Introduction to 5G NR Physical Layer

Where the bits hit the air. Why 5G's physical layer looks the way it does, and how to use the rest of this book.

1.1 Why 5G NR Exists

Every cellular generation answers a different question. 2G asked "can we make voice digital?" — and the answer was GSM, with 200 kHz channels and a 14.4 kbps data side-pocket. 3G asked "can we add data?" — and WCDMA gave us 384 kbps, later 21 Mbps with HSPA. 4G asked "can data be the default and voice the exception?" — and LTE rebuilt the whole stack around IP with 100 Mbps cell-edge and Voice over LTE. 5G asks three questions at once. Can we move more data per second per Hz than LTE ever did? Can we drive end-to-end latency down to the millisecond? And can we serve a million devices per square kilometre without choking the air? Those three questions become the three pillars of 5G design — and every choice in the NR physical layer can be traced back to one of them.

1.2 The Three Pillars — eMBB, URLLC, mMTC

The IMT-2020 vision document (ITU-R, 2015) defines three use-case families that 5G must serve. 3GPP translated each into concrete KPIs and PHY mechanisms:

1.3 Where the PHY Sits — The NR Protocol Stack

The physical layer is the bottom layer of the radio stack. Above it sit MAC, RLC, PDCP, SDAP, and then RRC for control plane and the IP-layer applications for user plane.

1.4 The Five Pillars of NR PHY Specifications

The 38-series specifications describe NR. The physical layer is split across five core documents, each a deep dive into one aspect. Memorise these five — every later chapter of this book cites one or more of them:

1.5 The Physical Channels and Signals — Full Map

NR defines six DL physical channels/signals, four UL channels, and a family of measurement-only references. Each chapter from 6 onward zooms into one:

1.6 The Physical-Layer Processing Chain — Big Picture

Every PHY transmission, regardless of direction or channel, walks the same skeleton of stages. Knowing this skeleton makes every later chapter feel like a familiar variation:

1.7 What Makes NR Fundamentally Different from LTE

If you came from LTE, six things will surprise you in NR:

1.8 How to Read This Book

The book is structured in seven parts. You can read it linearly (recommended for newcomers) or jump to the chapter you need (recommended for engineers debugging a specific issue):

• Part I (Ch 1–5) — Foundations. OFDM, frame structure, modulation, channel coding. Read first if any of those words feel fuzzy.
• Part II (Ch 6–9) — Downlink Channels. SSB, PDCCH, PDSCH, DL reference signals. The DL story.
• Part III (Ch 10–13) — Uplink Channels. PUSCH, PUCCH, PRACH, UL reference signals. The UL story.
• Part IV (Ch 14–15) — MIMO & CSI. Spatial multiplexing, beamforming, codebooks, CSI feedback.
• Part V (Ch 16–19) — System-level topics. Link adaptation, power, scheduling, measurements.
• Part VI (Ch 20–24) — Deep topics. Sequences, sidelink, NR-U, positioning, MBS.
• Part VII (Ch 25–27) — Operations. KPIs, optimization, troubleshooting.

Every chapter ends with a References block (the exact 3GPP citation for every claim) and a Live labs block (cross-links to the interactive labs at /labs/5g-phy-layer/ where you can play with the same concepts). Treat the labs as the second half of each chapter — formulas land in memory only after you've watched them move.

1.9 References

OFDM Fundamentals and Numerology

Every NR signal you will ever decode sits on an OFDM grid. This is the chapter where that grid is built — subcarrier by subcarrier, symbol by symbol — and where you learn to size it for any band, any cell, any service.

There is one idea underneath the whole of NR's physical layer, and it is geometric, not algebraic: the air interface is a grid. One axis is time, divided into symbols; the other is frequency, divided into subcarriers. Every bit the network ever sends you is painted onto the cells of that grid. Master how the grid is dimensioned — how wide each subcarrier is, how long each symbol lasts, how much guard time protects it — and the rest of the physical layer becomes bookkeeping on top of a structure you already understand. That dimensioning is exactly what 3GPP calls numerology, and building it correctly is the entire job of this chapter.

2.1 The Multipath Problem and Why OFDM Solves It

A radio signal travelling from a gNB to a handset does not take one path. It takes dozens. There is the direct line-of-sight component, plus a reflection off the glass tower across the street, plus a bounce off the wet road, plus a scatter off a passing bus. Each path has its own length, and since radio travels at a fixed 3·10⁸ m/s, each copy of the signal arrives at the antenna at a slightly different instant. The spread between the earliest and the latest meaningful arrival is the channel's delay spread, written τ. It is the single most important number for choosing a numerology, so it is worth memorising the typical ranges.

Now picture a single wide-band carrier sending one symbol every 33 nanoseconds — roughly what a 30 MHz single-carrier link would do. In an urban-macro cell with a 1 µs delay spread, the tail of symbol N is still arriving when symbols N+1 through N+30 have already been transmitted. The copies pile on top of one another at the receiver. This overlap is Inter-Symbol Interference (ISI), and it corrupts demodulation thoroughly. Crucially, you cannot modulate your way out of it: the channel will have multipath, and no clever constellation removes a physical echo. A single-carrier receiver must instead fight ISI with a time-domain equaliser whose tap count grows with the delay spread — tens of taps, re-converging every time the channel shifts. That is expensive silicon, and it scales badly as bandwidth grows.

OFDM — Orthogonal Frequency-Division Multiplexing — attacks the problem from the opposite direction. Instead of one fast carrier, it splits the band into hundreds or thousands of narrow subcarriers, each carrying symbols slowly. A 100 MHz NR carrier at 30 kHz spacing holds 3,276 active subcarriers; each one sends a symbol only once every 33 microseconds — a thousand times slower than the single-carrier equivalent. Because each subcarrier is much narrower than the coherence bandwidth, it sees an essentially flat channel: one complex gain, nothing more. The echo that wrecked the wide carrier becomes, per subcarrier, a tiny rotation the receiver corrects with one complex multiply. The price is a Fast Fourier Transform at each end — and an FFT is precisely the operation modern silicon performs most efficiently.

2.2 The Cyclic Prefix — Free Insurance

Narrow subcarriers tame ISI but do not abolish it. At the boundary between two OFDM symbols, the channel's delay-spread tail from the previous symbol still spills into the start of the next. The naïve fix — insert a few microseconds of silence as a guard — works but wastes both energy and bandwidth, and worse, it would break orthogonality by truncating the useful symbol. NR, following LTE, does something far more elegant: it copies the last N_CP samples of each OFDM symbol and prepends them to the front. That copied segment is the cyclic prefix (CP), and it earns its keep twice over.

• It absorbs the multipath tail. As long as the delay spread is shorter than the CP duration, every echo of the previous symbol lands inside the CP region — which the receiver discards before the FFT. The useful part of the symbol is therefore echo-free.
• It converts linear convolution into circular convolution. Prepending the tail makes the transmitted symbol look periodic to the channel over the FFT window. The channel's linear convolution then produces the same result a circular convolution would — and circular convolution is diagonalised by the DFT. After the FFT the channel collapses to one scalar gain H_k per subcarrier, so equalisation is a single complex divide.

The CP length is not arbitrary — it is fixed by 3GPP and scales with numerology. From TS 38.211 §5.3.1, the normal CP for a symbol is N_CP = 144·κ·2^−µ time units T_c, except at the two symbols that align with a 0.5 ms boundary (symbol 0 and symbol 7·2^µ), which carry an extra 16·κ T_c so the slots tile the radio frame perfectly. With κ = 64 and T_c ≈ 0.509 ns, this produces the familiar numbers below.

2.3 NR Numerologies — Seven Subcarrier Spacings

NR's defining break from LTE is scalable numerology. Where LTE fixed the subcarrier spacing at 15 kHz forever, NR lets it scale as Δf = 2^µ·15 kHz, with µ ∈ {0, 1, 2, 3, 4, 5, 6} (TS 38.211 §4.2; µ = 5 and 6 were added in Rel-17 for FR2-2). The choice is made per bandwidth part, not per cell — so a single carrier can run a 30 kHz eMBB BWP and a 60 kHz URLLC BWP side by side, and the UE simply re-parameterises its FFT when it switches between them.

2.4 FFT Sizes and Sample Rates

NR's physical layer is deliberately not tied to one FFT size. TS 38.211 §5.3 defines the OFDM signal in continuous time and in terms of the base unit T_c, leaving the implementer free to pick any FFT large enough to hold the active subcarriers. In practice vendors choose from the standard radix-2 set — 256, 512, 1024, 2048, 4096, 8192 — and typically over-size it so a single silicon block serves every channel bandwidth in a band. The governing relationships are simple and worth committing to memory:

2.5 Frequency Ranges — FR1, FR2-1, FR2-2

3GPP partitions NR's spectrum into frequency ranges, and the boundaries are not arbitrary — they fall where the underlying RF physics changes character. Below ~7 GHz (FR1) silicon is cheap, oscillators are stable, and power amplifiers are efficient. Above 24 GHz (FR2) phase noise rises steeply, PA efficiency collapses, and free-space path loss grows so severe that beamforming stops being optional. Each range therefore favours a different slice of the numerology table.

2.6 Filter Shaping and the Pulse Shape

Orthogonality (Fig 2.1b) comes at a spectral price: each subcarrier is a sinc in frequency, and a sinc's side-lobes decay slowly — only as 1/f. Summed across thousands of subcarriers, that energy spills past the channel edge into the neighbour's band. Left unchecked it would violate the adjacent-channel-leakage-ratio (ACLR) and spectrum-emission-mask (SEM) limits that TS 38.104 places on every base station. NR controls this leakage with two complementary tools.

• Guard subcarriers — the first and cheapest defence. The channel bandwidth is deliberately wider than the active transmission. At 100 MHz / 30 kHz only 273 of the available RBs are used (3,276 subcarriers = 98.28 MHz), leaving ~1.7 MHz of unused spectrum at the band edges as a built-in guard. This is why NR achieves ~98–99 % spectral occupancy versus LTE's ~90 % — NR's guard bands are proportionally far smaller.
• Transmit-side shaping — applied on top of the guard. Two families dominate: windowed OFDM (W-OFDM), which multiplies the time-domain symbol edges by a raised-cosine taper to soften the spectral roll-off; and filtered OFDM (f-OFDM), which runs a band-pass FIR after the IFFT for a sharper edge at higher complexity. The 3GPP spec mandates the mask, never the method — vendors are free to choose, and may even apply different shaping per BWP.

There is a genuine engineering tension here, not a free lunch. Sharper spectral edges require longer time-domain filters, which smear the symbol slightly and raise the in-band error-vector magnitude (EVM). Over-filtering to win a few dB of ACLR can quietly cost you a constellation point at the high MCS where EVM headroom is thin. The art is to use exactly enough shaping to clear the mask and not one tap more.

2.7 Choosing Numerology — A Decision Tree

Numerology selection is not a matter of taste — it is a short, deterministic walk through four physical constraints, taken in order. Band fixes the candidate set; latency, coverage, and Doppler narrow it; SSB is handled separately because it has its own restricted list. The flowchart below is the same logic an RF planner applies, drawn as a decision tree.

2.8 Worked Examples — n78 (FR1) and n257 (FR2)

Numbers make the framework concrete. Here are two complete dimensioning walk-throughs — one on the workhorse FR1 band n78, one on mmWave n257 — taking each from band and bandwidth all the way to FFT size, sample rate, and CP length in samples.

2.9 References

Frame Structure and Resource Grid

Time is divided into frames, half-frames, subframes, slots and symbols. Frequency is divided into resource blocks and subcarriers. The intersection of one symbol and one subcarrier is a single resource element — the indivisible atom of NR, and the thing every channel in this book ultimately writes to.

If Chapter 2 built the OFDM grid in the abstract, this chapter gives it coordinates. NR is, at heart, a two-dimensional canvas: time on one axis, frequency on the other. Everything the network does — sending a control message, carrying a megabyte, asking for an acknowledgement — is an instruction to paint specific cells of that canvas. To follow any later chapter you need fluent command of three things: how the axes are numbered, how the canvas is partitioned into the chunks the scheduler hands out, and how those chunks are timed relative to one another. We take them in that order.

3.1 The Time-Domain Hierarchy

Every NR transmission is anchored to a global clock. That clock counts radio frames of 10 ms. Each frame splits into two half-frames of 5 ms — a division that matters because the SS/PBCH burst (Chapter 6) is always confined to one half-frame. Each frame also divides, independently, into ten subframes of exactly 1 ms. The subframe is special: its duration is fixed at 1 ms regardless of numerology, which makes it the common heartbeat that keeps different-µ Bandwidth Parts on one carrier aligned in absolute time.

Inside a subframe sit one or more slots, and here numerology finally enters: there are 2^µ slots per subframe — 1 at 15 kHz, 2 at 30 kHz, 4 at 60 kHz, up to 64 at 960 kHz. Every slot holds 14 OFDM symbols under normal CP (or 12 under the extended CP that exists only at µ=2). The slot is the default scheduling unit: PDCCH, PDSCH, PUSCH and PUCCH all live inside one slot unless the spec explicitly permits cross-slot or multi-slot operation. The whole structure is strictly hierarchical, and every resource element in time is addressed by the triple (SFN, slot index, symbol index).

3.2 The Frequency-Domain Resource Grid

For each numerology and each transmission direction, NR defines a resource grid: a rectangle of 12·N^size,µ_grid subcarriers by 14·2^µ symbols per subframe, replicated once per antenna port (TS 38.211 §4.4.2). The grid is sized in Resource Blocks (RBs), each a fixed 12 contiguous subcarriers — so one RB spans 12·Δf in frequency: 180 kHz at 15 kHz SCS, 360 kHz at 30 kHz, and so on. The carrier may be up to N^size_grid = 275 RBs wide. The smallest addressable element is the resource element (RE), identified by the index pair (k, l): k the subcarrier, l the OFDM symbol.

3.2.1 Point A and the Anchoring Chain

NR places its frequency origin not on any UE and not on any BWP, but on a band-anchored reference called Point A. Point A is the lowest subcarrier of Common RB 0 (CRB 0) evaluated on the 15 kHz reference grid (60 kHz for FR2). It can be signalled absolutely via absoluteFrequencyPointA (an ARFCN) or relatively via offsetToPointA in SIB1. From Point A, a chain of offsets locates everything else: offsetToCarrier places the numerology-specific carrier; locationAndBandwidth (RB_start + length) carves a BWP from it; and k_SSB reconciles the SSB raster with the CRB grid.

3.2.2 CRB, PRB, VRB — Three Rulers, One Grid

Three layers of RB numbering coexist, and confusing them is the single most common source of "off-by-N RBs" bugs in the field.

3.2.3 VRB-to-PRB Mapping

The DCI allocates virtual RBs; the resource grid is addressed in physical RBs. The mapping between them is either non-interleaved (VRB n → PRB n, an identity, used for localized frequency-selective scheduling where the gNB wants the UE on a known-good sub-band) or interleaved (contiguous VRB bundles of L = 2 or 4 RBs are scattered across the band by a block interleaver, buying frequency diversity when no reliable CSI is available). The choice is signalled per grant by a 1-bit field in DCI formats 1_0/1_1 (TS 38.211 §7.3.1.6).

3.2.4 The DC Subcarrier

Direct-conversion radios leak a DC offset that, after the FFT, appears as a spur on one subcarrier. NR handles this by signalling where a transmitter's DC falls rather than forbidding data there: txDirectCurrentLocation (0…3299) tells the receiver which subcarrier carries the DC component, or flags that it sits outside the carrier or on a 7.5 kHz half-subcarrier shift. The receiver can then de-weight or puncture that RE in its demodulation. Unlike LTE, NR has no mandatory empty DC subcarrier — it is a signalled location, not a reserved gap, which is part of how NR reaches ~98 % spectral occupancy.

3.3 Bandwidth Parts (BWP)

A Bandwidth Part is a contiguous subset of the carrier's RBs, with its own numerology and CORESET, on which a UE operates at a given moment. Up to four DL and four UL BWPs are configured per serving cell, but only one of each is active at a time. This is how a 100 MHz cell serves a 20-MHz-capable (or battery-conscious) UE through a 20 MHz BWP, and how one carrier can run eMBB and URLLC at different numerologies side by side.

3.3.1 Initial vs Dedicated BWPs

3.3.2 BWP Switching

The active BWP changes through three mechanisms, spanning three orders of magnitude in speed:

• RRC reconfiguration — slow (~10 ms); used when the whole BWP set is re-planned.
• DCI BWP indicator (DCI 0_1/1_1, 2-bit) — fast; completes in one BWP-switch delay (type-1/type-2 UE capability, typically ~0.5–3 slots / a few hundred µs).
• BWP-inactivity timer — automatic fallback to the default BWP after a configurable idle interval; a pure power-saving feature.

3.4 Slot Formats — DL, UL, Flexible

In a TDD carrier, every OFDM symbol is one of three kinds: D (downlink — gNB transmits), U (uplink — UE transmits), or F (flexible — decided dynamically). TS 38.213 Table 11.1.1-1 enumerates 56 slot-format codes (0…55) for the legal symbol combinations within a slot. But the format codes are only the vocabulary; the real machinery is how a UE learns which symbols are which, and that is a strict four-layer process.

3.4.1 tdd-UL-DL-ConfigurationCommon — building the pattern

The cell's semi-static TDD pattern is not hand-written as "DDDSU"; it is parameterised in SIB1 by tdd-UL-DL-ConfigurationCommon. The key fields are a referenceSubcarrierSpacing and one or two patterns, each giving a periodicity and a count of DL/UL slots and symbols:

3.4.2 The Four-Layer DL/UL Determination

A UE resolves the direction of every symbol by consulting four sources in a fixed priority order. The governing rule (TS 38.213 §11.1) is that dynamic signalling may only fill in flexible symbols — it can never repurpose a symbol that the semi-static configuration already fixed as DL or UL. That one-way constraint is what keeps interference predictable across a cell.

3.4.3 The Slot Format Indicator (DCI 2_0)

Layer 3 of that stack deserves its own note. DCI format 2_0, scrambled with the SFI-RNTI and monitored by a group of UEs, carries a Slot Format Indicator: an index into a configured slotFormatCombination table that announces the format(s) of one or more upcoming slots. It lets the gNB flip flexible symbols between DL and UL on a slot-by-slot basis to chase bursty, asymmetric traffic — without an RRC reconfiguration and without per-UE signalling. It only ever touches flexible symbols, exactly as the four-layer rule demands.

3.4.4 The Guard Period and Cell Radius

When a slot turns from downlink to uplink, the gNB needs a gap: time for the last DL symbol to finish propagating out to the cell edge, for the UE to switch its transceiver from receive to transmit, and for the UE's (timing-advanced) uplink to travel back. That gap is the guard period (GP) — the flexible symbols in the special slot. Its length sets a hard ceiling on cell radius, by the same logic the cyclic prefix uses for delay spread: the GP must exceed the round-trip propagation delay.

3.4.5 Common TDD Patterns

3.5 Mini-Slots and URLLC

For URLLC and other short-payload traffic, PDSCH/PUSCH need not wait for a slot boundary or occupy all 14 symbols. A mini-slot (PDSCH/PUSCH mapping Type B) can start on almost any symbol and run for as few as 2, 4 or 7 symbols, using the same numerology as its host slot. Latency drops on two fronts at once — shorter start delay and shorter duration — at the cost of fixed overhead (DMRS, PDCCH) becoming a larger fraction of a tiny transmission.

3.6 Frequency-Domain Resource Allocation — RBG, RIV, PRB Bundling

Once the grid is numbered, the scheduler must hand a UE a subset of RBs, compactly, in a DCI that has only a handful of bits to spare. NR defines two resource-allocation types for this, plus a precoding-granularity concept that rides on top. Knowing all three is what lets you read a real DCI dump.

Type 0 — RBG bitmap. The BWP's RBs are grouped into Resource Block Groups (RBGs) of size P (2, 4, 8 or 16 RBs, chosen from the BWP size by TS 38.214 Table 5.1.2.2.1-1). The DCI carries one bit per RBG, so the allocation can be non-contiguous — ideal for frequency-selective scheduling and for fitting around other users. The cost is a wider bitmap field.

Type 1 — RIV. A single contiguous block of RBs, encoded as a Resource Indicator Value that packs the start RB and the length into one compact number: RIV = N_BWP·(L−1)+RB_start when L−1 ≤ N_BWP/2, and a complementary form otherwise. Cheaper DCI, but contiguous only.

PRB bundling (PRG). Separately, the UE may assume the gNB used the same precoder across a Precoding Resource block Group (PRG) — 2 RBs, 4 RBs, or the whole allocation ("wideband"). A larger PRG lets the UE average its channel estimate across more pilots (better estimate, lower noise); a smaller PRG lets the gNB steer each sub-band independently (better selective gain). The trade is configured by prb-BundlingType (static or dynamic), per TS 38.214 §5.1.2.3.

3.7 Antenna Ports — the Logical Reference Frame

An antenna port is not a physical antenna. It is a logical reference defined entirely by its DMRS pattern: "the channel over which a symbol on this port is conveyed is the one you estimate from this port's reference signal." How many physical elements sit behind a port, and what precoding mixes them, is internal to the transmitter and never signalled — which is exactly what lets a vendor change antenna hardware without any UE-side spec change.

3.8 Slot Timing Relationships — K0, K1, K2

The frame structure only becomes a working system once the pieces are timed relative to one another. NR ties the downlink grant, the data, the acknowledgement, and the uplink grant together with three slot offsets — K0, K1, K2 — each signalled per grant so the scheduler can adapt them to numerology and processing capability.

3.9 Worked Example — A Slot at µ=1 on n78

3.10 Field-Engineering Notes

• BWP misalignment after handover. Source BWP 1 might be 80 MHz/30 kHz; target's 50 MHz/30 kHz. A UE that does not reconfigure promptly ends up on the wrong subset — throughput collapses until it resyncs.
• Slot-format mismatch in CA. Aggregated cells with different TDD patterns confuse cross-carrier HARQ timing. Align slot patterns within a band combination.
• Initial BWP too narrow. SIB1 mandates the initial DL BWP carry SIB1/RMSI; under-size it and SIB1 misses its BLER target — an access-only failure invisible on dedicated BWPs.
• CRB-vs-PRB confusion. RRC config uses CRB; DCI uses PRB; logs report both. Mix them and every RB index is wrong by the BWP offset — the classic off-by-N bug.
• Guard period vs cell radius. A cell engineered for 16 km that switches to a one-symbol guard period (≈5.3 km) will see uplink-into-downlink collisions from edge UEs.
• K1 pointing at a DL slot. A HARQ-ACK timing that lands on a slot with no UL symbols silently drops the ACK; co-design K1 with the TDD pattern.

3.11 References

Modulation Schemes

From π/2-BPSK at the cell edge to 1024-QAM at the cell centre — the six modulation orders NR uses, the exact constellations the spec mandates, the EVM each demands, and how the receiver turns a noisy I/Q sample back into soft bits.

After channel coding and rate matching, the physical layer holds nothing but a stream of bits. Modulation is the rule that paints those bits onto the I/Q plane as complex symbols the radio can actually transmit. It is the most visual layer in the whole stack — a literal picture of dots — and yet it is governed by a handful of precise equations in TS 38.211 §5.1 that fix, to the last normalisation constant, exactly where every dot sits. This chapter takes you from that picture to those equations, then back out to the link-budget consequences that decide which constellation a UE is allowed to use at any moment.

4.1 What a Modulation Scheme Is

A modulation scheme maps bits to complex-valued symbols on the I/Q plane. The modulator groups the bit stream Q_m bits at a time and maps each group to one point in a 2-D constellation of 2^Q_m points. The receiver does the reverse: for each received complex sample it decides which constellation point was most likely sent and recovers Q_m bits. Larger Q_m means more bits per symbol — and a more crowded constellation, so the receiver needs a cleaner signal to tell the points apart. Crucially, every NR constellation is power-normalised so the average symbol energy is 1; that is the job of the 1/√2, 1/√10, 1/√42 … factors in the mapping equations, and it is what lets the link budget compare modulations on equal footing.

4.2 The Six NR Modulation Orders

4.2.1 The Constellation Mapping Equations

The spec does not leave the dot positions to the implementer — TS 38.211 §5.1 fixes them exactly. Every higher-order QAM is built from pairs of bits that select an odd-integer coordinate (…,−3,−1,+1,+3,…) on each axis, then the whole grid is scaled by the normalisation factor so the average power is 1.

4.3 Gray Mapping and Bit Labelling

NR labels the constellation points with a Gray code, so that any two physically adjacent points differ in exactly one bit. Since the overwhelmingly most likely demodulation error is mistaking a point for its nearest neighbour, Gray labelling converts each such symbol error into a single bit error rather than two or three — a free reduction in bit-error rate for the downstream decoder.

4.4 Scrambling Before Modulation

Just before modulation, NR XORs the coded bits with a Gold sequence seeded by the UE's RNTI and the cell ID. Two cells — or two co-scheduled UEs — carrying similar data on overlapping resources then produce uncorrelated bit patterns, so inter-cell interference looks like noise the decoder can average out rather than structured signal it might lock onto.

4.5 π/2-BPSK and Low-PAPR Transmission

Standard BPSK flips between +1 and −1 on the I axis; the transition passes straight through the origin, momentarily collapsing the envelope to zero and forcing the power amplifier to back off. π/2-BPSK rotates every other symbol by 90° (the e^{jπ(i mod 2)/2} term in §4.2.1), so the trajectory slides around the unit circle and never reaches the origin. Peak-to-average power ratio drops by roughly 3 dB versus QPSK, handing a power-limited cell-edge UE about 3 dB more usable transmit power — pure coverage.

4.5.1 Transform Precoding (DFT-s-OFDM) and Allowed Modulations

π/2-BPSK is not available everywhere — it is a tool of transform precoding, the DFT-s-OFDM uplink waveform. With transform precoding enabled, an extra DFT spreads each modulation symbol across the whole allocation before the IFFT, producing a near-single-carrier, low-PAPR waveform. In that mode NR permits π/2-BPSK, QPSK, 16-, 64- and 256-QAM. With transform precoding disabled (ordinary CP-OFDM, used on all downlink and on high-SINR uplink), π/2-BPSK is not used and the constellations are the standard QAM set — with 1024-QAM available on PDSCH (FR1, Rel-17) but not on PUSCH.

4.6 Soft Demodulation — From I/Q to LLRs

The LDPC and polar decoders downstream do not want hard 0/1 decisions — they want soft information: for each coded bit, a log-likelihood ratio (LLR) whose sign is the best guess and whose magnitude is the confidence. The demodulator produces these from the equalised I/Q sample. For Gray-mapped QPSK the result is beautifully simple — each bit's LLR is just a scaled I or Q coordinate — and higher QAM uses a per-bit max-log approximation that reduces to distances to the nearest 0-subset and 1-subset of points.

4.7 EVM — Error Vector Magnitude

Error Vector Magnitude measures how far, on average, the transmitter's actual symbols land from their ideal constellation points — the residual after the receiver has equalised the channel. It is the single number that decides whether a radio can run high-order QAM at all: an EVM floor caps the constellation no matter how strong the signal is, because it acts like a noise the receiver can never remove.

4.8 Modulation per Physical Channel

Not every channel is free to pick a constellation. Control and broadcast channels are fixed at robust low orders; only the shared data channels walk the full MCS ladder.

4.9 MCS-to-Modulation Mapping

For the shared data channels, the DCI carries a 5-bit MCS index into one of four tables (TS 38.214 Tables 5.1.3.1-1…-4, detailed in Chapter 8). Each row gives a (Q_m, target code rate R, spectral efficiency) triple — so the MCS index implicitly selects the constellation, and the same index means different things depending on which table the UE was configured with.

• Table 1 (default): up to 64-QAM (Q_m=6).
• Table 2 (qam256): up to 256-QAM (Q_m=8).
• Table 3 (low spectral efficiency): up to 64-QAM, conservative R for URLLC reliability.
• Table 4 (qam1024, Rel-17): up to 1024-QAM (Q_m=10).

4.10 Worked Example — Bits to Symbols and Back

4.11 References

Channel Coding — LDPC and Polar Codes

Two coding families do all the heavy lifting in NR: LDPC carries the data, polar carries the control. This is the chapter where you meet both end-to-end — from the transport-block CRC, through segmentation and the base-graph lift, through rate matching and the redundancy versions, to the polar reliability sequence and its list decoder — and learn exactly why 3GPP chose each.

Every payload bit on the NR air interface is wrapped in error-correcting code before it is ever modulated. The choice of code is a four-way trade between block length, code rate, decoding cost, and floor behaviour — and no single code wins on all four. So 3GPP split the job: a pair of LDPC base graphs for the long, high-rate data channels, and polar codes for the short, ultra-reliable control channels, with two tiny block codes for the very smallest payloads. This chapter follows a transport block all the way through that machinery and then does the same for a control message, so that by the end the words "BG2, lifted by Z_c=208, RV2, E=13200" read as a sentence rather than a riddle.

5.1 Two Coding Families, Two Jobs

The right code depends on what it must protect. Long data blocks at high rate want a code that is cheap to decode in parallel and near-capacity — that is LDPC. Short control blocks want a code with no error floor and clean rate matching at tiny lengths — that is polar. Below a dozen bits even polar is overkill, so NR falls back to Reed–Muller and simplex/repetition.

It is worth saying what NR left behind. LTE carried data on turbo codes and control on tail-biting convolutional codes. Turbo decoding is inherently serial — its trellis must be walked forward and backward — which caps throughput and burns power at the multi-gigabit rates NR targets, and turbo codes show a stubborn error floor at the very high code rates 256/1024-QAM demand. LDPC's sparse graph decodes in parallel with no such floor, and polar's list decoder beats convolutional codes at the short control lengths while rate-matching cleanly to any size. The two new families were chosen precisely where the old ones ran out of road.

5.2 The Transport-Block Processing Chain

Before diving into either code, it helps to see the whole assembly line. A transport block (TB) handed down from the MAC layer passes through a fixed sequence of stages (TS 38.212 §7.2 for PDSCH, §6.2 for PUSCH): attach a CRC, choose the base graph, segment into code blocks with their own CRCs, LDPC-encode each block, rate-match each to its share of the granted resources, concatenate, and pass the result to scrambling and modulation (Chapter 4).

5.3 LDPC — Base Graphs and Code Blocks

LDPC — Low-Density Parity-Check — is defined by a sparse parity-check matrix: every codeword bit participates in only a handful of parity equations. That sparsity is the whole point; it makes the iterative belief-propagation decoder cheap and massively parallel, which is exactly what multi-Gbps NR data needs. NR does not invent a fresh matrix per transport block — it stores two compact base graphs, BG1 and BG2, and lifts the one it picks.

5.3.1 Mother Code Rate and the Punctured Systematic Columns

Each base graph defines a mother code rate — the lowest rate it natively produces before any rate matching. BG1's is 1/3 (22 information columns), BG2's is 1/5 (10 information columns). One subtlety trips up every newcomer: the first two systematic columns (2·Z_c information bits) are always punctured — encoded into the parity but never transmitted. The receiver reconstructs them from the parity, which buys coding gain for free.

5.3.2 Lifting and Circulants

Each base graph is a small matrix of shift values — 46×68 for BG1, 42×52 for BG2. To get a concrete parity-check matrix it is lifted by a factor Z_c drawn from one of eight sets (Z_c up to 384): every non-zero entry expands into a Z_c×Z_c circulant (a cyclically shifted identity), and a blank becomes a Z_c×Z_c zero block. The result is a structured matrix of up to ~26,000 columns — all generated on the fly from two tiny tables.

5.3.3 Code-Block Segmentation

If the CRC-attached TB exceeds the base graph's K_cb, it is sliced into C equal code blocks, each given its own 24-bit CB-CRC (gCRC24B), and each LDPC-encoded independently.

5.4 Rate Matching, Bit Interleaving and HARQ

LDPC produces a fixed mother codeword, but the scheduler grants an arbitrary number of bits E. Rate matching bridges the two: it lays the codeword in a circular buffer, reads out exactly E bits from a redundancy-version offset, and interleaves them across the modulation. This stage is also where incremental-redundancy HARQ lives.

5.4.1 The Circular Buffer and Redundancy Versions

The systematic and parity bits are written into a circular buffer. A transmission reads E bits starting at one of four redundancy-version offsets (RV0–RV3). RV0 begins on the systematic bits and is self-decodable; later RVs deliver fresh parity the receiver soft-combines with what it kept — so the effective code rate falls with every retransmission. The practical order is RV0 → RV2 → RV3 → RV1.

5.4.2 Bit Interleaving

The selected E bits are then passed through a bit interleaver with one row per modulation bit (Q_m rows): bits are written by rows and read by columns. This spreads consecutive coded bits across the Q_m bit-positions of each QAM symbol, so a single deeply-faded symbol damages many codewords a little rather than one codeword a lot — the LDPC decoder copes far better with the former.

5.4.3 Limited-Buffer Rate Matching (LBRM)

A UE cannot store every LLR of an enormous TB across HARQ rounds, so NR caps the usable buffer with limited-buffer rate matching: the circular buffer length is N_cb = min(N, N_ref), where N_ref is derived from the UE's declared soft-buffer size. The gNB must keep the effective code rate within what that buffer supports, or retransmissions stop adding usable parity.

5.4.4 Code-Block Concatenation

Finally, the rate-matched code blocks are concatenated back into one bit stream of exactly the granted size G (TS 38.212 §5.5), ready for scrambling and modulation. The boundaries are implicit — the receiver knows C, E and the segmentation rule, so no explicit delimiters are sent.

5.5 Polar Codes

Polar codes were the youngest entrant in NR's coding bake-off and won the control channels outright. The construction is striking: a recursive transform turns N ordinary channels into N synthetic channels whose reliabilities polarize toward either near-perfect or near-useless. Carry the K information bits on the most reliable synthetic channels, freeze the rest to a known zero, and you have a capacity-achieving code with no error floor at the short lengths control needs.

5.5.1 Channel Polarization and the Reliability Sequence

5.5.2 Distributed CRC and PC Bits

Raw polar is decoded by Successive Cancellation, but NR strengthens it. On the downlink (PDCCH, PBCH) the CRC is distributed — its bits are interleaved among the information bits so the list decoder can prune wrong paths early (and even terminate early), not just at the end. On the uplink, short UCI uses parity-check (PC) bits — a few extra frozen-like bits set from earlier bits — to the same end. Both turn the CRC from a final pass/fail into an active steering signal for the decoder.

5.5.3 Polar Rate Matching — Repetition, Puncturing, Shortening

The polar mother length N is a power of two, but the granted size E rarely is. After a 32-way sub-block interleaver, NR matches N to E with one of three modes, chosen by comparing E with N and the code rate (TS 38.212 §5.4.1):

5.5.4 SCL Decoding

The decoder is Successive-Cancellation List (SCL) with list size L ∈ {1, 4, 8, 16, 32}. It explores the bit-decision tree, keeps the L most-likely partial paths alive at each step, prunes the rest, and lets the distributed CRC select the survivor.

5.5.5 Where Polar Is Used

• PBCH — K = 56 after CRC, N = 512, E = 864.
• PDCCH — K up to ~140 after CRC, N up to 512, E = 108·(aggregation level).
• UCI > 11 bits — K up to 1706, N up to 1024 (uplink, with PC bits).

5.6 CRC Families and Polynomials

NR uses several CRC polynomials, sized to the payload and, for control, doing double duty as an address. TS 38.212 §5.1 fixes each one exactly.

5.7 Worked Example — A Transport Block Through the Chain

5.8 References

SS/PBCH Block

A four-symbol beacon that turns a phone from lost into ready in thirty milliseconds — and a friendly walk through the exact 3GPP machinery that makes it possible.

6.1 What the SSB Is, and Why It Has to Be Tiny

A 5G phone wakes up in a city it has never visited. It does not know the operator, the carrier frequency it ought to land on, the cell identity, the system-frame number, the slot offset, the subcarrier-spacing of the control region — nothing. Inside thirty milliseconds it must know all of those things, decode the first broadcast message, and be on the verge of sending a random-access preamble. The signal that closes that gap is the SS/PBCH Block — the SSB — and it is one of the smallest, most carefully optimised pieces of waveform in the entire physical layer.

The SSB carries four logically distinct things, in this order of decode-time priority:

• PSS (Primary Synchronization Signal) — provides symbol-timing lock and narrows the cell identity to one of three groups1.
• SSS (Secondary Synchronization Signal) — resolves the cell identity to exactly one of 1,008 PCIs2.
• PBCH (Physical Broadcast Channel) — carries the Master Information Block (MIB), 24 bits, augmented with 8 timing/transport bits to form the 32-bit PBCH payload that together steers the UE to CORESET#03.
• PBCH-DMRS — the demodulation pilot that lets the UE estimate the channel and read three bits of SSB index for free, before PBCH is even decoded4.

6.2 The SSB Resource Grid — Four Symbols, 240 Subcarriers, 960 REs

The SSB occupies 4 contiguous OFDM symbols in time and 240 contiguous subcarriers (20 PRBs) in frequency, regardless of numerology. Inside that grid, the four signals are packed in a fixed, beam-independent layout — the same layout on every cell, every gNB vendor, in every band:

6.2.1 PSS — the length-127 m-sequence

The PSS is a single Binary Phase-Shift Keying (BPSK) modulated m-sequence of length 127, mapped to the 127 central subcarriers of symbol l₀. There are exactly three of them, indexed by N_ID⁽²⁾ ∈ {0, 1, 2}. The recursion is the same in all three cases; only the cyclic offset changes.

6.2.2 SSS — the length-127 Gold sequence

The SSS is the product of two length-127 m-sequences with independent shifts. There are 336 distinct SSS, indexed by N_ID⁽¹⁾ ∈ [0, 335].

The PCI follows immediately:

6.2.3 PBCH — payload, polar coding, scrambling, modulation

The PBCH is the only channel in the SSB that actually carries application-layer bits. Its raw Master Information Block (MIB) payload is just 24 bits (23 information bits + the BCCH-BCH-Message choice bit) — the physical layer then appends 8 timing bits to reach the 32-bit PBCH payload (Sec. 6.2.4). The MIB is defined in TS 38.331 as the IE BCCH-BCH-Message → MIB:

The PHY appends 8 additional bits to the 24-bit BCCH-BCH-Message — the 4 LSBs of the SFN, the half-frame indicator n_hf, and 3 case-dependent bits (k_SSB MSB + 2 reserved for FR1; the 3 SSB-index MSBs for L_max=64) — yielding the 32-bit PBCH payload (Ā = 32) defined by TS 38.212 §7.1.1:

  Ā = 32 payload bits (24-bit MIB + 8 PHY)  →  +CRC-24C (L=24)  →  K = 56 bits
                       →  payload bit interleaving (Table 7.1.1-1, SFN-aware)
                       →  Polar encoder (mother N = 512)
                       →  sub-block interleaving (32 columns, Table 5.3.1.1-1)
                       →  rate matching to E = 864 bits
                       →  scrambling with Gold seq c(i) seeded by N_ID^cell
                       →  QPSK → 432 modulation symbols → 432 PBCH REs

6.2.4 PBCH payload extension — the 8 PHY bits in detail

The 32-bit PBCH payload does not appear from nowhere. The PHY appends exactly 8 bits onto the 24-bit MIB before CRC-24C attachment. Their layout (TS 38.212 §7.1.1) is L_max-dependent. Note the indexing: in TS 38.212 these are ā_A…ā_A+7 with A = 24, so ā₀ below denotes ā_A+0:

6.2.5 PBCH-DMRS — the cleverest reference signal in 5G

PBCH-DMRS is the demodulation pilot for PBCH. It sits on every fourth subcarrier (k = 4n + ν) in symbols l₀+1 and l₀+3, plus the same comb on the top/bottom 57/56 subcarriers of symbol l₀+2 — 144 pilot REs in total. The comb offset is just ν = N_ID^cell mod 4.

What makes PBCH-DMRS unusual is that its sequence selection is information-bearing. The UE doesn't have to decode PBCH to learn the SSB index; it correlates the received DMRS against 4 or 8 candidate sequences and picks the strongest. Three bits of i_SSB are conveyed by the choice of DMRS sequence itself.

6.2.6 Point A and frequency-domain anchoring

Decoding the SSB locks PCI, SFN, and i_SSB — but the UE still doesn't know where the cell's RB grid starts in absolute frequency. That's what Point A is for. Point A is the lowest subcarrier of the common RB grid; everything (PDCCH BWP, PDSCH BWP, RACH RO, CSI-RS, you name it) is measured from there.

Once Point A is known, the UE turns offsetToPointA and locationAndBandwidth from SIB1 into a concrete PRB index for CORESET#0, the initial DL BWP, and every other resource it will be told about. Get Point A wrong by one subcarrier and every subsequent RB index is off by one — symptom seen in the field as "UE decodes MIB fine but never decodes SIB1".

6.3 SSB Burst Sets and Beam Sweeping

NR's defining departure from LTE: the SSB is not always-on and not omnidirectional. The gNB transmits an SS-burst set — L_max SSBs back-to-back inside a single 5 ms half-frame, each on a different beam — and goes silent for the rest of the period (default 20 ms). The next burst-set sweeps the same beam grid again. This is the entire premise of mmWave NR coverage.

6.3.1 L_max — how many beams in one burst

6.3.2 Candidate symbol positions — Case A through Case G

6.3.3 Beam-sweep timing and SSB index conveyance

6.3.4 CD-SSB and non-CD-SSB

Not every transmitted SSB is the same kind of SSB. The spec distinguishes two roles:

• CD-SSB — Cell-Defining SSB. The "real" cell. Its pdcch-ConfigSIB1 points to a CORESET#0 carrying SIB1 for this cell. There is exactly one CD-SSB per physical cell. Standalone UEs camp here.
• NCD-SSB — Non-Cell-Defining SSB. Additional SSBs the gNB transmits inside the carrier (typically inside other BWPs) so that a UE on a different BWP can still measure SSB-based RSRP. NCD-SSBs do not carry a valid pointer to SIB1; their pdcch-ConfigSIB1 is set to indicate "no SIB1 for this SSB" (a specific encoding in Table 13-1.., dependent on FR/SCS).

In an SA deployment with one BWP per UE, the CD-SSB is all you have. In a CA / multi-BWP deployment, NCD-SSBs let measurement happen on every BWP without forcing the UE to retune to the BWP-with-CD-SSB just to measure. The UE knows the type from the pdcch-ConfigSIB1 byte: any encoding that points at a valid CORESET#0/SS#0 is CD; anything else is NCD.

6.3.5 SMTC — SSB Measurement Timing Configuration

For RRM measurement (RSRP/RSRQ for handover, cell reselection, conditional handover), the UE doesn't decode SSBs continuously. The network tells it when to look via the SMTC — an IE in MeasObjectNR:

So SMTC says "every 20 ms, starting at offset 5, look at SSBs for 2 subframes." Outside that window, the UE doesn't even tune to that frequency. SMTC is what enables low-power inter-frequency measurements: the UE only wakes its receiver during the SMTC window.

6.4 Cell Search Procedure (UE side)

6.4.1 Synchronization raster — where to even look

The UE does not scan every 5 kHz step of the band. It scans the synchronization raster, a sparse band-specific grid expressed as a GSCN (Global Synchronization Channel Number).

6.4.2 The five decode stages

6.4.3 Receiver implementation notes

• Coherent vs non-coherent PSS. Non-coherent (magnitude-squared) PSS correlation is standard — the UE has no phase reference yet. Coherent extensions use the SSS phase from a previous SSB to lift the threshold (~3 dB win), useful in steady-state but not first acquisition.
• FFT vs time-domain. SSS is decoded in the frequency domain (after FFT) because SSS sits on 127 specific subcarriers. PSS may be detected in either domain; modern receivers run a small FFT once timing is approximately known.
• Joint vs sequential. Some receivers run PSS+SSS jointly across multiple half-frames to maximise diversity in low SNR. This costs latency but improves sensitivity by ~3 dB per added half-frame.

6.4.4 CORESET#0 — what pdcch-ConfigSIB1 actually decodes to

If you have to remember one field in the entire MIB, make it pdcch-ConfigSIB1. It is eight little bits, but those eight bits are what turn a phone that has "found a cell" into a phone that can "read the cell's settings". Splitting the byte in half: the top four bits are an index into one of TS 38.213 Tables 13-1 to 13-10 — and which table you use depends on the SSB subcarrier spacing, the PDCCH subcarrier spacing, and the minimum channel bandwidth. Each entry in those tables names a concrete CORESET#0 layout: how many resource blocks, how many symbols, and how far away from Point A it starts. The bottom four bits are an index into Tables 13-11 to 13-15, which name a concrete search-space schedule: which slots within the SSB period the UE should monitor, which symbol inside the CORESET the PDCCH starts on, and how many blind decoding candidates to try.

6.5 Worked Example — UE finds PCI 451 on n78

6.6 RRM Measurements on SSB — SS-RSRP, SS-RSRQ, SS-SINR

Once the UE is on the cell, it doesn't stop looking at SSBs — it measures them, continuously, for handover, beam selection, and RLM (radio-link monitoring). Three quantities are defined, all on SS reference signals (PBCH-DMRS + SSS together).

All three are per-SSB-beam. The UE returns either the maximum across beams, or a list of the top N beams, depending on the nrofReportedRS in the reporting configuration. Beam-level RSRP is what BFR (beam failure recovery) uses to detect "current beam dead" and pick a new one.

6.7 Rel-17 and Rel-18 Deltas

• RedCap (Rel-17). Reduced-Capability UEs decode SSB normally but may use narrower CORESET#0 (12 RBs instead of 24/48/96) and a separately signalled SSB for RedCap (so legacy UEs still see the same broadcast cell). The spare MIB bit becomes a RedCap-indication candidate in Rel-18 to advertise "this cell supports RedCap UEs".
• Multi-TRP (Rel-17). Up to two SSB sets may be transmitted from two TRPs of the same cell, with TCI states distinguishing them. The UE measures both and reports per-TRP beam RSRP for joint scheduling.
• NES — Network Energy Saving (Rel-18). The SSB period can be temporarily elongated to 40, 80, or 160 ms in low-traffic hours via SIB signalling. UEs adjust their measurement period accordingly. This is the first standardised mechanism for reducing AOAOA energy on the always-on signal.
• FR2-2 (Rel-17). 480 / 960 kHz SCS introduce Cases F and G; symbol density is so high that the SSB and SIB1 both fit inside a fraction of a symbol's worth of legacy timing — receiver design changes substantially.

6.8 Field-Engineering Notes & Edge Cases

• PCI collisions in dense deployments. Two cells with the same PCI inside one neighbour relation produce SS-RS interference that no normal receiver can untangle. Symptom: UE camps fine but never decodes SIB1. Fix: PCI replan with mod 3 and mod 4 constraints.
• SSB < carrier centre offset. ssb-SubcarrierOffset (k_SSB) can be non-zero — the SSB does not have to sit on the carrier centre. UE uses k_SSB + SS_ref to derive Point A; an off-by-one here breaks every subsequent RB index.
• FR2 missing beams. L_max=64 is a ceiling, not a requirement. Real FR2 deployments often transmit 16 or 32. UE receives a "transmitted SSBs" bitmap in SIB1 (ssb-PositionsInBurst) so it knows which i_SSB are real.
• n_hf ambiguity for L_max=4. Because n_hf is folded into ī_SSB, a misdetection shifts c_init and the descrambler fails. Robust receivers try both n_hf = 0 and 1 in parallel.
• SSB transmit periodicity vs measurement periodicity. SIB1's ssb-PeriodicityServingCell tells the UE the actual gNB SSB period; the UE assumes 20 ms for cell search but uses the SIB1 value for steady-state RRM measurement.
• CD-SSB silently switched to NCD-SSB. Some operators reconfigure their cells and turn an active CD-SSB into NCD without coordinating timing. UEs that hadn't refreshed SIB1 then fail with "valid MIB, no SIB1 found". Always re-read SIB1 after long sleep.

6.9 References & Where to Go Next

PDCCH — Physical Downlink Control Channel

Every byte your phone receives is permitted by one tiny instruction sent moments earlier. This chapter is about that instruction — where it lives, how it's encoded, and why the phone has to guess where to look for it.

7.1 What PDCCH Is — The Permission Slip

Every single byte your phone downloads is preceded, somewhere between fifty microseconds and a few milliseconds earlier, by a tiny instruction the gNB sent it. That instruction says which resource blocks contain the next chunk of data, how they were modulated, which redundancy version of the code it is, and a dozen other little facts. Without the instruction, the phone wouldn't know where to look. With it, the phone knows exactly where in the next slot or two to point its FFT. That instruction is called a DCI — Downlink Control Information — and the place it lives is the PDCCH, the Physical Downlink Control Channel.

PDCCH is the most-scheduled, most-monitored, most-decoded channel in the entire NR system. Every slot, on every cell, in every band, the gNB writes one or more DCIs into it, and every connected phone tries to find every DCI that might be addressed to it — without knowing in advance where the gNB wrote them. The whole chapter is, in some sense, a story about that mismatch: the gNB knows; the phone has to guess; and the spec arranges for the guessing to be cheap enough that the phone can do it 1,000 times per second on battery.

7.2 The PDCCH Hierarchy — RE, REG, CCE, Aggregation Level, Candidate

PDCCH has five units of resource, each built from the one below it. Understanding the stack is the single most important thing in this chapter — every other PDCCH concept reduces to "how do these five things fit together?"

7.3 CORESET — The Control Resource Set

A CORESET is the time-frequency rectangle in which PDCCH lives. It is configured by RRC (ControlResourceSet IE in TS 38.331) and changes only when the network reconfigures the UE. Up to three CORESETs can be configured per BWP at any one time (each with a controlResourceSetId in 0–11, one of which may be CORESET#0); CORESET#0 is the special one decoded during cell search (Chapter 6).

7.3.1 Frequency-domain allocation — the 45-bit bitmap

The frequency layout of a CORESET is described by a 45-bit bitmap, frequencyDomainResources. Each bit covers a group of 6 contiguous resource blocks. With 45 bits × 6 RBs = 270 RB max, that covers any FR1 or FR2 channel up to ~273 RB.

7.3.2 Time-domain duration — 1, 2, or 3 symbols

CORESETs are short in time. duration ∈ {1, 2, 3} OFDM symbols. CORESET#0 is special: pattern 1 (multiplexed in time with the SSB) supports 1, 2, or 3 symbols depending on the configuration table. The other two CORESETs (1, 2) are typically 1 or 2 symbols.

Why so short? Because every PDCCH symbol is a symbol the gNB cannot use for data on those RBs. PDCCH is overhead; you want to minimise it. The duration knob is a direct trade-off between PDCCH capacity and PDSCH throughput.

7.3.3 CCE-to-REG mapping — interleaved vs non-interleaved

Once you know how many REGs the CORESET has (= N_RB × duration), you have to decide which REGs make up CCE 0, CCE 1, CCE 2, and so on. There are two strategies:

7.3.4 REG bundle size and precoder granularity

A REG bundle is the unit across which the gNB uses the same precoder. Within a bundle, the UE can assume channel coherence — meaning the DMRS pilots from one REG can extrapolate to estimate the channel for the data REs in the neighbour REGs of the same bundle. Bigger bundles = better channel estimate but coarser precoder granularity.

L = 6 is the "all REGs of a CCE share one precoder" choice — common in simple CORESETs. L = 2 or 3 trades better precoder agility for noisier channel estimation. precoderGranularity in ControlResourceSet can also be set to allContiguousRBs, which says "use one precoder across every contiguous RB region of the CORESET" — an even bigger granularity, very common in CORESET#0.

7.3.5 TCI states and QCL

Every CORESET has up to 64 candidate TCI states (tci-StatesPDCCH-ToAddList) and exactly one of them is active at any moment, switched by a MAC CE. A TCI state says "the channel of this CORESET's DMRS is quasi-co-located (QCL) with the channel of that other reference signal". The reference might be an SSB beam, a CSI-RS, or another PDCCH-DMRS. The QCL relationship can be of four types: Type A (Doppler, delay spread), B (Doppler shift, delay spread), C (Doppler, delay shift), D (Spatial Rx — beam direction).

For FR2 PDCCH, the TCI state's QCL-Type D is what tells the UE which receive beam to point its antenna at when listening for this CORESET. Without it, the UE has no idea which physical direction to look. That's why FR2 PDCCH always has a TCI state; FR1 typically uses TCI Type A only.

7.4 Search Spaces — Where to Look

A CORESET is just a place. A Search Space (SS) is the schedule for monitoring that place. The SS tells the UE: "in this CORESET, on these slots, with these aggregation levels, try this many candidates of each." Multiple SSs can be active simultaneously on the same CORESET; one for system info, one for paging, one for the UE's own data, and so on.

7.4.1 Common Search Space vs UE-specific Search Space

7.4.2 The USS hashing function — Y_p,ns

The UE-specific search space cannot place all UEs' candidates at the same CCEs every slot — that would cause collisions every slot. Instead, the spec defines a per-UE, per-slot hash that pseudo-randomly picks a different starting CCE every slot, every UE. The hash is the famous Y_p recursion:

7.4.3 Candidate placement formula

7.5 Blind Decoding — Budgets and Trade-offs

The UE does not know which AL the gNB used. It tries them all — or rather, it tries as many as the spec allows. The total work is capped to keep silicon affordable.

7.5.1 BD and CCE budgets per slot

Two budgets matter: the number of blind decode attempts (M^BD) and the number of distinct CCEs covered by those attempts (C^CCE). One blind decode of an AL16 candidate consumes 16 CCEs of the C^CCE budget but just 1 of the M^BD budget. So the constraint isn't "44 candidates total" — it's "44 candidates AND 56 CCEs". If the gNB tries to schedule four AL-16 candidates for one UE, that's 4 × 16 = 64 CCEs, over budget, not allowed.

7.5.2 Aggregation level adaptation

The gNB chooses the AL based on the UE's reported channel quality. A UE with strong RSRP and SINR can decode AL=1 (8 PDCCH coded bits per CCE × 1 = barely enough). A cell-edge UE needs AL=8 or 16 to gain the coding gain it requires. The gNB tracks CQI/SRS for every UE and adjusts AL slot-by-slot. The UE has no idea what AL was used — it tries them all and the one with a passing CRC wins.

7.6 DCI Formats — The Two-Dozen Messages

As of Rel-18, TS 38.212 §7.3.1 defines 24 DCI formats, grouped into UL grants (0_x), DL grants (1_x), group-common DCIs (2_x), sidelink DCIs (3_x), and the multicast/broadcast (MBS) DL family (4_x). Each format has a fixed-ish field layout — variable lengths come from BWP-dependent fields like "frequency-domain resource assignment". (NR launched in Rel-15 with far fewer; the 0_3/1_3 multi-cell formats, 2_8/2_9, 3_2, and the 4_x MBS family are the newest additions.)