Tutorial 5G NR cells

Tutorial: 5G NR cells

What it is. 5G NR cells broadcast a synchronisation and broadcast block (SS/PBCH) that identifies the cell. OnAir finds these blocks on the sync raster (GSCN), shows the physical cell id, the beams heard and the broadcast parameters from the MIB. It is a cell finder, not a decoder of 5G traffic.

Read this first. Receive only, public broadcast only. Nothing addressed to a phone is decoded. SIB1 (operator, tracking area, cell id) is not decoded yet, so the tower map stays empty. Check the law where you live. See Legal.

What you need

• A radio that reaches the NR bands you want and runs at 3.84 Msps or more. The mode asks for 20 Msps and starts on 3541.44 MHz (n78, GSCN 7875, per the frequency database; it also lists 3700 MHz for n77/n78 C-band). The mode table covers 600 to 4200 MHz. An RTL-SDR cannot reach 3.5 GHz; use a HackRF, PlutoSDR, LimeSDR, BladeRF or similar.
• An antenna for the band, for example 3.3 to 3.8 GHz for n78.

Before you start

Below 7.68 Msps only the 15 kHz SSBs (bands n1, n3, n7, n8, n20, n28, n38) are searched, as the panel says. At 20 Msps several raster points are searched in each step. Watch the input level (dBFS) and avoid overload.

Step by step

1. In the mode list open Cellular & rail and choose 5G NR, GSCN scan.
2. Choose your radio and sample rate under Source, start the receiver.
3. Under Bands tick the NR bands to scan: n78, n77, n28, n20, n8, n3, n1, n7, n38, n40, n41, n79, n48, n5, n2, n25, n12, n71, n66, n34, n39 and n50 are available (n78, n28 and n20 start ticked). Custom scans a range you type in MHz over the sync raster.
4. Press Scan. Stop scan ends it.
5. Open Cells.

What you should see

Each cell appears with its PCI (from the PSS and SSS). Once the polar-coded PBCH decodes, the MIB values appear: system frame number, common subcarrier spacing, k_SSB, DMRS type A position, CORESET#0 and search space 0 of SIB1, barred flag and intra-frequency reselection. A cell shown as sync only has the PCI but no MIB yet.

Reading the screen

• Cells: PCI, band, frequency, GSCN, SSB spacing, signal measures (SS-RSRP, SS-RSRQ, SS-SINR), carrier offset, last seen.
• Beams: the SSB indices heard; the strongest beam is marked. 5G cells sweep several beams.
• Map: stays empty until SIB1 is decoded.
• Log: the decoded broadcast messages.

Options and settings

Dwell time per step, bands and Custom range are in the scan row. Clear empties the table.

Troubleshooting

• No cells at 3.5 GHz. Check the radio really reaches the band, antenna, and that a cell is present. Beamforming makes cells weak off-axis.
• PCI but no MIB. The signal is too weak for the PBCH. Improve the antenna.
• Empty map. Expected; SIB1 is not decoded yet.
• Only some bands found. Below 7.68 Msps the 30 kHz SSB bands are skipped.

Tips

Stay on a found carrier for a few seconds so beams are all heard.

Legal and privacy notes

Only the public synchronisation and broadcast channel is read.

Under the hood

PSS and SSS give the PCI, DMRS and the PBCH polar code (3GPP TS 38.211, 38.212, 38.213) give the MIB. SSBs lie on the global synchronisation channel raster (GSCN, TS 38.104).

Related

Mode-5G-NR-cells, Tutorial-Cell-towers, Tutorial-NB-IoT-cells, Modes, Main-window, Supported-radios, Troubleshooting, FAQ, Legal.