Module 3 — PBCH & MIB

MIB —
Every field, every bit

The MIB is 24 bits. Every single bit matters. This section parses each field of our decoded MIB — what it means, what 3GPP says about it, and exactly how the UE uses it to derive CORESET#0, frame timing, and cell selection parameters.

TS 38.331 §6.2.2 TS 38.213 §13 TS 38.304 §5.3.2

MIB structure

The MIB is defined in TS 38.331 as an ASN.1 structure. It is 24 bits long and is carried in the 32-bit PBCH payload (the remaining 8 bits carry SFN LSBs and SSB index implicitly).

MIB ::= SEQUENCE {
  systemFrameNumber         BIT STRING (SIZE (6)),
  subCarrierSpacingCommon   ENUMERATED {scs15or60, scs30or120},
  ssb-SubcarrierOffset      INTEGER (0..15),
  dmrs-TypeA-Position       ENUMERATED {pos2, pos3},
  pdcch-ConfigSIB1          PDCCH-ConfigSIB1,
  cellBarred                ENUMERATED {barred, notBarred},
  intraFreqReselection      ENUMERATED {allowed, notAllowed},
  spare                     BIT STRING (SIZE (1))
}
3GPP TS 38.331, Section 6.2.2
MIB bit layout — our decoded example TS 38.331 §6.2.2

Field 1 — systemFrameNumber (6 bits)

Our value: 100011 (binary)

These are the 6 most significant bits of the 10-bit System Frame Number. The remaining 4 LSBs are extracted from the PBCH payload overhead bits (not the MIB itself). The UE combines both to reconstruct the full SFN.

SFN counts from 0 to 1023, wrapping every 10.24 seconds. It is the master clock for all scheduling, paging, measurement gaps, and system information timing.

SFN reconstructionTS 38.331 §6.2.2
// MIB gives 6 MSBs:
SFN[9:4] = 100011

// PBCH overhead gives 4 LSBs:
SFN[3:2] = half-frame + 1 SFN bit  → 01
SFN[1:0] = SSB index bits           → 01

// Full SFN:
SFN = 1000110101 (binary)
    = 2^9 + 2^5 + 2^4 + 2^2 + 2^0
    = 512 + 32 + 16 + 4 + 1
    = 565

// Current time since SFN=0:
565 × 10 ms = 5650 ms = 5.65 seconds into the 10.24s cycle

Field 2 — subCarrierSpacingCommon (1 bit)

Our value: 1 → 30 kHz (FR1)

This tells the UE what subcarrier spacing to use when receiving SIB1, paging, RAR (Random Access Response), and PDCCH in CORESET#0. It is distinct from the SSB SCS used for synchronization.

subCarrierSpacingCommon: Subcarrier spacing for SIB1, Msg.2/4 for initial access, paging and broadcast SI-messages. If the UE is in FR1, the value scs15or60 corresponds to 15 kHz and scs30or120 corresponds to 30 kHz.
3GPP TS 38.331, Section 6.2.2
bit=0
FR1 → 15 kHz
FR2 → 60 kHz
bit=1
FR1 → 30 kHz ← ours
FR2 → 120 kHz

Field 3 — ssb-SubcarrierOffset / k_SSB (4 bits)

Our value: 0010 = 2 subcarriers

This is the frequency offset between the SSB and the common resource block (CRB) grid, measured in subcarriers. It tells the UE where Point A is — the absolute frequency reference from which all RB positions are computed.

Point A derivation from k_SSB = 2TS 38.211 §4.4.4.1
// k_SSB = offset in subcarriers between SSB and PRB grid
k_SSB = 2

// SSB lowest subcarrier frequency:
f_SSB_center = 3498.24 MHz  (GSCN 7845)
f_SSB_low    = 3498.24 − 60 × 0.030 = 3496.44 MHz
// (60 subcarriers below SSB center = half of 120 subcarriers)

// Point A = k_SSB subcarriers below SSB lowest edge:
Point_A = 3496.442 × 0.030 = 3496.38 MHz

// Special case: k_SSB = 31 means "no SIB1 on this cell"
// UE should not look for CORESET#0

Field 4 — dmrs-TypeA-Position (1 bit)

Our value: 0 → position 2

This tells the UE where the first DMRS symbol is in PDSCH (data channel). DMRS is needed to estimate the channel before decoding data — without knowing its position, the UE cannot decode SIB1.

dmrs-TypeA-Position: Position of (first) DM-RS for downlink (see TS 38.211). Value pos2 means the DM-RS is located at symbol position 2 and pos3 means symbol position 3.
3GPP TS 38.331, Section 6.2.2

For our cell: DMRS at symbol 2. This means PDSCH data starts at symbol 3. This is consistent with our 2-symbol CORESET#0 (occupying symbols 0–1).

Field 5 — pdcch-ConfigSIB1 (8 bits)

The most important MIB field. These 8 bits tell the UE exactly where to look for the PDCCH that schedules SIB1. They are split into two 4-bit indices.

controlResourceSetZero (4 bits)

Our value: 0011 = 3

This is an index into tables 13-1 through 13-10 in TS 38.213. The table is selected based on SSB SCS and PDCCH SCS combination. The entry gives the CORESET#0 size and position.

Table 13-4 lookup — SSB SCS=30kHz, PDCCH SCS=30kHz, index=3 TS 38.213 §13, Table 13-4
IndexNum RBsNum symbolsOffset (RBs)
02420
12422
22424
3 ← ours2422
42430
52432
64810
74814
CORESET#0 position — from table entry
// From table: 24 RBs, 2 symbols, offset 2 RBs above Point A
Point_A = 3496.38 MHz

CORESET0_start = Point_A + offset × 12 × SCS
               = 3496.38 + 2 × 12 × 0.030
               = 3496.38 + 0.720
               = 3497.10 MHz

CORESET0_width = 24 RBs × 12 × 30 kHz = 8.64 MHz
CORESET0_end   = 3497.10 + 8.64 = 3505.74 MHz
CORESET0_symbols = 2 (symbols 0 and 1 of monitoring slot)

searchSpaceZero (4 bits)

Our value: 0010 = 2

This indexes Table 13-11 in TS 38.213 to define Search Space#0 — when the UE must monitor CORESET#0 for PDCCH.

Table 13-11 lookup — index=2, CORESET#0 duration=2 TS 38.213 §13, Table 13-11
IndexPeriod (slots)Slot offsetSymbolAL4 candidatesAL8 candidates
0200042
1200042
2 ← ours202042
3202042
4205042
Search Space#0 monitoring occasions
// Period=20 slots, offset=2, SCS=30kHz → slot duration=0.5ms
Monitor at: slot 2, 22, 42, 62, ...  (every 10 ms)
Symbol:     0 (first symbol of each monitoring slot)

// Blind decoding at each occasion:
4 candidates at AL=4 (4 CCEs each)
2 candidates at AL=8 (8 CCEs each)
Total: 6 blind decoding attempts per occasion

// Timing:
Next occasion: SFN=565, slot=2
               = 5650 ms + 1 ms = 5651 ms

Field 6 — cellBarred (1 bit)

Our value: 0 → notBarred

If this bit is 1 (barred), the UE must immediately abandon this cell and start a barring timer. It cannot return to this cell for the duration of T_barred (typically 300 seconds). This is used by operators to shed load from a congested cell or during maintenance.

If cellBarred is set to barred, the UE is not allowed to camp on the cell. The UE shall apply the cell barring as specified in TS 38.304, i.e. the UE shall consider the cell as barred and start the timer T_barring.
3GPP TS 38.331, Section 6.2.2 | TS 38.304, Section 5.3.2

Field 7 — intraFreqReselection (1 bit)

Our value: 0 → allowed

Only relevant when cellBarred = 1. If this is notAllowed, the UE must not only avoid this specific cell but also avoid all cells on the same frequency. This forces the UE to try a different band entirely. Used when the entire frequency layer has a problem.

Field 8 — spare (1 bit)

Always set to 0. Reserved for future 3GPP releases. UE ignores this bit.

Complete MIB — bit by bit

MIB decoded — all 24 bits TS 38.331 §6.2.2
BitsFieldOur valueDecoded meaning
[0:5]systemFrameNumber100011SFN MSBs → full SFN = 565
[6]subCarrierSpacingCommon130 kHz (FR1)
[7:10]ssb-SubcarrierOffset0010k_SSB = 2 → Point A = 3496.38 MHz
[11]dmrs-TypeA-Position0DMRS at symbol 2
[12:15]controlResourceSetZero0011idx=3 → 24 RBs, 2 syms, offset 2 RBs
[16:19]searchSpaceZero0010idx=2 → period 20 slots, offset 2
[20]cellBarred0notBarred ✓ — UE may proceed
[21]intraFreqReselection0allowed
[22:23]spare00ignored
MIB fully parsed — UE now knows:
Timing              → SFN = 565, slot = to be determined at SS#0 occasion
Frequency reference  → Point A = 3496.38 MHz
CORESET#0 position   → 24 RBs from 3497.10–3505.74 MHz, 2 symbols
SS#0 timing          → monitor slots 2, 22, 42, ... (every 10 ms)
Cell status          → notBarred — proceed with SIB1 acquisition
DMRS position        → symbol 2 — needed for SIB1 PDSCH decoding
The 8-bit efficiency: The entire CORESET#0 derivation — frequency position, size, and monitoring schedule — is encoded in just 8 bits of the MIB (controlResourceSetZero + searchSpaceZero). This elegant bootstrapping is possible because the tables are fixed and known to every 5G UE worldwide.