The document discusses cell tower triangulation and how it can be used to determine the approximate location of a mobile phone. It describes how triangulation works by measuring the signal strength and transmission time from multiple cell towers to calculate the phone's position. It also provides specifications for the SIM800 GSM module hardware used and shows sample output from a network scan command identifying nearby cell towers and their parameters. Finally, it outlines how to calculate the phone's position using the cell tower coordinates, signal strengths, and triangulation algorithm.

1. Table of Contents
1 GSMTriangulation........................................................................................................................1
2 Whatis Cell Tower Triangulation?....................................................................................................1
2.1 Cell Tower Triangulation.......................................................................................................1
3 How tofindthe locationwith GSMcells ...........................................................................................4
3.1 Discover how to find the coordinate from the GSMcells!!......................................................4
4 Hardware Used.............................................................................................................................7
5 SIM800Specifications....................................................................................................................8
5.1 General features..................................................................................................................8
5.2 Specifications for GPRS Data.................................................................................................9
5.3 Specifications for SMS via GSM/GPRS....................................................................................9
5.4 Software features................................................................................................................9
5.5 Specifications for voice.........................................................................................................9
5.6 Interfaces..........................................................................................................................10
5.7 Compatibility.....................................................................................................................10
5.8 Certifications.....................................................................................................................10
6 ExecutionCommandAT+CNETSCAN..............................................................................................10
7 Descriptionsof NetworkParameters..............................................................................................11
8 Resultsusing Termite 3.2Terminal Software...................................................................................11
9 How to Calculate the positions and Draw map............................................................................13
10 Triangulation Algorithm (Python)............................................................................................14
11 Triangulation results using open cell_id ..................................................................................17
12 References.................................................................................................................................20

2. 1 GSM Triangulation
Triangulation isamethod/processbywhichthe locationof aradiotransmittercan be determinedby
measuringeitherthe radial distance,orthe direction,of the receivedsignalfromtwo orthree different
pointsforlocatinga mobile phone.Triangulationissometimesusedincellularcommunications/mobile
networktopinpointthe geographicpositionof auser.
In Triangulationmethod,itusesradiotowersclosestoyourphonesforthe triangulation.Yourphone will
emit a roaming signal to a nearby radio tower. The location of your phone is determined through how
strongthe signal issenttoeachof the receivingradiotower.The numberthatisbeingusedbythe mobile
phone caneasilybeobtainedbycontactingthe operatornetworkandtheywill identifywhichradiotowers
isreceivingthe strongestsignal fromthatparticularnumberof the mobile phone.The triangularmethod
thenisalsousedtodetermine whichotherradiotowersisalsoreceivingsignal.Bycalculatingthestrength
and weak signal, they can obtain a rough estimate of the mobile phone location.
So, how does the pinpointing of mobile users work and just how accurate is it?
There are twomethodsforpinpointingthe locationof cell phoneusers.CellphonesequippedwithGlobal
Positioning System (GPS) capability, use signals from satellites to pinpoint location very accurately. The
second and less-accurate method is often called “Cell Tower Triangulation”, referring to how the cell
towers, which receive a phone’s signal, may be used to calculate its geophysical location.
2 What is Cell Tower Triangulation?
2.1 Cell Tower Triangulation
Cell tower triangulation is similar toGPS trackingin many ways. Multiple towers are used to track the
phone’s location by measuring the time delay that a signal takes to return back to the towers from the
phone.Thisdelayisthencalculatedintodistance andgives anaccurate locationof the phone. Detecting
which antenna of the tower the signal bouncedoff of can further refine the location. This gives a more
specificlocationwhenusedcongruentlywithmultipletowerscalculatedbymultipledishesoneachtower.
Cell towertriangulation isalsousedto provide the phone withthe bestservice bynoting whichtowerit
is closest to and using them to provide service. Cell tower triangulation providesthe ability to track the
historic location of the cell phone’s presence. It will then identify where the cell phone was when
receiving/making calls, texting, emailing, etc.
In a best-case scenario,acell phone’ssignal maybe pickedupbythree or more cell towers,enablingthe
“triangulation”towork.From a geometric/mathematical standpoint,if youhave the distance to an item
from each of three distinctpoints,youcan compute the approximate locationof that iteminrelationto
the three reference points. This geometric calculation appliesin the case of cell phones, since we know

3. the locationsof the cell towerswhichreceive the phone’ssignal,andwe canestimate the distance of the
phone from each of those antennae towers, basedupon the lag time betweenwhen the tower sendsa
ping to the phone and receives the answering pingback.
In manycases,there may actuallybe more thanthree cell towersreceivingaphone’ssignal,allowingfor
evengreaterdegreesof accuracy(althoughthe pedanticside of me notesthatthe term“triangulation”is
not reallycorrect if you are usingmore than three reference points).Indenselydeveloped,urbanareas,
the accuracy of cell phone pinpointing isveryhighbecausethere are typicallymore cell towerswiththeir
signal coverage areasoverlapping.Incaseswhereacell userisinside largestructuresorunderground,cell
towertriangulationmaybe the onlylocationpinpointingmethodsince GPSsignal may not be available.
For many cell towernetworks,the pinpointingaccuracymay be evengreater,since directional antennae
may be used on the tower, and thus the direction of the cell phone’s signal might be identifiable. With
the signal direction plus the distance of the phone from the cell tower, accuracy might be pretty good,
even with only two towers.

4. However,there are manyplaceswhere there are fewercell towersavailable,suchasinthe fringesof the
cities and out in the country. If you have fewer than three cell towers available,pinpointinga mobile
device canbecome alotlessprecise.Incitieswherethere are alotmore vertical structures,whichcanbe
barrierstocell phone broadcasting,andreceiving,there have tobe many,more cell towersdistributedin
orderto have goodservice.Inthe countryside,thereare relativelyfewer cell towersandonlyasingle one
at a much greater distance may pick up a phone’s signal.
Those areas where a phone is only getting picked up by a single tower and if it’s equippedwith only
omnidirectional antennae, the accuracy becomes even less.
In rural areas, coverage of the cell tower can vary from about a quarter of a mile to several miles,
depending upon how many obstacles could be blocking the tower’s signal.

5. 3 How to find the location with GSM cells
3.1 Discover how to find the coordinate from the GSM cells!!
The radiomobile networkismade up of a numberof adjacentradio cells,eachof whichis characterized
byan identifierconsistingof fourdata:aprogressive number(CellID),acode relatedtothe areainwhich
that givencell is(LAC,or Local Area Code),the code of national networktowhichthe cell belongs(MCC,
an acronym for Mobile Country Code), and finally the company code (MNC, or Mobile Network Code),
which obviouslyidentifies the phone company itself. For this reason, once a cell name and coordinates
are known, and considering the maximum distance allowed between this cell and a phone before the
phone connects to a new cell, it is possible to find out, approximately, the most distant position of the
phone itself.Forexample,if the maximumdistance hasbeendeterminedtobe one mile,the cell phone
can be withina one-mile radius.Itcan be deducedthatthe more cellsare foundin each area, the more
precisely one can determine where the phone is located (up to 200-350 feet).
To determine the coordinate,we use opencell_id andthe maps show also the range of approximation.
Youmay have noticedthatthe antennasonacell towerare alwaysarrangedinatriangle. There are some
soundtechnical and economicreasonsfor this,but we won’tgo intothat here. But it doesmean that a
cell towercantell fromwhichof the three antennaarraysitisreceivingasignal. Eachof the threeantenna
arrays covers a 120° sector withthe towerat its focus,and these sectors,by convention,are referredto
as alpha, beta, and gamma – α, β, γ.
Within each sector, the tower can make a measurement of how far away the transmitting cell phone
is. Thisisdone bymeasuringsignalstrengthandthe round-tripsignaltime. Foralotof technical reasons,
this isnot a very accurate measurement,andthe determineddistance will have areasonablysignificant
error band.
Here is a diagram of a single cell tower showing concentric bands of distance from the tower, and the
three “sectors”. The distance bands don’t stop at “6”, but this is just to give you the idea. Note that at
six miles out, the arc of a sector is 12.6 miles long.

6. Here is howa single-towerlocationwouldwork. The cell towerhasdeterminedthatthe signal iscoming
from the γ sector and that the origin of the signal is approximately 4 miles from the tower. This would
place the callerwithinthe yellowband,whichyoucansee is8.4 mileslongand“about” ½ mile wide –an
area of 4.2 sq. miles.
If the cell phone in questionisalso negotiatingwithasecondcell tower at the same time (andthismust
be the case), the ability to locate the phone gets much better. Here is a diagram of the situation when

7. the phone is 4 miles from the “orange” tower in the γ sector, and 5 miles from the “blue” tower in
the α sector. This will place the phone in an oval (shownin red) whose center is the intersectionof the
swept areas of the two towers’ approximate distance bands.
If a thirdtowerisbroughtintoplay,andthe phoneinquestionis determinedtobe 5milesfromthe (third)
“green”tower,thisdiagramshowsthatthe areaof locationcanbe estimatedevenmore closely. Keepin
mind that the phone must be negotiating with all three towers at the same time.

8. In densely populated urban areas, the cell towers are close together, and a much closer estimationof
phone location can be made than in a rural area, where the towers are far apart.
Some of the newestcellphonescanactuallyreportaGPSlocation,andthisisquite accurate anddoesnot
rely on the cell towers at all.
Usingcell towertriangulation(3towers),itispossible todetermineaphone locationtowithinanareaof
“about” ¾ square mile.
4 Hardware Used
 SIM800
 USB-to-TTL’

9. 5 SIM800 Specifications
5.1 General features
 Quad-band850/900/1800/1900MHz
 GPRS multi-slotclass12/10
 Bluetooth:Compliantwith3.0+EDR
 Dimensions:24.0*24.0*3.0mm
 Weight:3.14g

10.  Control viaAT commands(3GPP TS 27.007,27.005 andSIMCOM enhancedATCommands)
 Supplyvoltage range 3.4 ~ 4.4V
 Low powerconsumption
 Operationtemperature: -40℃ ~85℃
 GPRS mobile stationclassB
 ComplianttoGSM phase 2/2+
 Class4 (2 W @ 850/900MHz)
 Class1 (1 W @ 1800/1900MHz)
5.2 Specifications for GPRS Data
 GPRS class12: max. 85.6 kbps(downlink/uplink)
 PBCCH support
 CodingschemesCS1, 2, 3, 4
 PPP-stack
 CSD up to 14.4 kbps
 USSD
 Nontransparentmode
5.3 Specifications for SMS via GSM/GPRS
 Pointto pointMO and MT
 SMS cell broadcast
 Textand PDU mode
5.4 Software features
 0710 MUX protocol
 EmbeddedTCP/UDPprotocol
 FTP/HTTP
 MMS
 E-MAIL
 DTMF
 JammingDetection
 AudioRecord
 TTS (optional)
 EmbeddedAT(optional)
5.5 Specifications for voice
 Tricodec
 Half rate (HR)
 Full rate (FR)
 EnhancedFull Rate (EFR)
 AMR
 Half rate (HR)
 Full rate (FR)

11.  Hands-free operation （Echosuppression）
5.6 Interfaces
 68 SMT padsincluding:
 Analogaudiointerface
 PCMinterface(optional)
 SPIinterface (optional)
 RTC backup
 Serial interface
 USB interface
 Interface toexternal SIM3V/1.8V
 Keypadinterface
 GPIO
 ADC
 GSM Antennapad
 BluetoothAntennapad
5.7 Compatibility
 AT cellularcommandinterface
5.8 Certifications
 CE
 GCF
 FCC
 TA
 CTA
 CCC
 ROHS
 REACH
 ANATEL
 A-TICK
6 Execution Command AT+CNETSCAN
AT+CNETSCAN command perform a net survey to show all the cell information
Response
If format’s value is 0:
Operator:"<Network_Operator_name>",MCC:<MCC>,MNC:<MNC>,Rxlev:<Rxlev>,Cellid:<CellID>,Arfcn:<Arfcn>[<CR><LF>
Operator:"<Network_Operator_name2>",MCC:<MCC2>,MNC:<MNC2>,Rxlev:<Rxlev2>,Cellid:<CellID2>,Arfcn:<Arfcn2>[…]]

12. If format’s value is 1:
Operator:"<Network_Operator_name>",MCC:<MCC>,MNC:<MNC>,Rxlev:<Rxlev>,Cellid:<CellID>,Arfcn:<Arfcn>,Lac:<Lac>,Bsic:<Bsic
>[<CR><LF>
Operator:"<Network_Operator_name2>",MCC:<MCC2>,MNC:<MNC2>,Rxlev:<Rxlev2>,Cellid:<CellID2>,Arfcn:<Arfcn2>,Lac:<Lac2>,Bsic:<Bsic2>[…]]
OK
7 Descriptions of Network Parameters
8 Results using Termite 3.2 Terminal Software
WE get the following responses from GSM module 800 after sending the Execution Command
AT+CNETSCAN
<Network_Operator_name> Long format alphanumeric of the network operator.
<MCC> Mobile country code.
<MNC> Mobile network code.
<Rxlev> Recieve level, in decimal format.
<CellID> Cell identifier, in hexadecimal format.
<Arfcn> Absolute radio frequency channel number, in decimal format.
<Lac> Location area code, in hexadecimal format.
<Bsic> Base station identity code, in hexadecimal format.

13. The outputof Terminal islistedandarrangedsystematicallyin below table.

14. 9 How to Calculate the positions andDrawmap
 Cell tower’scoordinatesare representedasx & y i.e.tx andty alsocalledlatitude andLongitude
 Signal Strength of Each Tower is represented by s and signal strengthRatio representedby sr in
our case S is RXL signal receive level, you can see in above table.
 The signal strength ratio for each tower can be calculated as ratio = signal strength/(total,
combined signal strength):
 Finally, coordinates can be calculated individually by multiplying each tower’s coordinate by its
signal strength ratio and adding them together.
Operators MCC MNC RXl
CELL
ID
(HEX)
CELL ID
DECIMAL
ARFCN
LAC(HEX)
LAC
(DECIMAL) BSIC LAT LONG
Spice
telecom 404 44 48 32DD 13021 15 514 1300 3B 12.954366 77.694103
Spice
telecom 404 44 41 2942 10562 16 514 1300 38 12.948838 77.695289
Spice
telecom 404 44 40 32DF 13023 25 514 1300 0F 12.953097 77.689468
Spice
telecom 404 44 29 32E8 13032 18 514 1300 22 12.952558 77.696156
Spice
telecom 404 44 25 27A7 10151 24 514 1300 27 12.956038 77.680652
Bharat
Karnataka 404 71 42 2875 10357 74 09CE 2510 10 12.954797 77.696468
Bharat
Karnataka 404 71 33 275E 10078 75 09CE 2510 16 12.951517 77.693764
Bharat
Karnataka 404 71 32 27B9 10169 73 09CE 2510 20
Hutch
Karnataka 404 86 37 221C 8732 723 7C3A 31802 23
Hutch
Karnataka 404 86 34 3D19 15641 662 7C3A 31802 26
Hutch
Karnataka 404 86 33 C258 49752 724 7C3A 31802 15
Docomo 405 34 32 5FAB 24491 763 4A38 19000 01
Docomo 405 34 29 9062 36962 760 4A38 19000 14
Aircel 405 803 29 689F 26783 709 048A 1162 21
Aircel 405 803 25 689D 26781 706 048A 1162 3E
Reliance
Comm. 405 10 29 A3C1 44921 687 274E 10062 29
Airtel 404 45 51 3B61 15201 56 61E5 25061 09
Airtel 404 45 34 3B63 15203 54 61E5 25061 39
Airtel 404 45 29 EDD3 60883 50 61E5 25061 3D
Airtel 404 45 29 3B62 15202 52 61E5 25061 01

15. 10 TriangulationAlgorithm(Python)
Google locationservice isnomore free andexpectsto provide payment details in terms of credit card.
We have chosen https://opencellid.org forGSM locationaccessand plots are createdusingGoogle Map
and OpenStreetMap
import requests
url = "https://us1.unwiredlabs.com/v2/process.php"
payload = "{"token": "0baef160915ec5","radio": "gsm","mcc": 404,"mnc": 44,"cells": [{"lac":
1300,"cid": 10151}]}"
response = requests.request("POST", url, data=payload)
print(response.text)

16. # importthe library
importgmplot
importfolium
importpandasas pd
tx1 = 77.694103;
tx2 = 77.695289;
tx3 = 77.689468;
tx4 = 77.696156;
tx5 = 77.680652;
tx6 = 77.696468;
tx7= 77.693764;
ty1 = 12.954366;
ty2 = 12.948838;
ty3 = 12.953097;
ty4 = 12.952558;
ty5 = 12.956038;
ty6 = 12.954797;
ty7 = 12.951517;
s1 =48
s2 =41
s3 =40

17. s4 =29
s5 =25
s6 =42
s7 =33
sr1 = s1 / (s1 + s2 + s3 + s4 + s5 + s6 + s7);
sr2 = s2 / (s1 + s2 + s3 + s4 + s5 + s6 + s7);
sr3 = s3 / (s1 + s2 + s3 + s4 + s5 + s6 + s7);
sr4 = s4 / (s1 + s2 + s3 + s4 + s5 + s6 + s7);
sr5 = s5 / (s1 + s2 + s3 + s4 + s5 + s6 + s7);
sr6 = s6 / (s1 + s2 + s3 + s4 + s5 + s6 + s7);
sr7 = s7 / (s1 + s2 + s3 + s4 + s5 + s6 + s7);
longitude =((tx1* sr1) + (tx2* sr2) + (tx3* sr3) + (tx4 * sr4) + (tx5 * sr5) + (tx6 * sr6) + (tx7* sr7));
latitude =((ty1* sr1) + (ty2 * sr2) + (ty3 * sr3) + (ty4 * sr4) + (ty5 * sr5) + (ty6 * sr6) + (ty7 * sr7));
print(longitude,latitude)
latitude_list=[12.954366,12.948838,12.953097,12.952558,12.956038,12.954797,12.951517,latitude]
longitude_list=[77.694103,77.695289,77.689468,77.696156,77.680652,77.696468,77.693764,longitude]
gmap.scatter( latitude_list,longitude_list,'#FF0000',size = 40, marker = False)
gmap.draw( "D:google-map.html")
# Make a data frame withdotsto showon the map

18. 11 Triangulationresults using opencell_id
data = pd.DataFrame({
'lat':[12.954366,12.948838,12.953097,12.952558,12.956038,12.954797,12.951517,latitude],
'lon':[77.694103,77.695289,77.689468,77.696156,77.680652,77.696468,77.693764,longitude],
'name':['Cell Tower1','Cell Tower2','Cell Tower3','Cell Tower4','Cell Tower 5','Cell Tower6',
'Cell Tower7', 'TriangulatedPosition']
})
data
m = folium.Map(location=[latitude,longitude],tiles="OpenStreetMap",zoom_start=80)
for i in range(0,len(data)):
folium.Marker([data.iloc[i]['lat'],data.iloc[i]['lon']],popup=data.iloc[i]
['name']).add_to(m)
m.save('D:folium_map.html')

20. {
"token": "0baef160915ec5",
"radio": "gsm",
"mcc": 404,
"mnc": 44,
"cells": [{
"lac": 1300,
"cid": 13021,
"signal": 48
},{
"lac": 1300,
"cid": 10562,
"signal": 41
},{
"lac": 1300,
"cid": 13023,
"signal": 40
},{
"lac": 1300,
"cid": 13032,
"signal": 29
},{
"lac": 1300,
"cid": 10151,
"signal": 25

21. {
"status": "ok",
"balance": 97,
"lat": 12.952645,
"lon": 77.693824,
"accuracy": 524,
"address": "1st Cross Road, Ashwath Nagar, Marathahalli Ward, Mahadevapura Zone, Bengaluru, Bangalore
Urban, Karnataka, 560037, India"
}
12 References
 https://www.neilson.co.za/mobile-network-geolocation-obtaining-the-cell-ids-the-signal-strength-
of-surrounding-towers-from-a-gsm-modem/
}],
"address": 1
}

22.  https://www.geeksforgeeks.org/python-plotting-google-map-using-gmplot-package/
 http://simcomm2m.com/En/module/detail.aspx?id=138
 https://python-graph-gallery.com/288-map-background-with-folium/