LTE Cell Search from UE's perspective

Once power-up UE, UE will do initial cell search and try to camp on suitable cell. Following is general UE's procedure on cell search.

1. UE has no knowledge of any close-by band, bandwidth and pilot signal. UE has to do a step called "RSSI scan" before actual cell search started. (This RSSI concept is different than the RSSI associated with RSRP and RSRQ).  During RSSI scan, UE first filter which band it should scan on, this could be done by applying software filter, I.E. UE supported Band3, Band4, Band5 and Band13, once power up, UE would start detecting power for every 20MHz chunk starting from lowest frequency in Band3.

2. After RSSI scan phase, UE would have knowledge about which earfcn is transmitting, and power strength. I.E. earfcn 2170 has highest power level.

3. Pinpointing earfcn 2170 as central frequency with 6 PRBs as cell search bandwidth, UE first acquire PSS (For FDD, located at the last symbol of slot 0 and slot 10; For TDD, located at third symbol of subframe 1 and 6), PSS is a Zadoff-Chu sequence with length of 62 bits. PSS's root sequence has information about NID2 (3 possible root sequence mapping to 0,1,2 NID2). Since PSS's two appearances in one radio frame is the same, UE only knows 5ms timing with PSS.

4. After acquired PSS, UE has knowledge of system frame timing but not subframe timing. In order to get subframe timing and calculate CellId, UE needs to acquire SSS (For FDD, located at 1 symbol before PSS; For TDD, second last symbol of slot 1 and slot 11). The sequences that SSS used in two different locations are different (3GPP 36.211 6.11.2 ). By acquiring SSS, UE can retrieve NID1 and 10ms timing information.

5. After acquired PSS and SSS, UE is now able to do following steps:
   (1) Calculate CellId, CellId = 3 * NID1 + NID2. This CellId will be used to de-scrambling PBCH bits.
   (2) Decode PBCH (MIB, is transmitted every 4 radio frames), which is located in slot 1 of subframe 0.
   (3) Successfully decoded MIB provided 8 bits of SFN (last 2 bits of SFN is implicitly acquired in decoding PBCH), system bandwidth and PHICH configuration information (PHICH duration and PHICH Ng factor)

6. MIB was also coded by number of antenna ports. After retrieved MIB and CellId, UE is now able to do following steps:
   (1) Decode PCFICH and get number of symbols used for PDCCH.
   (2) Locate REs used for CRS (by calculating Vshift using CellId)
   (3) Locate REs used for PHICH
   (4) Calculate remaining REs left for PDCCH

7. UE is now in state waiting for System Information. UE would do blind-decoding of CCE on aggregation level 4 and 8 using SI-RNTI (65535).

8. After successful decoding SystemInformationBlock1 and other SIBs, UE has common RRC configuration information of the cell and can do random access now.