5G NR PBCH and the MIB: The 32 Bits That Unlock a Cell
What the PBCH carries, why every bit in the MIB is there, how the physical layer adds timing bits, and how the UE goes from PBCH to SIB1.
Where we are
After PSS and SSS the UE knows: symbol timing, the PCI, and roughly where the SSB is in frequency. It still does not know the frame number, which beam it is listening to, or where to find the rest of the cell (the carrier, SIB1, the numerology for data). All of that is the job of the PBCH, which carries the MIB.
The mental model: a business card, not a brochure
The MIB is deliberately tiny — 24 bits from RRC, 32 bits after the physical layer adds its own. Think of it as a business card the cell hands to strangers: name, a timestamp, and "for details, look here". The "look here" is a pointer to SIB1, which is the brochure. Everything on the card is either needed to decode the card itself at the right time, or needed to find the brochure. Nothing else is allowed on the card.
Keeping it this small is what lets PBCH be decodable by a UE that knows nothing except the PCI — it uses the most robust coding and modulation available and repeats often.
What is in the MIB (RRC layer, 24 bits)
TS 38.331 defines the MIB fields. Read each one as "why must this be on the business card?":
| Field | Bits | Why it must be here |
|---|---|---|
| systemFrameNumber (6 MSBs of the 10-bit SFN) | 6 | So the UE can know the frame number. The 4 LSBs come from the PHY (see below) |
| subCarrierSpacingCommon | 1 | The SCS for SIB1, Msg2/4 and paging: 15 or 30 kHz in FR1, 60 or 120 kHz in FR2. Without this the UE cannot decode the PDCCH that schedules SIB1 |
| ssb-SubcarrierOffset (k_SSB, 4 bits here) | 4 | The frequency offset between the SSB and the common resource block grid. Needed to locate CORESET#0 relative to the SSB |
| dmrs-TypeA-Position | 1 | Whether PDSCH/PUSCH mapping type A DM-RS is on symbol 2 or 3. Needed to decode the SIB1 PDSCH |
| pdcch-ConfigSIB1 | 8 | Where and when to look for the PDCCH that schedules SIB1: 4 bits → CORESET#0 configuration, 4 bits → Type0-PDCCH search space configuration |
| cellBarred | 1 | "Do not camp here." Lets the network keep UEs off a cell (e.g. during commissioning) before they even read SIB1 |
| intraFreqReselection | 1 | If barred, may the UE reselect to another cell on the same frequency? |
| spare | 1 | — |
| Message choice bit (BCCH-BCH-MessageType) | 1 | ASN.1 choice between MIB and extension |
That is 24 bits. Note what is not there: no PLMN, no tracking area, no cell identity, no bandwidth. Those all live in SIB1.
What the physical layer adds (8 bits → 32-bit payload)
The PHY appends 8 more bits before coding (TS 38.212 §7.1.1). These are timing bits that RRC does not need to generate because the PHY knows them:
- 4 LSBs of the SFN — together with the 6 MSBs in the MIB, the UE gets the full 10-bit SFN (0–1023).
- Half-frame bit — is this SSB in the first or second 5 ms half of the frame?
- 3 bits that depend on the number of SSB beams (L_max):
- If L_max = 64 (FR2): the 3 MSBs of the SSB index. The 3 LSBs are carried implicitly by the PBCH DM-RS sequence (see below), so 3 + 3 = 6 bits = 64 beams.
- If L_max = 4 or 8 (FR1): 1 bit is the MSB of k_SSB (making k_SSB a 5-bit value in FR1, range 0–23 plus special values), and 2 bits are reserved.
Why split the SFN between RRC and PHY? Because the PBCH has an 80 ms transmission time interval. The MIB content from RRC is identical for 80 ms (8 frames), so the 6 MSBs of the SFN (which change every 16 frames) can be in the RRC part. The 4 LSBs change every frame, so they must be added by the PHY each time. This lets the UE soft-combine PBCH copies within an 80 ms window — a big deal for coverage.
Where the SSB index comes from: the DM-RS trick
The PBCH DM-RS sequence is generated from the PCI, the half-frame bit, and the 3 LSBs of the SSB index (2 LSBs when L_max = 4). The UE tries the candidate DM-RS sequences, finds which one correlates, and thereby learns the low bits of the SSB index without spending payload bits. This is why the "same" PBCH can be transmitted on 64 different beams and the UE can still tell which beam it caught.
The PBCH physical layer chain
TS 38.212 §7.1 and TS 38.211 §7.3.3:
- Payload: 32 bits (24 MIB + 8 PHY).
- Payload interleaving and first scrambling: scrambled with a sequence initialised by the PCI and the 2 or 3 LSBs of the SSB index. The timing bits (SFN LSBs, half-frame bit) are not scrambled, so a UE can still combine across SSB indices for those.
- CRC: 24 bits → 56 bits.
- Polar coding (mother code length 512).
- Rate matching to 864 bits.
- Second scrambling with a PCI-based sequence (per SSB index).
- QPSK modulation → 432 symbols.
- Mapping to the PBCH resource elements of the SSB.
Why polar codes? Polar codes give excellent performance at short block lengths, which is exactly the PBCH case (56 bits in). LDPC (used for data) is better at long blocks.
Resource elements: where the 432 symbols go
The SSB is 4 symbols × 240 subcarriers. PBCH uses:
- Symbol 1: all 240 subcarriers
- Symbol 2: subcarriers 0–47 and 192–239 (the 96 subcarriers either side of the SSS)
- Symbol 3: all 240 subcarriers
That is 240 + 96 + 240 = 576 REs. Every 4th subcarrier is PBCH DM-RS, so 576 / 4 = 144 DM-RS REs and 576 − 144 = 432 data REs — matching the 432 QPSK symbols.
The DM-RS position within each group of 4 subcarriers is shifted by v = PCI mod 4, so neighbouring cells with different PCI mod 4 do not have their PBCH DM-RS colliding.
From PBCH to SIB1: what the UE does next
With the MIB decoded, the UE:
- Reads subCarrierSpacingCommon → knows the SCS of the SIB1 PDCCH/PDSCH.
- Reads k_SSB → knows the offset from the SSB to the common RB grid. If k_SSB indicates a value meaning "no SIB1 on this frequency" (k_SSB > 23 in FR1, or > 11 in FR2), the UE stops and may use the remaining pdcch-ConfigSIB1 bits as a hint of where to search next.
- Reads pdcch-ConfigSIB1 → looks up CORESET#0 (how many RBs, how many symbols, offset from the SSB) and the Type0-PDCCH search space (which slots to monitor, relative to the SSB index it detected).
- Monitors that CORESET for a DCI format 1_0 with SI-RNTI (0xFFFF) → decodes the SIB1 PDSCH.
This chain — SSB → MIB → CORESET#0 → SIB1 — is the spine of initial access. The PDCCH article covers the CORESET#0 and search-space tables in detail.
Common confusions
- "The MIB contains the SFN." Only the 6 MSBs. The full 10-bit SFN needs the 4 PHY bits.
- "k_SSB is 4 bits." In FR1 it is 5 bits (4 in the MIB + 1 from the PHY). In FR2 it is 4 bits.
- "The PBCH changes every SSB period." The RRC part is constant for 80 ms; only the PHY timing bits change. Soft-combining within 80 ms is allowed.
- "The SSB index is in the MIB." For FR2, only the 3 MSBs are in the PBCH payload; the 3 LSBs are inferred from the DM-RS. For FR1 the whole index (≤ 3 bits) comes from the DM-RS.
- "cellBarred is in SIB1." It is in the MIB, so barring works before any scheduling.
Spec pointers
- TS 38.331 §6.2.2 — MIB ASN.1
- TS 38.212 §7.1 — PBCH payload generation, CRC, polar coding, rate matching
- TS 38.211 §7.3.3 — PBCH scrambling, modulation, RE mapping
- TS 38.211 §7.4.1.4 — PBCH DM-RS
- TS 38.213 §4.1 and §13 — SSB detection, k_SSB, CORESET#0 and Type0 search space tables
Recap
The PBCH is a 32-bit business card: 24 bits of "who and where to look next" from RRC, 8 bits of "when" from the PHY. It is protected by polar coding, stays constant for 80 ms so the UE can combine copies, uses the DM-RS to smuggle in the beam index, and its single most important field is the pointer to CORESET#0 that leads to SIB1.
Interview questions
The questions below are drawn from this topic and phrased the way they tend to come up. Try each one out loud before revealing the answer.
18 questions
- The MIB is 24 bits from RRC. The physical layer adds 8 more, giving a 32-bit PBCH payload before CRC and coding.
- The system frame number's most significant bits, the subcarrier spacing for initial access, the CORESET#0 and search space configuration, the kSSB offset, the DMRS type A position, and a cell-barred indication.
- The least significant bits of the system frame number, a half-frame indicator, and for FR2 the most significant bits of the SSB index.
- From the PBCH DM-RS sequence, not from the payload. The DM-RS scrambling carries the index, which is why the UE can identify the beam before decoding anything.
- The UE needs the index to know which beam it found, and it needs that before successful decoding. Carrying it in the reference signal makes it available from detection rather than decode.
- Polar coding, the same family used for downlink control, chosen because the payload is short.
- 432 modulation symbols across the PBCH resource elements of the SSB, using QPSK.
- It must be decodable at the cell edge by a UE with no prior configuration and no channel knowledge. Robustness matters far more than throughput for 32 bits.
- The MIB content is updated every 80 ms, though the PBCH is transmitted in every SSB, so it repeats far more often than it changes.
- Repetition gives the UE multiple chances to combine and decode without extending the acquisition time, and each SSB is on a different beam so a given UE may only see some of them.
- Uses the CORESET#0 and search space configuration to find a PDCCH addressed to SI-RNTI, which schedules SIB1 on PDSCH.
- The frequency offset between the SSB's own subcarrier grid and the carrier's common resource block grid. Without it the UE cannot relate what it found to where the carrier actually sits.
- Tells the UE the cell must not be camped on. It is the fastest way to take a cell out of service for new access without stopping transmission.
- The most significant bits change slowly and sit in the payload; the least significant bits change every frame and are carried implicitly by the scrambling, avoiding a payload change every 10 ms.
- The UE cannot proceed to SIB1 and must try again — on another SSB, another beam, or after combining more repetitions. It has the cell identity but nothing else usable.
- It is the bootstrap. Everything it carries must be decodable in the worst conditions, so it contains only what is needed to reach SIB1, where the real configuration lives.
- LTE's PBCH carried a 24-bit MIB with a 40 ms period and used convolutional coding, with no beam sweeping. NR's is polar-coded, beam-swept, and carries the SSB index implicitly.
- It carries the smallest set of bits that lets a UE which has just found a beam work out the frame timing and where to look for the system information that follows.
Related Articles
5G NR Waveforms: CP-OFDM and DFT-s-OFDM, and When the Uplink Should Use Which
Why NR uses CP-OFDM everywhere but keeps DFT-s-OFDM as an uplink option, what PAPR really costs, and how the network chooses per UE.
5G NR Transmitter and Receiver Chain: Following the Bits From MAC to Antenna and Back
A block-by-block walk through the NR physical-layer transmit chain and its mirror-image receiver, explaining what each stage does and why it sits where it does.
5G NR Synchronisation Signals (PSS and SSS): How a Phone Finds a Cell From Nothing
PSS and SSS explained from the UE's point of view: what each signal gives the receiver, how the PCI is built from them, and why NR has 1008 cell identities.