How to determine the location of cellular networks (Cell ID)

^{Map Members OpenStreetMap}

There are many ways to determine your location, such as satellite navigation (GPS), location over WiFi networks and cellular networks.

In this post we tried to check how well the technology of determining the location of cell phone towers in the city of Minsk (subject to using only open databases of coordinates of GSM transmitters).
')
The principle of operation lies in the fact that the cellular phone (or cellular communication module) knows which base station transceiver serves it and having a base of transmitters of the base station transmitters can approximately determine its location.




As indicated on the Cell ID page, there are not so many open databases with coordinates of cellular transmitters. For example, this is OpenCellID.org , containing 2,611,805 transmitters (13042 of them in Belarus) and openbmap.org, containing 695,294 transmitters.

Below is a screenshot with designated transmitters in the western part of Minsk. As can be seen, the number of base stations is not zero, which inspires optimism and a possible positive outcome of the experiment.


^{Map Members OpenStreetMap}

Now a little about what a transmitter is in understanding OpenCellID and how the OpenCellID database is filled. This database is populated in various ways, the simplest is to install an application on a smartphone, which records the coordinates of the phone and the serving base station, and then sends all measurements to the server. On the OpenCellID server, the approximate location of the base station is calculated based on a large number of measurements (see figure below). Thus, the coordinates of the wireless network are calculated automatically and are very approximate.


^{Map Members OpenStreetMap}

We now turn to the question of how to use this database. There are two options: use the Cell ID translation service to the coordinates provided by the OpenCellID.org site, or perform a local search. In our case, the local method is preferable, since we are going to take a 13 km route, and work through the web will be slow and inefficient. Accordingly, we need to download the database on a laptop. This can be done by downloading the cell_towers.csv.gz file from downloads.opencellid.org .



The database is a table in CSV format, described below:



We are interested in the following parameters:

• <mcc> is the country code;
  
• <mnc> - operator code;
  
• <lac> - area code;
  
• <cellid> is the transmitter identifier;
  
• <long> - transmitter longitude;
  
• <lat> is the transmitter latitude.
  

Everything is clear with the database, now you can proceed to the definition of Cell ID.

All cellular modules support the following commands: AT + CREG, AT + COPS (serving base station), AT + CSQ (signal level from the base station). Some modules allow to know, in addition to the serving transmitter, also neighboring ones, i.e. Monitor base stations with AT ^ SMONC commands for Siemens and AT + CCINFO for Simcom. I had a SIMCom SIM5215E module at my disposal.



Accordingly, we used the AT + CCINFO command, its format is given below.





We are interested in the following parameters:

• <SCELL> - serving transmitter indicator;
  
• <NCELLn> - indicator of the neighboring transmitter;
  
• <mcc> is the country code;
  
• <mnc> - operator code;
  
• <lac> - area code;
  
• <id> is the transmitter identifier;
  
• <rxlev> is the received signal power in dBm.
  

Having connected the cellular module to the laptop, we received the following log:



Monitoring works - you can go.

The route lies in the western part of Minsk on the street. Matusevich, Pushkin Ave., st. Ponomarenko Str. Sharangovicha, st. Maxim Goretsky Str. Lobanka, st. Kuntsevschina, st. Matusevich.


^{Map Members OpenStreetMap}

Log was recorded at intervals of 1 second. When performing the CellID transformation to coordinates, it turned out that 6498 calls to the OpenCellID database were effective, and 3351 calls did not match the database. Those. hit rate for Minsk is about 66%.

The figure below shows all the transmitters that met in the log and were in the database.


^{Map Members OpenStreetMap}

The figure below shows all the serving transmitters that were encountered in the log and were in the database. Those. A similar result can be obtained on any cellular module or phone.


^{Map Members OpenStreetMap}

As we see, at one of the moments we were served by a transmitter located behind a traffic intersection at the intersection of ul. Pritytskogo and Moscow Ring Road. Most likely, this is a country base station serving subscribers within a distance of several kilometers, which leads to significant errors in determining the location by Cell ID.

Since our SIMCom SIM5215E at any given time shows not only the serving transmitter, but also the neighboring and signal levels from them, we will try to calculate the coordinates of the device based on all the data available at a particular time.

Calculation of subscriber's coordinates will be performed as a weighted average of the coordinates of the transmitters:
Latitude = Sum (w [n] * Latitude [n]) / Sum (w [n])
Longitude = Sum (w [n] * Longitude [n]) / Sum (w [n])

As is known from the theory of propagation of radio waves, the attenuation of a radio signal in a vacuum is proportional to the square of the distance from the transmitter to the receiver. Those. when removed 10 times (for example, from 1 km to 10 km), the signal will become 100 times weaker, i.e. reduced by 20 dB in power. Accordingly, the weight with each term is defined as:
w [n] = 10 ^ (RSSI_in_dBm [n] / 20)

Here we have assumed that the power of all transmitters is the same; this assumption is erroneous. But due to the lack of information about the transmitter power of the base station, one has to go to the obviously rough assumptions.

The result is a more detailed picture of the locations.


^{Map Members OpenStreetMap}

As a result, the route turned out to be well-drawn, with the exception of the ejection towards the junction on the Moscow Ring Road, for the previously described reason. In addition, over time, the coordinate database will be populated, which should also improve the accuracy and availability of the Cell ID location technology.

Thanks for attention. Questions and comments are welcome.