5G NR PDCCH Demystified: CORESETs, Search Spaces and Every DCI Format

Why this topic feels hard, and how to make it easy

The PDCCH is where three separate ideas get tangled together in most textbooks:

1. How a control message is physically built (REGs, CCEs, aggregation level).
2. Where and when the UE should look for it (CORESET = where in frequency and symbols; search space set = when in time and how many candidates).
3. What the message says (the DCI formats).

Keep those three as separate questions and the whole topic clicks. We will take them in that order, then do SIB1's special case, then the DCI formats one at a time.

The mental model: envelopes, letterboxes, and a schedule for checking them

• A DCI is a letter.
• The PDCCH is the envelope. Envelopes come in five sizes (aggregation levels) — bigger envelopes are more robust because the same letter is spread over more resources.
• A CORESET is the wall of letterboxes: a region of the time–frequency grid where envelopes may be placed.
• A search space set is the UE's instruction card: "check this wall every N slots, at these symbols, and try these envelope sizes, this many times."
• Because the UE does not know which letterbox or envelope size was used, it tries them all: blind decoding. The letter is only "addressed" via a CRC scrambled with the UE's RNTI, so the UE knows a decode succeeded only when the CRC checks.

Part 1 — How the envelope is built

REG and CCE

• A Resource Element Group (REG) = 1 resource block × 1 OFDM symbol = 12 REs. 3 of the 12 (subcarriers 1, 5, 9) are PDCCH DM-RS, so 9 carry data.
• A Control Channel Element (CCE) = 6 REGs = 54 data REs = 108 bits at QPSK.
• A PDCCH candidate is made of 1, 2, 4, 8 or 16 CCEs — the aggregation level (AL).

The DCI (typically 40–70 bits + 24-bit CRC) is polar coded and rate matched to the number of bits the AL provides. A higher AL means a lower effective code rate — the same message, more redundancy. The gNB picks the AL per UE based on its channel quality; the UE tries every configured AL.

REG bundles and interleaving (CCE-to-REG mapping)

REGs are grouped into REG bundles (size 2, 3 or 6). Within a bundle the UE may assume the same precoder, so the DM-RS across the bundle can be used jointly for channel estimation. Then the CCEs are mapped to REG bundles in one of two ways:

• Non-interleaved: a CCE's 6 REGs are adjacent (bundle size 6). Good when the gNB beamforms the PDCCH to a specific UE and wants localised, well-estimated resources.
• Interleaved: bundles are spread across the CORESET by a block interleaver (interleaver size 2, 3 or 6 and a shift index). Good for frequency diversity, and for common control that must reach everyone.

You configure this per CORESET; you do not need the interleaver equations to understand the system.

Part 2 — Where and when the UE looks

CORESET: the "where"

A Control Resource Set (TS 38.331 ControlResourceSet) defines:

• Frequency: a bitmap over groups of 6 RBs within the BWP (frequencyDomainResources), so a CORESET can be non-contiguous.
• Duration: 1, 2 or 3 OFDM symbols.
• CCE-to-REG mapping (interleaved / non-interleaved, bundle size, shift).
• Precoder granularity: same precoder per REG bundle, or across all contiguous RBs (the latter lets the UE estimate the channel across the whole CORESET).
• TCI states: which beam the PDCCH is transmitted on (QCL source) — essential in FR2.
• DM-RS scrambling ID.

Limits: up to 3 CORESETs per BWP in Rel-15 (more in later releases), each with an ID 0–11. CORESET 0 is special: it is defined by the MIB, not by RRC, and it is what the UE uses to find SIB1.

A CORESET says nothing about time beyond the symbol length. It is a spatial (frequency × symbols) template.

Search space set: the "when" and "how many"

A search space set (TS 38.331 SearchSpace) references one CORESET and adds:

• Monitoring periodicity and offset in slots (e.g. every slot, every 2 slots at offset 1…).
• Monitoring symbols within the slot (a 14-bit bitmap for the first symbol positions).
• Duration: how many consecutive slots to monitor per period.
• Number of candidates per aggregation level (0–8 for each of AL 1/2/4/8/16).
• Type: common or UE-specific.
• DCI formats to look for (e.g. 0_0/1_0 vs 0_1/1_1).

Up to 10 search space sets per BWP. Several search space sets can point at the same CORESET, and one search space set can be used by many RNTIs.

Common vs UE-specific search spaces

Common search spaces (CSS) are monitored by all UEs (or all UEs in a group), so their candidate locations do not depend on the UE identity. TS 38.213 §10.1 defines:

UE-specific search spaces (USS) are for a UE's own scheduling. Candidate positions are hashed from the C-RNTI so that different UEs' candidates are spread across the CORESET and collide less.

Blind decoding budget

Every candidate the UE tries costs processing. TS 38.213 caps the number per slot per serving cell:

Shorter slots → fewer candidates per slot (the UE has less time). The gNB configures search spaces so that these limits are respected; if configuration would exceed them, the spec defines which search spaces the UE drops.

Part 3 — The special case: how the UE finds SIB1

Before RRC has configured anything, the UE has only the MIB. The 8-bit pdcch-ConfigSIB1 field bootstraps a CORESET and a search space (TS 38.213 §13):

CORESET#0 (4 MSBs → one of Tables 13-1 to 13-10)

Which table applies depends on the SSB SCS, the PDCCH (common) SCS, and the minimum channel bandwidth of the band — all known to the UE. Each table row gives:

• SSB / CORESET#0 multiplexing pattern (1, 2 or 3):
  • Pattern 1: CORESET#0 in different slots from the SSB (TDM). Used in FR1 and FR2.
  • Pattern 2: same slot, different symbols and different RBs (FR2 with SSB 120 / PDCCH 60 or SSB 240 / PDCCH 120).
  • Pattern 3: same symbols as the SSB, different RBs (FR2, SSB 120 / PDCCH 120).
• Number of RBs: 24, 48 or 96.
• Number of symbols: 1, 2 or 3.
• Offset (in RBs) from the SSB's first RB to CORESET#0's first RB — so CORESET#0 is defined relative to the SSB, which is the only thing the UE can locate at this point. Together with k_SSB, this pins CORESET#0 onto the CRB grid.

Type0-PDCCH search space (4 LSBs → one of Tables 13-11 to 13-15)

For pattern 1 (the common case), the row gives O (a slot offset), the number of search space sets per slot, M (a slot multiplier), and the first symbol index. The UE that detected SSB index i monitors two consecutive slots starting at

n0 = ( O · 2^μ + floor(i · M) ) mod N_slot_frame      (μ = PDCCH SCS index)

in the frame whose SFN parity satisfies the spec's condition. The important intuition: each SSB index has its own SIB1 monitoring window, so the gNB can transmit SIB1 on beam i shortly after SSB i. The beam sweep of the SSB is followed by a beam sweep of SIB1.

In that window the UE looks for DCI format 1_0 with CRC scrambled by SI-RNTI (0xFFFF), aggregation levels 4, 8 and 16 (candidates 4, 2, 1). The DCI points to the PDSCH carrying SIB1.

Part 4 — The DCI formats

DCI formats come in three families. The naming is systematic: 0_x = uplink grant, 1_x = downlink assignment, 2_x = group/cell-level control. Within 0/1, _0 is the fallback (compact, fixed-size, minimal features) and _1 is the full format (all the features, size depends on configuration). Rel-16 added 0_2 / 1_2 (compact URLLC variants) and 2_4 – 2_6, and 3_0 / 3_1 for sidelink; this article stays on the Rel-15 set.

Every DCI ends with a 24-bit CRC XORed with an RNTI. That is the only addressing: no RNTI field exists inside the DCI.

DCI 0_0 — fallback uplink grant

Compact, no MIMO, no BWP switching. Used for Msg3 retransmissions, when the UE has just connected, or whenever the gNB wants a small, safe grant.

Format 0_0 and 1_0 are padded/truncated to the same size so the UE only needs one blind decode for both — the identifier bit tells them apart.

DCI 1_0 — fallback downlink assignment

The most-used format in the whole system, because it schedules SIB1, paging, RAR, Msg4 and any fallback data. Its fields are re-interpreted depending on the RNTI:

With C-RNTI / TC-RNTI (normal data):

With SI-RNTI: no HARQ fields (broadcast has no ACK). Instead: FDRA, TDRA, VRB-to-PRB, MCS, RV, a System information indicator (0 = SIB1, 1 = other SI), and reserved bits.

With P-RNTI: a Short Messages Indicator (2 bits) and Short Messages (8 bits) — e.g. "system information modified" or ETWS/CMAS alert — plus optional scheduling of a paging PDSCH (FDRA, TDRA, VRB-to-PRB, MCS, TB scaling).

With RA-RNTI: schedules the Random Access Response PDSCH: FDRA, TDRA, VRB-to-PRB, MCS, TB scaling, reserved bits.

Same envelope, four different letters. The UE knows which reading to apply because it knows which RNTI it used to pass the CRC.

DCI 0_1 — full uplink grant

Everything 0_0 has, plus the features that make NR uplink powerful. Size depends on RRC configuration.

Key additions: carrier indicator (cross-carrier scheduling), BWP indicator (switch active UL BWP), FDRA Type 0 or 1 (bitmap or contiguous, with dynamic switch), 1st / 2nd DAI, SRS resource indicator (which sounded beam/antenna set to transmit on), precoding information and number of layers (codebook-based UL MIMO), antenna ports (DM-RS ports and CDM groups), SRS request, CSI request (trigger aperiodic CSI on PUSCH), CBG transmission information (retransmit only failed code block groups), PT-RS–DM-RS association, beta offset indicator (UCI-on-PUSCH weighting), DM-RS sequence initialisation, UL-SCH indicator (0 = PUSCH carries only CSI, no data).

DCI 1_1 — full downlink assignment

Everything 1_0 has, plus:

Carrier indicator, BWP indicator, FDRA Type 0/1, PRB bundling size indicator (dynamic PRG), rate matching indicator (which configured rate-match patterns apply), ZP CSI-RS trigger (aperiodic zero-power CSI-RS for interference measurement / rate matching), a second transport block (own MCS/NDI/RV) when more than 4 layers are configured, antenna ports (DM-RS configuration), Transmission Configuration Indication (TCI) — the 3-bit field that tells the UE which beam/QCL assumption to use for this PDSCH — SRS request, CBG transmission information and CBG flushing out information, DM-RS sequence initialisation.

If you remember only one difference between 1_0 and 1_1: 1_1 can point to a beam (TCI) and can switch BWPs; 1_0 cannot.

DCI 2_0 — slot format indicator

CRC scrambled with SFI-RNTI. Carries one or more Slot Format Indicators, each an index into the slot-format table (TS 38.213 Table 11.1.1-1) telling a group of UEs which symbols in upcoming slots are DL, UL or flexible. Lets a TDD cell change its DL/UL split dynamically. (Rel-16 reuses 2_0 for unlicensed-band COT and available-RB-set information, and search-space-set switching.)

DCI 2_1 — pre-emption indication

CRC scrambled with INT-RNTI. Tells eMBB UEs that part of a previous PDSCH was punctured by a URLLC transmission: a 14-bit bitmap per cell over the last monitoring period, in time (14 or 7 partitions) and frequency (whole BWP or two halves). The UE discards the soft bits from the pre-empted region so they do not poison HARQ combining. See the PDSCH article for the full picture.

DCI 2_2 — TPC for PUCCH / PUSCH

CRC scrambled with TPC-PUCCH-RNTI or TPC-PUSCH-RNTI. A block of 2-bit TPC commands, one per UE in the group; each UE is told by RRC which block position is its own. Lets the gNB adjust many UEs' uplink power in one message without scheduling any of them.

DCI 2_3 — TPC for SRS

CRC scrambled with TPC-SRS-RNTI. Same idea as 2_2 but for SRS power control (and optionally SRS request), for UEs whose SRS power is not tied to PUSCH power — typically for carriers with SRS only (e.g. for DL reciprocity-based beamforming on a TDD carrier with no PUSCH).

Putting it together: one UE, one slot

1. RRC gave the UE three CORESETs and, say, six search space sets (some CSS, some USS).
2. In this slot, two search space sets are active. The UE reads the CORESET symbols, does channel estimation from the PDCCH DM-RS, then tries each candidate (AL × count) in each set.
3. For each candidate it polar-decodes, XORs the CRC with each RNTI relevant to that search space (C-RNTI, SI-RNTI, P-RNTI…) and checks.
4. A pass → it interprets the bits as the DCI format that search space set is configured for, with the field meanings for the RNTI that matched.
5. Then it goes to the PDSCH (or prepares the PUSCH) the DCI describes.

Common confusions

Spec pointers

Recap

Interview questions

The questions below are drawn from this topic and phrased the way they tend to come up. Try each one out loud before revealing the answer.