LTE MIB vs 5G NR MIB

Why the MIB Matters: First Contact

The Master Information Block is the first piece of structured information a UE decodes after acquiring time and frequency synchronisation from PSS/SSS. It is the handshake that transforms a detected carrier from “some signal on a frequency” into “a cell I can camp on.” Without MIB, the UE cannot locate CORESET#0 (NR) or determine the system bandwidth (LTE), and therefore cannot receive SIB1 — the gateway to every other parameter the cell broadcasts.

In both LTE and NR, the MIB is carried on the Physical Broadcast Channel (PBCH), which itself rides on the BCH transport channel. But the similarity ends at the acronym. The two systems differ in payload structure, encoding, resource mapping, timing, and — most profoundly — in how the MIB fits into the broader cell acquisition state machine. This article dissects every difference at the bit level, referencing the exact 3GPP specifications.

LTE MIB: The 24-Bit Blueprint

The LTE MIB, defined in TS 36.331 §6.2.2, is an ASN.1 structure with exactly three information fields and a spare block:

Field-by-Field Anatomy

dl-Bandwidth (3 bits)

Encodes the downlink system bandwidth in resource blocks. Six values: n6 (1.4 MHz), n15 (3 MHz), n25 (5 MHz), n50 (10 MHz), n75 (15 MHz), n100 (20 MHz). This is the first parameter the UE needs because it determines the extent of the OFDM resource grid — without it, the UE cannot demodulate any downlink channel beyond PBCH itself.

phich-Config (3 bits)

Two sub-fields: phich-Duration (1 bit: normal or extended) and phich-Resource (2 bits: 1/6, 1/2, 1, or 2). Together they tell the UE the number of PHICH groups per subframe. The UE needs this to locate PHICH — the channel that carries HARQ-ACK for uplink transmissions. This is critical because PHICH occupies resources within the control region alongside PDCCH, and its size affects how many CCEs are available for PDCCH allocation.

systemFrameNumber (8 bits)

The 8 most significant bits (MSBs) of the 10-bit System Frame Number. SFN cycles 0–1023 (10.24 seconds). The remaining 2 LSBs are derived implicitly from the PBCH self-decodable sub-block index: the 40ms PBCH TTI is divided into 4 blocks of 10ms each, and whichever block the UE successfully decodes tells it the 2 LSBs (00, 01, 10, 11). This is an elegant design but requires the UE to attempt up to 4 blind decodes.

spare (10 bits)

Reserved for future use. Always set to zero. Note that 10 spare bits in a 24-bit payload means over 41% of the MIB capacity was never utilised — a design choice that reflects the conservative 3GPP approach of reserving headroom in fundamental broadcast messages.

NR MIB: The 32-Bit Paradigm Shift

The NR MIB, defined in TS 38.331 §6.2.2, is a fundamentally different creature. The RRC-level MIB IE contains 23 bits, but the PBCH transport block is 32 bits because 3GPP added 8 additional timing/indexing bits that sit outside the MIB ASN.1 structure but inside the PBCH payload. This dual-layer design is one of NR's most elegant architectural decisions.

Field-by-Field Anatomy — Expert Deep Dive

What follows is a bit-by-bit forensic analysis of every field in the NR MIB. For each field, we cover: the exact ASN.1 encoding, the mapping from bit values to physical-layer parameters, the 3GPP specification cross-references, the design rationale, and worked examples showing how a real UE interprets these bits during initial cell acquisition.

Bit [22:17] — systemFrameNumber (6 bits)

These 6 bits carry the most significant bits of the 10-bit System Frame Number (SFN), representing SFN[9:4]. The SFN cycles 0–1023, giving a hyperframe period of 10.24 seconds (1024 × 10ms). In NR, the remaining 4 LSBs (SFN[3:0]) are explicitly carried in the PBCH payload outside the MIB IE — a fundamental departure from LTE where 2 LSBs required blind sub-block detection.

Bit [16] — subCarrierSpacingCommon (1 bit)

This single bit tells the UE the subcarrier spacing to use when receiving CORESET#0 (where PDCCH scheduling SIB1 is transmitted) and the initial downlink BWP for SIB1 PDSCH reception. It is the UE's first indication of the numerology used beyond the SSB itself.

Bit [15:12] — ssb-SubcarrierOffset (4 bits, k_SSB)

This 4-bit field encodes k_SSB — the frequency offset in subcarriers from the lowest subcarrier of the SSB (subcarrier 0 of the SSB resource grid) to the nearest common resource block (CRB) boundary. Without k_SSB, the UE cannot align its resource grid with the cell's CRB numbering, which means it cannot correctly identify the physical resource blocks (PRBs) of CORESET#0 or any other downlink channel.

Bit [11] — dmrs-TypeA-Position (1 bit)

This bit specifies the OFDM symbol index of the first DM-RS symbol for PDSCH mapping Type A:

Why in MIB? The UE needs to demodulate the PDSCH carrying SIB1 before it has received SIB1 itself. To demodulate PDSCH, the UE must know where the DM-RS is. Since SIB1 uses PDSCH mapping Type A, and the DM-RS position for Type A is not fixed (unlike LTE's CRS which is always at symbols 0/4/7/11), the MIB must convey this information. Without this single bit, the UE would have to blind-test two DMRS hypotheses for every SIB1 PDSCH decode attempt.

Bit [10:3] — pdcch-ConfigSIB1 (8 bits)

The most consequential field in the entire MIB — and arguably the most elegant piece of NR initial access design. These 8 bits replace what LTE needed three separate mechanisms for: the PHICH resource configuration (MIB), the Control Format Indicator via PCFICH (decoded every subframe), and the fixed PDCCH common search space definition. In NR, all of this is collapsed into two 4-bit table indices.

    Bits [10:7] — controlResourceSetZero (4 MSBs)

This 4-bit index selects a row from one of 15 CORESET#0 configuration tables in TS 38.213 §13, Tables 13-1 through 13-10. The specific table used depends on the {SSB SCS, common SCS} pair and the minimum channel bandwidth. Each table row defines:

• Number of RBs: The bandwidth of CORESET#0, typically 24, 48, or 96 RBs
• Number of OFDM symbols: 1, 2, or 3 symbols for the CORESET duration
• Frequency offset: The offset in RBs between the lowest RB of CORESET#0 and the lowest RB of the SSB, which tells the UE exactly where in frequency to look for PDCCH
• Multiplexing pattern: Pattern 1 (CORESET#0 and SSB TDM, non-overlapping in time), Pattern 2 (FDM within the same slot), or Pattern 3 (FDM with different symbol offsets)

    Bits [6:3] — searchSpaceZero (4 LSBs)

This 4-bit index selects a row from TS 38.213 Tables 13-11 through 13-15, defining the PDCCH monitoring occasions for SearchSpace#0. Each row specifies:

• Monitoring slot offset (O): The first slot (relative to the SSB) in which the UE monitors PDCCH
• Monitoring periodicity (M): How often the monitoring pattern repeats (every 1, 2, or 4 slots)
• Number of PDCCH candidates: The UE attempts to blind-decode this many PDCCH candidates per monitoring occasion, using aggregation levels from the set {4, 8, 16}
• First symbol index: Which OFDM symbol within the slot starts the monitoring occasion (for patterns where multiple occasions occur per slot)

Bit [2] — cellBarred (1 bit)

This bit indicates whether the cell is barred for access:

Why moved from SIB1 to MIB? In LTE, cell barring information is in SIB1 (cellAccessRelatedInfo), meaning the UE must acquire SIB1 (which can take 80–160ms) only to discover the cell is barred and it wasted time. By moving cellBarred to MIB in NR, the UE learns the cell's access status immediately after PBCH decode — if barred, it can skip SIB1 acquisition entirely and move to the next candidate cell, saving hundreds of milliseconds during cell search. This is especially important in dense deployments where many small cells may be barred for specific UE categories.

Bit [1] — intraFreqReselection (1 bit)

Interaction with cellBarred: This field only has meaning when cellBarred = barred. If the cell is barred and intraFreqReselection = notAllowed, the UE must treat all cells on this frequency as barred (unless they have higher reselection priority). This effectively bars an entire frequency carrier, which operators use during network maintenance or disaster recovery to steer traffic to other bands. When intraFreqReselection = allowed and the cell is barred, the UE can still reselect to other cells on the same frequency — only this specific cell is barred.

Bit [0] — spare (1 bit)

A single reserved bit, always set to 0. Compare this to LTE's 10 spare bits: NR MIB uses 22 out of 23 bits for actual information, achieving 95.7% information density vs LTE's 58.3%. This reflects NR's design philosophy of maximising every bit in the broadcast channel — future Rel-19+ features that need a MIB field will have to either repurpose this single bit or add bits to the PBCH payload.

PBCH Payload Fields (Outside MIB IE, Inside Transport Block)

The 32-bit PBCH transport block contains 8 additional bits that are not part of the RRC MIB IE but are generated by the physical layer (TS 38.212 §7.1.1). These bits carry timing and beam index information that changes faster than the MIB content cycle.

PBCH Bits — SFN[3:0] (4 bits)

The 4 least significant bits of the System Frame Number. Combined with the 6 MSBs from the MIB IE, the UE recovers the complete 10-bit SFN without any blind decoding. These bits change every 10ms (every radio frame), which is why they cannot be in the MIB IE (which is frozen for 80ms).

PBCH Bit — Half-Frame Indicator (1 bit)

Indicates which 5ms half-frame within the 10ms radio frame the SSB was transmitted in. Value 0 = first half-frame (symbols 0–6 of the frame), value 1 = second half-frame (symbols 7–13). This gives the UE 5ms timing resolution, which is essential because SSBs can appear in either half-frame depending on the SSB burst configuration (TS 38.213 §4.1 Tables 4.1-1/2).

PBCH Bits — SSB Block Index (up to 3 bits)

For L_max > 4 (FR1 bands 3–6 GHz or FR2), the PBCH payload carries 3 bits representing the MSBs of the SSB block index. The 3 LSBs of the SSB index are derived from the PBCH DMRS sequence initialisation (one of 8 possible sequences). Together, this gives up to 6-bit SSB index (0–63) for FR2 L_max = 64.

For L_max ≤ 4 (FR1 sub-3 GHz), only 2 SSB index bits are needed, and both are derived from the DMRS — no PBCH payload bits are used. The freed bits serve other purposes (k_SSB MSB for 15 kHz SCS).

Bit-Field Comparison: Every Bit Accounted For

The table below maps every bit of both payloads side by side. The fundamental philosophical difference becomes clear: LTE uses its MIB to describe the physical resource grid (bandwidth, PHICH), while NR uses its MIB to describe the control channel configuration (CORESET#0, SearchSpace#0) and timing parameters (SCS, SSB offset). NR delegates resource grid description entirely to SIB1.

PBCH Physical Channel: Resource Grid Geometry

LTE PBCH Resource Mapping

In LTE, PBCH occupies 72 subcarriers (6 central RBs) × 4 OFDM symbols in the second slot of subframe 0. This gives 72 × 4 = 288 REs, minus CRS (cell-specific reference signals), yielding approximately 240 available REs (exact count depends on antenna port count: 1, 2, or 4 CRS ports). The bandwidth is always 1.08 MHz, regardless of the cell's system bandwidth. PBCH is QPSK modulated.

NR PBCH Resource Mapping

In NR, PBCH is part of the SS/PBCH Block (SSB), which occupies 240 subcarriers × 4 OFDM symbols. The 4 symbols are allocated as:

• Symbol 0: PSS (127 subcarriers, centered)
• Symbol 1: PBCH (240 subcarriers, includes PBCH DMRS)
• Symbol 2: PBCH (48+48 subcarriers on the edges) + SSS (127 subcarriers, centered)
• Symbol 3: PBCH (240 subcarriers, includes PBCH DMRS)

Total PBCH REs: 240 × 2 (symbols 1 & 3) + 96 (symbol 2 edges) = 576 REs, minus DMRS (144 DMRS REs at density 1/4 per symbol), yielding 432 PBCH data REs. QPSK modulated → 864 coded bits.

Channel Coding: Tail-Biting Convolutional vs Polar

This is arguably the most significant technical divergence between the two systems. LTE PBCH uses a tail-biting convolutional code (TBCC) with rate 1/3 and constraint length K=7 — the same workhorse encoder used for all LTE control channels. NR PBCH uses a polar code — the first application of Arıkan's channel polarization theory in a commercial wireless standard.

LTE: TBCC Processing Chain

1. Input: 24-bit MIB payload (a₀ to a₂₃)
2. CRC attachment: 16-bit CRC (generator polynomial g_CRC16). The CRC bits are XORed with an antenna port mask (see Chapter 7).
3. Convolutional encoding: Rate 1/3, K=7 tail-biting encoder. Three generator polynomials: g₀=133₈, g₁=171₈, g₂=165₈. Output: 40 × 3 = 120 bits.
4. Rate matching: Sub-block interleaving + circular buffer + bit selection to produce 1920 coded bits.
5. Segmentation: 1920 bits divided into 4 self-decodable blocks of 480 bits each. Each block is transmitted in one 10ms radio frame.
6. Modulation: QPSK → 960 symbols mapped to ~240 REs × 4 frames.

NR: Polar Coding Processing Chain

1. Input: 32-bit PBCH transport block (A = 32)
2. CRC attachment: 24-bit CRC (CRC24C, polynomial per TS 38.212 §5.1). Output: 56 bits.
3. Payload interleaving: Per TS 38.212 Table 7.1.1-1, a specific bit-level interleaving is applied to align the distributed CRC for list decoding.
4. Polar encoding: Mother code size N = 512 (n = 9). Reliability sequence from TS 38.212 Table 5.3.1.2-1 selects K = 56 most-reliable channels. Remaining 456 channels are frozen (set to 0). Polar transform: d = u · G_N where G_N = F^⊗n, F = [1 0; 1 1].
5. Rate matching: Sub-block interleaving + circular buffer to produce E = 864 coded bits.
6. Scrambling: Scrambled with a sequence derived from cell ID (N_ID^cell) and the SSB index ν. This means each SSB beam has a different scrambling sequence.
7. Modulation: QPSK → 432 symbols mapped to 432 PBCH REs.

CRC & Antenna Port Detection

LTE: CRC Masking (TS 36.212 §5.3.1.2)

After computing the 16-bit CRC, LTE XORs the CRC bits with one of three masks to implicitly encode the number of cell-specific reference signal (CRS) antenna ports:

This is a classic example of hypothesis testing: the UE decodes PBCH once and checks the CRC against all three masks. Only one will pass (assuming no undetected error). This avoids using any MIB bits for antenna port information, which was critical given the limited 24-bit payload.

NR: DMRS-Based Detection

NR completely eliminates CRC masking. Instead, the PBCH DMRS sequences carry the necessary information. The DMRS sequence is generated using the cell ID (N_ID^cell) and implicitly encodes:

• SSB index (for L_max ≤ 4): The 2 LSBs of the SSB block index are derived from 1 of 4 possible DMRS sequence initialisation states.
• No explicit antenna port signalling: NR PBCH is always transmitted on a single antenna port (port 4000). There is no multi-antenna CRS concept. Instead, NR uses DMRS-based demodulation throughout, and beamforming is transparent to the UE at the PBCH level.

Timing Architecture: 40ms vs 80ms

LTE: 40ms PBCH TTI

The LTE PBCH TTI is 40ms, spanning 4 consecutive radio frames (frames N, N+1, N+2, N+3 where N mod 4 = 0). Each frame contributes one of four self-decodable sub-blocks. Key timing properties:

• MIB content changes every 40ms (SFN field updates)
• PBCH is transmitted in subframe 0, slot 1 of every frame (10ms periodicity for individual blocks)
• UE can decode after receiving any single sub-block (480 bits), but combining multiple blocks improves SINR
• Maximum acquisition delay: 40ms (worst case, UE arrives just after a TTI boundary)

NR: 80ms PBCH TTI with SSB Burst

The NR PBCH has an 80ms periodicity at which the MIB content changes. However, the actual transmission pattern is governed by the SSB burst set:

• Default SSB burst set periodicity: 20ms (configurable: 5, 10, 20, 40, 80, 160ms)
• Each burst set contains up to L SSB blocks (L_max = 4 for FR1 < 3 GHz, 8 for FR1 3–6 GHz, 64 for FR2)
• Each SSB block is transmitted on a different beam (beam sweeping)
• PBCH content is identical across all SSB blocks within one half-frame but the scrambling differs per SSB index
• Content changes every 80ms: 4 PBCH periods within 80ms for L_max ≤ 4 (distinguished by 2-bit SFN LSB difference), or 8 for L_max = 8/64

SSB Beam Sweeping: What LTE Never Had

The most radical difference between LTE PBCH and NR PBCH is not in the MIB content itself but in the spatial dimension. LTE PBCH is transmitted omnidirectionally (or with cell-wide beamforming at best). NR PBCH is transmitted as part of an SSB block that is beam-swept across the cell's coverage area.

Each SSB block (indexed 0 to L_max-1) is transmitted on a different beam direction. The UE selects the SSB with the strongest received signal quality (SS-RSRP) and decodes the MIB from that beam. This has profound implications:

• Coverage: Each beam has higher gain than an omnidirectional transmission, which is essential at mmWave frequencies where path loss is severe
• Cell ID structure: The SSB index is part of the PBCH scrambling, so the UE knows which beam it decoded even before reading the MIB content
• Mobility: The UE measures SS-RSRP per SSB index, enabling beam-level mobility management (TS 38.331 MeasObjectNR includes SSB-related measurement parameters)
• RACH association: Each SSB index is mapped to specific RACH occasions, so the gNB knows which beam the UE is responding to during initial access

SFN Recovery: Implicit vs Explicit

System Frame Number recovery illustrates a key NR design improvement. In LTE, the UE must perform up to 4 blind decode attempts to determine SFN[1:0]. In NR, all 10 SFN bits are available deterministically after a single successful PBCH decode.

LTE SFN Recovery

1. Decode PBCH → obtain MIB with SFN[9:2] (8 bits)
2. Determine which of 4 sub-blocks was decoded → SFN[1:0]
3. Combine: full SFN = SFN[9:2] | sub-block_index
4. Worst case: 4 decode attempts × 3 antenna hypotheses = 12 CRC checks

NR SFN Recovery

1. Decode PBCH → obtain MIB with SFN[9:4] (6 bits)
2. Extract SFN[3:0] from PBCH payload (4 bits) — no blind decode needed
3. Extract half-frame indicator (1 bit) — 5ms timing resolution
4. Extract SSB index (up to 3 bits from payload + 3 bits from DMRS for L_max = 64)
5. Combine: full SFN = SFN[9:4] | SFN[3:0], plus sub-frame timing from half-frame + SSB index

From MIB to SIB1: The Full Acquisition Chain

Understanding MIB in isolation is incomplete without seeing how it feeds the next step: SIB1 acquisition. The two systems have fundamentally different paths from MIB to SIB1.

LTE Acquisition Chain

1. PSS → 5ms timing, N_ID⁽²⁾ (sector ID, 0–2)
2. SSS → 10ms timing, N_ID⁽¹⁾ (group ID, 0–167) → full cell ID
3. PBCH/MIB → dl-Bandwidth, PHICH config, SFN
4. PCFICH (subframe 5) → CFI (control region size)
5. PDCCH blind decode → DCI 1A/1C with SI-RNTI → SIB1 allocation
6. PDSCH → SIB1 (fixed to subframe 5, periodicity 80ms)

NR Acquisition Chain

1. PSS → symbol-level timing, N_ID⁽²⁾ (0–2)
2. SSS → N_ID⁽¹⁾ (0–335) → full cell ID (0–1007)
3. PBCH/MIB → SCS, k_SSB, DMRS position, CORESET#0 + SS#0, SFN, cell barring
4. PDCCH in CORESET#0 (using SearchSpace#0 monitoring occasions from MIB) → DCI 1_0 with SI-RNTI → SIB1 PDSCH allocation
5. PDSCH → SIB1 (configurable periodicity, default 160ms)

The Master Comparison Table

The evolution from LTE MIB to NR MIB encapsulates the broader transition in 3GPP design philosophy: from a cell-centric, fixed-parameter, omnidirectional broadcast to a beam-centric, table-driven, spatially-multiplexed architecture. Every bit in the NR MIB earns its place by enabling the UE to move one step closer to SIB1 acquisition without relying on any other broadcast channel. The 10 spare bits that LTE never used stand as a quiet testament to the conservative design of an earlier era; NR's single spare bit shows what happens when every field must justify its existence in a spectrum-scarce, beam-swept world.