5G NR Initial Access: How does a device establish connection with a cellular operator?

Published on: Jan 20, 2023

Smartphones are an essential tool in our daily lives, with a myriad of applications at our disposal, many of which need some form of communication with what we call “the network”. We usually take for granted that we are connected to this “network” entity, being unaware of all that has happened to support such connections. This is also true for other devices that use cellular communication technologies. In this blog, we are going to zoom into the first moments when a device turns on, from the 3rd Generation Partnership Project (3GPP) 5G New-Radio (NR) perspective.

Let us first define the two main actors when establishing the first steps towards communication with the cellular network. In 5G NR, any device that acts as a user (e.g., phone, tablet, laptop) is referred to as a user equipment (UE). From the side of the network, there is a whole infrastructure deployed to provide services to UEs, defined by a mutual agreement in communication standards. For 3GPP, this agreement is coordinated through the 3GPP technical specifications (TSs) (read more about it here: https://b5g-mints.eu/mints-101-part-4/).


Fig. 1. Uplink and downlink concepts within a cell (taken from [2]).


The network equipment at the front of this whole infrastructure, and directly interacting with the UEs, is referred to as gNodeB (gNB). The name comes from next-generation Node B, where Node B refers to a node acting as a base transceiver station (BTS). Simply put, the BTS is a station capable of transmitting and receiving signals to/from UEs, usually shortened to base station (BS). Any transmission from a gNB to a UE is said to be a downlink (DL) transmission. Likewise, any transmission from a UE to a gNB is said to be an uplink (UL) transmission. Fig. 1 illustrates this in a graphic way for a mobile device acting as a UE. There are multiple gNBs deployed to serve a certain area, and each gNB has a local identifier that corresponds to the cell we are connecting to, referred to as the physical cell identity (PCI). A cell can thus be defined as the geographical area covered by a certain gNB, where UEs are being served. The concepts of cell and gNB are closely connected and can sometimes be used interchangeably. The gNBs are further connected – usually via optical fiber – to the backbone of the cellular network. The concept of a cell, the modular deployment of multiple cells around the world, and their interconnection through the backbone infrastructure compose the paradigm of cellular communication.

So now we understand that a UE will try to connect to the network via a gNB. The issue here is that the UE does not know anything about the specific gNB that it is trying to connect to. This is where the 3GPP TSs come in, defining a set of procedures that both UE and gNB must follow to connect with each other, even if they do not know anything about their capabilities. These procedures are grouped into a context called initial access (IA). Below, we give a general overview of every procedure  in the IA and its purpose.

  1. Cell search: As the name suggests, this procedure searches for a suitable cell to connect to. The procedure is carried out in a DL fashion, so the gNBs are responsible for sending out the necessary signals to anyone that can receive them, while the UEs try to receive these signals to acquire enough information about a suitable gNB. Now, let us talk about these signals, and the information carried by them.

1.1. Primary synchronization signal (PSS) detection: A PSS is essentially a sequence – a maximum length sequence (m-sequence) to be precise – of a certain structure, modulated with a binary phase shift keying (BPSK) scheme. It serves as the flag that shows where to find the gNB information in the time-frequency grid. The name comes from the fact that this is the first sequence that the UE should detect in order to align gNB and UE to the same time and frequency. The alignment is called synchronization. Apart from that, it transmits a piece of the PCI.

1.2. Secondary synchronization signal (SSS) detection: An SSS is a combination of two m-sequences, also BPSK-modulated. Its time-frequency position can be known from the information gathered from the PSS. This sequence contains the remaining part of the PCI.

1.3. Demodulation reference signal (DM-RS) detection for physical broadcast channel (PBCH): The DM-RS is a type of signal whose time-frequency position and content are known at both gNB and UE sides, once the PCI is known at the UE side. It allows the UE to compute the effect of the wireless channel on the signal’s amplitude and phase, so that it can be predicted and reverted for related received signals of unknown content. In this case, DM-RSs help correctly demodulate the signals composing the physical broadcast channel (PBCH), which we will introduce shortly.

1.4. Physical broadcast channel (PBCH) demodulation: As its name tells us, the PBCH is a physical channel being broadcast – i.e., sent to everybody. A physical channel is composed of information/signals located in multiple locations of time and frequency. By using the estimations of the wireless channel computed from the PBCH DM-RSs, we can properly demodulate and decode the information contained in the PBCH. With that information, we can proceed to the next step within cell search.

1.5. System information block 1 (SIB1) decoding: SIB1 is the last block required to be received before a UE tries to ‘talk’ to a gNB. It can be found and decoded by using the information contained within the decoded PBCH. The SIB1 contains comprehensive information about the cell or where to find further details in case the UE requires them. With cell information we refer to, for example, frequency references, timers, bandwidth, identifiers for the network operator and its service areas, location for further time-frequency resources to continue communication, flags on supported features, etc. When the SIB1 has been received successfully, we can say that the cell search has been successful too.

  1. Random access (RA): After the UE has received all the necessary details about a specific cell, the UE tries to send information to the chosen gNB for the first time. There are certain resources over which the gNB is expecting new, unknown UEs to transmit information. However, multiple UEs might send information, try to gain access over the same resources, and thus collide. This happens because at the cell search stage, the gNB broadcasts information about its capabilities to any of the UEs within its coverage. Therefore, the access to the resources at which the gNB receives happens in a random way by an unknown number of UEs that might have been listening. From there, we have the name “random access” for this procedure. The goal of RA is that a specific UE receives a unique identity, assigned by the gNB, to establish collision-free communication with the network. The information flow goes in both ways, so there are UL and DL transmissions taking place in RA. After RA is successfully carried out for a UE, this UE is said to be successfully connected to the network.

Additional reading resources: There is much more to what was explained in this blog about IA. If you would like to go deeper into this topic, please refer to [3-6].

If you were able to stick until the end and can’t wait for more content and want to know about us and our projects, you can always follow our social media channels.


[1] MINTS. Blog: MINTS 101: Part 4 – On ITU, 3GPP, and Standardization. Available online at: https://b5g-mints.eu/mints-101-part-4/

[2] RF Page. LTE and 5G – NR Frequency Bands Explained. Available online at: https://www.rfpage.com/lte-and-5g-nr-frequency-bands-explained/

[3] Dahlman, Erik, Stefan Parkvall, and Johan Skold. 5G NR: The next generation wireless access technology. Academic Press, 2020.

[4] 3GPP TS 38.211 version 17.1.0 Release 17. Physical channels and modulation. 2022. Available online:  https://www.etsi.org/deliver/etsi_ts/138200_138299/138211/17.01.00_60/ts_138211v170100p.pdf

[5] 3GPP TS 38.213 version 17.1.0 Release 17. Physical layer procedures for control. 2022. Available online:  https://www.etsi.org/deliver/etsi_ts/138200_138299/138213/17.01.00_60/ts_138213v170100p.pdf

[6] 3GPP TS 38.321 version 17.0.0 Release 17. Medium Access Control (MAC) protocol specification. 2022. Available online:  https://www.etsi.org/deliver/etsi_ts/138300_138399/138321/17.00.00_60/ts_138321v170000p.pdf

About The Author

Juan Sanchez is an Early Stage Researcher for the EU H2020 MSCA-ETN MINTS project. He is currently enrolled as a PhD student in Electrical Engineering at Lund University, Sweden. He is focusing on channel dynamic behavior modeling and exploitation of mmWave massive MIMO systems in challenging scenarios with mission-critical constraints. His goal is to harness the mmWave channel diversity via fully digital beamforming to enable ultra-reliable links.

Juan obtained his B.Sc. degree in Electronic Engineering, with Honors, at Pontificia Universidad Javeriana in Colombia, and his M.Sc. degree in Telecommunications Engineering at Politecnico di Torino in Italy, in 2019. He received scholarships for his bachelor’s and master’s studies, and for a 1-year academic exchange in Germany.

Juan has worked as an intern for National Instruments and Robert Bosch GmbH, focusing on MIMO for 4G, V2X communications and 5G communications. He also wrote his thesis on Beam Management for 5G NR at National Instruments (https://webthesis.biblio.polito.it/13095/1/tesi.pdf). His interests lie in mmWave communications, 5G NR PHY/MAC, channel modeling and beamforming.