LTE Network Entry Steps

The first thing UE needs to do is to search for Primary Synchronization Signal (PSS). The
location of PSS is in the 1st and 6th sub frame of LTE and within the sub frame it exists
on the last symbol of the slot. So, once the UE has decoded the PSS, it gets the following
information.

 PSS gives the slot boundary timing independent of the CP length, so syncs at slot
level.
 It provides the center frequency as it is around the DC carrier.

After this, the UE starts looking for the Secondary Synchronization Signal (SSS) which is
just one symbol before the PSS. The PSS is on the 7th symbol of the 1st slot of 1st & 6th
sub frame while SSS lies on the 6th symbol. After decoding SSS, the UE gets the
following information.

 UE gets to know the CP length as it has the duration of two consecutive symbols
(SSS and PSS) so it can derive whether the eNB is using normal CP or extended CP.
 Since the location of SSS and PSS differs in TDD and FDD so the UE can also
find out the frame type.
 Next thing to find out is the start of the frame. As SSS & PSS exist in both Sub
frame 1 and 6, so the UE needs to know which of the frame is the 1st sub frame. That
is why the SSS is different in both sub frames and therefore, after decoding the SSS,
the UE can understand which is the 1st sub frame. So, this ensures that the UE is
synchronized at both frame and symbol level.

The PCI (Physical Cell Identity) is made up of a combination of PSS & SSS with the
following equation

PCI = 3(SSS) + PSS

Once, the UE has decoded both the PSS and SSS, it can derive the PCI which tells the
location of the RS and the PCFICH. This lets the UE get the RSRP and verify that the cell
is above the cell selection threshold. Then it goes for PBCH which is after the PSS of the
first subframe. PBCH tells about the system BW, System frame number, PHICH config
and number of Tx. Now that the UE knows PHICH, PCFICH and RS location, all the other
REs belong to PDCCH.

The UE looks for the DCI for SIB-1 by decoding the DCI masked with CRC of SI-RNTI.
The SIB-1 is sent after every 20 ms but the TTI is 80 ms (like PBCH – comes every 10
ms but the TTI is 40 ms). The copies of SIB-1 after 20 ms are different redundacny
versions of the same SIB-1. The SIB-1 tells about the other SIBs (SI periodicity and SI
Window length), including SIB-2 which tells about the RACH information required for
uplink synchronization.

The location of RACH is determined by the following parameters in SIB-2

PRACH CONFIGURATION INDEX ==> Tells the SFN (even/odd) and subframe number
– thus the location in time domain
PRACH FREQUENCY OFFSET ==> Tells the PRB offset and thus the location in
frequency domain
NCS VALUE ==> Tells the NCS value and the number of root sequences per cell needed
to generate 64 preambles
ROOT SEQUENCE INDEX ==> Tells the starting root sequence index for the cell

Based on these values, the UE generates a random preamble and sends a RACH
request. After the RACH request, the UE needs to start reading PDCCH for its RA-RNTI
after 3 subframes (3 SF after the prach preamble transmission is finished). The RA RSP
WINDOW SIZE tells the maximum number of subframes within which the eNB needs to
send the RAR. Usually, it is set to 10 SF and therefore the eNB needs to respond to a
PRACH request within 12 SF. The RAR contains RA-RNTI or temporary C-RNTI and
RAPID (which contains the preamble ID that UE sent).

Once RAR is received, the UE sends msg3 which is RRC Conn Req message that
contains UE ID (TMSI or random value). eNB responds with a MCE Contention resolution
message before RRC Conn Setup and that contention resolution message contains the
same UE ID that is sent by UE in RRC Conn Req message. So, if there are two UEs
using the same preamble, then at this step the contention will be resolved. As the UE
with the same ID will send the HARQ ACK to Contention resolution message but the
other UE will consider RACH failure and re-initiate RACH. In response to RRC
Connection Request, eNB sends a RRC Connection Setup which carries SRB1
(Signalling Radio Bearer) addition parameters. Before this, the UE uses SRB0 to send
the RRC message.

Once the UE gets RRC Connection Setup message, the UE responds with the RRC
Setup Complete message. It is this message that carries NAS messages. At this
moment, the RRC setup is completed and SRB1 is also setup.

Based on this, the eNB initiates S1 Initial UE message to the MME and MME can
respond to this message in different ways but the most common response is S1 Initial
Context Setup Request. This message is considered as the ERAB Setup Request and it
usually contains the ERAB-ID and QCI that has to be setup for the UE along with MBR
configuration of the bearer.Consequently, the eNB reconfigures UE using RRC
Connection Reconfiguration message which contains the addition for SRB2 and DRB
(data radio bearer) based on the QCI requirement. eNB also sends Security Mode
Command to UE to configure the security context at this stage. Once this is done, the
eNB responds to MME with S1 Initial Setup Response and at this point the ERAB Setup
is considered successful.