in it. The number of OFDM symbols within a slot are 14 symbols.

Numerology = 2

Numerology 2 means 60 kHz subcarrier spacing. In this configuration, a subframe is divided into 4 slots, it means a radio frame contains total 40 slots in it. The number of OFDM symbols within a slot is 14 symbols.

Numerology = 3:

Numerology 3 means 120 kHz subcarrier spacing. In this configuration, a subframe is divided into  8 slots, it means a radio frame contains total 80 slots in it. The number of OFDM symbols within a slot is 14 symbols.

Numerology = 4:

Numerology 4 means 240 kHz subcarrier spacing. In this configuration, a subframe is divided into 16 slots in it, it means a radio frame contains total 160 slots in it. The number of OFDM symbols within a slot is 14-symbols.

Extended CP

Numerology = 2

In this configuration, a subframe is divided into 8 slits, it means a radio frame contains total 80 slots in it. The number of OFDM symbols within a slot are 12-symbols.

Slot Formats:

        As we have seen above a slot has fixed 14-symbols with normal CP and how these 14 symbols are getting configured during transmission, is indicated by Slot Format. A slot can be categories as downlink (all symbols are dedicated for downlink) or uplink (all symbols are dedicated for uplink) or mixed uplink and downlink transmissions.

In the case of FDD(for UL and DL there are two different carriers), all symbols within a slot for a downlink carrier are used for downlink transmissions and all symbols within a slot for an uplink carrier are used for uplink transmissions because there are two separate carriers for uplink and downlink transmitions.

TDD Slot configuration:

      5G provides a feature using which each symbol within a slot can either be used to schedule Uplink packet (U) or Downlink packet(D) or Flexible (F). A symbol marked as Flexible means it can be used for either Uplink or Downlink as per requirement.

In NR, slot format configuration can be done in a static, semi-static or fully dynamic fashion. The configuration for Slot format would be broadcast from SIB1 or/and configured with the RRC Connection Reconfiguration message. The configuration of Static and semi-static for a slot is done using RRC while dynamic slot configuration is done using PDCCH DCI.
Note that if a slot configuration is not provided by the network through RRC messages, all the slots/symbols are considered as flexible by default.

Slot configuration via RRC consists of two parts:-
 1-  Providing UE with Cell-Specific Slot format Configuration (tdd-UL-DL-ConfigurationCommon)
 2-  Providing UE with dedicated Slot format configuration (tdd-UL-DL-ConfigurationDedicated)

November 29, 2025

5G NR CORESET

            CORESET is a common resource set that is set of multiple physical resources (Specific in NR downlink resource grid) and set of parameters that are used to carry PDCCH/DCI information. The PDDCH/DCI information will be the same as LTE.                               Unlike LTE there is no PCFICH in 5G as PCFICH gives information about PDCCH OFDM symbol in the time domain and in the frequency domain, there is no need to specify as it spreads across the whole channel bandwidth.

       But in 5G, the frequency region should be specific, and It can be signaled by the RRC signaling message.

       The network can define a common control region and UE specific control region. The number of CORESET is limited to 3 per BWP (Bandwidth part) including both common and UE specific CORESET.

=> Frequency allocation in CORESET configuration can be contiguous or non-contiguous.

=> In the time domain, CORESET configuration spans 1 to 3 consecutive OFDM symbols.

=> REs in CORESET are organized in REGs (RE Groups).

=> Each REG consists of 12 REs of one OFDM symbol in one RB.

Parameters of CORESET are as follows.

The Time-domain and frequency-domain parameters of CORESET are defined in TS 38.211 document. RRC signaling message consists of the following fields.

=>  NRBCORESET: The number of RBs in the frequency domain in CORESET.
=>  NSymbCORESET: The number of symbols in the time domain in CORESET. This can be               1/2/3.
=>  NREGCORESET: The number of REGs in CORESET.
=>  L: REG bundle size

RRC parameter structure of CORESET:

1- ControlResourceID: Bit 0 identifies common coreset and bit 1 identifies coreset for dedicated signaling. This ID should be unique for all BWP.

2- FrequencyDomainResources: Each bit corresponds to the group of 6RBs in the frequency domain.

3- maxCORESETDuartion: Contiguous time duration of the CORESET in OFDM symbols.

4- CCE-REG-MappingType: Mapping Method of CCE to REG. CCE aggregation level could be 1,2.4,8 and 18.

Use of CORESET in NR PDCCH channel

         A PDCCH channel is confined to one CORESET and transmitted with its own DMRS (Demodulation Reference Signal). Hence UE specific beam-forming of the control channel is possible.

=> PDCCH channel is carried by 1/2/4/8/16 CCEs (Control Channel Elements) to carry various DCI payload sizes or coding rates.
=> Each CCE consists of 6 REGs.
=> The CCE to REG mapping for CORESET can be interleaved (to support frequency diversity) or non-interleaved (for localized beam-forming)..

November 29, 2025

UE 5G NR Search Space”

UE 5G NR Search Space.

     In this article, we will describe search space types viz. Type0, Type0A, Type1, Type2, Type3, and UE specific search space sets as defined in 5G NR standards. It mentions fields used in the Search Space information element (IE) used by the RRC layer.

Introduction:
=>It is similar to the LTE search space.
=>It is the area in the downlink frame where PDCCH might be transmitted.
=>This area has been monitored by the UE to search for the PDCCH carrying data (i.e. DCI).
=>There are two types of search spaces viz. common and UE-specific. These are mentioned in the following table.

Search Space Information Element (IE)

Following structure mentions various fields used by RRC Search Space Information Element (IE).
=> This IE defines how and where to search for PDCCH candidates.
=> Each search space is associated with one ControlResourceSet.

RRC parameters:

searchSpaceId: Identity of the search space. SearchSpaceId = 0 identifies the SearchSpace configured via PBCH (MIB) or ServingCellConfigCommon. The searchSpaceId is unique among the BWPs of a Serving Cell

controlResourceSetId : The CORESET applicable for this SearchSpace.

Value 0 identifies the common CORESET configured in MIB and in ServingCellConfigCommon

Values 1..maxNrofControlResourceSets-1 identify CORESETs configured by dedicated signalling

monitoringSlotPeriodicityAndOffset: Slots for PDCCH Monitoring configured as periodicity and offset. Corresponds to L1 parameters ‘Monitoring-periodicity-PDCCH-slot’ and ‘Monitoring-offset-PDCCH-slot’. For example, if the value is sl1, it means that UE should monitor the SearchSpace at every slot. if the value is sl4, it means that UE should monitor the SearchSpace in every fourth slot.

monitoringSymbolsWithinSlot : Symbols for PDCCH monitoring in the slots configured for PDCCH monitoring (see monitoringSlotPeriodicityAndOffset).The most significant (left) bit represents the first OFDM in a slot. The least significant (right) bit represents the last symbol. Corresponds to the L1 parameter ‘Monitoring-symbols-PDCCH-within-slot’. This indicates the starting OFDM symbols that UE should search for a search space. For example, if the value is ‘1000000000000’, it means that UE should start searching from the first OFDM symbol. if the value is ‘0100000000000’, it means that UE should start searching from the second OFDM symbol.

nrofCandidates: Number of PDCCH candidates per aggregation level. Corresponds to L1 parameter ‘Aggregation-level-1’ to ‘Aggregation-level-8’. The number of candidates and aggregation levels configured here applies to all formats unless a particular value is specified or a format-specific value is provided (see inside search space type)

search space type : Indicates whether this is a common search space (present) or a UE specific search space as well as DCI formats to monitor for

common: Configures this search space as common search space (CSS) and DCI formats to monitor.

dci-Format0-0-AndFormat1-0: If configured, the UE monitors the DCI formats 0_0 and 1_0 with CRC scrambled by C-RNTI, CS-RNTI (if configured), SP-CSI-RNTI (if configured), RA-RNTI, TC-RNTI, P-RNTI, SI-RNTI

dci-Format2-0: If configured, UE monitors the DCI format format 2_0 with CRC scrambled by SFI-RNTI

nrofCandidates-SFI : The number of PDCCH candidates specifically for format 2-0 for the configured aggregation level. If an aggregation level is absent, the UE does not search for any candidates with that aggregation level. Corresponds to L1 parameters ‘SFI-Num-PDCCH-cand’ and ‘SFI-Aggregation-Level’

dci-Format2-1 : If configured, UE monitors the DCI format format 2_1 with CRC scrambled by INT-RNTI

dci-Format2-2 : If configured, UE monitors the DCI format 2_2 with CRC scrambled by TPC-PUSCH-RNTI or TPC-PUCCH-RNTI

dci-Format2-3 : If configured, UE monitors the DCI format 2_3 with CRC scrambled by TPC-SRS-RNTI

ue-Specific : Configures this search space as UE specific search space (USS). The UE monitors the DCI format with CRC scrambled by C-RNTI, CS-RNTI (if configured), TC-RNTI (if a certain condition is met), and SP-CSI-RNTI (if configured)

November 29, 2025

5G_NR_SLIV:

SLIV is the Start and Length Indicator for the time domain allocation for PDSCH, It defines start symbol and number of consecutive symbols for PDSCH allocation. It is defined in TS 38.214 5.1.2.1 Resource allocation in the time domain as follows.

if (L-1) <= 7 then

      SLIV = 14 x (L-1) + S

else

      SLIV = 14 x (14-L+1) + (14-1-S)

          , where 0 < L <= 14 – S

                   S = Start Symbol Index

                   L = Number of Consecutive Symbols

According to the above equation, you can create a huge table with the possible S and L values. But not all the combinations are taken as valid.  Only the set of combinations meeting the condition in the following table is allowed.

< 38.214-Table 5.1.2.1-1: Valid S and L combinations >

< 38.214-Table 6.1.2.1-1: Valid S and L combinations >

The PDSCH/PUSCH mapping type in the above table is specified in RRC message as shown in below.

PDSCH-TimeDomainResourceAllocation ::=      SEQUENCE {

    k0                                  INTEGER (1..3)

    mappingType                         ENUMERATED {typeA, typeB},

    startSymbolAndLength                BIT STRING (SIZE (7))

}

PUSCH-TimeDomainResourceAllocation ::=  SEQUENCE {

    k2                                  INTEGER (0..7)

    mappingType                         ENUMERATED {typeA, typeB},

    startSymbolAndLength                BIT STRING (SIZE (7))

}

By Applying the above equation and  38.214-Table 5.1.2.1-1, I have created a big table as below.

Following is the SLIV values that I have calculated according to the given formula described above. You can use SLIV value as a key-value to find out a unique pair of (S and L) in a lookup table.

S	L	L-1	Last Symbol	SLIV	Valid Mapping Type (Normal CP) PDSCH	Valid Mapping Type (Normal CP) PUSCH
0	1	0	0	0		Type B
	2	1	1	14	Type B	Type B
	3	2	2	28	Type A	Type B
	4	3	3	42	Type A,Type B	Type A,Type B
	5	4	4	56	Type A	Type A,Type B
	6	5	5	70	Type A	Type A,Type B
	7	6	6	84	Type A,Type B	Type A,Type B
	8	7	7	98	Type A	Type A,Type B
	9	8	8	97	Type A	Type A,Type B
	10	9	9	83	Type A	Type A,Type B
	11	10	10	69	Type A	Type A,Type B
	12	11	11	55	Type A	Type A,Type B
	13	12	12	41	Type A	Type A,Type B
	14	13	13	27	Type A	Type A,Type B
1	1	0	1	1		Type B
	2	1	2	15	TypeB	Type B
	3	2	3	29	Type A	Type B
	4	3	4	43	Type A,Type B	Type B
	5	4	5	57	Type A	Type B
	6	5	6	71	Type A	Type B
	7	6	7	85	Type A,Type B	Type B
	8	7	8	99	Type A	Type B
	9	8	9	96	Type A	Type B
	10	9	10	82	Type A	Type B
	11	10	11	68	Type A	Type B
	12	11	12	54	Type A	Type B
	13	12	13	40	Type A	Type B
2	1	0	2	2		Type B
	2	1	3	16	TypeB	Type B
	3	2	4	30	Type A	Type B
	4	3	5	44	Type A,Type B	Type B
	5	4	6	58	Type A	Type B
	6	5	7	72	Type A	Type B
	7	6	8	86	Type A,Type B	Type B
	8	7	9	100	Type A	Type B
	9	8	10	95	Type A	Type B
	10	9	11	81	Type A	Type B
	11	10	12	67	Type A	Type B
	12	11	13	53	Type A	Type B
3	1	0	3	3		Type B
	2	1	4	17	TypeB	Type B
	3	2	5	31	Type A	Type B
	4	3	6	45	Type A,Type B	Type B
	5	4	7	59	Type A	Type B
	6	5	8	73	Type A	Type B
	7	6	9	87	Type A,Type B	Type B
	8	7	10	101	Type A	Type B
	9	8	11	94	Type A	Type B
	10	9	12	80	Type A	Type B
	11	10	13	66	Type A	Type B
4	1	0	4	4		Type B
	2	1	5	18	TypeB	Type B
	3	2	6	32		Type B
	4	3	7	46	Type B	Type B
	5	4	8	60		Type B
	6	5	9	74		Type B
	7	6	10	88	Type B	Type B
	8	7	11	102		Type B
	9	8	12	93		Type B
	10	9	13	79		Type B
5	1	0	5	5		Type B
	2	1	6	19	TypeB	Type B
	3	2	7	33		Type B
	4	3	8	47	Type B	Type B
	5	4	9	61		Type B
	6	5	10	75		Type B
	7	6	11	89	Type B	Type B
	8	7	12	103		Type B
	9	8	13	92		Type B
6	1	0	6	6		Type B
	2	1	7	20	TypeB	Type B
	3	2	8	34		Type B
	4	3	9	48	Type B	Type B
	5	4	10	62		Type B
	6	5	11	76		Type B
	7	6	12	90	Type B	Type B
	8	7	13	104		Type B
7	1	0	7	7		Type B
	2	1	8	21	TypeB	Type B
	3	2	9	35		Type B
	4	3	10	49	Type B	Type B
	5	4	11	63		Type B
	6	5	12	77		Type B
	7	6	13	91	Type B	Type B
8	1	0	8	8		Type B
	2	1	9	22	TypeB	Type B
	3	2	10	36		Type B
	4	3	11	50	Type B	Type B
	5	4	12	64		Type B
	6	5	13	78		Type B
9	1	0	9	9		Type B
	2	1	10	23	TypeB	Type B
	3	2	11	37		Type B
	4	3	12	51	Type B	Type B
	5	4	13	65		Type B
10	1	0	10	10		Type B
	2	1	11	24	TypeB	Type B
	3	2	12	38		Type B
	4	3	13	52	Type B	Type B
11	1	0	11	11		Type B
	2	1	12	25	TypeB	Type B
	3	2	13	39		Type B
12	1	0	12	12		Type B
	2	1	13	26	TypeB	Type B
13	1	0	13	13		Type B

November 29, 2025

PDSCH Resource Allocation in Time-Domain

5G(NR): How PDSCH Resource Allocation happened in Time-Domain.

 Introduction:

it is important for the network to tell the UE about the timing of data transmission and reception. So we use the resource allocation process for informing the UE about in which slots/symbols the data can be transmitted/received. the resource allocation can be done either dynamically or in a semi-persistent manner.

PDSCH Resource Allocation in Time-Domain

1- Dynamic Scheduling:

In Short, PDSCH is the physical channel that carries the user data. The resources allocated for PDSCH are within the bandwidth part (BWP) of the carrier, according to the TS 38.214 Section 5.1.2 [2], The resources in the time domain for PDSCH transmissions are scheduled by DCI format 1_0 and 1_1 in the field Time-domain resource assignment. This field indicates the slot offset K0, starting symbol S, the allocation length L, and the mapping type of PDSCH.

The valid combinations of S and L are shown in  below Table. For mapping type A, the value of S is 3 only when the DM-RS type A position is set to 3.

When UE is scheduled to receive PDSCH by a DCI format 1_0 and 1_1, the Time domain resource assignment field value ‘m’ of the DCI provides a row index ‘m + 1′ to an allocation table. The determination of the used resource allocation table is defined in Clause 5.1.2.1.1. The indexed row defines slot offset – K₀, the Start and length indicator ‘SLIV’, or directly the start symbol S and the allocation length L, and the PDSCH mapping type to be assumed in the PDSCH reception.

where ‘n’ is the slot with the scheduling DCI 10 and 1_1, and K₀ is based on the numerology of PDSCH, and the subcarrier spacing(SCS) configurations for PDSCH and PDCCH, respectively.

How to Determine the resource allocation table to be used for PDSCH:

1. default PDSCH time domain allocation table:   PDSCH and PUSCH scheduling is done by the combination of many different factors. But most of those factors are optional parameters which cannot be configured. Those parameters can be omitted.  If any of those parameters are omitted (not configured), then the system will get those parameters from 3gpp predefined table [38.214 v15.3 – Table 5.1.2.1.1-2,3]. These set of predefined scheduling parameters are called ‘Default’ parameter.(See in section 4 below)
2. pdsch-TimeDomainAllocationList provided in pdsch-ConfigCommon: When pdsch-TimeDomainAllocationList is configured by RRC parameters and sent in either pdsch-ConfigCommon (sent via SIB1 or dedicated RRC signalling) or pdsch-Config (sent via dedicated RRC signalling) 

Below Table define which PDSCH time domain resource allocation configuration is to apply. Either a default PDSCH time domain allocation A, B or C is to applied, or the higher layer. RRC configured pdsch-TimeDomainAllocationList is to applied.

Table 5.1.2.1.1-1: Applicable PDSCH time domain resource allocation for DCI formats 1_0 and 1_1.

=============================================================================
TimeDomainAllocationList

The PDSCH-TimeDomainResourceAllocation is an IE(Information Element) of the PDSCH-Config and PDSCH-ConfigCommon. It is defined as an element (kind of array element) of an IE called pdsch-AllocationList with RRC signaling.  Once this array(pdsch-AllocationList) is defined in RRC message, which elements of the array is used for each PDSCH scheduling is determined by the field called Time domain resource assignment in DCI 1_0 and DCI 1_1.

The pdsch-TimeDomainResourceAllocationList contains one or more (up to 16)  pdsch-TimeDomainResourceAllocations.

pdsch-TimeDomainResourceAllocationList IE structure is shown below. It contains K₀, PDSCH mapping type, and startSymbolAndLength (SLIV).

=>In pdsch-TimeDomainResourceAllocationList, upto 16 TimeDomainResourceAllocations
can be possible.(0 to 15).
=>under every TimeDomainResourceAllocations the value of K0 can be from 0 to 32 integer values, when value of K0 is absent, the UE will consider value 0.

=> startSymbolAndLength(SLIV) :SLIV is the Start and Length Indicator for the time domain allocation for PDSCH, It defines start symbol ‘S’ and number of consecutive symbols (Length= ‘L’)for PDSCH allocation.

According to the above equation, you can create a huge tables with all the possible S and L values. But not all of the combinations are considered as valid.
The UE shall consider the ‘S’ and ‘L’ combinations defined in table 5.1.2.1-1 satisfying for normal cyclic prefix(CP) and for extended cyclic prefix(EP) as valid PDSCH allocations:

=====================================================================

PDSCH mapping type:

Both PDSCH and PUSCH has two different types of mapping called Type A and Type B. These types are characterized by DMRS type (PDSCH DMRS type and PUSCH DMRS type) and SLIV table as shown below.

< 38.214-Table 5.1.2.1-1: Valid S and L combinations >

PDSCH mapping type A:

=> PDSCH DMRS is Type

–>The DMRS location is fixed to 3rd (pos2) or 4th(pos3)

=> PDSCH Starting Symbol can be 0~3

=> PDSCH Length can be 3~14 in case of normal CP and 3~12 in case of extended CP

=> the DMRS symbol can start only at symbol 2 or 3 regardless of PDSCH start and length. It implies this cannot be used when PDSCH start symbol is greater than 3. This is related to the row ‘Type A’ in PDSCH SLIV table. This type is used for slot based scheduling.

PDSCH mapping type-B:

=> PDSCH DMRS is Type B

–>The DMRS location is fixed to the first symbol of the allocated PDSCH

=> PDSCH Starting Symbol can be 0~12 in case of Normal CP and 0~10 in case of extended CP

=> PDSCH Length can only be 2 or 4 or 7 in case of Normal CP and 2 or 4 or 6 in case of extended CP

=> The DMRS symbol can start at the first PDSCH symbol regardless of PDSCH start. This is related to the row ‘Type B’  in PDSCH SLIV table. This type is used for mini-slot based scheduling.

2- Semi-Persistent Scheduling:

Under downlink SPS, PDCCH carrying DCI 1_0 and 1_1 is addressed to Configured Scheduling-RNTI (CS-RNTI). In LTE, SPS-C-RNTI is used for this purpose. CS-RNTI is used to configured downlink assignment.

As shown in picture below, SPS in downlink assignment is configured by the network to the UE, and UE stores this assignment and uses it according to the pre-configured timing given by the network in RRC signaling messages.

Once SPS is configured, UE will start monitoring the PDCCH because the time-domain resource allocation is done using PDCCH DCI (format 1_0 or 1_1) addressed to CS-RNTI. Even for re-transmissions, PDCCH DCI 1_0 or 1_1 addressed to CS-RNTI is used.

Once network configured time domain resource allocation using DCI 1_0 or 1_1, the UE periodically uses same time-domain resources until the gNB(MAC) re-transmit PDCCH with new configuration to the UE.

Configure CS for Downlink / SPS

3-Slot Aggregation:

Some time when UE is in bad radio network coverage (far from the network base station or you can say cell edge area) then the big possibility of incorrect PDCCH decoding. so in such scenario the network transmit the PDSCH in consecutive slots  instead of waiting confirmation from the UE.

=> PDSCH AggregationFactor is a mechanism that one DCI can schedule multiple consecutive downlink slots for PDSCH.
=> The number of the consecutive slots can be 2 or 4 or 8. The number of slots can be determined by the RRC parameter pdsch-AggregationFactor.

In second step, network sends DCI format 1_1 on PDCCH with CRC scrambled with C-RNTI, MCS-C-RNTI, or CS-RNTI.

After slot aggregation is activated, the UE follows the below procedures….

=>    When the MAC entity is configured with pdsch-AggregationFactor > 1, the parameter pdsch-AggregationFactor provides the number of transmissions of a TB within a bundle

=>    After the initial transmission, pdsch-AggregationFactor – 1 HARQ retransmissions follow within a bundle.

=>    Same HARQ process is used for each transmission that is part of the same bundle.

=>    The UE may expect the same symbol allocation across the PDSCH-AggregationFactor consecutive slots i.e., the network shall repeat the same TB across the PDSCH-AggregationFactor consecutive slots applying the same symbol allocation in each slot.
=>    The redundancy version to be applied on the n^th transmission occasion of the TB, where n = 0, 1, … (PDSCH-AggregationFactor – 1), is determined according to table below.

4- Default PDSCH time-domain allocation tables:

PDSCH and PUSCH scheduling is done by the combination of many different factors. But most of those factors are optional parameters that cannot be configured. Those parameters can be omitted.  If any of those parameters are omitted (not configured), then the system will get those parameters from 3gpp predefined table [38.214 v15.3 – Table 5.1.2.1.1-2,3]. These sets of predefined scheduling parameters are called the ‘Default’ parameter.

The Default PDSCH time domain resource allocation A for normal CP and extended CP.

=> 38.214 v15.3 – Table 5.1.2.1.1-4: Default PDSCH time domain resource allocation B.

=> 38.214 v15.3 – Table 5.1.2.1.1-5: Default PDSCH time domain resource allocation C

November 29, 2025

5G-NR: MIB

Introduction:

                   When the UE switches on, it starts listening to the SSB(PSS/SSS/PBCH) for time and frequency synchronization with a cell and to detect Physical layer Cell ID (PCI) of the cell and tried to get the system information. After the successful cell setup gNB always broadcasting the MIB On SSBs occasions. MIB is the part on SSB.

PBCH carries system information, such as Master Information Block, SSB Index.

MIB:

MIB (Master information block) includes the system information and always transmitted on the BCH from network to UE with a periodicity of 80 ms and repetitions made within 80 ms.

it also includes the parameters that are needed to acquire/decode the SIB1 from the cell.

The first transmission of the MIB is scheduled in subframes defined by [TS 38.211, 7.4.3.2] and repetitions are scheduled according to the period of SSB;

It uses QPSK modulation for transmission from the network to UE It is transmitted on OFDM symbol 1,2,3.

RRC parameters of MIB:

NR PBCH under SSB:

MIB ::=                             SEQUENCE {

systemFrameNumber                          BIT STRING (SIZE (6)),

subCarrierSpacingCommon             ENUMERATED {scs15or60, scs30or120},

ssb-SubcarrierOffset                            INTEGER (0..15),  è offset in number of sub carrier between SSB(RB-0) and OffsetToPointA.

dmrs-TypeA-Position                           ENUMERATED {pos2, pos3},

pdcch-ConfigSIB1                                  PDCCH-ConfigSIB1,

cellBarred                                                 ENUMERATED {barred, notBarred},

intraFreqReselection                           ENUMERATED {allowed, notAllowed},

spare                                                           BIT STRING (SIZE (1))

}

Description if parameters:

systemFrameNumber:

The 6 most significant bit (MSB) of the 10-bit System Frame Number. The 4 LSB of the SFN is conveyed in the PBCH transport block as part of channel coding (i.e. outside the MIB encoding).

subCarrierSpacingCommon

Subcarrier spacing for SIB1, Msg.2/4 for initial access and broadcast SI-messages. If the UE acquires this MIB on a carrier frequency <6GHz, the value scs15or60 corresponds to 15 Khz and the value scs30or120 corresponds to 30 kHz. If the UE acquires this MIB on a carrier frequency >6GHz, the value scs15or60 corresponds to 60 Khz and the value scs30or120 corresponds to 120 kHz.

ssb-SubcarrierOffset

Corresponds to k_SSB (see TS 38.213 [13]), which is the frequency domain offset between SSB and the overall resource block grid in the number of subcarriers. (See 38.211).

The value range of this field maybe extended by an additional most significant bit encoded within PBCH as specified in 38.213 [13].

This field may indicate that this beam does not provide SIB1 and that there is hence no common CORESET (see TS 38.213 [13], section 13). In this case, the field pdcch-ConfigSIB1 may indicate the frequency positions where the UE may (not) find a SS/PBCH with a control resource set and search space for SIB1 (see 38.213 [13], section 13)

dmrs-TypeA-Position

Position of (first) DM-RS for in downlink (see 38.211, section 7.4.1.1.1) and in uplink (see 38.211, section 6.4.1.1.3).

cellBarred indicates whether the cell allows UEs to camp on this cell as per specification TS 38.304

intraFreqReselection indicates if Intra frequency cell reselection is Allowed or notAllowed. It controls cell reselection to intra-frequency cells when the highest ranked cell is barred, or treated as barred by the UE as specified in TS 38.304

The call flow of MIB and SIB:

NR and LTE comparison:

November 29, 2025

5G NR: DCI Formats

Introduction: 

         In this blog of our 5g series, we discussed downlink control information or DCI. we will look at its content on how it is encoded and modulated then mapped to the 5g new radio slot etc.

 

 

DCI: 

=> downlink control information or DCI carries control information used to schedule user data PD-SCH on the downlink and PU SCH on the uplink.

 

=> it is carried by the PDC CH or physical downlink control channel.

 

=> it indicates the location in time and frequency of the data that is scheduled for transmission.

 

=> the modulation and coding schemes used the number of antenna ports or layers as well as other aspects such as HARQ.

 

=> the user equipment needs to decode the DCI before they can decode downlink data or transmit uplink data depending on the content of the DCI.

 

=> one or more of several formats can be used.

 

 

 

 

 => Format 0 is for uplink grant meaning that it contains information that pertains to data the UE is about to transmit on the uplink.

 

=> Format 1 is for downlink allocation this means it includes information about the way data was sent to the UE.

 

=>For both uplink and downlink information there are two possible formats one with

underscore zero(0) and one with an underscore one(1).

 

=> The format with underscore zero is called the fallback format it is more compact than the full format with underscore one because it doesn’t include all options and therefore it trades off less scheduling flexibility for reduced control overhead.

 

=> finally format 2 addresses the information needed for groups of UEs and TPC commands.

 

=> Downlink control information uses polar code for error protection this is the main difference with encoding in LTE where tell binding convolutional encoding was used.

 

=> another difference with LTE where that the CRC used here is longer at 24 bits instead

of 16 for LTE.

=> the CRC value is crumbled with a UE identifier called the radio network temporary identifier(RNTI) in order to indicate that which UE the message is intended for.

 

=> After encoding downlink control information is scrambled with QPSK modulated and mapped to resource blocks with a very specific pattern.

 

=>UE must look for PDCCH and decode the PDCCH to get the required DCI information for further processing.

 

 

 

=> There are several significant differences with LTE:

1-  first the PDC CH may not spend the complete 5g bandwidth whereas in LTE it always does this. it is important because of the bandwidth may be much larger up to 400 Mhz in 5g and UEs in 5G or not required to support large bandwidth.

 

2- PDCCH in 5g supports device-specific beamforming this means, control information can be beamed toward a particular UE, this is possible because of the PDCCH has associated DMRS or demodulation reference symbols which undergo the same beamforming. it is similar to the concept of EPDCCH that was introduced late in LTE deployment.

    

 note that P DCCH is mapped to a corset or control resource set a concept that defines the location of a control region within the 5G resource grid.

 

Examples:

let us now look at two concrete examples of DCI usage first for downlink data scheduling.

 

For Downlink:

 

 

 

=>  The UE looks for the pc CH and if a match is found meaning that a block decoded with a CRC that matches the RNTi of a UE. it passes the DCI and extracts all information about where in time and frequency data is located and how data was sent to the UE, with this information, the UE can grab the relevant parts of the 5g grids.

 

=>Performs channel estimation equalization inverse rate matching and decoding to

retrieve the downlink data packet.

 

For uplink:

 

 

 

 

 

 => for the uplink transmission downlink control information carrying an uplink grant. comes in response to a scheduling request from the UE when the gNB received the scheduling request, it makes all the decisions about when and how the UE should transmit the data that is ready for transmission.

 

=> Those parameters include beside the time and frequency location and modulation and coding scheme other information such as precoding which comes in the form of an index that points to a table of possible precoding matrices.

 

=>After decoding the control information for the uplink grant remember this would be format 0_0 and format 0_1. The UE transmits uplink data according to those parameters.

 

=> To understand how downlink information is mapped to the 5g grid, we must introduce two new concepts.

1- resource element groups
2- control channel elements or CCE

1-Resource element group:
    The resource element group is simply a block of 12 resource elements by one symbol. this is the basic unit used to define CCEs.

 

 

 

2- control channel elements or CCE

 

 

 

=> one control channel element corresponds to six resource element groups this means that one CCE includes six times 12 resource elements that equals 72.

1CCE = 6×12 = 72 resource elements

 

54 are available for the PDCCH itself.

18 are reserved for associated DMRS or demodulation reference symbols.

 

 =>one PDCCH is mapped to one or more CCEs. the standard defines several aggregation

levels as in LTE except for the introduction of a new level of 16 which was not available in LTE. 

 

=> The higher the aggregation level the more resources are used but the more possibility for redundancy enhance.

November 29, 2025

5G-NR: Carrier Aggregation (CA)

Description:

        when there is no CA in the picture,  UE will receive and transmit data on a single carrier, this carrier is called primary component carrier and the corresponding cell is called a primary serving cell. In case of carrier aggregation, one or more component carriers are aggregated with the primary component carrier in order to support wider transmission bandwidth. 

 

Carrier Aggregation:

       Carrier Aggregation feature is introduced in the initial version of Release-15 of 3GPP Specifications. 5G New Radio uses carrier aggregation of multiple Component Carriers (CCs) to achieve high-bandwidth transmission (and hence high data rate). 

 

In LTE, you can aggregate a maximum up to five carriers that is one primary component carrier and four secondary component carriers. But in 5G NR supports aggregation of up to 16 components carriers.

 

    Carrier aggregation is designed to support aggregation of a variety of different arrangements of CCs, including CCs of the same or different bandwidths, adjacent or non-adjacent CCs in the same frequency band, including CCs of the same or different numerologies and CCs in different frequency bands. Each CC can take any of the transmission bandwidths, namely (5, 10, 15, 20, 25, 30, 40, 50, 60, 80, 90, 100) MHz for FR1 & (50, 100, 200, 400) MHz for FR2 respectively.

 A UE that is configured for carrier aggregation connects to one Primary Serving Cell (known as the ‘PCell’ in MCG or ‘PSCell’ in SCG) and one or more Secondary Serving Cell (known as ‘SCell’).

All RRC connections and Broadcast signalings are handled by the Primary serving cell. The primary Serving cell is the master of the whole procedure. Primary serving cell decides that which serving cell need to be aggregated or added and deleted from the Aggregation.

 

      
Now we will look into the role of Primary serving cell and secondary serving cell in terms of carrier aggregation.

1- Role of Primary serving cell: followings are the role of primary serving cell.

=> Dynamically add or remove the secondary component carriers.
=> Dynamically activate and deactivate the secondary cell.
=> Handle all RRC(Radio resource control) and NAS(non-access stratum) procedures.
=> Receive measurement reports and control mobility of UE.

Note: Primary serving cell can be changed only at the time of handover.


2- role of Secondary serving cell: followings are the role of secondary serving cell.

=> An UE can aggregate maximum up to 16 component carrier where 1 is primary component carrier and 15 are secondary component carrier. (In case of LTE it is 1PCC and 4 SCC).
=>Actual number of secondary serving cell that can be allocated to UE is dependents on UE capability.

Note: It is not possible to configure an UE with more UL CCs than DL CCs, while revere of this can be possible.

==================================================================
There are mainly three ways by which component carriers can be allocated.

1- Intra Band Contiguous:
In this Primary component carrier and secondary component carrier is configured with same band but they are contiguous.

2- Intra Band Non-Contiguous:

In this Primary component carrier and secondary component carrier is configured with same band but they are not contiguous.

3-inter band Contiguous:

In this Primary component carrier and secondary component carrier  are allocated on two frequency band.

By using the above configuration, infinite combinations are possible. But 3GPP has defined allowed combinations

Denoting Band combination:

CA_X:

        Denotes intra band contiguous CA

        e.g CA_10(band)

CA_X-X:

        Denotes intra band non-contiguous CA

        e.g CA_10-10

CA_X-Y:

        Denotes inter band contiguous CA

        e.g CA_10-20

Precondition for CA:

     UE can be configured CA only when it is capable to support CA. UE informs its  capability to the network during registration procedure in “UE capability information” message to network.

November 29, 2025

5G-NR: Channels

November 29, 2025

5G-NR: SIGNALLING RADIO BEARERS

November 29, 2025

5G NR Bandwidth Part (BWP)

Introduction:

            A Bandwidth Part is a set of contiguous Common Resource Blocks. A Bandwidth Part may include all Common Resource Blocks within the channel bandwidth, or a subset of Common Resource Blocks

=>    Bandwidth Parts are an important aspect of 5G because they can be used to provide services to UE which do not support the full channel bandwidth, i.e. the Base Station and UE channel bandwidth capabilities do not need to match.

      ->For example, a Base Station could be configured with a 400 MHz channel bandwidth, while a UE may only support a 200 MHz channel bandwidth. In this case, the UE can be configured with a 200 MHz Bandwidth Part and can then receive services using a subset of the total channel bandwidth.

=> A UE can be configured with up to 4 downlink Bandwidth Parts per carrier and up to 4 uplink Bandwidth Parts per carrier. Only a single Bandwidth Part per carrier can be active in each direction. A UE receives the PDCCH and POSCH only within an active downlink Bandwidth Part. A UE transmits the PUCCH and PUSCH only within an active uplink Bandwidth Part. A UE can complete measurements outside the active bandwidth part but this can require the use of Measurement Gaps.

     Below Figure illustrates some example Bandwidth Part allocations for an operator using 2 x 400 MHz RF carriers. These examples illustrate the flexibility which Bandwidth Parts allow when configuring frequency domain resources.

=> the first UE is assumed to support the complete 400 MHz channel bandwidth and inter-band Carrier Aggregation

=> the second UE is assumed to support inter-band Carrier Aggregation but a maximum channel bandwidth of200 MHz

=> the third UE is assumed to support both inter and intra-band Carrier Aggregation with a maximum channel bandwidth of200 MHz. This combination allows the UE to use all 800 MHz of spcctrum simultaneously, i.e. a single active Bandwidth Part per Component Carrier.

=> the fourth VE is also assumed to support both inter and intra-band Carrier Aggregation. However, this UE is assumed to support a maximum channel bandwidth of 100 MHz and is configured with multiple Bandwidth Parts per Component Carrier

=> the fifth UE is assumed to support only one of the two operating bands and a maximum channel bandwidth of200 MHz. For the purposes of this example, the UE is allocated only a single Bandwidth Part to illustrate that the set of allocated Bandwidth Parts do not have to cover the complete channel bandwidth.

UE 1 configured with:

2 Camponent Carriers (inter-band Carrier Aggregation).

Single Bandwidth Part per Carrier

 UE 2 configured with:

2 Component Carriers (inter-bond Carrier Aggregation)

2 Bandwidth Parts per Carrier

UE 3 configured with:

4 Campanent Carriers (intra & inter-band Carrier Aggregation)

Single Bandwidth Parts per Carrier

UE 4 configured with:

4 Camponent Carriers (intra & inter-band Carrier Aggregation)

Up to 4 Bandwidth Parts per Carrier

UE 5 configured with:

1 Component Carrier

1 Bandwidth Part

In above Figure, the second and third UE appear to have very similar configurations, i.e. both UE arc configured with 2 x 200 MHz Bandwidth Parts within each operating band. The second UE is configured with 2 Component Carriers and 2 Bandwidth Parts per carrier, whereas the third UE is configured with 4 Component Carriers and I Bandwidth Part per Carrier. This difference in configuration has implications upon some lower level procedures and also the RF performance requirements.

=> at the MAC layer there is a HARQ entity for each serving ce:11. The second UE which is configured with 2 Component Carriers would have 2 HARQ entities and HARQ re-transmissions can be switched between Bandwidth Parts by dynamically changing the active Bandwidth Part (field within the PDCCH DC] can be used to change the active Bandwidth Part). The third lJE which is configured with 4 Component Carriers would have 4 HARQ entities and HARQ re-transmissions cannot be switched between Component Carriers.

=> RF performance requirements such as out-of-band emissions are specified per carrier rather than per Bandwidth Part. This means that the second UE has to achieve its RF requirements at the edge of each 400 MHz carrier, while the third UE has to achieve its

RF requirements at the edge of each 200 MHz carrier.

BWP Types:

 

    A UE uses an ‘Initial’ Bandwidth Part when first accessing a cell. The Initial Downlink Bandwidth Part can be signalled within SIB-1 using the inilia/DownlinkBWP parameter structure presented in below table. This parameter structure uses the  locationAndBandwidth information element to specify the set of contiguous Common Resource Blocks belonging to the Initial Downlink Bandwidth Part. The value is coded using Resource Indication Value (RIV) rules with N size of BWP = 275 (these rules are described in section 3.6.4.2.2 within the context of allocating Resource Blocks for the POSCH). The RB start value which is derived from the locationAndBandwidth value is

added to the offsetToCarrier value  i.e. the starting position of the Bandwidth Part is relative to the first usable Resource Block. The initia/DownlinkBWP parameter structure also specifics the subcarrier spacing to be used for the Bandwidth Part and provides the UE with cell level information for receiving the PDCCH and PDSCH.

The initial Downlink BWP parameter structure can also be provided to the UE using dedicated signalling. If the parameter structure is not provided to a UE then the Initial Downlink Bandwidth Part is defined by the set of Rcsource Blocks belonging to the Control

Resource Set (CORESET) for the Type O PDCCH Common Search Space. These Resource Blocks can be deduced from information within the MIB.

Information regarding the Initial Uplink Bandwidth Part can also be signalled within SIB-1 or by using dedicated signalling.

The Base Station can use dedicated signalling to configure up to 4 Downlink Bandwidth Parts per cell and up to 4 Uplink Bandwidth Parts per cell. The parameter structure used to configure a Downlink Bandwidth Part. The Initial Bandwidth Part is referenced using an identity of 0, whereas other Bandwidth Parts are allocated an identity within the range 1 to 4

=> In the case of TDD, an Uplink and Downlink Bandwidth Part with the same bwp-ld share the same center frequency

=> The Base Station can dynamically switch the Active Bandwidth Part using the Bandwidth Part Indicator field within DCI Formats 0 and 1_1. The switching procedure is not instantaneous so the Base Station cannot allocate resources immediately after changing the Active Bandwidth Part. The switching delay is specified within 3GPP TS 38.133.

=> A UE can also be configured with a Default Downlink Bandwidth Part (identified using defaultDownlinkB WP-Id which points to one of the configured hwp-id values). If a UE is not explicitly provided with a Default Downlink Bandwidth Part then it is assumed to be

the Initial Downlink Bandwidth Part.

=> If a UE is configured with a bwp-lnactivityTimer then the UE switches back to the Default Downlink Bandwidth part after the inactivity timer has expired while using a non-Default Downlink Bandwidth Part.

November 29, 2025

5G(NR)-GUTI, SUPI, SUCI

 5G-GUTI,

The 5G Globally Unique Temporary Identifier (5G-GUTI) is allocated by the AMF. It is a temporary identity so it docs not have a fixed association with a specific subscriber nor device. The use of a temporary identity helps to improve privacy. The AMF can change the allocated 5G-GUTI at any time.

The structure of the 5G-GUTI is illustrated in Figure below. It is a concatenation of the Globally Unique AMF Identifier (GUAMI) and 5G-TMSI.

The GUAMI is a concatenation of the PLMN Identity and the AMF Identifier. Inclusion of the GUAMI allows identification of thc AMF which allocated the 5G-GUTI. The 5G-TMSI identifies the UE within that AMF.

3GPP has specified a mapping between the 5G-GUTI and the 4G-GUTI. This mapping is used when a UE moves between technologies. For example, when a UE moves from 5G to 4G and is required to send a GUTI to the MME, then the UE maps the 5G-GUTI onto the 4G-GUTI and forwards it to the MME. The MME can then complete the reverse mapping to identify the AMF that it needs to contact in order to retrieve the UE context. Similarly, when a UE moves from 4G to 5G then the 4G-GUTI can be mapped onto the 5G-GUTI and sent to the AMF. The AMF can then extract the MME Identity and subsequently request the UE context.

SUPI & SUCI:

 

A 5G Subscription Permanent Identifier (SUPI) can be either:

•   An International Mobile Subscriber Identity (IMSI)
•   A Network Access Identifier (NAI)

A Subscription Concealed Identifier (SUCI) allows the SUPI to be signalled without exposing the identity of the user.

Signalling procedures use the SUCI rather than the SUPI to provide privacy. For example, the ‘5GS Mobile Identity’ within NAS signalling procedures can be based upon a SUCI (alternatively, the ‘5GS Mobile Identity’ can be an IMEI, IMEISY, 5G-GUTI or 5G-S-TMSI)

* The SUCI uses a ‘Protection Scheme’ which can be set to ‘null’ in which case the SUPI is visible within the message. These protection schemes are used to encrypt the SUPI prior to including within the message.

November 29, 2025

MSG1 – PRACH in 5G NR:

What is MSG1 in 5G?

November 24, 2025

5G (NR): DAPS Handover

Introduction to DAPS Handover 

In this article, we will discuss the basics of DAPS (Dual Active Protocol Stack) Handover in 5G networks.

What is DAPS Handover?

DAPS (Dual Active Protocol Stack) handover is a handover procedure designed to minimize interruption during the transition between cells. In this mechanism, the User Equipment (UE) maintains the source gNB configuration even after receiving the Handover Command and continues using it until the Random Access (RACH) procedure at the target gNB is successfully completed.

 Key Characteristics of DAPS Handover:

• UE continues transmission (TX) and reception (RX) on the source cell after receiving the handover request.

• UE performs simultaneous reception of user data from both source and target cells.

• UE switches uplink (UL) transmission to the target cell after completing the RACH procedure.

• DAPS reduces handover interruption time to almost 0 ms by maintaining the source radio link while establishing the target radio link.

• DAPS handover is supported over both Xn and NG interfaces.

• It can be used for RLC AM (Acknowledged Mode) or RLC UM (Unacknowledged Mode) bearers.

• Downlink Data Forwarding is mandatory during a DAPS Handover

NG-Based DAPS Handover Call Flow:

Step 1: UE sends a Measurement Report to the Source CU, which decides whether to perform a Normal or DAPS Handover.

Step 2: Source CU sends F1AP: UE Context Modification Request to the Source DU with IE gNB-DUConfigurationQuery = TRUE.

Step 3: Source DU responds with UE Context Modification Response including Cell Group Configuration.

Step 5: AMF forwards NGAP: Handover Request to Target CU with the same DAPS Request Information.

Step 6: Target CU sends F1AP: UE Context Setup to Target DU along with Handover Preparation Information.

Step 7: Target DU responds with UE Context Setup Response including Cell Group Configuration.

Step 8: Source CU sends NGAP: Handover Request Acknowledge to AMF with RRC Reconfiguration and DAPS Response Information.

Step 9: AMF sends NGAP: Handover Command to Source CU with the same RRC Reconfiguration and DAPS details.

Step 10: Source CU forwards F1AP: UE Context Modification to Source DU with RRC Container (HO Command) and DAP_HO_Status = Initiation.

Step 11: UE receives HO Command and performs RACH procedure at Target Cell while still receiving DL data from Source gNB.

Step 12: Source CU sends NGAP: Uplink Early Status Transfer to AMF, which forwards it to Target CU as NGAP: Downlink Early Status Transfer.

Step 13: After completing RACH, UE sends RRC Reconfiguration Complete to Target Node and switches UL data to Target gNB.

Step 14: Target CU sends NGAP: Handover Notification to AMF with IE Notify Source NG-RAN Node.

Step 15: AMF sends NGAP: Handover Success to Source CU.

Step 16: Source CU sends F1AP: UE Context Modification to Source DU with TransmissionActionIndication = Stop, stopping DL data transmission.

Step 17: Source CU sends NGAP: Uplink Status Transfer to AMF, which forwards it to Target CU via Downlink Status Transfer.

Step 18: AMF sends NGAP: UE Context Release to Source CU, which clears the UE context and responds.

Step 19: Target CU sends RRC Reconfiguration to UE with daps-SourceRelease and UE responds with RRC Reconfiguration Complete

November 24, 2025