Cell Search: PSS/SSS & PBCH/MIB in LTE 4G
Power-on to sync: PSS and SSS, how the 504 PCIs are formed, and reading the MIB on PBCH.
When an LTE phone powers on it is completely blind: it knows the LTE rules but not which cell is near, on which frequency, or how its clock lines up with the network's. Cell search is the fixed ritual — scan, synchronise, identify, then read the map — that turns that blind modem into a UE camped on a cell. This page walks the whole chain end to end: the two synchronisation signals (PSS and SSS), how they combine into a Physical Cell Identity, exactly where they sit in the grid for FDD and TDD, and how the UE then reads the MIB and reaches SIB1. Everything downstream — system information, random access, attach — depends on getting these first signals right. It is grounded in TS 36.211 (signals) and TS 36.331 (MIB/SIB).
Introduction
Cell search is the very first thing an LTE UE does on the air interface, and it is a pure downlink, receive-only procedure — the UE transmits nothing until random access, much later. Its inputs are just RF samples; its outputs are time and frequency synchronisation, the cell's identity (PCI), and enough system information (the MIB, then SIB1) to decide whether the cell is usable and how to access it.
It runs far more often than "at power-on." The same PSS/SSS detection drives initial cell selection, cell reselection in idle mode, and neighbour measurement for handover in connected mode — every time the UE needs to find, rank, or lock onto a cell it leans on these two signals. Because they are transmitted at the very centre of the band and on a fixed schedule, a UE can search for any LTE cell without first knowing its bandwidth or configuration.
It matters because everything else is gated on it. Without correct symbol/frame timing the UE cannot place any other channel; without the PCI it cannot generate the CRS sequence to equalise the downlink; without the MIB it does not know the bandwidth; without SIB1 it cannot access the cell. Get the first two signals wrong and nothing downstream works.
On this page
Why cell search is needed
In plain words: imagine walking into a dark, noisy stadium and needing to join one specific conversation. First you listen for any sound and turn toward it (RSSI). Then you catch the speaker's rhythm so you can follow their beat (PSS → timing). Then you learn who they are and where the sentence starts (SSS → identity and frame timing). Only then can you understand the words (PBCH/MIB), and finally read the full instructions they hand you (SIB1). A UE does exactly this, with radio — each step is useless until the previous one has succeeded.
Concretely, a receiver that has never heard this network faces four unknowns at once, and they can only be resolved in order. It does not know where to listen in the spectrum — solved by the frequency scan and RSSI triage. It does not know when symbols start — solved by the PSS correlation peak, which pins OFDM-symbol and slot timing and exposes the residual frequency offset. It does not know which cell this is or where the frame begins — solved by the SSS, which gives the cell-ID group and distinguishes subframe 0 from subframe 5. And it does not know how the cell is configured — solved by reading the MIB on PBCH and then SIB1 on PDSCH. Cell search is exactly the minimal ordered procedure that removes those unknowns one by one.
A receive-only, ordered procedure — scan → PSS → SSS → PCI → MIB → SIB1 — that takes a blind modem to a UE camped on a cell with full timing, identity and access parameters.
Nothing else on the downlink can be placed or decoded until timing, cell identity and bandwidth are known; each step unlocks the next.
Correlate against the 3 known PSS sequences at band centre; use the peak to fix timing and N_ID(2); correlate the SSS for N_ID(1) and frame timing; combine into PCI; decode MIB, then SIB1.
Step 0: Frequency scan and RSSI
The UE cannot listen to every frequency at once, so it first decides where to look. If it has camped on this network before, it jumps straight to stored carrier frequencies (fast). Otherwise it performs an initial cell selection: it sweeps the supported bands, tuning to each candidate EARFCN (E-UTRA Absolute Radio Frequency Channel Number, an integer 0–262143 that maps one-to-one to a centre frequency).
On each candidate it asks the cheapest possible question first: is there any power here at all? That quick wideband measurement is RSSI — total received power including signal, interference and noise. RSSI is a coarse filter: it lets the UE skip dead channels and spend its real effort only where there is energy worth decoding. Only after the UE finds and decodes the synchronisation signals does it get the meaningful quality metrics RSRP (per-resource-element reference power, typically reported over roughly −140 to −44 dBm) and RSRQ (a quality ratio combining RSRP and RSSI).
A coarse power sweep across candidate carriers, followed by a fine synchronisation search only on carriers that show energy. The synchronisation signals themselves always live in the centre 62 subcarriers (about 6 resource blocks) around DC.
Searching for a full Zadoff-Chu correlation on every EARFCN in every band would drain the battery and take far too long. RSSI is the triage step that concentrates effort where a cell might actually be.
Tune to an EARFCN, measure wideband RSSI, and if there is energy, run the PSS correlator on the centre of the band. Because sync always sits at band centre, the UE does not need to know the cell bandwidth to start.
PSS: Primary Synchronisation Signal
Having found a carrier with energy, the UE hunts for the cell's first beacon: the PSS. It sits at the very centre of the band, so the UE can find it regardless of the cell's bandwidth.
A short, known frequency-domain Zadoff-Chu sequence of length 63 (the centre element, at DC, is punctured, so it maps onto the middle 62 subcarriers — roughly 6 resource blocks around DC). There are exactly 3 PSS sequences, generated from Zadoff-Chu root indices 25, 29 and 34.
The PSS is the UE's first foothold. Detecting it gives OFDM-symbol and slot timing, a coarse frequency correction (it exposes the residual carrier-frequency offset), and the first piece of the cell identity — the physical-layer identity within the group, N_ID(2) ∈ {0, 1, 2}.
The UE correlates each of the 3 known Zadoff-Chu sequences against the incoming samples. A sharp correlation peak means "found it, and here is exactly when." Zadoff-Chu sequences have a perfect (impulse-like) periodic autocorrelation, so the peak is clean even when the signal is weak, and low cross-correlation between the three roots means the UE can tell which of the three it found.
The frequency-domain PSS is defined (TS 36.211) as a Zadoff–Chu sequence d_u(n) = exp(−jπ·u·n·(n+1)/63), where the root u takes the value 25, 29 or 34 for N_ID(2) = 0, 1 or 2 respectively. The choice of those roots is not arbitrary: they are symmetric about the length — 25 and 34 form a complex-conjugate pair (34 = 63 − 29 and 25 = 63 − 38 in the Zadoff–Chu index sense) — which lets a UE reuse one correlator to detect a conjugate root and helps the receiver estimate and correct large frequency offsets. In practice the PSS correlation is the single most computationally expensive part of cell search, which is exactly why the designers held it to just three candidate sequences.
N_ID(2) | Zadoff-Chu root index u | Role in the identity |
|---|---|---|
| 0 | 25 | Physical-layer identity within the group |
| 1 | 29 | Physical-layer identity within the group |
| 2 | 34 | Physical-layer identity within the group |
Key idea: PSS is always in the centre 6 RBs regardless of system bandwidth (1.4 to 20 MHz). This is deliberate — the UE can lock onto any LTE cell without first knowing how wide it is. The PSS gives timing and N_ID(2); it does not tell the UE where the frame starts or which duplex mode is in use — that comes next.
SSS: Secondary Synchronisation Signal
Once the PSS has pinned the timing and given N_ID(2), the UE knows exactly where the SSS sits (right next to the PSS) and decodes it next.
The SSS is built from two length-31 m-sequences (maximum-length shift-register sequences), interleaved element-by-element into a length-62 sequence on the centre subcarriers. The two m-sequences carry two indices (m0, m1, each derived from N_ID(1)) whose combinations map to the cell-identity group, N_ID(1) ∈ {0 … 167} — 168 combinations.
Beyond completing the cell identity, the SSS also gives radio-frame timing. The two m-sequences are swapped between the first and second half-frame, so the UE can tell subframe 0 apart from subframe 5. Detecting the SSS also lets the UE determine the cyclic-prefix length (normal vs extended) and, from the SSS position relative to the PSS, whether the cell is FDD or TDD.
With timing and N_ID(2) already known from the PSS, the UE correlates the received SSS against the candidate m-sequence combinations to find N_ID(1) and, from which of the two SSS variants matched, whether it is looking at subframe 0 or subframe 5. Because the coarse timing is already fixed, this larger 168-way search is cheap — the UE knows precisely where to look.
The interleaving matters. The SSS is two independent length-31 codes woven together — even-indexed subcarriers carry one m-sequence (index m0), odd-indexed carry the other (index m1). The pair (m0, m1) is a function of N_ID(1), and the two indices are exchanged between subframe 0 and subframe 5, which is what resolves the half-frame ambiguity. A second scrambling derived from N_ID(2) ties the SSS to the PSS the UE already detected, so a UE cannot mistakenly pair an SSS with the wrong PSS. The net effect: from one SSS symbol the UE simultaneously recovers the 168-value group index and resolves the half-frame ambiguity that the PSS alone leaves open.
Common confusion: the PSS gives N_ID(2) (only 3 values) and timing; the SSS gives N_ID(1) (168 values), frame timing, CP length, and the FDD/TDD distinction. The PSS is identical in both of a cell's occurrences per frame; the SSS differs between subframe 0 and subframe 5 — that difference is exactly how the UE finds the start of the radio frame.
Putting them together: the PCI
The two signals were split on purpose. Detecting three PSS candidates is cheap and nails the timing; the larger 168-way search is then done on the SSS once the UE already knows where to look. Combine the two parts and you get the cell's fingerprint, the Physical Cell Identity:
Notice the structure of the arithmetic: multiplying the group index by 3 and adding the in-group index guarantees every one of the 504 combinations is unique, and it means that from a single PCI value you can recover both parts — N_ID(2) = PCI mod 3, and N_ID(1) = ⌊PCI / 3⌋. The PCI keys the cell's CRS (Cell-specific Reference Signals) and their frequency shift in the resource grid: the CRS are shifted by PCI mod 6 subcarriers, so neighbouring cells with different PCIs place their reference symbols on different subcarriers and interfere less.
Because only 504 PCIs exist, neighbours must reuse them — careful PCI planning avoids collision (two adjacent cells sharing a PCI, so a UE cannot tell them apart) and confusion (two neighbours of one cell sharing a PCI, so a handover request is ambiguous). Both break handover and synchronisation, which is why PCI assignment is a real network-planning problem despite sounding like a trivial numbering exercise.
| Signal | What it gives the UE | Sequence type | Identity part |
|---|---|---|---|
PSS | Symbol/slot timing, coarse frequency | Zadoff-Chu (3 sequences, roots 25/29/34) | N_ID(2) (0–2) |
SSS | Frame timing (SF0 vs SF5), CP length, FDD/TDD | Two interleaved length-31 m-sequences | N_ID(1) (0–167) |
| PSS + SSS | Full cell identity | — | PCI = 3×N_ID(1) + N_ID(2) (0–503) |
PBCH | MIB: bandwidth, PHICH, SFN MSBs, CRS ports | QPSK, tail-biting convolutional code | — |
LTE ↔ NR: NR keeps the two-part identity idea but changes the numbers and the sequences. NR has 1008 physical cell IDs (NID = 3×N_ID(1) + N_ID(2), with N_ID(1) ∈ 0–335), its PSS/SSS are length-127 m-sequences (not Zadoff–Chu), and — crucially — NR bundles PSS, SSS and PBCH into a single SS/PBCH block (SSB) that is beam-swept, rather than LTE's fixed centre-band sync that recurs every 5 ms. So the "PSS gives N_ID(2), SSS gives N_ID(1)" mental model survives, but the ranges, sequence family, and transmission pattern all change.
Where the sync signals sit in the grid
The relative position of PSS and SSS is not just detail — it is how the UE tells FDD from TDD before it has read any configuration. In both duplex modes the signals occupy the centre 62 subcarriers (6 RBs) around DC, regardless of the cell's actual bandwidth, and they repeat twice per 10 ms radio frame (every 5 ms). What differs is which symbols they land on.
In FDD, the PSS occupies the last OFDM symbol of slot 0 and slot 10 (i.e. the last symbol of the first slot of subframes 0 and 5), and the SSS sits in the symbol immediately before it. Because PSS and SSS are back-to-back — SSS then PSS in the last two symbols — a UE that detects them adjacent in time knows it is on an FDD carrier.
In TDD, the layout is shifted: the PSS moves into the third OFDM symbol of subframes 1 and 6 (inside the special-subframe DwPTS region), while the SSS stays in the last symbol of subframes 0 and 5 — three symbols ahead of the PSS rather than one behind it. That distinctive gap (SSS three symbols before PSS, and in different subframes) lets the UE distinguish TDD from FDD purely from timing.
| Aspect | FDD | TDD |
|---|---|---|
| PSS symbol | Last OFDM symbol (symbol 6) of slots 0 and 10 | Symbol 3 (3rd symbol) of subframes 1 and 6 (DwPTS) |
| SSS symbol | Symbol immediately before PSS (symbol 5 of slots 0 and 10) | Last symbol of subframes 0 and 5 |
| PSS–SSS relationship | Adjacent: SSS then PSS, back-to-back | SSS is 3 symbols before PSS, in the preceding subframe |
| Subframes carrying sync | PSS & SSS both in subframes 0 and 5 | PSS in subframes 1 and 6; SSS in subframes 0 and 5 |
| Frequency location | Centre 62 subcarriers (6 RB) around DC | Centre 62 subcarriers (6 RB) around DC |
| Repetition period | Every 5 ms (twice per frame) | Every 5 ms (twice per frame) |
PBCH and the MIB: the map to everything next
The UE is now synchronised and knows the PCI — but it still cannot use the cell, because it does not know the system bandwidth or where the detailed system information lives. The PBCH (Physical Broadcast Channel) solves this by carrying the MIB (Master Information Block).
The PBCH sits in the first four OFDM symbols of slot 1 in subframe 0, on the centre 72 subcarriers (6 RBs) — again in the middle so the UE can read it before knowing the bandwidth. The MIB is a tiny 24-bit message, so it is protected heavily: a 16-bit CRC is appended, the whole thing is tail-biting convolutionally coded and QPSK-modulated, then spread over a 40 ms TTI as four self-decodable repetitions, one every 10 ms. Each copy is independently decodable, so a UE in good coverage decodes on the first try, while a UE at the cell edge can soft-combine up to all four. The UE also uses the four-way scrambling phase to recover the two least-significant bits of the system frame number, resolving where in the 40 ms window it landed.
The PBCH does one more clever thing. The number of CRS antenna ports (1, 2, or 4) is not sent as an explicit field — it is encoded in the PBCH CRC mask. The 16-bit CRC is XORed with one of three fixed masks depending on the transmit-antenna count. When the UE tries to decode, it tests each mask; the one that produces a valid CRC tells it how many CRS ports the cell uses. That is essential, because the UE needs the antenna-port count to correctly demodulate every other downlink channel — a chicken-and-egg problem the CRC mask neatly solves without spending payload bits.
| MIB field | Bits | In plain words |
|---|---|---|
dl-Bandwidth | 3 | The downlink system bandwidth as a number of RBs (6, 15, 25, 50, 75 or 100, i.e. 1.4/3/5/10/15/20 MHz) — now the UE knows how wide the cell is. |
phich-Config | 3 | PHICH duration (normal/extended) and resource amount Ng ∈ {1/6, 1/2, 1, 2} — needed to locate the control region and decode PDCCH. |
systemFrameNumber | 8 | The 8 most-significant bits of the SFN (the 2 LSBs come from the PBCH 40 ms TTI timing) — the UE's clock in the 1024-frame cycle. |
| (spare) | 10 | Reserved bits (later partly reused, e.g. for eMTC/NB-IoT indications). |
| CRS antenna ports | — | Not a field: signalled implicitly by the PBCH CRC mask (1, 2 or 4 ports). |
Mental model: PSS/SSS told the UE who the cell is and fixed its clock. The MIB is a small signpost that says "the cell is this wide, its PHICH looks like this, the clock reads this, and it has this many antenna ports." It is the pointer, not the manual — the manual is SIB1.
From MIB to SIB1: reading the manual
After decoding the MIB the UE has: full time synchronisation and the frame number, the PCI, the downlink bandwidth, the PHICH configuration, and the CRS antenna-port count. That is enough to make sense of the control region and demodulate the downlink. But it still cannot access the cell, because it does not yet know the PLMN identity, the tracking area, whether the cell is barred, the cell-selection thresholds, or how to perform random access.
All of that lives in SIB1 (System Information Block Type 1), which is not carried on the PBCH. SIB1 is transmitted on the PDSCH, scheduled by a PDCCH grant (a DCI format 1A or 1C) whose CRC is scrambled by the SI-RNTI (the fixed value 0xFFFF). SIB1 has a fixed schedule: it is sent in subframe 5 of every even-numbered radio frame (an 80 ms period), with redundancy-version repetitions in subframe 5 of the intervening frames. So the UE's very next job is to monitor the control region — now that it knows the bandwidth, PHICH and antenna ports — find the SI-RNTI grant, and decode SIB1.
SIB1 itself does two things: it carries the essential access parameters (cellAccessRelatedInfo with the PLMN list, tracking-area code and cell identity; cellSelectionInfo with the minimum received-power threshold q-RxLevMin; and a cell-barred flag), and it carries the scheduling information (schedulingInfoList) for all the other SIBs (SIB2, SIB3, …) grouped into SI messages on the PDSCH. Once the UE reads SIB1 and then SIB2 (which holds the RACH-ConfigCommon), it finally knows how to transmit — and cell search proper is complete.
Spec note: PSS/SSS generation and mapping are defined in TS 36.211; the MIB and SIB structures and SIB1 scheduling in TS 36.331; PBCH coding and the CRS-port CRC mask in TS 36.212 / 36.211. Cite the TS if you are unsure of a clause number.
⚠ Common pitfalls / gotchas
- Assuming PSS alone gives frame timing. PSS gives symbol/slot timing and
N_ID(2)only; the SSS is what resolves subframe 0 vs 5 and thus the radio-frame boundary. - Looking for sync across the whole band. PSS/SSS are always in the centre 62 subcarriers (6 RB) regardless of bandwidth — searching the full band wastes effort and battery.
- Expecting the antenna-port count as a MIB field. It is carried implicitly in the
PBCH CRC mask; decoding blindly against one mask can silently fail on 2- or 4-port cells. - Confusing FDD and TDD sync placement. In TDD the PSS is in subframes 1/6 (symbol 3) and the SSS in subframes 0/5, three symbols apart — not the FDD back-to-back layout.
- Thinking the MIB is enough to camp. Access parameters (PLMN, TAC, barring,
q-RxLevMin, RACH config) live inSIB1/SIB2, not the MIB.
Summary
Cell search is a strict pipeline, and each stage removes exactly one unknown. The frequency scan plus RSSI decides where to look; the PSS (3 Zadoff–Chu sequences, roots 25/29/34) gives symbol/slot timing, a coarse frequency estimate, and N_ID(2) ∈ {0,1,2}; the SSS (two interleaved length-31 m-sequences) gives N_ID(1) ∈ {0…167}, radio-frame timing, CP length, and the FDD/TDD distinction. Combine them — PCI = 3×N_ID(1) + N_ID(2) — and you have one of 504 cell identities, invertible as N_ID(2) = PCI mod 3, N_ID(1) = ⌊PCI/3⌋.
With the cell identified, the UE reads the 24-bit MIB on PBCH (bandwidth, PHICH, SFN MSBs, and the antenna-port count hidden in the CRC mask), then decodes SIB1 on PDSCH under SI-RNTI to learn the PLMN, tracking area, barring status, and the schedule of the remaining SIBs. Only after SIB2's RACH configuration does the UE know how to transmit. If any early stage is wrong — wrong timing, wrong PCI, wrong bandwidth — nothing after it can work, which is why walking cell search in order is the fastest way to reason about a UE that "won't camp."
Quick Q&A
Q. How is the PCI formed in LTE, and how many are there?
A. PCI = 3×N_ID(1) + N_ID(2), where the SSS gives N_ID(1) (0–167) and the PSS gives N_ID(2) (0–2). That yields 504 PCIs (0–503). You can invert it: N_ID(2) = PCI mod 3, N_ID(1) = ⌊PCI/3⌋.
Q. What sequences and roots does the PSS use, and what does it give the UE?
A. Three Zadoff-Chu sequences with root indices 25, 29 and 34, one per N_ID(2) value. The PSS gives OFDM-symbol and slot timing, a coarse frequency-offset estimate, and N_ID(2).
Q. What does the SSS provide that the PSS does not?
A. The SSS is two interleaved length-31 m-sequences (168 combinations) giving N_ID(1). It also distinguishes subframe 0 from subframe 5 (radio-frame timing), lets the UE determine the cyclic-prefix length, and its position relative to the PSS reveals FDD vs TDD.
Q. Where do PSS and SSS sit for FDD versus TDD?
A. FDD: PSS in the last OFDM symbol of slots 0 and 10 with SSS in the symbol just before it (subframes 0 and 5). TDD: PSS in symbol 3 of subframes 1 and 6, SSS in the last symbol of subframes 0 and 5. Both always in the centre 62 subcarriers (6 RB).
Q. Why is the MIB sent as four repetitions over 40 ms, and how is the antenna-port count signalled?
A. The 40 ms TTI with four self-decodable repetitions lets a cell-edge UE soft-combine copies to decode the tiny critical payload, while a good-coverage UE decodes one copy; the repetition timing also encodes the 2 LSBs of the SFN. The CRS antenna-port count (1/2/4) is carried implicitly in the PBCH CRC mask, not as a payload field.
Q. After the MIB, why can't the UE use the cell yet, and where does it turn next?
A. The MIB gives bandwidth, PHICH, SFN and antenna ports but no access information. The UE must decode SIB1 on the PDSCH — scheduled by a PDCCH grant scrambled with the SI-RNTI, in subframe 5 of even frames — to learn the PLMN, tracking area, cell-barred status and the schedule of the remaining SIBs.
You're synchronised — now what?
The UE has found a carrier, locked its clock, computed the PCI, read the MIB and decoded SIB1. It still has not transmitted anything. Next come the pieces that turn a synced UE into an attached one: