SSB & Cell Search — How a Phone Finds a Cell in 5G NR

1. What the UE Does Not Know at Power-On

Start with the honest position. A UE that has just been powered on, or that has just walked out of a tunnel, holds no information about the radio world around it. It does not know which frequency any base station is transmitting on. It does not know when an OFDM symbol begins, so it cannot run a Fourier transform in a way that produces anything but noise. It does not know when a radio frame begins, so even a perfectly decoded message would carry no timestamp it could use. And it does not know the identity of any cell, so it has nothing to tell the network about where it is.

That is four separate unknowns, and they are circular. You cannot demodulate without timing. You cannot get timing without knowing which frequency to look at. You cannot know which frequency to look at without having found something. Cell search is the procedure that breaks the circle, and the way it breaks it is with a signal whose shape is known in advance even though its position is not — a signal a receiver can recognise by correlation rather than by decoding.

That signal is the SS/PBCH block, universally shortened to SSB. SS stands for Synchronisation Signals and PBCH for Physical Broadcast Channel; the block bundles both into one small, rigidly specified rectangle of the time-frequency grid. It is the only thing in NR a UE can find with no prior information whatsoever, and everything else the UE ever does hangs off having found it.

Table 1. The six things cell search produces, in the order it produces them. Each row depends on every row above it — this is a chain, not a checklist.

2. The Cost of Blind Search, in Seconds

It is worth being concrete about the search-time problem before looking at any of the machinery, because the machinery only makes sense as an answer to it. Searching for a signal you cannot predict costs time in proportion to the number of guesses you have to make. Every guess about frequency has to be tested by listening for long enough to be confident the signal is genuinely absent rather than merely weak, and "long enough" is measured in whole SSB repetition periods, not in microseconds.

So the search time is roughly the number of candidate frequencies multiplied by the dwell time per candidate. Both factors are design choices, and 3GPP pushed on both:

• The number of candidate frequencies is bounded by making the synchronisation raster deliberately coarse and then, per band, publishing a short list of the raster points that are actually allowed there. On band n78 that list has 341 entries. If the SSB could sit anywhere on the channel raster it would have about 33 000.
• The dwell time per candidate is bounded by requiring the SSB to repeat at least every 20 ms for the purposes of initial search TS 38.213 cl. 4.1, regardless of what the cell has actually configured. A UE therefore never has to wait longer than 20 ms to know whether it should have heard something.

Three consequences follow, and they explain design decisions that look arbitrary in isolation:

Table 2. Six choices in the SSB and raster design, each traced back to the search-time budget. Section references in the middle column point at where the mechanism is described.

3. Three Rasters, and Why There Have To Be Three

This is the section that exists because the word raster is used for three different things and they get mixed up constantly. A raster, plainly, is an agreed grid of permitted frequencies — a list of the only places something is allowed to sit. NR has three such grids, nested inside one another, each answering a different question:

1. The global frequency raster. Question: what shall we call this frequency? It is a numbering scheme covering everything from 0 to 100 GHz in fixed steps, so that any frequency the system can name has exactly one number. That number is the NR-ARFCN (NR Absolute Radio Frequency Channel Number). It grants no permission at all; it is a dictionary, not a rule.
2. The channel raster. Question: where may the centre of a carrier sit? This is a per-band subset of the global raster. Its step size is called ΔF_Raster and it varies by band — 100 kHz for many older FR1 bands, 15 or 30 kHz for the newer mid-band ones. It constrains network planning, and it is what an operator's carrier centre frequency is quoted against.
3. The synchronisation raster. Question: where may an SSB sit? This is a much sparser grid again, with its own numbering — the GSCN, Global Synchronisation Channel Number. It is the list of detents on the dial from §1, and it is deliberately coarse because a UE has to search it blind.

Table 3. The three rasters side by side. The bottom-but-one row is the one worth memorising: on a single band the three grids differ by two orders of magnitude in density.

4. The Global Frequency Raster and the NR-ARFCN

The global raster is the simplest of the three and the easiest to explain in words: it is a ruler laid along the whole usable spectrum, with marks at regular intervals, and every mark has a number. The numbering starts at zero at DC and counts upward. Because the useful step size is not the same at 700 MHz as it is at 39 GHz — a 5 kHz step would need twenty million numbers to reach 100 GHz — the ruler changes its step twice, at 3 GHz and at 24.25 GHz.

The conversion from number to frequency is one equation TS 38.104 cl. 5.4.2.1:

F_REF  =  F_REF_Offs  +  DELTA_F_Global  x  ( N_REF  -  N_REF_Offs )

  F_REF          the RF reference frequency, in Hz
  N_REF          the NR-ARFCN -- the channel number itself
  DELTA_F_Global the global raster step for this frequency range
  F_REF_Offs     the frequency at which this range's counting starts
  N_REF_Offs     the channel number at which this range's counting starts

In plain terms: the ARFCN is just a channel number, and this equation converts it to a frequency in hertz by counting a whole number of fixed-size steps up from a fixed starting point. The two Offs quantities exist only so that the three ranges join up without overlapping or leaving a gap — each range restarts its counting where the previous one stopped.

Table 4. The three global raster ranges, TS 38.104 Table 5.4.2.1-1. The last column is the arithmetic check that each range really does reach its stated ceiling — worth doing once, because an off-by-one in N_REF_Offs is a silent 15 kHz error in everything downstream.

5. The Channel Raster: Which ARFCNs May Be a Carrier Centre

The global raster names every frequency; the channel raster says which of those names an operator is actually allowed to use for the centre of a carrier. It is a filter, nothing more: take the global raster, keep every Nth point, throw the rest away. The keep-every-Nth spacing is called ΔF_Raster and it is fixed per band in TS 38.101-1 for FR1 and TS 38.101-2 for FR2.

Why do bands differ? Because bands were defined at different times, for different technologies, by different regulators. A band that was originally an LTE band inherits LTE's 100 kHz planning grid, because existing licences, existing filters and existing planning tools all assume it. A band defined for NR from the start can afford a finer grid — 15 or 30 kHz, matching the subcarrier spacing — which lets an operator place a carrier so that it fits its licensed block exactly rather than wasting up to 100 kHz at one edge. Finer is better for spectral efficiency and worse for interoperability with anything that predates it.

Table 5. Channel raster spacing for a representative spread of bands, from TS 38.101-1 Table 5.4.2.3-1 and TS 38.101-2 Table 5.4.2.3-1. Where two values are listed the band supports two carrier subcarrier spacings and the raster follows. Always read the current table for the band you are actually working on — these change between releases as bands are extended.

For planning purposes the channel raster interacts with two other constraints that are easy to forget. First, the carrier must fit inside the band: the centre frequency plus half the transmission bandwidth must not exceed the band edge, which pulls the usable centre frequencies in from both ends by half a carrier. Second, the carrier's own resource block grid has to be expressible — the relationship between the carrier centre, the transmission bandwidth in PRBs and the guard bands is fixed by TS 38.101-1 cl. 5.3, and the companion 02 Radio Frame Structure document has the PRB tables.

6. The Synchronisation Raster and the GSCN

Now the raster that matters most for this document. The synchronisation raster is the list of frequencies at which an SSB is permitted to be centred, and it is far coarser than either of the other two. The reason is the one from §2 and it is worth stating flatly: every extra permitted position costs the UE real seconds of blind search, so the specification made the list as short as it could while still leaving operators somewhere sensible to put the block in every band. Coarseness here is not laziness; it is the product.

Each permitted position has a number of its own, the GSCN. The GSCN is not an ARFCN and does not share its numbering — it is a separate, compact index that runs from 2 to 26639 across the entire spectrum. There are three regions, matching the three global raster ranges but with completely different arithmetic TS 38.104 cl. 5.4.3.1:

0 - 3000 MHz
  SS_REF = N x 1200 kHz  +  M x 50 kHz      N = 1 .. 2499, M in {1, 3, 5}
  GSCN   = 3N + (M - 3) / 2                 GSCN = 2 .. 7498

3000 - 24250 MHz
  SS_REF = 3000 MHz + N x 1.44 MHz          N = 0 .. 14756
  GSCN   = 7499 + N                         GSCN = 7499 .. 22255

24250 - 100000 MHz
  SS_REF = 24250.08 MHz + N x 17.28 MHz     N = 0 .. 4383
  GSCN   = 22256 + N                        GSCN = 22256 .. 26639

In plain terms, all three lines say the same thing: pick an integer, multiply it by a fixed step, add a fixed base, and you have the centre frequency of a permitted SSB position. The GSCN is simply that integer shifted so that the three regions produce one continuous, non-overlapping numbering. Two details deserve their own explanation.

6.1 What M is for, and why it only exists below 3 GHz

Below 3 GHz the step is not really 1.2 MHz. Each 1.2 MHz position is split into three sub-positions 50 kHz apart, selected by M ∈ {1, 3, 5} — that is, at −50 kHz, 0 and +50 kHz relative to the nominal N × 1.2 MHz point, since M = 3 gives 150 kHz and the other two give 50 and 250 kHz. M = 3 is the ordinary case and is what the great majority of deployed cells use.

M exists because the sub-3 GHz bands are almost all refarmed from LTE or earlier, with licensed blocks whose edges do not line up with a 1.2 MHz grid. Without the ±50 kHz freedom there would be bands in which no legal SSB position existed at all inside a narrow licence. Above 3 GHz the bands are wide and NR-native, the problem does not arise, and M was dropped — which is why a GSCN step of 1 means 1.44 MHz above 3 GHz but only 50 kHz below it.

6.2 Why the steps above 3 GHz are what they are

The two upper steps look like arbitrary decimals and are not. They are chosen to be whole numbers of resource blocks at the subcarrier spacing that band range uses:

Table 6. The raster steps are chosen for grid alignment, and the one region where alignment was impossible is the one region where k_SSB needs an extra bit. The two facts are the same fact.

7. Per-Band GSCN Ranges, With n78 Worked Through

The raster equations of §6 define far more positions than any UE ever tests. Between 3 and 24.25 GHz alone there are 14 757 of them. A UE searching band n78 does not test 14 757 frequencies; it tests the ones that fall inside n78 and are listed as usable for that band. That list is published per band, as a first value, a step and a last value, in TS 38.104 Table 5.4.3.3-1.

The list is narrower than "every raster point inside the band" for a practical reason: the SSB has to fit inside a carrier, and the carrier has to fit inside the band. A raster point 1 MHz from the band edge is arithmetically fine and physically useless, because no legal carrier of the band's minimum bandwidth could contain an SSB there. So the ends get trimmed.

Table 7. Six bands from TS 38.104 Table 5.4.3.3-1. Bands that support two SSB subcarrier spacings appear twice in the real table, once per SCS, with different GSCN ranges — n41 is the usual example. Always read the entry for the SSB SCS the cell actually uses, and read it from the release your equipment implements: ranges have been extended as bands were widened.

8. The SS/PBCH Block, Resource Element by Resource Element

The SSB is a fixed rectangle: four OFDM symbols by 240 contiguous subcarriers. 240 subcarriers is 20 resource blocks, so the block is 7.2 MHz wide at 30 kHz spacing, 3.6 MHz at 15 kHz, 28.8 MHz at 120 kHz. Nothing about that rectangle is configurable. It cannot be, because a UE has to be able to recognise it without having been told anything, and you cannot recognise a shape that varies.

Inside the rectangle, four things share the space: the primary synchronisation signal, the secondary synchronisation signal, the broadcast channel, and the broadcast channel's own reference signal. Their positions are given exactly in TS 38.211 cl. 7.4.3.1, Table 7.4.3.1-1, and the companion 02 Radio Frame Structure document has the same mapping at survey level. What follows adds the two things that survey does not: the guard regions dimensioned, and the reference-signal comb at resource-element resolution.

Table 8. TS 38.211 Table 7.4.3.1-1, laid out by subcarrier range. k is counted from the block's own lowest subcarrier, so k = 0 is not a carrier subcarrier index — converting between the two is what §17 is about.

8.1 The guard bands around SSS, and what they cost

The eight subcarriers below the SSS and the nine above it are transmitted as zero. They are there so that PBCH energy in the same symbol does not leak into the SSS correlation through the receiver's channel filter — the SSS is being detected at low signal-to-noise ratio and against 336 hypotheses, and adjacent-subcarrier interference from a signal 20 dB stronger would matter. The asymmetry, eight below and nine above, is simply because 240 − 127 = 113 is odd and the SSS is centred as nearly as it can be.

Those seventeen zeroed subcarriers, plus the requirement to leave the SSS's own 127 alone, are the reason PBCH gets 576 resource elements rather than the 720 that three full symbols would give:

8.2 Where the PBCH DM-RS actually sits

The PBCH's demodulation reference signal is not in a symbol of its own. It is interleaved with the PBCH data at a density of one resource element in four, on subcarriers k = 4n + ν where ν = N_ID^cell mod 4 TS 38.211 cl. 7.4.1.4. In words: the reference signal occupies every fourth subcarrier, and which of the four it occupies is decided by the cell identity.

The DM-RS sequence itself is initialised from the cell identity and from the candidate SSB index, which is the mechanism by which a UE learns which beam it is looking at before it has decoded a single bit of the MIB. That is §12. The sequence generation is owned by the companion 33 DMRS document and is not repeated here.

9. PSS: Three Sequences, Found With No Timing At All

The primary synchronisation signal is the first thing the UE finds and the only thing it can find with no help. Everything about it is shaped by that. It has to be recognisable when the receiver does not know where a symbol starts, does not know the exact frequency, and has no channel estimate — so it cannot be a coded message, because there is nothing to demodulate against. It has to be a known waveform that the receiver slides along the incoming samples looking for a correlation peak.

An m-sequence — short for maximum-length sequence — is the standard choice for that job. It is a binary sequence generated by a shift register with feedback, and its defining property is that it correlates strongly with itself and weakly with a shifted copy of itself. In plain terms: slide it along a noisy recording and you get one sharp spike where it matches and near-nothing everywhere else. That spike is the symbol timing.

NR's PSS is a length-127 m-sequence, and the three PSS variants are three different cyclic shifts of the same sequence TS 38.211 cl. 7.4.2.2.1:

d_PSS(n) = 1 - 2 x( m )        n = 0, 1, ... , 126

  m = ( n + 43 x N_ID_2 ) mod 127

  generator:  x(i+7) = ( x(i+4) + x(i) ) mod 2
  initial:    [x(6) x(5) x(4) x(3) x(2) x(1) x(0)] = [1 1 1 0 1 1 0]

  N_ID_2 in {0, 1, 2}   ->   cyclic shifts of 0, 43 and 86
  mapped to symbol l = 0, subcarriers k = 56 .. 182

In plain terms: one 127-symbol pattern exists, generated by that seven-stage shift register. The three PSS signals are that pattern read starting from position 0, position 43 and position 86. The mapping 1 − 2x turns the binary 0/1 into +1/−1, which is BPSK. And because 43 and 86 are roughly a third and two thirds of 127, the three shifts are spaced as far from each other as three shifts can be — so a receiver that finds a peak for one of them will not accidentally find a significant peak for another.

Table 9. PSS at a glance. The last row is the one people forget: after PSS the UE knows when a symbol begins but has no idea what time it is.

10. SSS, and the Cell Identity Completed

By the time the UE looks for the secondary synchronisation signal, it already knows where a symbol boundary is and roughly what the frequency error is. That changes the problem completely. It no longer has to slide a template along an unknown number of sample offsets; it knows exactly which resource elements to look at, because SSS sits in symbol 2 of the same block, on the same 127 subcarriers as PSS. All it has to do is work out which of the possible sequences arrived. That is one correlation window against 336 candidates, which is cheap, and it is why SSS is allowed to carry far more information than PSS.

SSS is built from two different m-sequences multiplied together — a construction called a Gold sequence, which yields many more distinguishable members than a single m-sequence of the same length could TS 38.211 cl. 7.4.2.3.1:

d_SSS(n) = [ 1 - 2 x0( (n + m0) mod 127 ) ]
         x [ 1 - 2 x1( (n + m1) mod 127 ) ]      n = 0 .. 126

  m0 = 15 x FLOOR( N_ID_1 / 112 )  +  5 x N_ID_2
  m1 = N_ID_1 mod 112

  x0(i+7) = ( x0(i+4) + x0(i) ) mod 2
  x1(i+7) = ( x1(i+1) + x1(i) ) mod 2
  both initialised to [x(6)..x(0)] = [0 0 0 0 0 0 1]

  N_ID_1 in 0 .. 335   ->   3 values of FLOOR(N_ID_1/112) x 112 of (N_ID_1 mod 112) = 336
  mapped to symbol l = 2, subcarriers k = 56 .. 182

In plain terms: two shift registers with different feedback taps produce two 127-length patterns; the SSS is the element-by-element product of those two patterns, each started at its own offset. The pair of offsets (m0, m1) is what encodes the identity. m1 takes 112 values and the coarse part of m0 takes 3, giving 3 × 112 = 336 distinguishable sequences. Note that m0 also depends on N_ID2 — the SSS sequence is not independent of the PSS, which is a small but real detail: a receiver has to know N_ID2 before it can search SSS efficiently, reinforcing the ordering.

10.1 Putting the two halves together

The physical cell identity — PCI, the number every log, every measurement report and every neighbour relation uses to name a cell — is simply the two halves combined TS 38.211 cl. 7.4.2.1:

N_ID_cell  =  3 x N_ID_1  +  N_ID_2

  N_ID_1  from SSS,  0 .. 335
  N_ID_2  from PSS,  0 .. 2

  ->  N_ID_cell = 0 .. 1007      1008 identities in total

and in reverse:
  N_ID_2 = N_ID_cell mod 3
  N_ID_1 = FLOOR( N_ID_cell / 3 )

In plain terms, PCI is a two-digit number in a mixed base: the SSS supplies the high digit in base 336 and the PSS supplies the low digit in base 3. Multiplying the SSS half by three and adding the PSS half is exactly how you reassemble it, and dividing by three with remainder is exactly how you take it apart.

Table 10. PSS and SSS compared. The information rows explain the design: 1.58 bits where searching is expensive, 8.39 bits where it is not. Ten bits of identity in total, which is 1024 — of which 1008 are used, because 336 × 3 does not reach 1024.

11. The Search Procedure, Step by Step

With the pieces described, the procedure itself is short to state. The UE works down a list of candidate frequencies, and at each one it listens for the one thing it can recognise blind. When it finds it, it stops scanning and starts a fixed sequence of steps, each of which resolves one more unknown, until it has the MIB and can go and fetch SIB1. If any step fails it either retries with more accumulation or goes back to scanning.