NR Initial Access: SSB, MIB, SIB1, and the RACH Procedure Interview Prep
5G NR initial access — SSB cell search, MIB and SIB1 decode, 4-step vs 2-step RACH, contention resolution, and open-loop power control.
Quick answer
5G NR initial access is the sequence of procedures a UE performs to go from "I have detected nothing" to "I have a C-RNTI and can be scheduled." The sequence touches every layer of the air-interface stack — synchronization, broadcast information acquisition, system information decode, random access, contention resolution — and the cell-access reliability of a deployed network depends on it working correctly under the worst link conditions the cell needs to support.
Initial access is the deepest single-topic interview question in 5G modem roles because it integrates synchronization, broadcast information, system information acquisition, random access, contention resolution, and power control in one procedure.
Editorial review
Written by
CompoundLearn editorial team
Wireless / RF / hardware engineering
Reviewed by
CompoundLearn editorial team
Wireless / RF / hardware engineering
Last reviewed
Built from curated topic maps, editorial validation, and subject-matter review so the page stays aligned with the interview intent and the current content pipeline.
What it is
5G NR initial access is the sequence of procedures a UE performs to go from "I have detected nothing" to "I have a C-RNTI and can be scheduled." The sequence touches every layer of the air-interface stack — synchronization, broadcast information acquisition, system information decode, random access, contention resolution — and the cell-access reliability of a deployed network depends on it working correctly under the worst link conditions the cell needs to support. This is the most-asked topic in 5G modem and cellular-systems interviews because it is also the layer where deployment-quality issues most often surface as user-visible "no service" symptoms. The sequence begins with SSB detection. The UE scans candidate frequencies and looks for PSS first, which has only three sequences and is fast to detect; then SSS, which combines with PSS to identify the cell; then decodes the PBCH carried in the same SSB structure, which carries the MIB. The MIB is small (fits in a tightly-coded broadcast) and contains the CORESET-0 configuration the UE needs to find SIB1 on PDSCH. The UE then decodes SIB1, which is large (carried on PDSCH with rate adaptation) and contains the cell-access parameters: PLMN list, RACH configuration, power-control parameters, common uplink and downlink configuration, and pointers to additional SIBs. Once the UE has SIB1 it can attempt random access. The RACH procedure exists in two variants: the classic 4-step procedure (MSG1 preamble → MSG2 Random Access Response → MSG3 UE-identity → MSG4 contention resolution) and the 2-step procedure introduced in Rel-16 (MSGA combines preamble plus payload → MSGB combines RAR plus contention resolution). 4-step is the default and the workhorse for fresh initial access at the cell edge. 2-step is selected when the UE has a small payload ready and is in good radio conditions, cutting the access latency roughly in half. Contention-free RACH (CFRA) is a third variant where the network has pre-allocated a dedicated preamble to a specific UE — used during handover and beam failure recovery, where contention resolution is unnecessary because no other UE can use the preamble. Initial-access power control is open-loop because the UE has no closed-loop feedback yet. The UE measures RSRP from the SSB it locked to, computes a path-loss estimate, and applies the path-loss compensation factor and target received power signaled in SIB1 to set its first RACH preamble transmit power. If MSG2 does not arrive within the RAR window, the UE ramps transmit power up by the configured step before retransmitting, up to the maximum-preamble-transmission count. This power-ramping plus maximum-power cap is the safety mechanism that lets cell-edge UEs find the cell while limiting uplink interference inside the cell.
Why interviewers ask
Initial access is the deepest single-topic interview question in 5G modem roles because it integrates synchronization, broadcast information, system information acquisition, random access, contention resolution, and power control in one procedure. A candidate who can walk through the full sequence — SSB to MSG4 — with the right naming and the right ordering reveals working knowledge across every layer of the air-interface stack. A candidate who can name the messages but not order them, or who conflates MIB and SIB1, has read the standard but not implemented or operated it. Hiring teams probe the MIB-to-SIB1 staircase specifically because the design rationale is non-obvious. Strong candidates explain that the MIB is intentionally small so it fits in a tightly-coded PBCH that can be transmitted often and decoded fast, while SIB1 is larger and lands on PDSCH where it can use full rate adaptation. Weak candidates treat MIB and SIB1 as interchangeable broadcast structures and miss the staircase entirely. RACH is the deepest interview sub-topic because operators tune it daily. Hiring teams ask about 4-step versus 2-step trade-offs, contention-based versus contention-free flows, RACH preamble formats and when each format applies (different formats for different cell radii), power-ramping rules, and the MSG3-MSG4 identity-echo mechanism. Candidates from research or simulator backgrounds often know the message names but cannot describe what each message carries or what failure mode each is protecting against; candidates with deployed-network experience can usually name a specific operational failure they have debugged. Cell-edge access reliability is a recurring senior-level interview theme because that is where cell-coverage planning lives or dies. Strong candidates can describe the path-loss budget for the SSB and the RACH preamble, how power-ramping protects against initial estimate errors, and how RACH-occasion density and preamble formats trade against access latency and uplink interference. Weak candidates treat RACH as a procedure that "just works" without identifying the parameters operators tune.
Common mistakes
The most common mistake is conflating MIB and SIB1. Candidates who describe the SSB as "carrying all the system information" or who skip the MIB→SIB1 staircase reveal that they have not worked at the cell-acquisition layer. The MIB is small and broadcast in the PBCH inside the SSB; SIB1 is large and carried on PDSCH scheduled by the Type-0 PDCCH that the MIB-signaled CORESET-0 configures. These are different channels with different coding and different sizing constraints; treating them as the same broadcast structure is a clear signal of inexperience. A second common gap is missing the contention-resolution mechanism in 4-step RACH. Candidates who say "MSG2 resolves contention" or "the UE with the strongest signal wins" have not understood that MSG2 (the RAR) is broadcast to a RA-RNTI shared by all UEs in the same RACH occasion — it cannot single out a UE. Contention is resolved at MSG4 via the UE-identity echo, and any candidate who cannot describe the MSG3-MSG4 identity round has not worked at the RACH-debug level. A third gap is missing the 2-step RACH design rationale. Candidates who describe 2-step as "just faster" without identifying when it is enabled (RRC_INACTIVE resume, small payload ready at access time, good radio conditions) and when it falls back to 4-step (cell edge, high RACH load, no payload at access) have read the feature description but not understood the operational deployment model. A fourth gap is treating initial-access power control as closed-loop. The UE has no closed-loop feedback during initial access — that is the entire reason for open-loop estimation from RSRP and power ramping across retransmissions. Candidates who describe MSG1 power as set by the gNB or as adjusted between MSG1 and MSG3 within a single attempt have inverted the procedure. A fifth gap, more subtle, is missing the SSB-index-to-RACH-occasion mapping that lets beam-swept SSBs in FR2 still drive correct UE-to-beam association. In FR2 the gNB sweeps multiple SSB beams in each SS burst set; the UE picks the strongest SSB and uses its index in the RACH preamble selection so the gNB knows which beam direction the UE is in. Candidates who describe initial access without mentioning beam association in FR2 miss the mmWave deployment reality. See /topics/nr-beam-management for the broader beam-management context.
4-step vs 2-step RACH — Trade-offs
| Procedure | Messages | Latency | Best Conditions | Contention Resolution | Typical Use |
|---|---|---|---|---|---|
| 4-step RACH (CBRA) | MSG1 preamble, MSG2 RAR, MSG3 UE-id, MSG4 contention | Higher (4 transmissions + RTTs) | Robust at cell edge; tolerates high RACH load | At MSG4 via UE-identity echo | Default for initial access from IDLE |
| 4-step RACH (CFRA) | MSG1 dedicated preamble, MSG2 RAR (then continues) | Faster than CBRA (no contention round) | Network has pre-allocated a dedicated preamble | None needed — preamble is unique to UE | Handover, beam failure recovery |
| 2-step RACH | MSGA preamble+payload, MSGB RAR+contention | Lowest (2 transmissions) | UE has payload ready and is in good radio conditions | At MSGB (combined with RAR) | RRC_INACTIVE resume, small data, IoT bursts |
Sample interview questions
- A UE searching for a 5G NR cell completes SSB detection. What does the SSB carry, and what step does the UE perform immediately after successful SSB decode?
- A. The SSB carries the MIB; the UE next decodes SIB1 on PDSCH using the CORESET-0 configuration signaled in the MIB to learn the cell access parameters. ✓
- B. The SSB carries SIB1 directly; the UE skips SIB acquisition and proceeds straight to RACH.
- C. The SSB carries the entire system information; the UE proceeds to RACH without further decoding.
- D. The SSB carries only synchronization signals; the UE waits for paging on the configured DRX cycle before acting.
Option A is correct. The SSB (Synchronization Signal Block) carries PSS, SSS, and PBCH. The PBCH carries the MIB (Master Information Block), which contains the parameters the UE needs to find SIB1 — most importantly the CORESET-0 configuration that tells the UE where to monitor the Type-0 PDCCH search space. The UE then decodes PDCCH-scheduled SIB1 on PDSCH; SIB1 carries the cell-access parameters (PLMN, cell barring, RACH configuration, power-control parameters) the UE needs before attempting RACH. Option B is wrong: SIB1 is too large to fit in the PBCH; it must be carried on PDSCH. The SSB only carries the MIB, which is small and tightly coded. Option C is wrong: the SSB carries only the MIB, not all system information. SIB2 and onward (if needed) come after SIB1. Option D is wrong: paging is a notification mechanism for UEs already camped on a cell; during initial access the UE is actively acquiring system information. Production reality: the MIB→SIB1 staircase is the deliberate design that lets the SSB stay small (so it can be transmitted often and decoded fast) while the larger SIB1 lands on PDSCH where it gets full coding and rate-adaptation flexibility.
- During the 4-step RACH procedure, when does contention resolution complete, and what mechanism guarantees that only one of two UEs choosing the same preamble survives?
- A. Contention is resolved at MSG2 (Random Access Response) — the gNB picks one UE's timing-advance, discarding the other.
- B. Contention resolution completes at MSG4: the gNB echoes back the UE-identity (C-RNTI or NAS-supplied identity) from MSG3 on a contention-resolution message, and only the UE whose identity matches considers the procedure successful; the other UE backs off and retries. ✓
- C. Contention is resolved at MSG3 — the gNB looks at the UE's power level and selects the stronger one.
- D. There is no contention resolution in NR — preambles are always unique by design.
Option B is correct. The 4-step RACH (MSG1 preamble, MSG2 RAR, MSG3 with UE identity, MSG4 contention resolution) is designed so that contention is only resolved at the very end. MSG2 is broadcast to a RA-RNTI shared by all UEs whose preambles fell in the same RACH occasion, so it cannot resolve contention on its own. MSG3 carries the UE identity (either a stored C-RNTI for connected mode or a NAS-supplied identity for initial access). MSG4 echoes that identity back on the PDCCH/PDSCH directed at the temporary C-RNTI assigned in MSG2; the UE whose identity matches what it sent considers contention won and promotes the temporary C-RNTI to its permanent C-RNTI. The other UE sees an identity that does not match and backs off. Option A is wrong: MSG2 carries timing-advance and the temporary C-RNTI but cannot single out a UE because the RAR is shared across the contention window. Option C is wrong: power-based selection is not how NR resolves RACH contention; preamble detection and the MSG3-MSG4 identity round are the mechanism. Option D is wrong: preambles are not unique. The pool is finite (usually 64 preambles), and multiple UEs can pick the same preamble in the same RACH occasion — exactly the situation that motivates the contention-resolution step. Production reality: in cells with high RACH load (e.g., post-handover storm or paging response burst), MSG3-MSG4 contention failures are a real operational concern; operators tune RACH configuration (preamble subsets, RACH occasion density, power ramping) to keep collision rates manageable.
- How does the 2-step RACH procedure differ from the 4-step RACH, and when is it preferred?
- A. 2-step RACH skips contention resolution entirely — it is only used in licensed-band deployments.
- B. 2-step RACH is identical to 4-step RACH but uses a longer preamble for better cell-edge performance.
- C. 2-step RACH is only used in NR-Unlicensed (NR-U) deployments and cannot be used in licensed spectrum.
- D. 2-step RACH combines MSG1+MSG3 into MSGA (preamble + payload sent together) and MSG2+MSG4 into MSGB (RAR + contention resolution combined). It cuts the procedure latency by roughly half and is preferred for small uplink transactions where the UE has the payload ready at access time — RRC_INACTIVE resume, small data transfer, and short-burst IoT being the canonical use cases. ✓
Option D is correct. 2-step RACH (introduced in Rel-16) compresses the 4-step procedure into two transmissions: MSGA combines the preamble (the MSG1 equivalent) with the payload that MSG3 would have carried; MSGB combines the RAR with the contention-resolution message. The latency saving comes from removing two of the four messages and the round-trip delays between them. When 2-step wins: UE has a small uplink payload ready at access time (RRC_INACTIVE resume with the small uplink that triggered the resume, short IoT transactions, small data transfer feature), and the UE is in good radio conditions so the larger MSGA can be reliably decoded by the gNB. The procedure has a fallback — if MSGB indicates the gNB could not decode MSGA, the UE retries with traditional 4-step RACH. When 4-step still wins: cell-edge UEs where the larger MSGA is too risky to send before the gNB has confirmed the preamble, high RACH-load cells where the 4-step contention-resolution mechanism is more robust under collisions, and cases where the UE does not have payload ready at access time (so MSGA would just be the preamble, removing the latency advantage). Option A is wrong: 2-step RACH retains contention resolution; MSGB carries it. Option B is wrong: 2-step RACH does not use a different preamble structure for cell-edge robustness; the savings come from compressing the message exchange. Option C is wrong: 2-step RACH is available in both licensed NR and NR-U; it is not band-restricted. Production reality: operators enable 2-step RACH selectively and per-deployment-scenario; the falling back to 4-step ensures it cannot hurt cells where conditions vary.
Frequently asked questions
- What happens during 5G NR initial access?
- A UE in RRC_IDLE that needs to attach to a cell performs a sequence: SSB detection (PSS, SSS, PBCH) to acquire timing and read the MIB; SIB1 acquisition on PDSCH using the CORESET-0 configuration signaled in the MIB; RACH preamble selection and transmission on PRACH; MSG2 (Random Access Response) decode for timing advance, uplink grant, and temporary C-RNTI; MSG3 transmission carrying the UE identity on PUSCH; and MSG4 (contention resolution) confirming the UE has won the RACH contention. After MSG4 the UE has a C-RNTI, knows the cell-access parameters, and can proceed to NAS-layer signaling (Registration) followed by RRC_CONNECTED operation. The whole sequence — SSB to MSG4 — is what an interview means when it says "initial access."
- What is the SSB and how is it detected?
- The SSB (Synchronization Signal Block) is a 4-symbol structure carrying the Primary Synchronization Signal (PSS), Secondary Synchronization Signal (SSS), and Physical Broadcast Channel (PBCH). The UE detects PSS first (it has only 3 sequences, so the search is fast), gets symbol-level timing, then detects SSS (336 sequences, gives the physical cell ID together with PSS), then decodes the PBCH which carries the MIB. SSB transmissions are arranged into an SS burst set repeated every 20 ms by default; the gNB sweeps multiple SSB beams within the burst set for FR2 deployments so that UEs in different beam directions can each detect at least one SSB. The UE picks the strongest SSB and uses its index later in the RACH preamble selection so the gNB knows which beam direction the UE is in.
- What is the difference between MIB and SIB1?
- The MIB (Master Information Block) is carried in the PBCH inside the SSB and is small enough to fit in a tightly-coded broadcast structure. It contains the parameters the UE needs to find SIB1 — most importantly the CORESET-0 configuration that tells the UE where to monitor the Type-0 PDCCH search space, plus a few cell-level flags (SFN, cellBarred, intraFreqReselection). SIB1 (System Information Block 1) is much larger and carried on PDSCH scheduled by the Type-0 PDCCH. It contains the parameters needed to access the cell: PLMN list, cell-selection criteria, RACH configuration (preamble set, RACH occasions, power-control), uplink and downlink common configuration, and a list of which other SIBs are scheduled and how often. The MIB→SIB1 staircase is the design that keeps the broadcast structure compact while delivering full system information once the UE is locked.
- What is the RACH procedure in 5G NR?
- RACH (Random Access Channel) is how a UE requests an uplink grant from the gNB when it has no scheduled uplink resource. NR supports a 4-step RACH (the classic procedure: MSG1 preamble, MSG2 RAR, MSG3 with UE identity, MSG4 contention resolution) and a 2-step RACH introduced in Rel-16 (MSGA combines preamble + payload, MSGB combines RAR + contention resolution). 4-step is the default; 2-step is enabled when the UE has a small payload ready at access time and is in good radio conditions. RACH is triggered for initial access from RRC_IDLE, for RRC_INACTIVE resume, for handover, for re-establishment after radio-link failure, for scheduling request when no PUCCH SR resource is configured, and for beam failure recovery.
- What is the difference between contention-based and contention-free RACH?
- Contention-based RACH (CBRA) is the procedure described above where the UE picks a preamble from a shared pool and contention is resolved at MSG4. Multiple UEs picking the same preamble in the same RACH occasion will collide and only one will survive the MSG3-MSG4 identity round. Contention-free RACH (CFRA) is used when the network has pre-allocated a dedicated preamble to a specific UE — typically during handover (the source gNB tells the UE which dedicated preamble to use at the target gNB) or during beam failure recovery (the UE has a pre-configured preamble for the BFR procedure). CFRA skips the contention-resolution step because no other UE can use the dedicated preamble, so the procedure completes faster and is more reliable. CFRA is preferred whenever the network can pre-allocate a preamble; CBRA is the fallback for unsolicited UE access.
- What do MSG2, MSG3, and MSG4 carry?
- MSG2 is the Random Access Response (RAR), broadcast on PDSCH addressed to a RA-RNTI derived from the RACH occasion the UE picked. RAR carries: timing-advance for the UE to align its uplink, an uplink grant telling the UE when to transmit MSG3, and a temporary C-RNTI the UE will use for the rest of the procedure. MSG3 is the first scheduled uplink transmission from the UE; it carries the UE identity (a stored C-RNTI if the UE was previously known to the network, or a NAS-supplied identity for fresh initial access) plus an RRC message indicating the access cause (RRCSetupRequest, RRCResumeRequest, RRCReestablishmentRequest, depending on the scenario). MSG4 is the contention-resolution message — it echoes the UE identity from MSG3 back to the UE so each contending UE can determine whether it won the contention. The UE that sees its own identity echoed considers the procedure complete; the UE that sees a different identity backs off and retries.
- How does initial-access uplink power control work?
- Initial-access power control uses open-loop estimation because the UE has no closed-loop feedback yet. The UE measures RSRP from the SSB it locked to, computes a path loss estimate, and applies the path-loss compensation factor (alpha) and the target received power (P0) signaled in SIB1 to set its first RACH preamble transmit power. If MSG2 does not arrive within the RAR window, the UE assumes the gNB did not decode the preamble and ramps the transmit power up by a configured power-ramping step before retransmitting. The ramping continues across retransmissions until either MSG2 is received or the maximum-preamble-transmission count is reached. This open-loop ramping plus a maximum-power cap is the safety mechanism that lets cell-edge UEs find the cell while limiting uplink interference.
- Why does initial-access reliability matter so much at the cell edge?
- At the cell edge a UE has the worst link budget for both the SSB (downlink) and the RACH preamble (uplink). If SSB detection fails, the UE never decodes the MIB and cannot access the cell. If RACH preamble decoding fails after the maximum retransmissions, the UE declares cell-access failure and triggers cell reselection — which on a deployed network manifests as a "stuck on no service" symptom for the user. Operators tune RACH parameters (preamble format, longer formats for larger cells with higher path loss, power-ramping step, RACH occasion density) to balance access success rate at the edge against the uplink interference that aggressive RACH parameters generate in the interior of the cell. Strong candidates can describe the trade-off; weak candidates treat RACH as a fire-and-forget procedure that just works.
Related topics
Siblings
- 5G NR Explained: Numerology, BWP, HARQ, and Frame Structure
- RRC States in 5G NR: RRC_IDLE, RRC_INACTIVE, RRC_CONNECTED
- NR Reference Signals: DMRS, CSI-RS, SRS, PTRS, and the SSB
- PDCCH, PDSCH, PUCCH, PUSCH: The 5G NR Physical Channels
- NR Beam Management: SSB Sweep, P-1/P-2/P-3, TCI States, QCL
- 5G NR Handover: Xn vs N2, Conditional HO, Beam Failure Recovery
- Beamforming Interview Guide: Analog vs Digital vs Hybrid
Practice
Essential AI-Native Skills for NR Initial Access: SSB, MIB, SIB1, and the RACH Procedure
Modern engineering work increasingly uses AI tools for design and code review, debugging, documentation, test and testbench generation, and workflow automation. The goal is not to let AI replace engineering judgment — it is to move faster while keeping verification discipline.
- Use AI to explain unfamiliar code, logs, waveforms, datasheets, or test failures.
- Break large problems into small, reviewable steps you can verify independently.
- Ask AI for hypotheses, then validate them against tests, measurements, simulations, or lab data.
- Version-control your analysis scripts, testbenches, and configs — keep changes small and reviewable.
- Document your assumptions, design tradeoffs, and debugging decisions.
- Verify AI output before trusting it: run the checks that fit the domain — unit tests, linters, simulations, or bench/lab measurements.
- Review AI output for correctness, edge cases, and real-world consequences.
NR Initial Access: SSB, MIB, SIB1, and the RACH Procedure — coming to the question bank
The adaptive practice engine is already live for core wireless, RF, and ML systems. NR Initial Access: SSB, MIB, SIB1, and the RACH Procedure isn't covered in the question bank yet — get notified when it's added.