3. Cell Search
the mobile device performs a full search
Voice-centric devices might start their search
on GSM bands first as such networks are the
most widely deployed and hence there is the
highest probability to find a cell of a suitable
network there.
LTE devices that are more data centric might
start the search by looking for LTE cells and
fall back to UMTS and GSM cell search if not
successful
4. Cell Search
First step
the mobile device searches on all channels in
all supported frequency bands for an initial
signal
tries to pick up a primary synchronization
signal (PSS)
PSS is broadcasted every 5 milliseconds
twice per air interface frame
5. Cell Search
Second step
the device remains on the channel
locates the secondary synchronization signal
(SSS)
which is also broadcast once every 5 milliseconds
While the content of the PSS is always the same,
the content of the SSS is alternated in every frame
the mobile device can detect from the pattern as to
where to find the beginning of the frame
7. Cell Search
To make cell detection easier, the PSS
and SSS are broadcast only on the inner
1.25MHz of the channel, irrespective of
the total channel bandwidth. This way, a
simpler FFT analysis can be performed to
detect the signals. Also, the initial cell
search is not dependent on the channel
bandwidth. Hence, this speeds up the cell
search process.
8. Cell Search
The primary and secondary
synchronization signals implicitly contain
the PCI.
The PCI is simply a lower layer physical
identity of the cell
The PCI is important to distinguish
neighboring cells transmitting on the same
frequency
especially in cell edge scenarios
9. Cell Search
After detection of the PSS and SSS, the
mobile device is also aware if the cell uses
a normal or an extended cyclic prefix
The signals transmitted from the different
cells on the same channel interfere with
each other
10. Cell Search
In case the mobile device has found the
cell described on the SIM card after power
up
it may go directly to this cell
stop searching for other cells on different
channels in the current frequency band
even if the cell is not the strongest on the current
channel.
After a successful attach procedure
the cell reselection mechanism or a handover will
ensure that the mobile device is served by the
strongest cell it receives
11. Cell Search
The next step in the cell search procedure
Read the MIB from the PBCH
Broadcast every 40 milliseconds in the inner
1.25MHz of the channel
The MIB contains the most important information
about the configuration of the channel
Very conservative modulation and strong error detection
and correction information is added to allow successful
decoding of this information even under very unfavorable
reception conditions
12. Cell Search
The first information that the mobile device gets
from the MIB is the total bandwidth used for the
channel since all decoding attempts so far were
only performed in the inner 1.25MHz of the
channel
Further, the MIB contains the structure of the
HARQ indicator channel and the System Frame
Number (SFN)
for ciphering and calculation of paging opportunities
13. Cell Search
With the information from the MIB, the
mobile device can then begin to search for
the SIB-1.
Broadcast on the downlink shared channel
every 80 milliseconds
the mobile device needs to decode the
‘common’ search space in the control region
of a subframe to find a downlink control
channel (PDCCH) message
announces the presence and location of the SIB-1
in the subframe.
14. Cell Search
SIB-1 message contains the following
information
MCC and MNC of the cell
MCC: Mobile Country Code
MNC: Mobile Network Code
These parameters tell the mobile device if the cell
belongs to the home network or not
NAS cell identifier
similar to the cell-ID in GSM and UMTS
Tracking Area Code (TAC)
corresponds to the location and routing areas in
GSM and UMTS
15. Cell Search
Cell barring status
whether the cell can be used or not.
Minimum reception level (q_RxLevMin)
If the level is lower
the mobile device must not try to establish
communication with the cell
A scheduling list of other SIBs
With the information provided in SIB-1
the mobile device can decide if it wants to
start communicating with this cell
16. Cell Search
SIB-2 contains further parameters that are
required to communicate with a cell
the configuration of the RACH
the paging channel configuration
the downlink shared channel configuration
the PUCCH configuration;
the SRS configuration in the uplink;
uplink power control information;
timers and constants (e.g. how long to wait for
an answer to certain messages, etc.);
uplink channel bandwidth.
18. Attach Procedure
Once the mobile device has all the
required information to access the network
MIB
SIB-1
SIB-2…
Attach procedure
Deliver an IP address
The mobile device is then able to send and receive
data from the network
19. Attach Procedure
First: request resources on the uplink shared
channel
A request on the RACH
To let the mobile device be known to the eNode-B
eNB assigns a Cell Radio Network Temporary Identity
(C-RNTI)
MAC layer ID
e.g. scheduling grants in downlink control
channel (PDCCH) messages
Second: establish an RRC channel
To exchange signaling messages with the eNode-
B and the core network
By sending an RRC connection request message
to the network
20. Attach Procedure
If access is granted
Third: the network responds with an RRC
connection setup message
contain the assignment parameters for a dedicated
radio signaling bearer (SRB-1)
from that moment onward used to transfer RRC
messages to the eNode-B
SRB-1 is also used to transfer NAS signaling to and from
the MME
These messages are encapsulated in RRC
messages
contain MAC and physical layer parameters
a DRX interval
uplink shared channel configuration
uplink power control…
21. Attach Procedure
Fourth: the mobile device returns an RRC
connection setup complete message to the
eNode-B
the RRC part of the message
the mobile device informs the eNode-B which MME it
was last connected to
If no information about the previous MME is given
the eNode-B selects one of its own
An embedded NAS message
the actual Attach Request message
the eNode-B transparently forwards to the MME it has
selected
22. Attach Procedure
Part of the message is the Globally Unique Temporary
Identity (GUTI)
a temporary identifier
the device was assigned when it was previously
connected to the network
help the MME to locate the MME
the device was previously connected
to retrieve the user’s subscription profile
to inform the old MME that the device has
changed its location
In case the GUTI is not present or the MME is unable to
find the previous MME
an authentication procedure is started
involves the UE and the HSS
23. Attach Procedure
Once the subscriber is authenticated
ciphering and integrity checking for all control
messaging between the UE and the MME is
activated
the eNode-B receives the necessary keys for
encryption of the user data later on and for
encryption and integrity checking of RRC
messages
Fifth: Once the subscriber is authenticated
the MME confirms the successful authentication to the
HSS
sending a update location request message to the
HSS
HSS responds with an update location
acknowledge
the eNode-B asks the mobile device to provide a list of its
supported air interface functionalities with a UE capability
enquiry
24. Attach Procedure
The mobile device responds to the message with a
UE capability information message
contain information
the supported radio technologies (GSM, UMTS,
CDMA, etc.)
frequency band support of each technology…
This information helps the eNode-B
to select the best air interface parameters for the
device
The interband and interradio technology
measurements
it should configure so that the device can detect
other networks for a handover
This information is also forwarded to the MME
25. Default bearer activation
Once the MME has received the update
location acknowledge message from the
HSS
it starts the session establishment process in
the core network
results in the creation of a tunnel over which the
user’s IP packets can be sent
Be done by sending a create session request
message to the serving-GW of its choice
The serving-GW in turn forwards the request to a
PDN-gateway
located between the LTE core network and the Internet
26. Default bearer activation
The PDN-GW then
selects an IP address from a pool and
responds to the serving-GW with a create session
response message
The serving-GW then
returns the message to the MME
the tunnel for the IP packets of the user between the
serving-GW and the PDN-GW is ready to be used
This tunnel is necessary as the user’s location and
hence its serving-GW can change during the lifetime
of the connection
27. Default bearer activation
After the context for the user has been
established in the core network
the MME responds to the initial Attach
Request
with an Initial Context Setup Request message
includes the Attach Accept message
On the S1 interface between the MME and eNode-B
starts the establishment procedure for a user data
tunnel between the eNode-B and the serving-GW
It includes the Tunnel Endpoint Identity (TEID)
used on the serving-GW for this connection
28. Default bearer activation
The final link that has to be set up now
the bearer for the user’s IP packets on the air
interface
Be done by the eNode-B
by sending an RRC Connection Reconfiguration
message to the mobile device
Earlier during the attach process
a signaling radio bearer (SRB-1) was established
for the signaling messages
With this connection reconfiguration
a second signaling radio bearer is established for
lower priority signaling messages
a Data Radio Bearer (DRB) over which user’s IP
packets are transmitted is also established
29. Default bearer activation
The message also includes two further NAS
messages
Attach Accept message
Activate Default Bearer Context Request message
These messages configure the device’s higher protocol
layers on the radio protocol stack
This step is also used to assign the IP address to the
mobile device for communication
with the Internet
other parameters
such as the IP address of the DNS server
The message includes the QoS profile for the default
bearer context
30. Default bearer activation
Once the RRC part of the protocol stack
has been configured
the mobile device returns
an RRC Connection Reconfiguration Complete
message
to the eNode-B
triggers the confirmation of the session establishment on
the S1 interface
with an Initial Context Setup Response message
31. Default bearer activation
After the mobile has also configured the
user plane part of the protocol stack
it returns an Attach Complete message to the
eNode-B
includes the Activate Default Bearer Complete
message
Both messages are destined for the MME
The final step of the attach procedure
to finalize the user data tunnel establishment
on the S1 interface
between the serving-GW and the eNode-B
