Main Content

NB-IoT Cell Search and MIB Recovery

This example shows how the LTE Toolbox™ can be used to fully synchronize, demodulate and decode a live narrowband internet of things (NB-IoT) downlink signal. Before the user equipment (UE) can communicate with the network, it must perform cell search and selection procedures and obtain initial system information. This involves acquiring slot and frame synchronization, finding out the cell identity and decoding the MIB. This example demonstrates this process and decodes the MIB. To decode MIB a comprehensive receiver is required, capable of demodulating and decoding the downlink channels and signals.


As NB-IoT is an extension of LTE infrastructure, the NB-IoT waveform has some similarities to that of LTE. Similarities between these two include:

  • Sub-carrier spacing (15kHz)

  • Frame structure (10 subframes with 2 slots each)

  • Frame duration (10 ms)

  • Physical channels

However, the number of subcarriers in NB-IoT is fixed to 12 (one resource block), unlike in LTE, where number of subcarriers vary with the bandwidth. Also, the physical channel mapping on the resource grid of NB-IoT is different from that of LTE. For more information see NB-IoT Downlink Waveform Generation.

In order to communicate with the network the UE must obtain some basic system information. This is carried by the MIB and SIBs. The MIB carries the most essential system information:

  • System frame number (SFN)

  • Scheduling information of SIB1-NB

  • Operation mode information for LTE-NB

  • Access barring

The MIB is carried on the broadcast channel (BCH) mapped into the narrowband physical broadcast channel (NPBCH) [ 1 ]. This is transmitted with a fixed coding and modulation scheme and can be decoded after the initial cell search procedure. The MIB corresponds to one BCH transport block. The BCH transmission time interval (TTI), or the time needed to transmit a single transport block, is 640 msec or 64 frames [ 3 ]. The BCH is transmitted in 64 parts, each part mapped to the first subframe (subframe 0) of a frame and it is possible that each transmission is independently decodable, depending on signal conditions. To ensure that subframe 0 is received, the capture should be at least 11 subframes long, to account for the possibility that the capture is started during subframe 0. For poor signal conditions, all 64 parts of the TTI may be required, in which case the capture should be at least 641 subframes long. For more details on NPBCH symbols generation, see NB-IoT Downlink Waveform Generation.

NB-IoT Downlink Waveform Generation and Initializing Parameters

Generate the time-domain waveform of a reference measurement channel (RMC) for narrowband physical downlink shared channel (NPDSCH) performance requirements, in accordance to TS 36.101 Annex A.3.12 [ 2 ]. The waveform is generated using the generateWaveform method in the class NBIoTDownlinkWaveformGenerator. To call the method, an object ngen is created and the method is called by using generateWaveform(ngen).

% Initialize NBIoTDownlinkWaveformGenerator object
% Use the 'rc' values of 'R.NB.5' and 'R.NB.6' for MIB decoding. Note that
% RMCs 'R.NB.5-1', 'R.NB.6-1' and 'R.NB.7' correspond to Non-Anchor type
% carriers which do not contain the required NPSS, NSSS and NPBCH.
rc = 'R.NB.5';
ngen = NBIoTDownlinkWaveformGenerator(rc);
ngen.Config.NNCellID = 120;
ngen.Config.NBRefP = 1;
ngen.Config.NFrame = 640;
ngen.Config.TotSubframes = 50;
ngen.Config.NPBCH.DataSource = 'MIB';

% Generate time domain NB-IoT waveform
[eNodeBOutput,grid,ofdmInfo] = generateWaveform(ngen);
sr = ofdmInfo.SamplingRate;

% Introduce a delay to simulate the unknown timing alignment associated
% with an arbitrary signal capture. This is compensated at the receiver
% while synchronizing the received signal.
delay = 50;
waveform = circshift(eNodeBOutput, delay);

% Initialize plots
if (~exist('channelFigure','var') || ~isvalid(channelFigure))
    channelFigure = figure('Visible','off');
[spectrumScope,synchCorrPlot,pdcchConstDiagram] = ...

% Display received signal spectrum
fprintf('\nPlotting received signal spectrum...\n');
spectrumScope(awgn(waveform, 100.0));
Plotting received signal spectrum...

Cell Search and Timing Synchronization

Call the function hNBCellSearch to obtain the cell identity and timing offset offset to the first frame head. A plot of the correlation between the received signal and the narrowband primary synchronization signal (NPSS)/narrowband secondary synchronization signal (NSSS) for the detected cell identity is produced. The NPSS is detected using time-domain correlation and the NSSS is detected using frequency-domain correlation. Prior to NSSS detection, frequency offset estimation/correction using cyclic prefix correlation is performed. The time-domain NPSS detection is robust to small frequency offsets but larger offsets may degrade the NPSS correlation.

% Cell search
fprintf('\nPerforming cell search...\n');
alg.SSSDetection = 'PostFFT';
alg.MaxCellCount = 1;
[NNCellID, offset, peak] = hNBCellSearch(waveform, alg);
nbenb = struct;
nbenb.NNCellID = NNCellID;

[~,corr] = lteNBDLFrameOffset(setfield(nbenb,'OperationMode','Standalone'),waveform); %#ok<SFLD>

% As NB-IoT has similar waveform structure as LTE waveform, use functions
% pertaining to LTE to work with NB-IoT. For this purpose, create a
% cell-wide settings structure enb.
enb = nbenb;

% Plot NPSS/NSSS correlation and threshold
synchCorrPlot.YLimits = [0 max(corr(:))*1.1];

% Perform timing synchronization
fprintf('Timing offset to frame start: %d samples\n',offset);
timesynced = waveform(1+offset:end,:);

% Show cell-wide settings
fprintf('Cell-wide settings after cell search:\n');
Performing cell search...
Timing offset to frame start: 50 samples
Cell-wide settings after cell search:
    NNCellID: 120

Frequency Offset Estimation and Correction

Prior to OFDM demodulation, any significant frequency offset must be removed. The frequency offset in the I/Q waveform is estimated and corrected using lteFrequencyOffset and lteFrequencyCorrect. The frequency offset is estimated by means of correlation of the cyclic prefix and therefore can estimate offsets up to +/- half the subcarrier spacing i.e. +/- 7.5kHz. NB-IoT downlink waveform generation is similar to LTE uplink waveform generation as both the waveforms have half sub-carrier shift. Hence, use LTE uplink functions to estimate the frequency offset and to demodulate the NB-IoT OFDM downlink received waveforms.

% Frequency offset estimation
fprintf('\nPerforming frequency offset estimation...\n');
enb.NULRB = 6; % For frequency offset computation
enb.DuplexMode = 'FDD';
foffset = lteFrequencyOffset(enb,timesynced,0);
fprintf('Frequency offset: %0.3fHz\n',foffset);

% Compensating for frequency offset
freqsynced = lteFrequencyCorrect(enb,timesynced,foffset);
Performing frequency offset estimation...
Frequency offset: -0.031Hz

OFDM Demodulation and Channel Estimation

The OFDM downsampled I/Q waveform is demodulated to produce a resource grid rxgrid. This is used to perform channel estimation. hest is the channel estimate, nest is an estimate of the noise (for MMSE equalization), and cec is the channel estimator configuration.

For channel estimation the example assumes four cell specific reference signals, and two narrowband reference signals. This means that channel estimates to each receiver antenna from all possible cell-specific reference signal ports are available. The true number of cell-specific reference signal ports is not yet known. The channel estimation is only performed on the first subframe, i.e. using the first L OFDM symbols in rxgrid.

A conservative 13-by-9 pilot averaging window is used, both in frequency and time, to reduce the impact of noise on pilot estimates during channel estimation.

% Channel estimator configuration
cec.PilotAverage = 'UserDefined';     % Type of pilot averaging
cec.FreqWindow = 13;                  % Frequency window size
cec.TimeWindow = 9;                   % Time window size
cec.InterpType = 'Cubic';             % 2D interpolation type
cec.InterpWindow = 'Centered';        % Interpolation window type
cec.InterpWinSize = 1;                % Interpolation window size
cec.Reference = 'NRS';                % NB-IoT downlink channel estimation

% Assume 4 cell specific and 2 narrowband reference signals for initial
% decoding attempt. This ensures channel estimates are available for all
% reference signals
enb.CellRefP = 4;
enb.NBRefP = 2;
enb.NTxAnts = 2;
nbenb.NBRefP = 2;

fprintf('Performing OFDM demodulation...\n\n');
griddims = lteResourceGridSize(enb); % Resource grid dimensions
L = griddims(2);                     % Number of OFDM symbols in a subframe

enb.NBULSubcarrierSpacing = '15kHz'; % Required for NB-IoT downlink OFDM demodulation
rxgrid = lteSCFDMADemodulate(enb,freqsynced); % For OFDM demodulation in NB-IoT
if (isempty(rxgrid))
    fprintf('After timing synchronization, signal is shorter than one subframe so no further demodulation will be performed.\n');

% Perform channel estimation
enb.NSubframe = 0; % Initialize NSubframe for channel estimation
[hest, nest] = lteDLChannelEstimate(enb, cec, rxgrid(:,1:L,:));
Performing OFDM demodulation...

NPBCH Demodulation, BCH Decoding, MIB Parsing

The MIB is now decoded along with the number of narrowband reference signal ports transmitted as a mask on the BCH CRC. The function lteNPBCHDecode establishes frame timing modulo 64 and returns this in the nfmod64 parameter. It also returns the MIB bits in vector mib and the true number of narrowband reference signal ports which is assigned into nbenb.NBRefP at the output of this function call. If the number of narrowband reference signal ports is decoded as nbenb.NBRefP=0, this indicates a failure to decode the BCH.

% Decode the MIB
% Extract resource elements (REs) corresponding to the NPBCH from the first
% subframe across all receive antennas and channel estimates
separator = repmat('-',1,50);
fprintf('Performing MIB decoding...\n');
npbchIndices = lteNPBCHIndices(nbenb);
[npbchRx, npbchHest] = lteExtractResources(npbchIndices, ...
                              rxgrid(1:12,1:L,:), hest(:,1:L,:,:));

% Decode NPBCH
dstate = [];
[bchBits, dstate,npbchSymbols,nfmod64,mib,nbenb.NBRefP] = lteNPBCHDecode( ...
    nbenb, npbchRx, npbchHest, nest, dstate);

% Parse MIB bits
nbenb = hNBMIB(mib,nbenb);

if (nbenb.NBRefP == 0)
    fprintf('MIB decoding failed (nbenb.NBRefP=0).\n\n');

% Incorporate the nfmod64 value from the function lteNPBCHDecode, as
% the NFrame value established from the MIB is the SFN modulo 64 (it is
% stored in the MIB as floor(SFN/64)).
if nbenb.NBRefP % If NPBCH decoding is passed then set the NFrame value
    nbenb.NFrame = nbenb.NFrame+nfmod64;

if strcmpi(nbenb.OperationMode, 'Inband-SamePCI')
    nbenb.NCellID = NNCellID;

% Display cell-wide settings after MIB decoding
fprintf('Cell-wide settings after MIB decoding:\n');
Performing MIB decoding...

Cell-wide settings after MIB decoding:
                      NNCellID: 120
                        NBRefP: 1
                        NFrame: 640
                      HyperSFN: 0
                     ABEnabled: 0
                 OperationMode: 'Inband-DifferentPCI'
    AdditionalTransmissionSIB1: 0


This example uses the following helper files:

Selected Bibliography

  1. 3GPP TS 36.211. "Physical channels and modulation." 3rd Generation Partnership Project; Technical Specification Group Radio Access Network; Evolved Universal Terrestrial Radio Access (E-UTRA). URL:

  2. 3GPP TS 36.101. "User Equipment (UE) radio transmission and reception". 3rd Generation Partnership Project; Technical Specification Group Radio Access Network; Evolved Universal Terrestrial Radio Access (E-UTRA). URL:

  3. O. Liberg, M. Sundberg, Y.-P. Wang, J. Bergman, and J. Sachs. Cellular Internet of Things: Technologies, Standards and Performance. Elsevier, 2018.