PSTN-to-Mobile Calls & 3G Architecture Deep Dive
This article covers how an incoming call from the public telephone network reaches a mobile subscriber, how voice quality is preserved across networks, and how 2G evolved into 3G through the addition of IP data (2.5G) and Soft Switching (Release 4).
1. PSTN-to-Mobile Call Flow
When a landline subscriber dials a mobile number, the call must cross three separate network domains: the PSTN, the Home PLMN (where the subscriber's HLR lives), and potentially a Visitor PLMN (if the subscriber is roaming). All coordination uses the SS7 (Signaling System 7) backbone — the same network PSTN uses, extended into the mobile domain.
Signaling Protocols
| Protocol | Purpose |
|---|---|
| MAP (Mobile Application Part) | Subscriber management, location queries, roaming |
| IS41 | North American equivalent of MAP |
| TCAP | Transaction-based dialogues carrying MAP/IS41 |
| ISUP (ISDN User Part) | Circuit-switched call setup / teardown |
| STP | SS7 router — forwards signaling between nodes |
Step-by-Step: The 6 Signaling Steps
PSTN Phone PSTN GMSC (Home) HLR
514 581... │
│──①IAM (ISUP)────────────────────────────►│ │
│ │──②MAP: Where is ──►│
│ │ subscriber? │
│ │◄──③Provide Roaming─│
│ │ Number (MSRN) │
│ ④ STP routes ──────►VMSC (Visitor) │
│ │──⑤Routing Info─────►
│ │◄────────────────── │
│──⑥IAM (ISUP)──────────────────────────────────────────►VMSC │
│ │───Page→MS
│◄══════════════ Voice Circuit ══════════════════════════►│
① PSTN → GMSC: IAM (Initial Address Message)
The calling party dials the mobile MSISDN. PSTN routes the call to the subscriber's GMSC (Gateway MSC) based on the MCC+MNC in the dialed number. Protocol: ISUP — same as any PSTN trunk call.
② GMSC → HLR: "Where is the subscriber?" (MAP)
GMSC receives the IAM but does not know the subscriber's current location. It queries the HLR via SS7 MAP SendRoutingInfo. The query travels through STP (SS7 router). No voice flows yet.
③ HLR → GMSC: Provide Roaming Number
HLR instructs the VMSC in the Visitor PLMN to allocate a MSRN (Mobile Station Roaming Number) — a temporary dialable number. HLR returns this MSRN to GMSC.
④ STP Routes Between PLMNs
The STP translates Global Title addresses to point codes, routing MAP messages between Home and Visitor PLMNs.
⑤ Routing Info Confirmed to GMSC
GMSC now holds a real dialable number for the subscriber's current location.
⑥ GMSC → VMSC: IAM (Second Leg)
GMSC sends a new IAM to the VMSC using the MSRN. The VMSC pages the MS over the BSS. Once the MS answers, a 64 Kbps TDM circuit is connected end-to-end.
Key: STPs and SCPs live entirely in the signaling plane — they never handle voice. Voice circuits connect directly between SSPs (MSC ↔ GMSC ↔ PSTN switch) after signaling completes.
2. GSM 2G Architecture
The 2G GSM network groups its elements into the BSS (Base Station System) for radio access and the NSS (Network Sub-System) for core switching and databases. All core signaling runs over the SS7 cloud.
Interface Reference
| Interface | Between | What it carries |
|---|---|---|
| Um | MS ↔ BTS | Radio — voice frames + RR/MM/CM signaling |
| Abis | BTS ↔ BSC | PCM traffic + OML management |
| A | BSC ↔ MSC | Voice circuits + BSSAP signaling |
| B | MSC ↔ VLR | Internal subscriber data lookup |
| C | MSC/GMSC ↔ HLR | MAP — location, routing, subscriber checks |
| D | VLR ↔ HLR | MAP — location updates when MS moves |
| E | MSC ↔ GMSC | ISUP — inter-MSC calls and handovers |
| H | HLR ↔ AuC | Authentication triplet generation |
3. Typical 2G Network Deployment
In a real operator network, multiple BSCs each aggregate dozens of BTS sites. Multiple MSC/VLR pairs serve different geographic areas, all sharing a common PLMN core (SS7 backbone with HLR and SMS-SC). The GMSC bridges to the PSTN via Tandem switches and Central Offices (COs).
Key Points
- HLR is shared across all MSCs in the PLMN — one central database (or replicated pair) per operator
- SMS-SC (SMS Service Center) is a signaling-only element — stores/forwards SMS via MAP operations, never touches voice
- PSDN (Packet Switched Data Network) was the pre-GPRS data option (circuit-switched data)
- Calls between two mobiles on the same PLMN route MSC → MSC (E interface), bypassing PSTN
4. TFO — Tandem Free Operation
When two GSM subscribers call each other through a PSTN core, the voice path normally passes through two unnecessary codec conversions — one at each BSC's TRAU. TFO bypasses both, preserving voice quality end-to-end.
Without TFO: The Tandem Problem
MS1 → [GSM codec 13 Kbps] → TRAU1 → [decode to G.711 64 Kbps] → PSTN → [re-encode to GSM] → TRAU2 → MS2
↑ ↑
Codec loss #1 Codec loss #2
Each TRAU (Transcoder and Rate Adaptor Unit, inside the BSC) converts between:
- 13 Kbps GSM (compressed, sent over the radio)
- 64 Kbps G.711 (PCM, the PSTN standard)
Two tandem conversions introduce cumulative noise and artifacts.
With TFO: In-Band Bypass
The two TRAUs detect each other using TFO signaling embedded in the 2 LSBs of the G.711 stream:
64 Kbps G.711 stream with TFO active:
Bits 7–2: G.711 samples (6-bit accuracy, used as carrier)
Bits 1–0: GSM compressed voice + TFO signaling markers
Result: GSM frames travel end-to-end — no decode/encode cycle
| Scenario | Codec Conversions | Voice Quality |
|---|---|---|
| No TFO | 2 (both TRAUs active) | Degraded (double tandem) |
| TFO Active | 0 (both TRAUs bypass) | Original GSM quality |
Half-Rate note: 7 bits of G.711 are used for GSM frames when Half-Rate coder is active (instead of 6).
5. 2.5G / 3G — Adding IP Data
GPRS added a parallel packet data path alongside the existing circuit-switched voice network. The core architecture headline: no changes to voice calls — the 2G circuit-switched path remained intact. 2.5G/3G simply added new nodes (SGSN, GGSN, IP Gateway) for data.
Two Parallel Paths from the Same Base Station
2G MS (voice only) ──► BTS/BSC ──(A)──► MSC ──► PSTN/ISDN
2G+ MS (voice+data) ──► BTS/BSC ──(A)──► MSC ──► PSTN/ISDN ← voice unchanged
──(Gb)─► SGSN ──► GGSN ──► Internet ← new data path
The same BTS/BSC serves both types. The BSC splits traffic: voice on the A interface, data on the Gb interface.
6. 2.5G Architectural Detail (GPRS)
GPRS (2.5G) added the SGSN and GGSN to the existing 2G NSS, creating a dual-plane core: SS7 circuit-switched (voice) and IP packet-switched (data). Both planes share the HLR.
New 2.5G Interfaces
| Interface | Between | Purpose |
|---|---|---|
| Gb | BSC ↔ SGSN | GPRS radio traffic — carries data packets |
| Gs | SGSN ↔ MSC | Coordination — paging and location update sync |
| Gr | SGSN ↔ HLR | GPRS subscription check (MAP) |
| Gn | SGSN ↔ GGSN | GTP (GPRS Tunnelling Protocol) — data tunnel |
| Gc | GGSN ↔ HLR | Routing info for mobile-terminated data |
| Gi | GGSN ↔ Internet | Standard IP — the mobile's internet connection |
7. 3G rel99 Architecture (UMTS)
3GPP Release 99 (2000) introduced UTRAN (UMTS Terrestrial Radio Access Network) with WCDMA radio and added the RNS (Radio Network Subsystem: Node B + RNC). The core network was unchanged from 2.5G — only the radio access changed.
2G BSS vs 3G UTRAN
| Feature | 2G GSM (BTS/BSC) | 3G UMTS (Node B/RNC) |
|---|---|---|
| Radio technology | TDMA, 200 KHz | WCDMA, 5 MHz |
| Base station | BTS | Node B |
| Controller | BSC | RNC |
| Voice → Core | A interface (TDM) | Iu-CS (ATM/AAL2) |
| Data → Core | Gb (Frame Relay) | Iu-PS (ATM/AAL5) |
| Handover | Hard (BSC decides) | Soft (MS connected to multiple Node Bs) |
| Peak data | 115 Kbps (GPRS) | 384 Kbps rel99 → 14 Mbps (HSDPA) |
Soft Handover (3G exclusive)
In 3G, an MS can be simultaneously connected to two or more Node Bs during handover. The RNC combines both signals using a Rake receiver — impossible in 2G due to hard channel boundaries.
8. 3G rel4 Architecture — Soft Switching
3GPP Release 4 (2001) was the biggest architectural change since GPRS: the MSC was split into two separate nodes, making the voice plane / signaling plane separation physical and explicit.
The Split: MSC → MSS + MGW
2G / 3G rel99 (monolithic) 3G rel4 (split)
┌─────────────────────┐ ┌──────────────────┐ SS7 / BICC / SIP
│ MSC │ →→→ │ MSC Server (MSS)│ (Signaling Plane)
│ (call control + │ └────────┬─────────┘
│ voice switching │ │ Mc (H.248)
│ mixed together) │ ┌─────── ─┴─────────┐ RTP / TDM
└─────────────────────┘ │ CS-MGW │ (Voice/Bearer Plane)
└──────────────────┘
Benefits:
- Scale signaling and media capacity independently
- Deploy MGWs at the edge (close to RAN), keep MSS centralized
- Voice bearer traverses IP/MPLS backbone (Nb interface) — no expensive TDM transit
- ISUP over IP towards PSTN — the (G)MGW converts IP RTP ↔ PSTN TDM
9. R4 Network Interfaces
The Release 4 architecture introduced several new interfaces for the split MSS/MGW design, while retaining all the classic 2G interfaces.
Complete R4 Interface Table
| Interface | Node 1 | Node 2 | Protocol | Plane |
|---|---|---|---|---|
| A | MSS/MGW | BSC | IP / TDM | Both |
| B | MSS | VLR | Internal MAP | Signaling |
| C | MSS | HLR | SS7 MAP | Signaling |
| D | HLR | VLR | SS7 MAP | Signaling |
| F | MSS | EIR | SS7 MAP | Signaling |
| G | VLR | VLR | SS7 MAP | Signaling |
| H | HLR/HSS | AuC | Internal | Signaling |
| Mc | MSS | CS-MGW | H.248 / MEGACO over IP | Signaling |
| Nc | MSS | GMSC Server | BICC or SIP over IP | Signaling |
| Nb | CS-MGW | (G)CS-MGW | IP / RTP | Voice (Bearer) |
| Iu-CS | RNC | CS-MGW | ATM / AAL2 | Voice |
BICC = Bearer Independent Call Control. An SS7 evolution that separates call signaling from the bearer, used on the Nc interface between MSS nodes. Can be replaced by SIP in later releases.
10. R4 Split Architecture — Real-World Topology
In a real operator deployment, the MSS/MGW split enables a hub-and-spoke topology: a small number of centralized MSS nodes control a larger number of edge-deployed MGWs via IP/MPLS backbone.
Redundancy Design
- BSC is controlled by 2 MGWs (active/standby or load-shared)
- RNC can be connected to all 6 MGWs (maximum redundancy)
- Each MGW is controlled by at least 2 MSS nodes — MSS failure triggers automatic failover
- IP/MPLS backbone provides path redundancy without needing extra TDM links
- MGWs are named by geography (MAR, STR, BKC, GEN, GIL, LGE in the diagram) — deployed close to the RAN they serve
11. MSS Pool — CGR and Load Sharing
The MSS pool takes redundancy further: multiple MSS nodes jointly control the same set of BSCs/RNCs, with traffic distributed across the pool. The key concept is the CGR (Circuit Group Relation).
CGR — Circuit Group Relation
A CGR is the control relationship between one BSC and one MSS/MGW pair.
1 BSC × 2 MGWs × 3 MSS nodes = 6 CGRs
BSC1 ── MGW1 ── MSS1 (CGR 1)
BSC1 ── MGW1 ── MSS2 (CGR 2)
BSC1 ── MGW1 ── MSS3 (CGR 3)
BSC1 ── MGW2 ── MSS1 (CGR 4)
BSC1 ── MGW2 ── MSS2 (CGR 5)
BSC1 ── MGW2 ── MSS3 (CGR 6)
Any of the 3 MSS nodes can handle a call for any subscriber on BSC1, through either MGW. This gives N+1 MSS redundancy and full MGW redundancy simultaneously.
Virtual MGW (VMGW)
Within each physical MGW, multiple VMGWs are configured — one per controlling MSS. Each VMGW appears as an independent H.248 entity to its MSS, allowing one physical MGW to be managed by multiple MSS nodes simultaneously.
Signaling Services in the Pool
The SMSC, IN (Intelligent Network / SCP), and HLR connect to the MSS pool via STP pairs — providing load sharing and redundancy for signaling services across all MSS nodes.
Architecture Evolution Summary
| Generation | Voice path | Data | Key innovation |
|---|---|---|---|
| 2G GSM | TDM circuits (64 Kbps) | SMS only | Digital voice, SIM, roaming |
| 2.5G GPRS | Unchanged | 115 Kbps always-on | SGSN/GGSN, PDP contexts |
| 2.75G EDGE | Unchanged | 384 Kbps | 8-PSK modulation |
| 3G rel99 | TDM via ATM (Iu-CS) | 384 Kbps–2 Mbps | WCDMA, soft handover |
| 3G rel4 | IP/RTP via MPLS (Nb) | Same | MSS+MGW split, cheaper transport |
| 3G HSDPA | Same rel4 | 14 Mbps | Shared downlink channel (HS-DSCH) |