How does a 2G phone find and select a network after power-on (network selection)?

The phone scans all frequencies for energy (RF Power Scan), sorts the hits by signal strength, synchronizes to the strongest carriers, decodes each cell's broadcast channel (BCCH) to learn MCC, MNC, and Cell-ID — then picks a network manually or automatically.

* From scanning for energy to picking an operator. *

Step by step:

1. RF Power Scan — "where is energy?" The phone sweeps the frequency bands looking for active carriers (conceptually like a WLAN scan)
2. Sort by signal/energy strength — strongest candidates first
3. Synchronization (Freq + Sync Burst Detection) — lock onto the carrier: Where am I in the time multiplex? Where does the frame start (clocking)? Aided by the known training sequence
4. Decode the System Information Block on the BCCH (Broadcast Control Channel — the cell's general broadcast channel) → learns MCC (country), MNC (operator), and Cell-ID
5. Network selection — either manual (user picks from a list) or automatic, based on:
   • the SIM card's priority list of preferred networks
   • forbidden networks (also stored on the SIM)
   • preference for the home network

Key insight: Until step 4, the phone knows only "there is energy on this frequency." Only the BCCH decode turns an anonymous carrier into "this is Salt, cell #12345" — everything identity-related comes from that broadcast.

Go deeper:

• Broadcast control channel (Wikipedia) — the downlink beacon the phone decodes in step 4: it carries the System Information (cell identity, config, neighbour list) and must transmit continuously at full power.
• GSM logical, physical, broadcast & control channels (Electronics Notes) — how BCCH, RACH and SDCCH fit together, so you can see where the scan-and-decode step sits among GSM's channel zoo.