Note : See "Idle Mode Procedure" section first for the big picture. (I wrote this section with more focus on LTE, but it is similar logic in UMTS as well). Followings are the topics to be described in this page.

Cell search is where an idle UE spends most of its energy, and almost none of it is spent on the cell it is already camped on. The cost is in the candidates that are checked and then discarded.

Everything on this page happens in idle mode, and that is what makes it interesting. A connected UE measures under network control and reports what it finds. An idle UE decides for itself, inside limits the specification bounds rather than dictates, and it pays for every decision out of its own battery.

That is why the procedure is split into three named steps rather than written as one. Measurement, evaluation and detection cost very different amounts of time, and 36.133 gives each of them its own period. Reading those periods together explains most of what a UE does in idle mode. It also explains why the search is arranged as a filter rather than as a sweep.

• Cell Search (Measurement, Evaluate, Detect)
• Basic Terminology
• Overall Sequence of  Scan, Measurement, Evaluate, Detect, Select
• When these process is performed ?
• Serving Cell Measurement/Evaluation
• Intra/Inter Frequency and InterRAT Measurement/Evaluation/Detection
• How Neighbour Cell affect wake-up/cell search process ?
• How Roaming affect wake-up/cell search ?

Cell Search (Measurement, Evaluate, Detect)

"Cell Search" in this page means the collective term representing the combined procedure of Measurement, Evaluation, Detection process. The three words are often used loosely, and 36.133 does not use them loosely at all. Each one carries its own period, and the gap between those periods is what shapes the whole procedure.

This is very tightly related to Cell Selection process because UE goes through this search process first before it goes through the cell selection.

Also this process influence greatly on engergy consumption of UE during the idle mode.

The size of that influence is worth stating with numbers, because the three steps are not comparable in cost. At a 0.32 second DRX cycle, 36.133 allows 1.28 seconds to measure an intra-frequency cell, 5.12 seconds to evaluate it, and 11.52 seconds to detect a new one. The ratio is roughly one to four to nine.

Two consequences follow from that spread. The first is that a UE never detects when it can measure instead, because detection costs an order of magnitude more. The second is that the order of the three words is also the order of increasing cost. A procedure that reaches detection has already failed to settle the question more cheaply.

The same spread explains the shape of the search. A UE does not test every candidate at every level. It applies the cheap test to everything it can see, and it spends the expensive test only on what survived.

• Three steps, three costs : measure, evaluate and detect are separate words in 36.133 because they carry separate periods, not because they are separate ideas.
• Detection is the expensive one : at a 0.32 second DRX cycle it is allowed 11.52 seconds against 1.28 seconds for a measurement.
• The energy goes to the candidates : the serving cell is measured every DRX cycle and costs little, and the neighbours are what cost the energy.

Basic Terminology

Four words in this page carry precise meanings, and three of them have a period attached in 36.133. Confusing them makes the rest of the page hard to follow, because the whole procedure is built on the difference between them. Scan is the exception, and it is the only one that 3GPP does not define.

•   DRX Cycle : This is a kind of clock(Timer). Measurement/Evaluate/Detect process is performed in a specific interval specified in number of DRX cycles. (In Idle mode case, this DRX cycle is determined by network via SIB1)
•   Scan : This term is not frequency used in any specification, but most of UE (I think all the UE) performs this process. This is a process of tuning to a specific frequency and just measuring the simplest signal quality (e.g, RSSI). Usually before Measurement, Evaluation process UE performs the scan first and select 'small number of candidate' to go through next step (e.g, measurement, evaluate). If UE directly goes into the measurement, Evaluation step for all the possible frequency and band, it is too time consuming and more seriously energy consuming.
• Measurement : The process of measuring RSRP, RSRQ (For non-serving cell measurement, this is done according to T_measure_xxxxx cycle in 36.133. Also refer to following section).
• Evaluate : The processing of checking Cell Selection Criteria based on the result of 'Measurement' step(For non-serving cell measurement, this is done according to T_evaluate_xxxxx cycle in 36.133 Also refer to following section).
• Detect : The process of tuning to a specific frequency and going through synchronization process and decoding basic information of the cell (e.g, Physicall Cell ID and basic MIB/SIB information). (For non-serving cell measurement, this is done according to T_detact_xxxxx cycle in 36.133 Also refer to following section).

Overall Sequence of  Scan, Measurement, Evaluate, Detect, Select

Following illustration shows a possible example of initial scan and cell search mechanism for WCDMA. It is not for LTE, but you may apply the similar logic in LTE case as well. Overall description for each step is :

When you first power on the device or your device got into out of coverage and try to detect/search a new cell,

UE does not have any idea on which frequency it has to try camp on.

so it may have to do some kind of blind search.

For example, let's assume that your device support WCDMA Band I.

The NodeB around your UE may use any frequency channel from 10562 to 10838.

There can be 276 possibilities of frequencies that eNB would use. Then how UE can detect/find the cell(NodeB) it would camp on ?

There can be many different algorithm to try.

These algorithms are not defined in 3GPP.. so it is all up to the implementation on UE side or chipset implementation.

One of the most likely algorithm can be as follows :

i) UE tune to each and every channel that it support and measure RSSI.

(RSSI is simply a measurement of whatever energy/power it can measure. This measurement does not require any channel coding process. So at this step, UE does not need to know anything about the network. At this step, UE does not try to decode PCPICH (in WCDMA) or Sync/Reference Signal (in LTE) to detect Physical Cell ID. It just measure the power of each channel.) As UE measure RSSI for each channel, it create a list of each channel numbers with the measured RSSI.

 

ii) Then UE go through the list from step i) and figure out all the channels which shows RSSI value greater than the threshold (this threshold is also up to UE/chipset implementation, not determined by 3GPP).

 

Then the question would be "Any frequency with Passing RSSI value can be the one that UE can camp on ?". The answer is "Not Necessarily". >

For find the more proper candidate to camp on, UE performs following steps.

 

iii) UE decode PCPICH and measure the power and detect physical cell ID from the each candidate from step ii).

(Some candidate give successful result but some would not. UE make the list of all the successful tries).

 

iv) From the list with successful result from step iii), UE decode MIBs for each and every candidate. With this procedure, now UE can make a list of frequency, Physical Cell ID (PSC in case of WCDMA) and PLMN.

 

v) Based on USIM information and the candidate table from the step iv), can figure out which cell is the real candidate cell to camp on and try decoding System Information and proceed to registration process.

Figure 1. Each level up the diagram costs more per candidate and runs on fewer of them. The width of a level is the number of frequencies still being considered, and the whole point of the design is that the widest level is also the cheapest.

• RSSI Scan : the bottom level and the widest. Raw power is measured on every channel the UE supports, and no decoding is involved.
• Filter by RSSI Threshold : channels below the threshold are dropped, so the arrows thin out for the first time.
• PCPICH Decoding (PSC decoding) : only the survivors are tuned to and synchronised, which is where the physical cell identity is recovered.
• MIB Decoding (PLMN Decoding) : fewer still, because this needs a successful synchronisation first.
• SIB Decoding (Neighbour Cell Detection) : the top level, and one candidate reaches it in the drawing.

If UE fail to find any Home PLMN cell in the step v) above and find only VPLMN cell, it would camp on the VPLMN cell. But once it gets into Idle mode in VPLMN cell,  UE would try performing searching cell with HPLMN. This process may include all the steps described above or a little bit simplified process depending on UE implementation.

Usually these HPLM search process happens periodically as illustrated below. The search cycle (periodicity of HPLMN search is determined by a USIM parameter, but the detailed search algorithm is up to UE implementation). The period marked as 'backoff' is not defined by 3GPP.

If UE performs this periodic search in the area where there is no HPLMN, it would drain the battery too much.

So to save energy consumption, most of UE maker/chipset maker tend to implement a kind of 'backoff' method.

Figure 2. The search period is the only part of this that a specification fixes. The first search and the back off are both left to the UE, which is why two handsets in the same place can behave very differently.

• The first search : drawn about two minutes after the UE camps on the VPLMN, and marked as depending on UE implementation.
• The repeat period : N times 6 minutes, where N is held on the USIM. This is the part that is configured rather than chosen.
• The back off period : a longer gap after repeated failures, and it depends on UE implementation as well.
• Inside one search : the inset shows Scan and Detect alternating rather than one long block, so a single HPLMN search is itself a sequence of cheap and expensive steps.

When these process is performed ?

The trigger list below mixes two different kinds of event, and separating them makes it easier to remember. The first two entries are periodic and happen on every UE all the time. The last four are recovery cases, and each one exists because the UE is in a state it would rather leave.

Overall logic would be as follows :

• i) When UE is turned on
• ii) UE tries to find the serving cell at every DRX cycle during Idle mode
• iii) if UE does not find the serving cell withing a certain number of trials, it would start neighbour cell search (This neighbour cell search can be intra or inter. The interval between these neighbour cell search varies with DRX cycle and intra/inter frequency mode. Normally this search happen with N x DRX and 'N' varies with the situation. Refer to 36.304, 36.133 for the details).
• iv) When UE is in Limited Service (e.g, SOS/Emergency Call only) : UE periodically try to search a suitable cells for normal service.
• v) When UE is in OOC (Out of Coverage) : UE should try to rescan the existing cell to see if it can get back to normal service or try to other cells to see if it get the normal service.
• vi) When UE is in Roaming state (meaning that it is currently camped on to VPLMN cell), it should search HPLMN cell periodically (The period is usually N x 6 min, where N is specified in HPPLMN field in the USIM)

Serving Cell Measurement/Evaluation  

UE peforms the measurement for serving cell at every DRX cycle and check if it satisfy the cell selection criteria. If it successfully finds a cell meeting the criteria within a certain amount of trial, it stays at the cell but if it does not find the serving cell within a certain amount of trials (see the table shown below), it should initiate the measurement/evaluation for all the neighbour cells which is specified by the serving cell system information. (Refer to 36.133 section 4.2.2.1 for details)

The number of trials has a name and a table. It is N_serv, and 36.133 Table 4.2.2.1-1 gives it in DRX cycles rather than in seconds.

36.133 Table 4.2.2.1-1. The count falls as the cycle lengthens, so the deadline does not grow in proportion to the cycle. A UE on a long DRX cycle gets fewer chances, not more.

• 0.32 s and 0.64 s cycles : N_serv is 4, so the UE has four DRX cycles to find the serving cell.
• 1.28 s and 2.56 s cycles : N_serv drops to 2.
• Read it in seconds to see the effect : the deadline is 1.28 s, 2.56 s, 2.56 s and 5.12 s across the four rows. It grows, but not by the factor the cycle does.

What happens after the deadline is the part worth remembering. Failing N_serv does not drop the UE out of service. It promotes the UE from the cheap case to the expensive one, because the neighbour list in the system information now has to be measured as well.

That promotion is the link between this section and the next one. Serving cell measurement is the base load a UE always pays. Neighbour measurement is the extra load, and the rules in the next section exist to postpone it for as long as the serving cell stays good.

• The serving cell is measured every DRX cycle : that part is unconditional, and it is the cheapest thing the UE does.
• N_serv is a deadline, not a budget : missing it starts neighbour measurement rather than ending service.
• The count is in cycles, so read the seconds : 4 cycles at 0.32 s is 1.28 s, and 2 cycles at 2.56 s is 5.12 s.

Intra/Inter Frequency and InterRAT Measurement/Evaluation/Detection   

36.304 section 5.2.4.2  (V8.10.0) describes the rule for measurement of non-serving cell as follows (depending on the version of this document, you would see a little bit different parameter name and way of description):

Regarding Intra Frequency Measurement : SIB3 and SIB4 are involved in this process

• If S_intrasearch (SIB3) is sent in the serving cell and S_servingCell (Srxlev) > S_instrasearch, UE may choose to not perform intra-frequency measurement
• If S_servingCell (Srxlev) <= S_instrasearch or S_intrasearch is not sent in the serving cell, UE shall perform intra-frequency measurement. --> This means 'If you omit S_intrasearch IE in SIB3, UE has to perform instra-frequency measurement all the time regardless of Srxlev value.

Regarding Inter Frequency Measurement : SIB3 and SIB5 are involved in this process

Case 1 : When the reselection priority of a neighbour cell is higher than the current cell,

• UE shall perform measurements of higher priority neighbour cell

Case 2 : When the reselection priority of a neighbour cell is equal or lower than the current cell,

• If S_nonintrasearch(SIB3) is sent in the serving cell and S_servingCell(Srxlev) > S_nonintrasearch, UE may choose not to perform the neighbor cell measurement
• If S_servingCell (Srxlev) <= S_noninstrasearch or S_nonintrasearch is not sent in the serving cell, UE shall perform inter-frequency measurement. --> This means 'If you omit S_nonintrasearch IE in SIB3, UE has to perform inter-frequency measurement all the time regardless of Srxlev value. Measurement Interval is defined by 36.133 Table 4.2.2.1-1.

Regarding Inter RAT UTRA Measurement : SIB3 and SIB6 are involved in this process

• Rule is same as "Regarding Inter Frequency Measurement"

Regarding Inter RAT GERAN Measurement : SIB3 and SIB6 are involved in this process

• Rule is same as "Regarding Inter Frequency Measurement"

36.133 section 4.2.2.3 defines the intra frequency EUTRAN Measurement as follows :

Regarding Intra Frequency Measurement : ---------------

• The UE shall be able to identify new intra-frequency cells and perform RSRP and RSRQ measurements of identified intra-frequency cells without an explicit intra-frequency neighbour list containing physical layer cell identities.
• The UE shall be able to evaluate whether a newly detactable intra frequency cell meets the reselection criteria (36.304) within [T_detect,EUTRAN_Intra] when Treselection = 0 (i.e, T-ReselectionEUTRA in SIB3 = 0).
• The UE shall measure RSRP and RSRQ at least every [T_measure,EUTRAN_Intra] for intra-frequency cells that are identified and measured according to the measurement rules.

The major parameters mentioned in above statements came from SIB3 and 36.133 Table 4.2.2.3-1 as follows.

Figure 3. The two thresholds do not sit together. s-NonIntraSearch is in cellReselectionServingFreqInfo and s-IntraSearch is in intraFreqCellReselectionInfo, which is easy to miss when reading a live capture.

< 36.331 SystemInformationBlockType3 field descriptions >

Two things in those field descriptions change how the rules above are read on a modern network.

The first is the default. When neither s-IntraSearch nor s-IntraSearchP is present, the UE applies a value of infinity. Srxlev can therefore never exceed the threshold, so the UE always performs intra-frequency measurement. An absent threshold is the expensive case rather than the cheap one.

The second is that the single threshold became a pair. Release 9 added s-IntraSearchP and s-IntraSearchQ, and s-IntraSearchP replaces s-IntraSearch when it is present. 36.304 clause 5.2.4.2 now lets the UE skip intra-frequency measurement only when Srxlev is above S_IntraSearchP and Squal is above S_IntraSearchQ. Both conditions have to hold, so a cell that is strong but poor in quality is still measured. s-NonIntraSearch gained the same pair at the same time.

Regarding Inter Frequency Measurement : --------------

Refer to 36.133 section 4.2.2.4 for the details.

36.133 Table 4.2.2.4-1 carries the same numbers as Table 4.2.2.3-1, row for row. Inter-frequency measurement is therefore not slower than intra-frequency measurement once it is running. The difference between the two is whether it runs at all, and that is what s-NonIntraSearch and the reselection priorities decide.

Regarding Inter RAT UTRA_FDD Measurement : --------------

Refer to 36.133 section 4.2.2.5.1 for the details.

Regarding Inter RAT GSM Measurement : --------------

Refer to 36.133 section 4.2.2.5.3 for the details.

The two inter-RAT tables are where the cost jumps. At a 0.32 second DRX cycle, an E-UTRAN neighbour is measured in 1.28 seconds and a UTRA FDD neighbour takes 5.12 seconds. Evaluation goes from 5.12 seconds to 15.36 seconds over the same step. Detection is the widest gap of all, at 11.52 seconds against a flat 30 seconds.

GSM is given only a measurement period, and it matches the UTRA FDD one. There is no detect or evaluate column, because the GSM case is handled differently.

That is the practical reason inter-RAT measurement is gated so tightly. It is three to four times slower than staying inside E-UTRAN on every axis, and the UE pays that cost out of the same idle mode battery.

How Neighbour Cell affect wake-up/cell search process ?

The serving cell costs the UE almost nothing. Everything expensive in idle mode is caused by neighbours, and the neighbour configuration is chosen by the network rather than by the UE. This section puts the earlier rules together and asks what a given SIB configuration actually costs.

A neighbour configuration controls three separate things, and they multiply rather than add. The first is whether the UE measures at all. The second is how many layers it has to measure. The third is how expensive each of those layers is.

Whether the UE measures at all

Two of the three cases are gated by a threshold, and one is not gated by anything. The ungated case is the one to check first when a device shows unexplained idle drain.

Intra-frequency measurement is gated by S_IntraSearchP and S_IntraSearchQ. Inter-frequency and inter-RAT measurement at equal or lower priority is gated by S_{NonIntraSearchP} and S_{NonIntraSearchQ}. In both cases a strong serving cell lets the UE skip the work.

A higher priority layer is different. 36.304 clause 5.2.4.2 says the UE shall perform measurements of a higher priority E-UTRAN inter-frequency or inter-RAT frequency, and it attaches no condition about the serving cell to that sentence. The UE measures the layer however good its own cell is.

That asymmetry is deliberate, because a higher priority layer is one the operator wants the UE to move to. It also means a single high priority entry in SIB5 costs more battery than any threshold setting can recover. Setting s-NonIntraSearch generously does nothing for a layer whose priority is above the serving frequency.

How many layers

The number is larger than most people expect, and it is a requirement rather than a limit the network is asked to respect. 36.133 clause 4.2.2.9 states what a UE has to be capable of monitoring in idle mode.

• Per RAT, depending on UE capability : the intra-frequency carrier, 3 FDD E-UTRA and 3 TDD E-UTRA inter-frequency carriers, and 3 FDD UTRA and 3 TDD UTRA carriers. The list continues with 32 GSM carriers, 3 cdma2000 1x, 3 HRPD and 8 NR inter-RAT carriers.
• In total, without NR : at least 8 carrier frequency layers, and the serving layer is one of the 8.
• In total, with NR : at least 10 effective carrier frequency layers.
• GSM is counted differently : one GSM layer corresponds to 32 carriers, so a single layer in the count is 32 carriers of work.
• Increased UE carrier monitoring : clause 4.2.2.9a raises the E-UTRA inter-frequency figures to 8 FDD and 8 TDD for a UE that supports it.

Seven neighbour layers on top of the serving layer is therefore a configuration a UE has to cope with, not an abuse of the specification. Each of those layers carries its own detect, measure and evaluate obligation from the tables above.

How expensive each layer is

The per layer cost is not the same across RATs, and the gap is wide enough to change the answer. The numbers below are all at a 0.32 second DRX cycle, taken from the tables earlier on this page.

An E-UTRAN layer, whether intra-frequency or inter-frequency, costs 1.28 seconds to measure, 5.12 seconds to evaluate and 11.52 seconds to detect. A UTRA FDD layer costs 5.12 seconds to measure, 15.36 seconds to evaluate and a flat 30 seconds to detect. A GSM layer is given a measurement period of 5.12 seconds.

Put those two facts together and the size of the problem is clear. A UE configured with several inter-RAT layers is doing four times the work per layer, across up to eight layers. All of it happens inside the awake part of a DRX cycle.

What this does to the wake-up

The DRX cycle decides when the UE wakes. The neighbour configuration decides how long it stays awake, and that is the part a network can change.

36.133 Table 4.2.2.3-1 makes the point in its own timeline. The awake period is drawn as a variable block, and the annotation says it depends on the chipset implementation and on the amount of measurement. The sleeping period is what is left over.

One more path leads into the same place. Failing N_serv promotes the UE from serving cell measurement alone to measuring the whole neighbour list, so a marginal serving cell produces the same load as an aggressive neighbour configuration.

• Higher priority layers are not gated : 36.304 attaches no serving cell condition to them, so they are measured on a perfect cell as readily as on a weak one.
• Thresholds only help where they apply : S_IntraSearchP and S_{NonIntraSearchP} cover intra-frequency and equal or lower priority layers, and nothing else.
• Eight layers is a requirement : 36.133 clause 4.2.2.9 asks for at least 8 carrier frequency layers including the serving one, and at least 10 when NR is included.
• Inter-RAT costs about four times more : 5.12 seconds against 1.28 to measure, and 30 seconds against 11.52 to detect.
• The DRX cycle sets when, the neighbours set how long : the awake period is the variable, and it is the one the network controls.

How Roaming affect wake-up/cell search ?

Roaming adds a second search loop that has nothing to do with the serving cell. A UE camped on a VPLMN keeps doing everything in the sections above. It then periodically searches for a network it is not camped on at all.

23.122 clause 4.4.3.3.1.1 is where that obligation comes from. A UE in a VPLMN shall periodically attempt to obtain service on its HPLMN. When the EHPLMN list is present, it uses one of those instead. A higher priority PLMN from the user controlled or operator controlled selector also qualifies.

The period is on the SIM

Only one number in this loop is specified, and the SIM carries it. Everything else about the search is left to the UE, which is why two handsets in the same place can behave very differently.

The timer is called T. For an ordinary MS it is in the range 6 minutes to 8 hours, in 6 minute steps, and it can instead say that no periodic attempts are to be made. When the SIM holds no value for T, the default is 60 minutes.

Figure 2 shows what the specification does not fix. The first search after camping is drawn at about two minutes and marked as UE implementation. The back off after repeated failures is marked the same way. A UE that keeps failing is expected to slow down, and nothing says by how much.

Why the loop is expensive

The cost is not in the period. It is in what one search has to do, and in the fact that nothing gates it. Neither of those is visible in the timer value, so a short T is not the first thing to look at.

Neighbour measurement has a neighbour list and a set of thresholds. An HPLMN search has neither. The UE is looking for a network that is not in any SIB. It therefore has no list to narrow the search, and no threshold lets it skip the attempt because the serving cell is strong.

The inset in Figure 2 shows what that means in practice. One search is not a single measurement but an alternating run of Scan and Detect, which is the expensive end of the funnel in Figure 1. The UE is decoding, not just measuring power.

The same mechanism, a very different period

The clearest evidence that this loop is about energy is what happens when energy matters more. 23.122 keeps the mechanism and changes only the number.

An MS that supports only EC-GSM-IoT, Category M1 or Category NB1 gets T in the range 2 hours to 240 hours. The steps are 2 hours up to 80 hours, then 4 hours from 84 hours to 240 hours. When the SIM holds no value, the default is 72 hours rather than 60 minutes.

That is the same rule with the period raised by roughly two orders of magnitude. A device that cannot afford the search is given permission to do it once every few days instead of once an hour.

• Roaming is an extra loop, not a modified one : the UE keeps its normal serving and neighbour work and adds a periodic search on top.
• Only the period is specified : 6 minutes to 8 hours in 6 minute steps for an ordinary MS, with 60 minutes as the default when the SIM is silent.
• The SIM can switch it off : T can indicate that no periodic attempts are to be made at all.
• No list and no threshold : an HPLMN search cannot be narrowed by a neighbour list or skipped because the serving cell is good.
• IoT gets the same rule with a different number : 2 hours to 240 hours, and a default of 72 hours.