CellLocate getting started

Last update: September 9th, 2022

  • new option available: Location in the Cloud service access


Although it is a widespread and very effective technology, Global Navigation Satellite System (GNSS) positioning is not always possible, particularly in challenging signal environments such as urban canyons, indoors, parking garages, or when GNSS jamming signals are present.

On the other hand, network cells are widely available in urban and rural environments. For any given location with cellular network coverage (2G, 3G or 4G), a specific combination of network cells will be visible. u-blox CellLocate takes advantage of that visibility by allowing u-blox GSM/GPRS, HSPA/UMTS, and LTE cellular modules to report those surrounding cells at any specific location, together with previous observations from other IoT devices reporting the same visibility pattern. In this way, a mobile network-based location service provides position information even in areas where GNSS signals are poor or entirely absent

CellLocate offers a best-in-class mobile network-based location service. Years of strong historical records include billions of location data packages provided to IoT devices all over the globe for several thousand active customers. This end-to-end solution is proven, scalable, and ready to virtually eliminate any “no position scenario”.

In a nutshell

CellLocate provides an estimated location based on visible network cell information reported by the cellular module. When CellLocate is activated, a data connection to the CellLocate server is established and the network cell information is passed to the server which provides an estimation of the device position based on the cell information.

CellLocate is fully integrated into u-blox GSM/GPRS, HSPA/UMTS, LTE-M, and LTE Cat 1 cellular modules and works in parallel to normal module functionality. The technology enables stand-alone location data based on surrounding mobile network information as well as hybrid technology that works in conjunction with GNSS. Through the single AT command interface, it is possible to define all the location settings for optimized performance.

When using CellLocate, the position accuracy is not predictable and is determined by the availability in the database of previous observations within the same area. CellLocate does not require a GNSS receiver to be present or active.

Operator independent solution

It is a clever strategy to take advantage of the location attributes available via mobile networks to overcome the challenges of poor or absent GNSS, but this should not create vulnerable dependencies on the network operators themselves. Cellular networks evolve continuously, with changes made by network operators during network maintenance, to add capacity, spectrum, and even evolutionary advancements to infrastructure. Despite this, CellLocate delivers best-in-class performance by leveraging location attributes belonging to both the serving cell network and the cells of other network operators, working equally well in both cases. This provides a robustness against network changes, as well as multiplicity in the number of cells observed.

Hybrid positioning

Hybrid positioning provides a set of features, allowing the user to query the device position using a single AT command (AT+ULOC) which triggers the position calculation based on the GNSS receiver and/or the position estimated from the visible cells (CellLocate).

Hybrid positioning is designed to provide a single position estimate or multiple position estimates and may be configured to provide a single position estimate, on request, using the best of all the available information.

You can find more information about hybrid positioning in the SARA-R4 / SARA-R5 GNSS positioning and timing or GNSS implementation in cellular module application notes.

Hardware requirements

CellLocate is supported by following u-blox products:

  • ALEX-R5 series LTE-M/NB-IoT cellular SiP modules

  • SARA-R5 series multi-band LTE-M/NB-IoT cellular modules

  • SARA-R4 series LTE-M/NB-IoT/EGPRS cellular modules

  • LARA-R2 series LTE Cat 1 cellular modules

  • TOBY-R2 series LTE Cat 1 cellular modules

  • SARA-U2 series UMTS/HSPA cellular modules

  • LISA-U2 series UMTS/HSPA cellular modules

  • SARA-G4 series GSM/GPRS cellular modules

  • SARA-G3 series GSM/GPRS cellular modules


To use the service you need:

  • a valid CellLocate token which you can generate via the Thingstream service platform (explained in the next two sections)

  • An Evaluation Kit (EVK) for one of the supported modules which can be ordered from the u-blox website. You can, of course, use the module instead of the EVK if you already have it in your testing environment.

  • u-blox m-center software or a direct connection to the module to send AT commands

  • a working SIM with a valid data plan

  • An active data connection in the module. You can find some basic information that drives you on a quick connection set-up at this section. For additional information you can look at Internet applications development guide.

u-blox Thingstream service platform sign-up

u-blox Thingstream is a service delivery platform providing a management console that you can use to enable and manage the entire suite of u-blox services, including IoT Location-as-a-Services and CellLocate

Sign-up is free, quick and easy. Just go to the management console and register with your company information. If you already have a Thingstream domain for IoT Communication-as-a-Service (MQTT Anywhere, MQTT Here or MQTT Now), or for IoT Security-as-a-Service you do not need to register again.

Service configuration - obtain a token

To use the service you need a valid token (an alphanumeric string) generated by the Thingstream platform. The token needs to be configured on each module as explained in a later section, to grant the access to the service.

Check the token management section for more information on creating and managing your tokens.

Device configuration

Configuring the device and use the service is extremely simple. You just need

  • to set the server url and the authentication token

  • to set the cell scan mode as normal or deep

This configuration is persistent and need only be done once.

Configuring server settings

To configure the service endpoints and the token use this AT command



  • primary and secondary server shall be set as cell-live1.services.u-blox.com and cell-live2.services.u-blox.com unless you need to work in Server to Server mode as explained in one of the following section

  • your_auth_token is the authentication token that you generated on the Thingstream platform


Configuring the cell scan mode

There are two modes to choose from:

  • normal scan: the cellular module reports the serving cell and the neighboring visible cells designated by the network operator, which are normally collected by the module during its “network” activity. This configuration is suggested for a quick update of location

  • deep scan: the cellular module scans and reports all visible cells providing in addition to serving and neighboring cells by the serving network operator, also the cells of all other available (visible) network operators, thus increasing the probability of obtaining a successful position estimation. Although this takes a bit longer (approximately 30 sec to 2 minutes is needed to perform a deep scan), uses more data (each reported cell requires a few bytes), and more power, coverage and reliability are potentially better in corner cases.

Note: Deep scan configuration is generally recommended only for corner cases that must be individually considered and tested

Scan mode can be configured using the AT+ULOCCELL= <value> where:

  • <value> = 0 for normal scan

  • <value> = 1 for deep scan

Note: deep scan is not supported by all the modules. Refer to the module type AT manual to verify compatibility

Remember that that AT+UGSRV and AT+ULOCCELL are persisted settings

The scan mode influences the time needed to complete the scan, so the timeout value (explained in the next section) should be set accordingly. Be aware that the cell information is sent to the server only when the scan is completed, so setting a small value for the timeout means that the scan information may not be used.

Using the service

The AT+ULOC command is used every time that the device application wants to get a position using CellLocate. The command syntax is:


Where recommended settings are:

  • <mode> = 2 (single-shot position)

  • <sensor> = 2, (CellLocate)

  • <response_type> = 0 - standard response type; other options are available for this parameter.

  • <timeout> = 30 (normal scan). The timeout value defines the maximum amount of time in seconds allocated for the cell scan operation. If exceeded, the module sends the list of cells that it was able to collect before the timeout is reached. The timer is particularly important for deep scan mode because, as described previously, setting a short value does not allow a complete collection of cell ID of other operators than the serving one. In the event that the timeout is reached before the scan is complete, the output of normal scan will be sent to service endpoint to fulfill the request.

  • <accuracy> = 1000. This parameter (expressed in meters) specified the target accuracy when using hybrid positioning (CellLocate + GNSS). A low value will cause more frequent location requests whereas a high value, (up to 999999) can be used if you do not need a location update for every device movement in the specified range. Be aware that the module cannot predict in advance the real accuracy and will return any response provided by the service regardless of the calculated accuracy. When using CellLocate service in standalone mode (that is without GNSS) you can set 1000 as default value, as it does not affect in any way the behavior of the service


Note: Please check the AT command manual for your module type in the product documentation section of the u-blox website to find the full set of available parameters.

Once the device application has sent the command to the module, the module autonomously:

  • collects all the information required to get the position

  • request the position estimation to the service, using a proprietary protocol

  • waits for the response from the server

  • provides back to the application, date, time and location information

An example of response (when response_type=0) is:

+UULOC: 13/04/2011,09:54:51.000,45.6334520,13.0618620,0,1

that complies to this format

+UULOC: <date>,<time>,<lat>,<long>,<alt>,<uncertainty>

where :

  • <date> is a String that represents UTC date(DD/MM/YY) of the estimated position coming from the CellLocate server

  • <time> is a String that represents UTC time (hh:mm:ss.sss) of the estimated position coming from the CellLocate server

  • <lat> and <lon> are strings representing the estimated latitude and longitude

  • <alt> is a number reporting the estimated altitude, in meters. This is available only for hybrid positioning using GNSS and thus it is set to 0 when using CellLocate as the sensor

  • <uncertainty> is a number that represents the estimated 50% confidence level error, in meters (0 - 20000000). For a higher confidence level, read the relevant section below


  1. Once the +ULOC AT command is sent, the user/application should wait for the corresponding +UULOC URC before issuing the command again. If a new +ULOC AT command is sent before the +UULOC URC, is returned, the previous command is aborted and replaced by the new one.

  2. If no position is available (no network information and no previous data available) then the <lat> latitude and <long> longitude will be set to '0'.

  3. The use of the CellLocate sensor requires a data connection, which must be active until the +UULOC URC is received.

  4. in case of error the module replies with +UULOCIND: 3,6

Service endpoints

CellLocate offers multiple service endpoints that can be configured in the AT+UGSRV command:

  • cell-live1.services.u-blox.com

  • cell-live2.services.u-blox.com

Payload Size

Data size exchanged between the module and the service end-point depends on the number of cells and are in the range of:

  • uplink: 100-200 bytes

  • Downlink: 150 bytes

Estimation uncertainty and confidence level

The position uncertainty cannot be predetermined because it depends on several factor like the region, the technology (2G, 3G, 4G). At global level it spans from 100 m to 2.7Km. If you need additional information about your region and/or technology you can contact the support at support@thingstream.io.

As described in the previous section, the ULOC response provides the <uncertainty> parameter that represents the estimated 50% confidence level error, in meters.

It is possible to get also the 95% confidence level by setting a different response type (parameter 2 as highlighted in bold here below)


The format of the answer provided is reported below with the relevant parameters highlighted in bold



  • major50 and major95 report the uncertainty of the position estimation at 50% and 95% confidence level

  • confidence50 and confidence95 report the value respectively of 50 and 95 to indicate which is the confidence level

Here below an example of an extended answer


Other ways to access the service

Service to Service access

Some use cases impose that the device communicates only with your application server. To address this requirement it is possible also to work in Service to Service mode where the device sends the raw data to the your application server that will then provide these raw data to the CellLocate endpoints using a REST API; the service returns the position estimation directly to your server in JSON format.

Detailed information about this option are available in the Service to Service guide.

Location in the Cloud

This is the most straightforward and simple way to estimate the device location and get it directly on the cloud saving data, reducing latency and minimizing the battery drain.

Detailed information about this option are available in the Location in the Cloud documentation.


The service is charged on the number of location request on fleet basis without any limitation on the number of devices that compose the fleet.

You can select between multiple plans depending according to the monthly volume of request that you plan to have. Each plan has a fixed monthly fee and an overage fee (per request) that is applied in case you exceed the quota in a particular month.

You can change, in self-service mode, your plan using the Thingstream platform, accordingly to your forecast and use case. The platform will never change the plan automatically on a usage basis. Before moving to higher tier, evaluate if it is more cost effective to continue with a lower plan plus the overage cost.

The pricing plan is linked to a token. You can have multiple tokens each one with a different plan

Pricing plans are available in the IoT Location-as-a-Service section, on the CellLocate tab.


Invoices are raised on the 1st of each month and will include usage for any services configured via the Thingstream platform. Only completed subscriptions will be included so a plan which starts on 5th May, renewing on 5th June, would be included in the invoice raised on 1st July. Any usage from the renewed plan would not be invoiced until 1st August.

Invoices are sent by email from accounts@thingstream.io. Please add this address to your safe senders list to avoid invoices being lost in your junk folder.

Reference documentation

Additional information are available in the following documents: