CellLocate getting started

Last update:  July 4th, 2023


A Global Navigation Satellite System (GNSS) receiver cannot determine a position when satellite signals are unavailable, such as in urban canyons, indoors, parking garages, or when GNSS jamming signals are present. For fleet asset tracking and supply chain management, it’s unacceptable. On the other hand, cellular network cells and Wi-Fi access points are widely available, even in areas where GNSS signals are poor or absent. Network-based location using cellular and short-range radio attributes provides an alternative to no position fix at all.

CellLocate is a robust network-based location service that delivers location data where you need it, in the cloud, even in areas where GNSS is poor or absent, by using cellular and Wi‑Fi network attributes. It is ready to use since it is embedded in u-blox cellular and short-range modems. You can manage entire fleets with our easy-to-use IoT platform and flexible predictable plans. This end-to-end solution is proven, scalable, and ready to virtually eliminate any “no position” scenario.

In a nutshell

CellLocate provides an estimated location based on visible network cell information reported by the cellular module. When CellLocate is activated, a data connection to the CellLocate server is established and the network cell information is passed to the server which provides an estimation of the device position based on the cell information.

CellLocate is fully integrated into u-blox GSM/GPRS, HSPA/UMTS, LTE-M, and LTE Cat 1 cellular modules and works in parallel to normal module functionality. The technology enables stand-alone location data based on surrounding mobile network information as well as hybrid technology that works in conjunction with GNSS. Through the single AT command interface, it is possible to define all the location settings for optimized performance.

When using CellLocate, the position accuracy is not predictable and is determined by the availability in the database of previous observations within the same area. CellLocate does not require a GNSS receiver to be present or active.

Operator independent solution

It is a clever strategy to take advantage of the location attributes available via mobile networks to overcome the challenges of poor or absent GNSS, but this should not create vulnerable dependencies on the network operators themselves. Cellular networks evolve continuously, with changes made by network operators during network maintenance, to add capacity, spectrum, and even evolutionary advancements to infrastructure. Despite this, CellLocate delivers robust performance by leveraging location attributes belonging to both the serving cell network and the cells of other network operators, working equally well in both cases. This provides a robustness against network changes, as well as multiplicity in the number of cells observed.

Hardware requirements

CellLocate is supported by following u-blox Cellular products:


To use the service you need:

u-blox Thingstream service platform sign-up

u-blox Thingstream is a service delivery platform providing a management console that you can use to enable and manage the entire suite of u-blox services, including IoT Location-as-a-Services and CellLocate

Sign-up is free, quick and easy.  Just go to the management console and register with your company information. If you already have a Thingstream domain you do not need to register again.

Service configuration - obtain a token

To use the service you need a valid token (an alphanumeric string)  generated by the  Thingstream platform. The token needs to be configured on each module as explained  in a later section, to grant the access to the service. 

To get a token:

For further information check the token management section for more information on creating and managing your tokens.

NOTE: the token is used to authorize your device to access to the service and it's valid for the entire fleet. During the wizard, you are requested to associate to the token a price plan (it can be a developer or a paid plan).

Device configuration

Configuring the device and use the service is extremely simple. You just need

This configuration is persistent and need only be done once.

Configuring server settings

To configure the service endpoints and the token use this AT command




Configuring the cell scan mode

There are two modes to choose from:

Note: Deep scan configuration is generally recommended only for corner cases that must be individually considered and tested

Scan mode can be configured using the AT+ULOCCELL= <value> where:

Note: deep scan is not supported by all the modules. Refer to the module AT manual to verify compatibility

Note: Both settings AT+UGSRV and AT+ULOCCELL are persistent.

The scan mode influences the time needed to complete the scan, so the timeout value (explained in the next section) should be set accordingly. Be aware that the cell information is sent to the server only when the scan is completed, so setting a small value for the timeout means that the scan information may not be used.

Using the service

The AT+ULOC command is used every time that the device application wants to get a position using CellLocate. The command syntax is:


Where recommended settings are:

If you are not using hybrid positioning (that is only Cellular positioning without GNSS) you shall set a low value (1-30) so that at any location request sent in the AT interface corresponds to a request to the service and thus a cloud position estimation. 

If you setting an high value of <accuracy> (for example 150), the logic inside the modem, evaluates if it is possible to provide a solution without contacting the server to minimize the data and energy consumption.

Note: to know more about the logic implemented in the CellLocate client inside the u-blox cellular module, send a request to services-support@u-blox.com providing also the cellular model that you are using.

Here below the typical location request


Note: Please check the AT command manual for your module type in the product documentation section of the u-blox website to find the full set of available parameters.

Once the device application has sent the command to the module, the module autonomously:

An example of response (when response_type=0) is:

+UULOC: 13/04/2011,09:54:51.000,45.6334520,13.0618620,35,115

that complies to this format

+UULOC: <date>,<time>,<lat>,<long>,<alt>,<uncertainty>

where :

Extended responses

There is the possibility to get an extended response to obtain additional useful parameters, by setting it properly in the request. 


Standard response type

The standard response type described above is obtained by using the value <response_type>=0. As explained above the response is provided in the following format

+UULOC: <date>,<time>,<lat>,<long>,<alt>,<uncertainty>

where  <uncertainty> provides the uncertainty of the position estimation at 50th percentile.

Detailed response

This is obtained by setting <response_type>=1.

The resposne is in the following format

+UULOC: <date>,<time>,<lat>,<long>,<alt>,<uncertainty>,<speed>,<direction>,<vertical_acc>,<sensor_used>,<SV_used>,<antenna_status>,<jamming_status>

Most of these additional parameters (compared to standard response) are relevant only in case of hybrid positioning (CellLocate + GNSS) , but the <sensor_used> parameter is useful to understand if the location response is provided by the server (sensor_used = 2) or by the module (sensor_used=0) becuse of the client logic in the module.

Multi-hypothesis response type

By setting <response_type>=2, as explained in the following "Confidence level" section,  you can obtain additional information like

+UULOC: <sol>,<num>,<sensor_used>,<date>,<time>,<lat>,<long>,<alt>,<lat50>,<long50>,<major50>,<minor50>,<orientation50>,<confidence50>,<lat95>,<long95>,<major95>,<minor95>,<orientation95>,<confidence95>

It is worth noting that


Understanding errors

It's recommended to always activate the ULOC URCs to understand how the location request is progressing and if there is any issue. 

To activate the URC, you can use AT+ULOCIND=<mode> where mode can be  0 or 1 to disable or enable URCs. The response is in the format

+UULOCIND: <step>,<result>

where steps indicate which is the on-going task of the Cellular modem, while result represent the result of the task.


Service endpoints

CellLocate offers multiple service endpoints that can be configured in the AT+UGSRV command:

Payload Size

Data size exchanged between the module and the service end-point depends on the number of cells and are in the range of:

Estimation uncertainty and confidence level

The position uncertainty  cannot be predetermined because it depends on several factor like the region, the technology (2G, 3G, 4G).  At global level it spans from 100 m to 2.7Km. If you need additional information about your region and/or technology you can contact the support at services-support@u-blox.com.

As described in the previous section, the ULOC response provides the <uncertainty> parameter that represents the estimated 50% confidence level error, in meters. 

It is possible to get also the 95% confidence level by setting a different response type (parameter 2 as highlighted in bold here below)


The format of the answer provided is reported below with the relevant parameters highlighted in bold



Here below an example of an extended answer



As  short summary, to do the initial test:



And verify that the location estimation comes form the service by checking that the parameter <sensor_used> = 2 as explained in the above section

+UULOC: <date>,<time>,<lat>,<long>,<alt>,<uncertainty>,<speed>,<direction>,<vertical_acc>,<sensor_used>,<SV_used>,<antenna_status>,<jamming_status>

Wi-Fi location

CellLocate includes the capability to locate a device using the nearby Wi-Fi access points. Especially in urban environments, this greatly improves the accuracy of the solution provided.  To know more, visit the Wi-Fi location section.

Other ways to access the service

Service to Service access

Some use cases impose that the device communicates only with your application server. To address this requirement it is possible also to work in Service to Service mode where the device sends the raw data to the your application server that will then provide these raw data  to the CellLocate endpoints using a REST API; the service returns the position estimation directly to your server in JSON format.

Detailed information about this option are available in the Service to Service guide.

Location in the Cloud

This is the most straightforward and simple way to estimate the device location and get it directly on the cloud saving data, reducing latency and minimizing the battery drain. 

Detailed information about this option are available in the Location in the Cloud documentation.


The service is charged on the number of location request on fleet basis without any limitation on the number of devices that compose the fleet. 

You can select between multiple plans depending according to the monthly volume of request that you plan to have. Each plan has a fixed monthly fee and an overage fee (per request) that is applied in case you exceed the quota in a particular month.

You can change, in self-service mode, your plan using the Thingstream platform, accordingly to your forecast and use case. The platform will never change the plan automatically on a usage basis. Before moving to higher tier, evaluate if it is more cost effective to continue with a lower plan plus the overage cost.

The pricing plan is linked to a token. You can have multiple tokens each one with a different plan

Pricing plans are available in the IoT Location-as-a-Service section, on the CellLocate tab.


Invoices are raised on the 1st of each month and will include usage for any services configured via the Thingstream platform. Only completed subscriptions will be included so a plan which starts on 5th May, renewing on 5th June, would be included in the invoice raised on 1st July.  Any usage from the renewed plan would not be invoiced until 1st August.

Invoices are sent by email from accounts@thingstream.io.  Please add this address to your safe senders list to avoid invoices being lost in your junk folder.

Reference documentation

Additional information are available in the following documents: