I would like to take chance to answer this question based on my knowledge. Please correct me if I am wrong.
1. After powering on, UE scans all the supported bands one by one to synchronize with the available cell. Each cell transmits broadcast information at fixed place (middle 6 RBs of each band) irrespective of configured bandwidth(10 MHz, 20 MHz).
2. After Primary and Secondary synchronizations, UE gets the MIB information and other SIBs information based on location of PDSCH. System Information blocks are transmitted through PDSCH and location of PDSCH in a subframe is find out based on PCFICH, PHICH and PDCCH.
3. LTE system supports various types of system information blocks which broadcast different kind of system information. Based on 3GPP release compliance, a cell may broadcast different additional SIB. However a cell supports # of PLMN is found based on SIB1.
4. After getting SIB1 and SIB2 (common RACH chanel information), UE triggers RACH procedure towards eNodeB. RACH preamble is sent by UE to eNodeB using the PRACH and UE gets the RACH Response (success/failure) on PDSCH.
5. Assuming RACH response was successful then it sends RRC Connection Request message to eNodeB. It sends RRC level UE identifier and rrc connection establishment cause.
6. In successful case, eNodeB configures its lower layer and create UE context and responds to UE with the RRC Connection Setup.
7. If UE accepts the RRC Connection Setup and then it sends RRC Connection Setup Complete with the piggybacked NAS message to eNodeB. Once eNodeB receives RRC Connection Setup Complete, it moves UE state from RRC-IDLE to RRC-CONNECTED.
8. eNodeB forwards the received NAS message i.e Attach Request to MME using "Initial UE Message".
9. In attach request UE sends IMSI and MME fetch the UE subscription profile from HSS by using S6a interface defined procedure.
10. MME performs authentication and security procedure at NAS level with UE. After successful execution of these procedure, MME executes Create Session Procedure and gets the IP address and other details from PGW/PCRF.
11. After getting Create Session Response, MME prepares "Attach Accept" and send to UE by using "Initial Context Setup Request" procedure.
12. Once eNodeB receives "Initial Context Setup Request" from MME, it is successful response of "Initial UE Message" which it sent earlier.
13. If eNodeB does not receive UE radio capability from MME in "Initial Context Setup Request" then it performs radio capability exchange procedure with UE and after getting UE radio capability information, it updates to MME for the same so that MME can re-use this information next time.
14. After UE radio capability exchange, eNodeB activates radio security with UE.
15. After successful activation of radio security, eNodeB configures its lower layers for SRB2 and DRBs. It prepares "RRC Connection Reconfiguration" and sent to UE. One more thing here to note that receives "Attach accept" message is piggybacked in this RRC Connection Reconfiguration Message.
16. UE responds with RRC Connection Reconfiguration Complete message to eNodeB and eNodeB responds to MME with "Initial Context Setup Response". Initial Context Setup Response carries GTP tunnel end of eNodeB and MME communicates about eNodeB side tunnel end points so that SGW can forwards downlink packets of UE to eNodeB.
17. Finally "Attach Complete" NAS message is sent by UE to MME.
Hope this will help somewhat.
