Hey Guys! I just read through all of of your mails and searched on the net if no one else has had this idea before :) And well, there are two guys having done this for symbian. At [1] I collected links to documents written by them. The project seems pretty great! It was a final year project for the university of hong kong, and what they write seems to me preety successful as they were able to provide exact positions based on gsm-only information!
[1]: http://www.off-online.net [EMAIL PROTECTED] wrote: > This is about getting your actual position, not by means of GPS or WiFi > scanning (like http://www.skyhookwireless.com), but by exploiting the > information you may get from GSM network fingerprint. > All the tests were done with an old Nokia 6210. > > Everybody knows you may get information about the serving cell > (BaseTransmitterStation, BTS) from your GSM-modem (MobileStation, MS). > With this info, by getting exact geographical data for the BTS, you may > describe an area nearly the form of a circle with the BS position as > center, where your actual location is supposed to be within. The radius of > this circle may vary from a few 100 meters to a virtual maximum of 35km, > depending on the BTS density (distance between BTS) of the area you are > traveling. > > There is not so wellknown further more detailed information you may get > from your GSM-modem (MobileStation, MS), which consists of: > a) The (usually) 6 next nearby BTS (to be correct: next best RF-signal > BTS), b) The distance to your active BTS, in increments of 550m (Timing > Advance, TA) This additional info may be used to dramatically improve the > precision of GSM-based location data. > > According to > http://nobbi.com/download/nmmanual.pdf p.6,["Display 3 – Serving cell, > 1st and 2nd neighbour", ff.], I did some probes on "TWN GSM" provider's > network in OM apartment/Taipei and adjacent areas. > **** > Basic BTS and network info [Display 1]: > ---- > CH:706 RxL:-58 TxPWr:xxx > TS:0 TA:1 RQ:x RLT:xxxx > C1:51 C2:51 > CHT:CCCH > > **** > Basic BTS and network info [Display 11]: > ---- > MCC:466 MNC:97 > LocAreaCode:(LAC:) 12902 > ServChannel:706 > CellId:19351 > > That's quite the data everyone is thinking of when it comes to > GSM-location services, like here: > http://janus.liebregts.nl/cellid/index_en.html. Get the coordinates of BTS > ID:19351 and you roughly know where you are. Anyway, as described above, > this data is not as precise as we would like to see it, giving an area for > the current location of about 3 square-km and up to a theoretical maximum > of ~220 sq-km. Even when taking into calculation the very random > signal-strength of the active BTS, the figure isn't much better. > Furthermore signal strength reading isn't comparable between different > models of cellphones due to varying antenna and receiver sensitivity, what > makes it almost useless for centralized databases. > > To start with point b), according to http://nobbi.com/glossar.htm#ta we > can see from the timing advance value "TA:1" in [Display 1], that we are > at a distance to BTS of >(1 x 550m) and <(2 x 550m) > # ((please note: I'm not sure this is base:0 or base:1, so this "TA:1" > # might mean (0x550) < distance < (1x550) )) > Anyway, obviously that's _much_better_ than guessing our distance to BTS > based on some random signal-strength reading, that may jump up and down a > 12dB by moving just 1m or mere turning the phones heading. > To get an actual TA-reading, we have to trigger any communication between > MS and BTS. Any command sequence like "*#100#" will do, even when the > network answers "not done". > > > Now for point a): > (( I'm concatenating the info of the 3 displays for better reading. All > cells were "N"=normal priority, 1.line is channel, 2.ff lines the signal > strength )) > > **** > Neighbour cells info (NCELL-list) [Display 3-5]: > ---- > OM apartment, balcony: > 706__690__704__699__709__681__696__||_700__687 > -35__-54__-54__-47__-58__-56__-72__||_-50__-?- max > -62__-63__-68__-72__-72__-74__nul__||_nul__nul min > The max and min readings where obtained by moving the phone ~60cm! > Channels right of "||" are occasional readings, kicking out some weaker > station. > > OM apartment, big dorm (no more max and min, variation was like above): > 706__699__704__690__701__681__702 > -52__-56__-66__-72__-74__-76__-81 > > Front of OM Ap. building > 706__697__689__692__701__695__693 > -48__-66__-70__-71__-71__-74__-76 > > Front of OM Ap. building, 3m away > 706__689__683__687__697__695__701 > -53__-68__-70__-73__-73__-78__-79 > > 50m down he street, near park > 706__683__692__689__695__697__702 > -49__-79__-79__-79__-82__-82__-82 > > 150m direction 101, inside park > 693__697__681__706__689__699__702 > -71__-73__-73__-74__-76__-77__-85 > > > From this data, we see it's quite possible to determine location to a > precision of around 100 x 100m or even better. > Of course this depends on the density of BTS again. > > > To use this approach with GTA02 or GTA04/Diversity, it has to be evaluated > whether we can get he NCEL-list from our GSM-modems. > > > Further refinement is possible by using special debug modes of the modem > to register with remote neighbour cells and thus get a TA and thus > distance reading for them too. ((see > http://nobbi.com/download/nmmanual.pdf p.11, > ["Display 17 – Switch 'BTS Test' Status"])) > > cheers > jOERG
