Technical Articles

Acquiring LTE System Information


  • Analyze and debug drive test data
  • Validate the content of a generated LTE signal

LTE system information (SI) is transmitted in the broadcast control (BCCH) logical channel. Generally, BCCH messages are carried on the DL-SCH and transmitted on the physical downlink shared channel (PDSCH). This is done in conjunction with a downlink control information (DCI) message transmitted on the physical downlink control channel (PDCCH) that indicates format and resource allocation of the PDSCH transmission. SI-RNTI, the radio network temporary identity (RNTI) of the system information, scrambles this DCI message. The exception is that some initial system information is conveyed in the master information block (MIB), which is carried on the BCH transport channel and transmitted on the physical broadcast channel (PBCH) (Figure 1).

AcquiringLTE_Fig1_w.jpg
Figure 1. Transmission of initial system information.

The MIB contains system bandwidth, system frame number (SFN), and physical hybrid-ARQ indicator channel (PHICH) configuration, and is transmitted with a fixed modulation and coding scheme in a fixed set of physical resources. Once the MIB has been successfully decoded, the UE can decode the control format indicator (CFI) (indicating PDCCH length), the PDCCH can be demodulated, and the DCI messages decoded. This allows the UE to search for DCI messages scrambled with SI-RNTI in order to find the system information. SystemInformationBlockType1 (SIB1) specifies the timing of remaining system information, along with aspects of the cell identity such as public land mobile network (PLMN) identity. Although SIB1 is transmitted in a fixed time schedule, the resource allocation of the PDSCH carrying SIB1 is dynamic and is indicated in an associated DCI message. Therefore, to acquire the LTE system information, a comprehensive receiver is required.

LTE Toolbox™ includes a complete reference UE receiver. This receiver is capable of demodulating and decoding the majority of the downlink channels and signals.

This example shows how LTE Toolbox can fully synchronize, demodulate, and decode a live eNodeB signal using a handful of MATLAB® code lines. In this instance, we use a single antenna I/Q capture of an eNodeB with two transmit antennas (Figure 2).

AcquiringLTE_Fig2_w.jpg
Figure 2. Single antenna I/Q capture of an eNodeB with two transmit antennas.

I/Q Capturing of eNodeB Output

We perform the capture at 30.72 Msamples/s, which is sufficient to correctly sample all valid eNodeB bandwidths (1.4 MHz, 3 MHz, 5 MHz, 10 MHz, 15 MHz and 20 MHz).

Cell Search and Frame Timing

Prior to decoding the MIB, the UE does not know the full system bandwidth. The primary and secondary synchronization signals (PSS and SSS) and the PBCH (containing the MIB) lie in the central 72 subcarriers (six resource blocks) of the system bandwidth, allowing the UE to initially demodulate just this central region. In this example, we resample the waveform to filter just the central six resource blocks. Then, using LTE System Toolbox, we call LteCellSearch to give the cell identity and timing offset t to the first frame head.

enb.NDLRB = 6; % Number of resource blocks
waveform = resample(eNodeBOutput,1,DownSF);
[enb.NCellID,t] = lteCellSearch(enb,waveform);
waveform = waveform (1+t:end); 

OFDM Demodulation and Channel Estimation

We perform these steps in one line each. hest is the channel estimate, nest is an estimate of the noise for MMSE equalization, and cec is the channel estimator configuration.

rxgrid = lteOFDMDemodulate(enb,waveform);
[hest nest] = lteDLChannelEstimate(enb,cec,rxgrid);

Equalization and MIB Reception

The MIB is decoded along with the number of cell-specific reference signal (RS) ports transmitted as a mask on the BCH CRC.

pbchIndices = ltePBCHIndices(enb);
pbchSymbols = rxgrid(pbchIndices);
[bchBits mib enb.CellRefP] = ltePBCHDecode(enb,pbchSymbols,hest,nest);

A simple function, lteMIB, is used to parse the bit vector mib and add the relevant fields to the configuration structure enb.

enb = lteMIB(mib,enb)
enb =
    NDLRB: 25
    NCellID: 51
    CellRefP: 2
    PHICHDuration: 'Normal'
    Ng: 'One'
    NFrame: 828

At this point, we identify the full bandwidth (25 resource blocks), along with the correct number of cell-specific RS ports (two). The original I/Q captured signal is now resampled, re-demodulated, and equalized with these settings.

PDCCH Decoding

We now demodulate and decode the PDCCH using similar Indices and Decode functions to those previously shown for BCH reception.

pdcchIndices = ltePDCCHIndices(enb);
pdcchSymbols = rxgrid(pdcchIndices);
dciBits = ltePDCCHDecode(enb,pdcchSymbols,hest,nest); 

Blind PDCCH Search

The LTE System Toolbox provides full blind search of the PDCCH to find any DCI messages with a specified RNTI. In this case, it is the SI-RNTI.

dci = ltePDCCHSearch(enb,RNTI,dciBits)
dci =
    NDLRB: 25
    DCIFormat: 'Format1A'
    AllocationType: 0
    Allocation: [1x1 struct] 

PDSCH Demodulation and DL-SCH Decoding

We parse the DCI message to give the configuration of the corresponding PDSCH carrying SIB1. We demodulate the PDSCH and the received bits are DL-SCH decoded to yield the SIB1 bits.

pdschIndices = ltePDSCHIndices(enb,pdsch,pdsch.PRBSet);
pdschSymbols = rxgrid(pdschIndices);
dlschBits = ltePDSCHDecode(enb,pdsch,pdschSymbols,hest,nest);
[sib1 crc] = lteDLSCHDecode(enb,pdsch,trblklen,dlschBits)

The bit vector sib1 is now ready for export from MATLAB into an ASN.1 decoder to decode the SystemInformationBlockType1 message.

For detail of the SystemInformationBlockType1 content, refer to section 6.2.2 of the 3GPP TS 36.331 [1].

Summary

This example shows how to use LTE System Toolbox to extract the system information from a live eNodeB signal in a few lines of MATLAB code.

For access to the full code, refer to the Cell Search, MIB, and SIB1 Recovery example [2].

References

[1] 3GPP TS 36.331 section 6.2.2– Radio Resource Control (RRC): Protocol Specifications
[2] Cell Search, MIB and SIB1 Recovery

Published 2015 - 80713v00