PDCCH, PCFICH, PHICH & DCI Formats in LTE 4G

Introduction

The downlink control region is the LTE physical layer's dispatcher. In every 1 ms subframe, before any user data can be touched, the UE must read a compact set of control channels at the very front of the subframe to learn three things: how large the control region itself is, whether its last uplink transmission was acknowledged, and whether — and where — there is data scheduled for it right now. Those answers come from PCFICH, PHICH and PDCCH respectively, and the scheduling decisions ride the PDCCH as DCI (Downlink Control Information) messages defined in TS 36.212.

This machinery runs continuously the entire time a UE is camped on or connected to a cell. A UE in RRC_IDLE monitors the common part of the PDCCH for paging and system-information grants; a UE in RRC_CONNECTED additionally monitors a UE-specific part for its own dynamic grants, every subframe, both downlink and uplink. Nothing on the shared data channels is self-describing, so this control layer is what turns raw resource elements into an addressable, scheduled network.

Because the shared channels carry no header of their own, an error here is expensive: miss the control-region size and the whole subframe is lost; miss a grant and a transport block goes unscheduled. That is why every element in this region — the CFI codeword, the CRC scramble, the aggregation level — is built for robustness and unambiguous addressing.

Why the control region is needed

Concretely, three problems must be solved before the shared downlink and uplink channels can be used at all. First, the control region has a variable size, so the UE must be told each subframe how many symbols to skip before the data begins — that is the job of PCFICH. Second, LTE's uplink uses synchronous HARQ, so the UE needs a cheap, fixed-timing acknowledgement channel to know whether to retransmit its last PUSCH — that is PHICH. Third, the shared channels carry no self-describing header, so every grant must be signalled explicitly: which resource blocks, which modulation and coding, which HARQ process, addressed to a specific UE — that is the DCI on PDCCH.

The downlink control region

Every LTE downlink subframe is split in time into a control region at the front and a data region that follows. The control region occupies the first 1, 2, or 3 OFDM symbols — and up to 4 symbols in the narrowest 1.4 MHz bandwidth, where there are only 6 resource blocks to spread the control channels across — and it spans the whole carrier in frequency. Three physical channels share this region, and the UE must read them in a particular order: the control region is where scheduling happens, and until the UE has decoded it, it does not know whether there is any data for it at all.

The order matters because the three channels are not independent. PCFICH defines the boundary; PHICH resources are then mapped in at positions the UE derives from that boundary and its earlier uplink grant; only the resource elements left over then carry PDCCH. So a subframe heavy on PHICH feedback leaves fewer CCEs for grants — the three channels compete for one small pool of resource elements.

PCFICH and the CFI

The Physical Control Format Indicator Channel, PCFICH, answers one question: how many OFDM symbols does the control region occupy in this subframe? It carries the CFI (Control Format Indicator), a value of 1, 2, or 3. Because the size of the control region can change subframe by subframe as scheduling load varies, the UE cannot assume a fixed value — it must decode PCFICH every subframe before it can even locate the PDCCH symbols.

The PCFICH is always mapped to a fixed set of four resource-element groups spread evenly across the whole bandwidth in the first OFDM symbol of the subframe, so it is always in a known place regardless of how large the control region turns out to be. Its 2-bit CFI value is expanded into a 32-bit codeword for robustness, because a misread CFI is catastrophic: if the UE gets the boundary wrong, it misplaces the start of the data region and loses the entire subframe, control and data alike. To guard the four PCFICH groups against a bad frequency-selective fade, they are quadrature-spaced across the band.

The mapping between the CFI value and the actual number of symbols depends on bandwidth. In wider bandwidths the CFI value equals the number of control symbols directly. In the 1.4 MHz case (6 resource blocks), one extra symbol is needed to fit the same control information into so few subcarriers, so each CFI value maps to one symbol more than its nominal number.

PHICH: HARQ feedback for the uplink

The Physical HARQ Indicator Channel, PHICH, carries a single bit per uplink transport block: an ACK or NACK telling the UE whether its earlier PUSCH transmission was decoded correctly by the eNB. This is one of the defining features of LTE's uplink design. LTE uses synchronous HARQ in the uplink, meaning retransmissions happen at fixed, predictable timing (8 subframes later in FDD) rather than being freely scheduled. A NACK on the PHICH is therefore enough on its own to trigger a non-adaptive retransmission — the UE already knows exactly when to resend and on which resources, so no explicit uplink grant is required.

Because many UEs may need feedback in the same subframe, PHICHs are organised into PHICH groups. Within a group, the individual one-bit acknowledgements for different UEs are kept apart by orthogonal sequences (orthogonal spreading codes): several UEs share the same set of resource elements but each uses a different orthogonal sequence, so the group multiplexes multiple ACK/NACKs onto the same physical resource. A single PHICH is identified by the pair (PHICH group index, orthogonal sequence index within the group).

The UE never receives an explicit pointer to its PHICH. Instead it derives its PHICH resource implicitly from two things it already knows: the index of the lowest resource block of its PUSCH grant, and the DMRS cyclic-shift value that was signalled in the uplink grant (DCI 0). This implicit mapping is a neat trick — it addresses per-UE feedback without spending any extra downlink signalling bits, and it automatically spreads UEs scheduled on different RBs onto different PHICH groups.

The number of PHICH groups in a subframe is broadcast in the MIB via the parameter Ng (one of 1/6, 1/2, 1, 2), which scales the group count with the system bandwidth. PHICH also has a duration: normal PHICH occupies only the first OFDM symbol, while extended PHICH spreads each group's resources across the first two or three symbols for extra robustness (useful in large cells or poor channels, and mandatory in some MBSFN and TDD special-subframe configurations). Normal versus extended duration is also signalled in the MIB.

PDCCH structure: REG, CCE, coding, and aggregation

The Physical Downlink Control Channel, PDCCH, is the channel that actually carries the scheduling grants (DCI). It is built from a small hierarchy of resource units. The smallest is the Resource Element Group (REG), a cluster of 4 usable resource elements (contiguous in frequency within one symbol, excluding any REs taken by reference signals). Nine REGs are grouped into one Control Channel Element (CCE) — so one CCE equals 36 resource elements, which after QPSK modulation carries 72 coded bits.

Before a DCI reaches those resource elements it is channel-coded. The eNB attaches a 16-bit CRC to the DCI payload, then scrambles (XORs) that CRC with the target UE's RNTI. The result is encoded with a rate-1/3 tail-biting convolutional code — tail-biting is used rather than the turbo code of the data channel because DCI payloads are short (tens of bits) and tail-biting avoids the overhead of terminating tail bits. Rate matching then trims the coded bits to fit exactly the number of resource elements chosen by the aggregation level.

A single PDCCH is made from 1, 2, 4, or 8 contiguous CCEs. This count is called the aggregation level. A UE with a strong channel can be reached with aggregation level 1 (just one CCE, 72 coded bits), while a UE at the cell edge needs level 8 to spread the same DCI over eight times as many resources for extra coding protection. The eNB chooses the aggregation level to match the UE's radio conditions; the UE does not know it in advance and must try several during blind decoding.

To spread each PDCCH's energy across the band for frequency diversity, the CCEs are not laid down in simple order: all REGs in the control region are first interleaved and cyclically shifted by the cell ID, so a single CCE's REGs are scattered across the whole bandwidth. This is why a fade in one part of the band cannot wipe out a whole PDCCH.

Search spaces, blind decoding, and RNTIs

The UE is never told exactly where its PDCCH sits or how big it is. Instead it searches. It looks in a limited set of candidate CCE positions called search spaces and tries to decode each candidate at each plausible aggregation level — this trial-and-error is blind decoding. There are two kinds of search space. The Common Search Space (CSS) occupies a fixed range of CCEs at the start of the control region, is monitored identically by all UEs, and carries messages meant broadly — system information, paging, random-access responses, and TPC commands — using aggregation levels 4 and 8 only. The UE-specific Search Space (USS) starts at a CCE position derived from the UE's identity and the subframe number (so different UEs and different subframes hash to different positions, spreading load), and it carries that UE's own dynamic grants at aggregation levels 1, 2, 4, and 8.

The number of candidates the UE checks is fixed per aggregation level: in the USS there are 6, 6, 2, 2 candidates at levels 1, 2, 4, 8 respectively (16 candidates in all), and in the CSS there are 4 and 2 candidates at levels 4 and 8 (6 candidates). Multiplying those candidate counts by the number of DCI payload sizes the UE must monitor is what fixes its per-subframe decode budget.

How does the UE know a decoded DCI is for it? By the CRC. The 16-bit CRC attached to each DCI is masked (XORed) with an RNTI (Radio Network Temporary Identifier). The UE de-masks each candidate's CRC with the RNTIs it owns; if the CRC checks out, the DCI is genuine and addressed to that RNTI, and the RNTI used also fixes the interpretation. The same DCI format read with SI-RNTI means "system information," but read with C-RNTI it means "a dynamic grant for you." There is no explicit "this is for you" flag — the successful CRC unmasking is the addressing mechanism.

Blind decoding is bounded so the UE's decoder is never overwhelmed. Per subframe the UE performs a fixed budget of decode attempts — on the order of 44 across both search spaces and the DCI sizes it must monitor — because it tries every candidate at every configured aggregation level against each relevant RNTI, and for two DCI payload sizes (the UE-specific size for its transmission mode, plus the fallback size of DCI 1A/0). Each of the reserved RNTI code points below is drawn from the 16-bit RNTI space (0x0001–0xFFF3 for C-RNTI-class identities); SI-RNTI is the fixed value 0xFFFF, P-RNTI is 0xFFFE, and RA-RNTI is computed from the PRACH time/frequency occasion.

The DCI formats

LTE defines a fixed catalogue of DCI formats, grouped by job: uplink grants, downlink assignments, and power-control commands. A UL grant schedules the PUSCH; a DL assignment schedules the PDSCH. The downlink formats multiply because each supports a different transmission mode — single antenna, transmit diversity, or the various flavours of spatial multiplexing — and each format also implies a particular resource-allocation type. The compact formats (1A/1B/1C/1D) use resource-allocation type 2, which signals a contiguous block of RBs with a single compact index (the RIV); the larger formats (1, 2, 2A…) use type 0 or type 1, which use a bitmap of resource-block groups to allow non-contiguous allocation.

Inside DCI 0 and DCI 2A

The format list becomes concrete when you look at the fields. Two formats illustrate the two ends of the spectrum: DCI 0, the uplink grant, and DCI 2A, the open-loop spatial-multiplexing downlink assignment carrying two transport blocks.

DCI 0 and DCI 1A are deliberately padded to the same size so the UE can cover both with a single blind decode; a leading flag bit distinguishes them. The core of DCI 0 is the uplink resource assignment, the modulation-and-coding choice, and the fields needed to run synchronous uplink HARQ and closed-loop power/timing control.

DCI 2A (TM3, open-loop spatial multiplexing) is much larger because it schedules the downlink for up to two codewords at once. Each codeword gets its own MCS, NDI, and RV; a swap flag maps codewords to layers; and because the mode is open-loop, the precoding information carries only the number of transmission layers rather than an explicit precoding matrix (that is what makes it "open loop" as opposed to closed-loop DCI 2).

Two payload-sizing details are worth internalising. The RB-assignment field width scales with bandwidth: for type 2 it is ⌈log₂(N_RB^DL(N_RB^DL+1)/2)⌉ bits, which is 7 bits at 5 MHz (25 RB), 9 bits at 10 MHz (50 RB), 11 bits at 15 MHz (75 RB) and 13 bits at 20 MHz (100 RB). And the DCI 0 / 1A common size is padded up whenever the two would otherwise differ, so a single blind-decode candidate covers an uplink grant and a fallback downlink assignment at once.

EPDCCH: PDCCH in the data region

The classic PDCCH has a structural limit: it always lives in the first few symbols spread across the whole bandwidth, so its capacity is fixed and it cannot benefit from frequency-selective scheduling or beamforming. Release 11 introduced the Enhanced PDCCH (EPDCCH) to solve this. Unlike the legacy PDCCH, the EPDCCH is transmitted in the PDSCH region of the subframe — it uses ordinary resource blocks in the data region rather than the control region at the front.

Placing control in the data region lets the eNB assign specific resource blocks to a UE's control channel, so it can exploit frequency-selective gains and UE-specific beamforming (using DMRS-based demodulation rather than the cell-wide reference signals the legacy PDCCH relies on), and it relieves control-channel congestion in dense deployments and on new carrier types. The EPDCCH still carries the same DCI formats and is still found by blind decoding, but its building block is the ECCE rather than the CCE, and it comes in two mapping flavours: localized (RBs kept together, for beamforming when the eNB knows the channel) and distributed (RBs spread out, for frequency diversity when it does not).

Summary

The LTE control region is read front-to-back, every subframe, in a fixed order. PCFICH first gives the CFI (1–3 symbols, or 2–4 at 1.4 MHz) so the UE knows where data begins; miss it and the whole subframe is lost. PHICH next carries the one-bit uplink ACK/NACK that drives synchronous uplink HARQ, at a resource the UE derives implicitly from its PUSCH RB and DMRS cyclic shift — no signalling bits spent. PDCCH last carries the DCI grants, built REG (4 REs) → CCE (9 REGs, 36 REs, 72 QPSK bits) → aggregation level (1/2/4/8 CCEs), CRC-scrambled by the target RNTI and protected by a rate-1/3 tail-biting convolutional code.

Addressing is done by CRC unmasking, not a flag: the RNTI that cleans the CRC both proves the DCI is yours and fixes its meaning (SI-RNTI, P-RNTI, RA-RNTI, C-RNTI, and the rest). The UE finds its grant by blind-decoding a bounded set of candidates across the common and UE-specific search spaces. The DCI format catalogue then maps each transmission mode and direction to a payload — DCI 0 for the uplink grant, the 1-family for single-codeword downlink, the 2-family for spatial multiplexing — each implying a resource-allocation type. EPDCCH later moved control into the data region for beamforming and capacity, foreshadowing the NR CORESET model.

Quick Q&A