In order to understand LTE network entry steps, we must have knowledge of physical channels which you can get from my article “LTE Frame Structure Made Simple“.
The first thing UE needs to do is to search for Primary Synchronization Signal (PSS). The location of PSS is in the 1st and 6th subframe of LTE and within the subframe it exists on the last symbol of the slot. So, once the UE has decoded the PSS, it gets the following information.
- PSS gives the slot boundary timing independant of the CP length, so syncs at slot level.
- It provides the center frequency as it is around the DC carrier.
After this, the UE starts looking for the Secondary Synchronization Signal (SSS) which is just one symbol before the PSS. The PSS is on the 7th symbol of the 1st slot of 1st & 6th subframe while SSS lies on the 6th symbol. After decoding SSS, the UE gets the following information.
- UE gets to know the CP length as it has the duration of two consecutive symbols (SSS and PSS) so it can derive whether the eNB is using normal CP or extended CP.
- Since the location of SSS and PSS differs in TDD and FDD so the UE can also find out the frame type.
- Next thing to find out is the start of the frame. As SSS & PSS exist in both Subframe 1 and 6, so the UE needs to know which of the frame is the 1st subframe. That is why the SSS is different in both subframes and therefore, after decoding the SSS, the UE can understand which is the 1st subframe. So, this ensures that the UE is synchronized at both frame and symbol level.
The PCI (Physical Cell Identity) is made up of a combination of PSS & SSS with the following equation
PCI = 3(SSS) + PSS
Once, the UE has decoded both the PSS and SSS, it can derive the PCI which tells the location of the RS and the PCFICH. This lets the UE get the RSRP and verify that the cell is above the cell selection threshold. Then it goes for PBCH which is after the PSS of the first subframe. PBCH tells about the system BW, System frame number, PHICH config and number of Tx. Now that the UE knows PHICH, PCFICH and RS location, all the other REs belong to PDCCH.
The UE looks for the DCI for SIB-1 by decoding the DCI masked with CRC of SI-RNTI. The SIB-1 is sent after every 20 ms but the TTI is 80 ms (like PBCH – comes every 10 ms but the TTI is 40 ms). The copies of SIB-1 after 20 ms are different redundacny versions of the same SIB-1. The SIB-1 tells about the other SIBs (SI periodicity and SI Window length), including SIB-2 which tells about the RACH information required for uplink synchronization.
The location of RACH is determined by the following parameters in SIB-2
PRACH CONFIGURATION INDEX ==> Tells the SFN (even/odd) and subframe number – thus the location in time domain
PRACH FREQUENCY OFFSET ==> Tells the PRB offset and thus the location in frequency domain
NCS VALUE ==> Tells the NCS value and the number of root sequences per cell needed to generate 64 preambles
ROOT SEQUENCE INDEX ==> Tells the starting root sequence index for the cell
Based on these values, the UE generates a random preamble and sends a RACH request. After the RACH request, the UE needs to start reading PDCCH for its RA-RNTI after 3 subframes (3 SF after the prach preamble transmission is finished). The RA RSP WINDOW SIZE tells the maximum number of subframes within which the eNB needs to send the RAR. Usually, it is set to 10 SF and therefore the eNB needs to respond to a PRACH request within 12 SF. The RAR contains RA-RNTI or temporary C-RNTI and RAPID (which contains the preamble ID that UE sent).
Once RAR is received, the UE sends msg3 which is RRC Conn Req message that contains UE ID (TMSI or random value). eNB responds with a MCE Contention resolution message before RRC Conn Setup and that contention resolution message contains the same UE ID that is sent by UE in RRC Conn Req message. So, if there are two UEs using the same preamble, then at this step the contention will be resolved. As the UE with the same ID will send the HARQ ACK to Contention resolution message but the other UE will consider RACH failure and re-initiate RACH. In response to RRC Connection Request, eNB sends a RRC Connection Setup which carries SRB1 (Signalling Radio Bearer) addition parameters. Before this, the UE uses SRB0 to send the RRC message.
Once the UE gets RRC Connection Setup message, the UE responds with the RRC Setup Complete message. It is this message that carries NAS messages. At this moment, the RRC setup is completed and SRB1 is also setup.
Based on this, the eNB initiates S1 Initial UE message to the MME and MME can respond to this message in different ways but the most common response is S1 Initial Context Setup Request. This message is considered as the ERAB Setup Request and it usually contains the ERAB-ID and QCI that has to be setup for the UE along with MBR configuration of the bearer.Consequently, the eNB reconfigures UE using RRC Connection Reconfiguration message which contains the addition for SRB2 and DRB (data radio bearer) based on the QCI requirement. eNB also sends Security Mode Command to UE to configure the security context at this stage. Once this is done, the eNB responds to MME with S1 Initial Setup Response and at this point the ERAB Setup is considered successful.
If you have any questions or feedback, simply drop a comment below and I will surely get back to you.