MIB & SIB1 — Every IE Explained in 5G NR

1. Why MIB and SIB1 Get Their Own Document

The MIB is the smallest RRC message in NR by a wide margin -- 24 bits, including the CHOICE bit -- and SIB1 is one of the largest that a UE receives without any dedicated configuration. Between them they carry every decision a UE has to make before it is allowed to transmit: whether the cell is barred, whether it belongs to a PLMN the UE may use, whether its signal is strong enough, whether this particular access attempt is permitted, and where the PRACH is. Get any of it wrong and the failure is silent: the UE walks away and the gNB never learns it was there.

The two messages also differ in a way that matters constantly when debugging. The MIB is not scheduled -- it is part of the SSB, so a UE that found the SSB has it. SIB1 is scheduled on DL-SCH, which means it needs a control resource set, a search space, a monitoring occasion and a PDCCH grant, and every one of those is derived from eight bits inside the MIB. Section 4 and section 5 are about those eight bits, because they are where cells become undecodable.

This document is deliberately field-by-field. The companion 17 System Information document covers how SIB2 and beyond are scheduled, notified and re-acquired; the companion 01 Registration Process document covers what the UE does with SIB1 once it has it.

2. The 24-Bit MIB and the 32-Bit PBCH Payload

The RRC message on BCCH is BCCH-BCH-Message, and it is exactly 24 bits: one CHOICE bit selecting mib over messageClassExtension, then the 23 bits of the MIB SEQUENCE. MIB has no extension marker -- unusually for TS 38.331 -- which is precisely why it has a fixed length and why it ends in a single explicit spare bit.

systemFrameNumber

subCarrierSpacingCommon

ssb-SubcarrierOffset

dmrs-TypeA-Position

pdcch-ConfigSIB1

cellBarred

intraFreqReselection

spare

Table 1. BCCH-BCH-Message accounting: 1 + 6 + 1 + 4 + 1 + 8 + 1 + 1 + 1 = 24 bits exactly TS 38.331.

2.1 The eight bits the physical layer adds

The PBCH transmits a 32-bit payload, not 24 TS 38.212 cl. 7.1.1. The physical layer appends eight bits that do not exist anywhere in the ASN.1, and they carry information the MIB could not: they change from one SSB to the next inside the same MIB transmission period, which is exactly why they cannot be in a message whose content is fixed for 80 ms.

Table 2. The PBCH extra bits TS 38.212 cl. 7.1.1. 24 + 8 = 32 bits, which is then CRC-attached, polar-coded and rate-matched onto the PBCH resource elements.

2.2 Where the SSB index actually comes from

Even with the three conditional bits, the low bits of the SSB index are never transmitted in the payload. They are carried by the PBCH DMRS sequence, whose initialisation depends on the candidate SSB index TS 38.211 cl. 7.4.1.4.1:

c_init = 2^11 x (i_SSB + 1) x (FLOOR(N_ID_cell / 4) + 1)
       + 2^6  x (i_SSB + 1)
       + (N_ID_cell mod 4)

  L_max = 4        i_SSB = (SSB index mod 4) + 4 x n_hf
  L_max = 8 or 64  i_SSB = SSB index mod 8

  n_hf = half-frame number, 0 or 1

The UE correlates against each i_SSB hypothesis; whichever one produces a
successful PBCH decode is the SSB index (and, for L_max = 4, also the
half frame). For L_max = 64 the three MSBs then come from the payload.

The payload itself is scrambled with a sequence initialised from the cell ID, and the scrambling position depends on low SFN bits TS 38.212 cl. 7.1.2 -- so a UE that does not yet know the SFN tries several hypotheses across the 80 ms PBCH transmission period. A subset of the added bits is excluded from scrambling so that the UE can recover the timing information it needs to pick the right hypothesis.

3. MIB Fields, One at a Time

systemFrameNumber

subCarrierSpacingCommon

dmrs-TypeA-Position

pos2

pdcch-ConfigSIB1

cellBarred

notBarred

intraFreqReselection

allowed

spare

Table 3. MIB fields with ranges, typical values and consequences. Only two of the nine carry configuration the UE keeps after SIB1 arrives; the rest exist to get SIB1 decoded.

4. pdcch-ConfigSIB1: Decomposing Eight Bits

PDCCH-ConfigSIB1 is a SEQUENCE of two INTEGER (0..15), so it encodes as four bits then four bits, controlResourceSetZero first. In a log it usually appears as a single decimal number -- and the first thing to do with that number is split it.

4.1 The CORESET#0 table

controlResourceSetZero indexes one of Tables 13-1 to 13-10 of TS 38.213, selected by the {SS/PBCH block, PDCCH} subcarrier spacing pair and, for the FR1 tables, the band's minimum channel bandwidth. Every row gives four things: the SSB-to-CORESET multiplexing pattern, the number of resource blocks, the number of symbols, and an RB offset.

Table 4. TS 38.213 Table 13-1, for {SS/PBCH block, PDCCH} SCS = {15, 15} kHz in bands with a 5 MHz or 10 MHz minimum channel bandwidth. Other SCS pairs use different tables with different values -- always confirm which table applies before using a row.

The offset is measured in resource blocks, from the lowest RB of CORESET#0 up to the lowest RB of the SSB. Combined with k_SSB, which gives the sub-RB alignment, that fixes the CORESET's absolute position in the carrier.

4.2 The searchSpaceZero table

Table 5. TS 38.213 Table 13-11, for SSB-and-CORESET multiplexing pattern 1. O is a slot offset, M the number of monitoring occasions per slot. Patterns 2 and 3 (FR2 only) use Tables 13-12 and 13-13 and place occasions relative to the SSB instead.

5. CORESET#0 and the Type0-PDCCH Monitoring Occasions

With the two table rows in hand, the UE knows where in frequency to look and when in time. Frequency first:

5.1 Monitoring occasions, worked once

For SSB-and-CORESET multiplexing pattern 1 -- the only pattern used in FR1 -- the Type0-PDCCH common search space occasions are computed from O, M and the SSB index TS 38.213 cl. 13:

n_0 = ( O x 2^mu + FLOOR( i x M ) )  mod  N_slot_frame

and the system frame parity:

  if  FLOOR( ( O x 2^mu + FLOOR(i x M) ) / N_slot_frame )  mod 2  = 0
         -> the occasion is in a radio frame with  SFN mod 2 = 0
  else   -> the occasion is in a radio frame with  SFN mod 2 = 1

The UE monitors two consecutive slots starting from n_0.

  i             SS/PBCH block index
  O, M          from searchSpaceZero (Table 13-11)
  mu            numerology of the PDCCH SCS
  N_slot_frame  slots per radio frame = 10 x 2^mu

5.2 The same arithmetic when it overflows the frame

Change the numerology and the beam count and the picture changes completely -- which is why the SFN-parity half of the formula exists:

6. SIB1: the Whole IE Tree

cellSelectionInfo

cellAccessRelatedInfo

connEstFailureControl

si-SchedulingInfo

servingCellConfigCommon

ims-EmergencySupport

eCallOverIMS-Support

ue-TimersAndConstants

uac-BarringInfo

useFullResumeID

Table 6. SIB1 top-level IEs TS 38.331 cl. 6.2.2. M = mandatory, O = optional. The absence of servingCellConfigCommon is the one worth remembering: it turns a visible cell into an unusable one.

7. cellAccessRelatedInfo: Who the Cell Belongs To

This is the only mandatory IE, and its structure has one subtlety that trips people up: the PLMN list is a list of lists. plmn-IdentityInfoList holds up to twelve PLMN-IdentityInfo entries, and each of those holds up to twelve PLMN identities that all share the same TAC, RAN area code, cell identity and reservation flags.

plmn-IdentityList

trackingAreaCode

ranac

cellIdentity

cellReservedForOperatorUse

cellReservedForOtherUse

Table 7. CellAccessRelatedInfo and PLMN-IdentityInfo TS 38.331. The three reservation and barring mechanisms -- cellBarred, cellReservedForOtherUse and cellReservedForOperatorUse -- are independent and applied in that order.

8. cellSelectionInfo and the S-Criterion, Worked

cellSelectionInfo carries five values, and four of the five are optional. Their units are the single most common source of misreading in the whole of SIB1.

q-RxLevMin

q-RxLevMinOffset

q-RxLevMinSUL

q-QualMin

q-QualMinOffset

Table 8. CellSelectionInfo fields TS 38.331. Note that q-RxLevMin and q-RxLevMinOffset are in 2 dB units while q-QualMin and q-QualMinOffset are in 1 dB units -- the two halves of the same IE use different scalings.

Srxlev = Q_rxlevmeas - (q-RxLevMin x 2 + q-RxLevMinOffset x 2)
                     - Pcompensation - Qoffset_temp          > 0

Squal  = Q_qualmeas  - (q-QualMin + q-QualMinOffset)
                     - Qoffset_temp                          > 0

  Q_rxlevmeas   measured SS-RSRP                                  [dBm]
  Q_qualmeas    measured SS-RSRQ                                  [dB]
  Pcompensation max(P_EMAX - P_PowerClass, 0)                     [dB]
                P_EMAX from p-Max in frequencyInfoUL, or the band default
                P_PowerClass from the UE's power class (23 dBm for cl. 3)
  Qoffset_temp  0, or connEstFailOffset while its validity timer runs (S9)

A cell is *suitable* only if BOTH are strictly greater than zero.

9. connEstFailureControl: How a Cell Earns a Penalty

A cell can pass the S-criterion comfortably and still be unable to admit anyone -- because its PRACH is misconfigured, because it has no N2 connection, or because it is simply overloaded. connEstFailureControl is the mechanism that lets a UE stop trying without waiting for the cell to bar itself.

connEstFailCount

connEstFailOffset

connEstFailOffsetValidity

Table 9. ConnEstFailureControl TS 38.331. Qoffset_temp feeds straight into both halves of the S-criterion, which is what makes the interaction in §8 possible.

The counter is per cell and per UE, and it resets on a successful establishment. The offset makes the cell less attractive for reselection as well as potentially unsuitable altogether, so a UE that keeps failing on one cell drifts to a neighbour without any network involvement.

10. servingCellConfigCommon in SIB1

ServingCellConfigCommonSIB is the largest branch of SIB1 and the one the UE actually needs in order to transmit. It is a reduced form of the dedicated ServingCellConfigCommon -- everything a UE can be told without a dedicated connection.

downlinkConfigCommon

downlinkConfigCommon

downlinkConfigCommon

modificationPeriodCoeff

downlinkConfigCommon

uplinkConfigCommon

uplinkConfigCommon

uplinkConfigCommon

ssb-PositionsInBurst

ssb-PeriodicityServingCell

tdd-UL-DL-ConfigurationCommon

ss-PBCH-BlockPower

n-TimingAdvanceOffset

Table 10. ServingCellConfigCommonSIB, abridged TS 38.331. Two rows carry consequences far beyond their apparent scope: initialUplinkBWP because it holds the PRACH configuration, and ss-PBCH-BlockPower because every UE's uplink power derives from it.

11. ue-TimersAndConstants

Seven values that govern how long the UE persists before giving up. They are cell-wide defaults; a dedicated RRCReconfiguration can override some of them per UE once a connection exists.

t300

t301

t310

n310

t311

n311

t319

Table 11. UE-TimersAndConstants TS 38.331. If the whole IE is absent from SIB1 the UE applies its own defaults, which are not specified to be any particular value -- so a cell that omits it gets whatever the chipset vendor chose.

12. uac-BarringInfo and a Worked Barring Check

Unified Access Control is the last gate before the UE transmits, and it is the only one that is re-evaluated on every access attempt rather than once at camp time. It works on two independent axes: access identity, which is about who the subscriber is and can exempt them outright, and access category, which is about what the attempt is for and is subject to a probabilistic barring factor.

uac-BarringForCommon

uac-BarringPerPLMN-List

uac-BarringInfoSetList

uac-AccessCategory1-SelectionAssistanceInfo

UAC-BarringPerCat.accessCategory

UAC-BarringPerCat.uac-barringInfoSetIndex

UAC-BarringInfoSet.uac-BarringFactor

ENUMERATED {p00, p05, p10, ..., p95}

UAC-BarringInfoSet.uac-BarringTime

ENUMERATED {s4, s8, s16, s32, s64, s128, s256, s512}

UAC-BarringInfoSet.uac-BarringForAccessIdentity

Table 12. UAC-BarringInfo and its children TS 38.331. The access-identity bitmap is checked first and is absolute; the barring factor is only reached by UEs that no bit exempts.

12.1 The barring check, worked

Table 13. Access identities and their bitmap positions TS 22.261 / TS 24.501 cl. 4.5.2. Value 0 in a bit position means not barred, which is the opposite of the intuitive reading and worth checking twice.

13. Failure Modes and What Each One Means

Table 14. Sixteen MIB and SIB1 failure modes. In eleven of them nobody detects the fault: the UE draws a correct conclusion from wrong information and leaves, and the gNB never knows a UE was there.

14. ASN.1: MIB and SIB1

-- TS 38.331, verbatim in structure; ... marks omitted members

BCCH-BCH-Message ::= SEQUENCE {
    message   BCCH-BCH-MessageType
}

BCCH-BCH-MessageType ::= CHOICE {
    mib                     MIB,
    messageClassExtension   SEQUENCE {}
}

MIB ::= SEQUENCE {
    systemFrameNumber       BIT STRING (SIZE (6)),
    subCarrierSpacingCommon ENUMERATED {scs15or60, scs30or120},
    ssb-SubcarrierOffset    INTEGER (0..15),
    dmrs-TypeA-Position     ENUMERATED {pos2, pos3},
    pdcch-ConfigSIB1        PDCCH-ConfigSIB1,
    cellBarred              ENUMERATED {barred, notBarred},
    intraFreqReselection    ENUMERATED {allowed, notAllowed},
    spare                   BIT STRING (SIZE (1))
}                                   -- note: no extension marker

PDCCH-ConfigSIB1 ::= SEQUENCE {
    controlResourceSetZero  ControlResourceSetZero,   -- INTEGER (0..15)
    searchSpaceZero         SearchSpaceZero           -- INTEGER (0..15)
}

Listing 1. MIB in full -- it is short enough to quote without abridging. The absence of an extension marker is what fixes the length at 23 bits and forces the spare bit.

SIB1 ::= SEQUENCE {
    cellSelectionInfo SEQUENCE {
        q-RxLevMin              Q-RxLevMin,          -- INTEGER (-70..-22)
        q-RxLevMinOffset        INTEGER (1..8)        OPTIONAL,
        q-RxLevMinSUL           Q-RxLevMin            OPTIONAL,
        q-QualMin               Q-QualMin             OPTIONAL,
        q-QualMinOffset         INTEGER (1..8)        OPTIONAL
    }                                                 OPTIONAL,
    cellAccessRelatedInfo       CellAccessRelatedInfo,
    connEstFailureControl       ConnEstFailureControl OPTIONAL,
    si-SchedulingInfo           SI-SchedulingInfo     OPTIONAL,
    servingCellConfigCommon     ServingCellConfigCommonSIB OPTIONAL,
    ims-EmergencySupport        ENUMERATED {true}     OPTIONAL,
    eCallOverIMS-Support        ENUMERATED {true}     OPTIONAL,
    ue-TimersAndConstants       UE-TimersAndConstants OPTIONAL,
    uac-BarringInfo SEQUENCE {
        uac-BarringForCommon    UAC-BarringPerCatList OPTIONAL,
        uac-BarringPerPLMN-List UAC-BarringPerPLMN-List OPTIONAL,
        uac-BarringInfoSetList  UAC-BarringInfoSetList,
        uac-AccessCategory1-SelectionAssistanceInfo CHOICE {
            plmnCommon          UAC-AccessCategory1-SelectionAssistanceInfo,
            individualPLMNList  SEQUENCE (SIZE (2..maxPLMN)) OF
                                    UAC-AccessCategory1-SelectionAssistanceInfo
        }                                             OPTIONAL
    }                                                 OPTIONAL,
    useFullResumeID             ENUMERATED {true}     OPTIONAL,
    lateNonCriticalExtension    OCTET STRING          OPTIONAL,
    nonCriticalExtension        SIB1-v1610-IEs        OPTIONAL
}

CellAccessRelatedInfo ::= SEQUENCE {
    plmn-IdentityInfoList       PLMN-IdentityInfoList,
    cellReservedForOtherUse     ENUMERATED {true}     OPTIONAL,
    ...
}

PLMN-IdentityInfo ::= SEQUENCE {
    plmn-IdentityList           SEQUENCE (SIZE (1..maxPLMN)) OF PLMN-Identity,
    trackingAreaCode            TrackingAreaCode      OPTIONAL,
                                              -- BIT STRING (SIZE (24))
    ranac                       RAN-AreaCode          OPTIONAL,
                                              -- INTEGER (0..255)
    cellIdentity                CellIdentity,
                                              -- BIT STRING (SIZE (36))
    cellReservedForOperatorUse  ENUMERATED {reserved, notReserved},
    ...
}

ConnEstFailureControl ::= SEQUENCE {
    connEstFailCount            ENUMERATED {n1, n2, n3, n4},
    connEstFailOffsetValidity   ENUMERATED {s30, s60, s120, s240, s300,
                                            s420, s600, s900},
    connEstFailOffset           INTEGER (0..15)       OPTIONAL
}

UE-TimersAndConstants ::= SEQUENCE {
    t300  ENUMERATED {ms100, ms200, ms300, ms400, ms600, ms1000,
                      ms1500, ms2000},
    t301  ENUMERATED {ms100, ms200, ms300, ms400, ms600, ms1000,
                      ms1500, ms2000},
    t310  ENUMERATED {ms0, ms50, ms100, ms200, ms500, ms1000, ms2000},
    n310  ENUMERATED {n1, n2, n3, n4, n6, n8, n10, n20},
    t311  ENUMERATED {ms1000, ms3000, ms5000, ms10000, ms15000,
                      ms20000, ms30000},
    n311  ENUMERATED {n1, n2, n3, n4, n5, n6, n8, n10},
    t319  ENUMERATED {ms100, ms200, ms300, ms400, ms600, ms1000,
                      ms1500, ms2000},
    ...
}

UAC-BarringInfoSet ::= SEQUENCE {
    uac-BarringFactor           ENUMERATED {p00, p05, p10, p15, p20, p25,
                                            p30, p40, p50, p60, p70, p75,
                                            p80, p85, p90, p95},
    uac-BarringTime             ENUMERATED {s4, s8, s16, s32, s64, s128,
                                            s256, s512},
    uac-BarringForAccessIdentity BIT STRING (SIZE (7))
}

Listing 2. SIB1 and the four IEs this document works through in detail, abridged from TS 38.331. ServingCellConfigCommonSIB and SI-SchedulingInfo are left as type references -- see §10 and the companion 17 System Information document respectively.

15. Illustrative Message Traces

One cell throughout: PCI 217, PLMN 310-410, band n8 (FR1 low), 15 kHz SSB and PDCCH subcarrier spacing, 20 MHz channel, four SSBs, cellIdentity 0x01A2B3C40, TAC 0x4A2F1.

15.1 The MIB, decoded from the PBCH payload

08:15:02.104  [PHY] SSB detected  PCI 217  SS-RSRP -102.0 dBm
                    SS-RSRQ -11.0 dB  SS-SINR 14.2 dB
              PBCH DMRS hypothesis i_SSB = 2 correlated -> SSB index 2,
                    half frame 0   (L_max = 4, so i_SSB folds in n_hf)

08:15:02.104  [PHY] PBCH payload, 32 bits, descrambled
              0000 0110 0110 0100 1100 0100 0100 0000
              |-- BCCH-BCH-Message, 24b --| |8 PHY b|

08:15:02.104  [RRC-DL-BCCH] BCCH-BCH-Message
               message: mib                             -- CHOICE bit = 0
                systemFrameNumber ........... 000011      -- 6 MSBs = 3
                subCarrierSpacingCommon ..... scs15or60   -> 15 kHz (FR1)
                ssb-SubcarrierOffset ........ 6           -- 4 LSBs of k_SSB
                dmrs-TypeA-Position ......... pos2
                pdcch-ConfigSIB1 ............ 152
                  controlResourceSetZero .... 9
                  searchSpaceZero ........... 8
                cellBarred .................. notBarred
                intraFreqReselection ........ allowed
                spare ....................... 0

08:15:02.104  [PHY] the eight appended bits
                SFN LSBs 4,3,2,1 ............ 0100        -- = 4
                half frame .................. 0
                k_SSB MSB ................... 0           -- FR1, L_max=4
                reserved .................... 00

08:15:02.104  [RRC] assembled values
                SFN  = (000011 << 4) | 0100 = 0000110100b = 52
                k_SSB = (0 << 4) | 6 = 6      -- 6 x 15 kHz subcarriers

  -- Two things in this trace are NOT in the MIB: the SSB index (from the
  -- DMRS hypothesis) and the 4 SFN LSBs plus the k_SSB MSB (from the
  -- appended bits). An analyser that prints them alongside the MIB is
  -- combining three sources.

Listing 3. A MIB decode with the physical-layer contributions kept separate. The SFN assembly is the step most often skipped, and it is what makes every subsequent timing calculation possible.

15.2 From pdcch-ConfigSIB1 to a monitoring occasion

08:15:02.105  [RRC] pdcch-ConfigSIB1 = 152 -> (9, 8)

              {SS/PBCH block, PDCCH} SCS = {15, 15} kHz
              band n8, minimum channel bandwidth 5 MHz
              -> TS 38.213 Table 13-1

              controlResourceSetZero = 9
                multiplexing pattern ...... 1
                N_RB_CORESET .............. 48
                N_symb_CORESET ............ 2
                offset .................... 16 RB

              searchSpaceZero = 8   -> TS 38.213 Table 13-11
                O ......................... 0
                M ......................... 1
                first symbol index ........ 1

08:15:02.105  [RRC] CORESET#0 frequency position
                offsetToPointA ............ 42
                SSB lowest RB (CRB) ....... 42
                CORESET#0 lowest RB ....... 42 - 16 = 26
                CORESET#0 span ............ CRB 26 .. 73  (48 RB)
                carrier span .............. CRB 0 .. 105
                                            (106 PRB, 20 MHz @15 kHz)
                -> 26 >= 0 and 73 <= 105: CORESET#0 fits   OK

  -- Two comparisons. S15.6 is the same cell after the carrier was
  -- narrowed and this check was not repeated.

08:15:02.105  [RRC] Type0-PDCCH monitoring occasions, mu = 0, N_slot = 10
                n_0 = (O x 2^mu + FLOOR(i x M)) mod N_slot
                i = 0 -> n_0 = 0, even SFN, slots 0 and 1
                i = 1 -> n_0 = 1, even SFN, slots 1 and 2
                i = 2 -> n_0 = 2, even SFN, slots 2 and 3   <- our SSB
                i = 3 -> n_0 = 3, even SFN, slots 3 and 4
              -> monitor slots 2 and 3 of even radio frames,
                 symbols 1 and 2, SI-RNTI 0xFFFF

Listing 4. The full derivation, including the carrier-fit check that §13 row 3 is about. It costs one subtraction and one addition, and it prevents a cell that no UE can use.

15.3 SIB1, decoded

08:15:02.148  [PHY] SFN 54 slot 2 sym 1  PDCCH DCI 1_0, CRC = SI-RNTI
                    -> PDSCH 28 PRB, MCS 4, TBS 1288 bits
08:15:02.149  [RRC-DL-BCCH] SIB1

 cellSelectionInfo
  q-RxLevMin ......................... -60      -- = -120 dBm
  q-RxLevMinOffset ................... (absent) -- = 0 dB
  q-QualMin .......................... -18      -- dB
  q-QualMinOffset .................... (absent) -- = 0 dB

 cellAccessRelatedInfo
  plmn-IdentityInfoList
   [1] plmn-IdentityList
        [1] mcc 310  mnc 410
       trackingAreaCode ............... 0x4A2F1
       ranac ......................... 12
       cellIdentity .................. 0x01A2B3C40   -- 36 bits
       cellReservedForOperatorUse .... notReserved
  cellReservedForOtherUse ............ (absent)

 connEstFailureControl
  connEstFailCount ................... n2
  connEstFailOffsetValidity .......... s300
  connEstFailOffset .................. 10        -- dB

 si-SchedulingInfo .................... (see companion doc 17)

 servingCellConfigCommon
  downlinkConfigCommon
   frequencyInfoDL
    offsetToPointA ................... 42
   initialDownlinkBWP
    genericParameters
     locationAndBandwidth ............ 28875     -- 106 PRB from PRB 0
     subcarrierSpacing ............... kHz15
   bcch-Config
    modificationPeriodCoeff .......... n4
   pcch-Config
    defaultPagingCycle ............... rf128
  uplinkConfigCommon
   frequencyInfoUL
    p-Max ........................... 23        -- dBm
   initialUplinkBWP
    rach-ConfigCommon ............... (see companion doc 03)
   timeAlignmentTimerCommon ......... ms1920
  ssb-PositionsInBurst
   inOneGroup ...................... 11110000   -- SSB 0..3 transmitted
  ssb-PeriodicityServingCell ........ ms20
  ss-PBCH-BlockPower ................ 18        -- dBm EPRE
  n-TimingAdvanceOffset ............. (absent)

 ims-EmergencySupport ................ true

 ue-TimersAndConstants
  t300 ms1000  t301 ms1000  t310 ms1000  n310 n10
  t311 ms10000 n311 n1      t319 ms1000

 uac-BarringInfo
  uac-BarringForCommon
   [1] accessCategory 7  uac-barringInfoSetIndex 2
  uac-BarringInfoSetList
   [1] uac-BarringFactor p95  uac-BarringTime s4
       uac-BarringForAccessIdentity 0000000
   [2] uac-BarringFactor p40  uac-BarringTime s32
       uac-BarringForAccessIdentity 0111111

Listing 5. A complete, realistic SIB1. Every value in it is used somewhere in §7 to §12, and the uac-BarringInfoSetList here is the one the worked barring check in §12.1 uses.

15.4 The cell selection decision

08:15:02.150  [RRC] cell suitability evaluation, PCI 217
              MIB cellBarred .................. notBarred        PASS
              SIB1 acquired ................... yes              PASS
              cellReservedForOtherUse ......... absent           PASS
              selected PLMN 310-410 in list ... yes, index 1     PASS
              cellReservedForOperatorUse ...... notReserved      PASS
              trackingAreaCode ................ 0x4A2F1 present  PASS
              TAI 310-410-4A2F1 in forbidden lists .. no         PASS

              S-criterion
                Q_rxlevmeas ................... -102.0 dBm
                q-RxLevMin x 2 ................ -120.0 dBm
                q-RxLevMinOffset x 2 .......... 0.0 dB
                p-Max ......................... 23 dBm
                P_PowerClass .................. 23 dBm (class 3)
                Pcompensation = max(23-23,0) .. 0.0 dB
                Qoffset_temp .................. 0.0 dB
                Srxlev = -102 - (-120) - 0 - 0 = +18.0 dB         PASS

                Q_qualmeas .................... -11.0 dB
                q-QualMin ..................... -18 dB
                Squal  =  -11 - (-18) - 0     = +7.0 dB           PASS

08:15:02.150  [RRC] cell 217 is SUITABLE -> camp on it
08:15:02.151  [RRC] adopt ue-TimersAndConstants from SIB1
              t300 1000 ms, t310 1000 ms, n310 10, t311 10000 ms

Listing 6. Every gate in figure 7, evaluated in order, with the arithmetic of §8 shown. A log in this shape answers the "why did the UE not camp here" question in one screen.

15.5 The access barring check

08:17:44.902  [NAS] MO data attempt -> Access Category 7,
                    Access Identities held: { 0 }
08:17:44.902  [RRC] UAC check, PCI 217, selected PLMN index 1
              uac-BarringPerPLMN-List ......... absent
              -> use uac-BarringForCommon
              accessCategory 7 -> uac-barringInfoSetIndex 2
              set[2] uac-BarringFactor ........ p40   (0.40)
                     uac-BarringTime .......... s32   (32 s)
                     uac-BarringForAccessIdentity 0111111

              access identity check
                bitmap covers identities 1,2,11,12,13,14,15
                UE holds none of them -> no exemption, must draw

              rand1 = 0.5473   >= 0.40  -> BARRED
              rand2 = 0.6200
              T390(cat 7) = (0.7 + 0.6 x 0.6200) x 32 = 34.30 s
08:17:44.902  [RRC] access barred for Access Category 7, T390 started
              -- Access Category 0 is unaffected: a page can still be
              -- answered during these 34.3 s

08:17:52.310  [RRC] paging received -> Access Category 0, never barred
08:17:52.310  [RRC] RRCSetupRequest, establishmentCause mt-Access

08:18:19.204  [RRC] T390(cat 7) expired -> Access Category 7 allowed again

Listing 7. The barring check and its selective effect. A cell in this state shows healthy paging response counts and almost no MO access, which is correct behaviour and not a fault.

15.6 Failure path: CORESET#0 outside the carrier

-- Same MIB and same SSB position as S15.1, but the DL carrier was
-- narrowed from 106 PRB to 52 PRB (20 MHz -> 10 MHz) while
-- pdcch-ConfigSIB1 was left at 152 and offsetToPointA at 42.

09:02:11.070  [PHY] SSB detected  PCI 217  SS-RSRP -98.0 dBm
09:02:11.070  [RRC] MIB decoded, cellBarred = notBarred
09:02:11.070  [RRC] pdcch-ConfigSIB1 152 -> CORESET#0 index 9
                    N_RB_CORESET 48, offset 16
              SSB lowest CRB .................. 42
              CORESET#0 span .................. CRB 26 .. 73
              carrier .......................... CRB 0 .. 51
                                                 (52 PRB, 10 MHz @15 kHz)
              -> CORESET#0 requires CRB up to 73; the carrier ends at 51

09:02:11.070  [PHY] monitoring slots 2,3 of even SFN, symbols 1-2
09:02:11.230  [PHY] no PDCCH candidate decoded with SI-RNTI
09:02:11.550  [PHY] no PDCCH candidate decoded with SI-RNTI
09:02:12.190  [PHY] no PDCCH candidate decoded with SI-RNTI
09:02:12.190  [RRC] SIB1 acquisition failed
              -> TS 38.331 cl. 5.2.2.1: consider the cell as barred
              -> bar for 300 s; intraFreqReselection = allowed, so other
                 cells on this frequency remain candidates
09:02:12.191  [RRC] no other suitable cell on this frequency
              -> search other frequencies / RATs

-- gNB-side evidence over the same interval:
     PRACH preambles received ................. 0
     RRC connection establishment attempts .... 0
     SIB1 transmissions ....................... normal
     alarms, error counters, KPI degradation ... none

-- The cell is transmitting SSB and SIB1 perfectly. It is simply
-- unreachable, and the only place that shows is the subtraction
-- 42 - 16 = 26, 26 + 48 = 74 > 52.

Listing 8. The most consequential failure in this document, in full. A bandwidth change that left pdcch-ConfigSIB1 alone produces a cell that looks perfect from the network side and is invisible from the UE side.

16. Release Deltas: Rel-15 to Rel-18

Table 15. MIB and SIB1 changes by release. The asymmetry is the point: the MIB is frozen by its own encoding, while SIB1 has grown a long non-critical extension chain that a decoder must be built for.

17. Reading MIB and SIB1 in Logs: A Checklist

1. Split `pdcch-ConfigSIB1` immediately. Integer-divide by 16 for controlResourceSetZero, take the remainder for searchSpaceZero. A single decimal number in a log tells you nothing until you do (§4).

2. Confirm which CORESET#0 table applies before using a row. It is chosen by the {SS/PBCH block, PDCCH} subcarrier-spacing pair and the band's minimum channel bandwidth. Using the wrong table produces plausible numbers and a cell nobody can decode.

3. Check that CORESET#0 fits the carrier. Compute the SSB's lowest common RB, subtract the offset, add N_RB, and compare both ends against the carrier. This is one subtraction and one addition and it catches the single worst failure in this document (§15.6).

4. Compute the Type0-PDCCH occasions for every SSB index, not just #0, and cross-check them against tdd-UL-DL-ConfigurationCommon. Beam-specific SIB1 failure is invisible in aggregate statistics (§5.2).

5. Multiply `q-RxLevMin` by two before doing anything with it. Same for q-RxLevMinOffset. q-QualMin and q-QualMinOffset are plain dB. Two different scalings inside one IE (§8).

6. Check whether `q-QualMin` is present at all. Absent means Q_qualmin is negative infinity and the quality criterion is disabled, which lets UEs camp on cells they cannot use.

7. Read `connEstFailOffset` as 15 dB when it is absent, not as zero. Absence is the harshest setting available.

8. Check `trackingAreaCode` for the selected PLMN entry. Its absence means the cell is SCell/PSCell-only, which explains measurement activity with no access attempts (§7).

9. Read all three barring mechanisms, not just `cellBarred`. cellReservedForOtherUse bars the whole cell; cellReservedForOperatorUse bars it per PLMN for UEs without Access Identity 11 or 15; and from Rel-17 cellBarredRedCap bars it for one UE class only.

10. Resolve `selectedPLMN-Identity` against the SIB1 from the same cell. It is a 1-based index into the flattened PLMN list, not a PLMN value, and a different cell's SIB1 will resolve it to the wrong operator.

11. Sanity-check `ss-PBCH-BlockPower` against the cell's actual EIRP. Every UE's open-loop PRACH power derives from it, so an error here looks exactly like a coverage problem (§10).

12. Read `t310` and `n310` before investigating an RLF rate. ms0 and ms50 produce radio link failures from conditions a normal cell absorbs (§11).

13. For UAC, read the access-identity bitmap first and remember that 0 means not barred. Then check whether Access Category 0 traffic is present -- if paging responses are healthy and MO access is near zero, the cell is barred as configured, not broken (§12).

18. Glossary

ssb-SubcarrierOffset

19. References

• 3GPP TS 38.331 -- RRC protocol specification. Clause 5.2.2.1 (SI acquisition, including the requirement to treat the cell as barred on SIB1 failure), 5.3.14 (unified access control), 6.2.2 (message definitions: BCCH-BCH-Message, MIB, SIB1), 6.3.2 (IE definitions: CellAccessRelatedInfo, PLMN-IdentityInfo, ConnEstFailureControl, PDCCH-ConfigSIB1, ServingCellConfigCommonSIB, UAC-BarringInfoSet, UE-TimersAndConstants), 7.1 (UE timers and constants defaults).
• 3GPP TS 38.212 -- Multiplexing and channel coding. Clause 7.1.1 (PBCH payload generation and the eight appended bits), 7.1.2 (PBCH scrambling), 7.1.3-7.1.5 (CRC, polar coding, rate matching).
• 3GPP TS 38.211 -- Physical channels and modulation. Clause 7.4.1.4 (PBCH DM-RS, including the sequence initialisation that carries the SSB index), 7.4.3 (SS/PBCH block structure and candidate positions).
• 3GPP TS 38.213 -- Physical layer procedures for control. Clause 10.1 (search space sets and the common search space types), clause 13 (CORESET#0 and searchSpaceZero, Tables 13-1 to 13-10 for the control resource set and Tables 13-11 to 13-13 for the monitoring occasions).
• 3GPP TS 38.304 -- UE procedures in idle mode and RRC inactive state. Clause 5.2.3.2 (cell selection criterion S), 5.2.4 (cell reselection), 5.3.1 (cell status and barring, including cellReservedForOperatorUse handling).
• 3GPP TS 38.101-1 / 38.101-2 -- UE radio transmission and reception, for the power classes that P_PowerClass in the Pcompensation term refers to, and for the per-band minimum channel bandwidths that select the CORESET#0 table.
• 3GPP TS 24.501 -- NAS protocol for 5GS. Clause 4.5.2 (access categories and access identities, the NAS half of unified access control).
• 3GPP TS 22.261 -- Service requirements for the 5G system, for the definitions of the access identities in §12.
• 3GPP TS 23.003 -- Numbering, addressing and identification. Clause 19.6 (NR Cell Global Identity and the gNB ID / cell ID split within the 36-bit cellIdentity).

Companion documents in this set

• 17 System Information -- how SIB2 and beyond are scheduled, notified and re-acquired; the si-SchedulingInfo branch this document leaves as a type reference.
• 02 Radio Frame Structure -- SFN, half-frames, slots per frame, and the SSB candidate positions the L_max discussion of §2.1 depends on.
• 03 Random Access -- the rach-ConfigCommon inside initialUplinkBWP, the open-loop power formula that consumes ss-PBCH-BlockPower, and the connEstFailReport of §9.
• 01 Registration Process -- what the UE does with SIB1 once it has it, and the cell-selection and barring gates of figure 7 in their procedural context.
• 16 RLM and RLF -- what t310, n310, t311 and n311 from §11 actually govern.
• 19 Paging -- pcch-Config and defaultPagingCycle from §10, and the paging occasion arithmetic they drive.
• 14 RRC States -- useFullResumeID and the RRC_INACTIVE resume identity of §6.
• 12 Beam Failure Recovery -- what ssb-PositionsInBurst from §10 means for beam management.
• 20 Measurements and Events -- the reselection thresholds and offsets SIB2 to SIB5 carry, which build on the S-criterion of §8.