Wi-Fi Location on CellLocate


Although the GNSS (Global Navigation Satellite System) is the most accurate way to locate an IoT device, a GNSS receiver cannot determine a position when satellite signals are unavailable, such as in urban canyons, indoors, parking garages, or when GNSS jamming signals are present. For fleet asset tracking and supply chain management, it’s unacceptable. 

On the other hand, cellular network cells and Wi-Fi access points are widely available, even in areas where GNSS signals are poor or absent.  Network-based location using cellular and short-range radio attributes provide an essential alternative to no position fix at all. 

Using cellular network location technology as a backup to GNSS is usually the first choice of a designer since almost all the IoT devices have a cellular modem to communicate data to the cloud application platform.

There are use cases in which the cellular network location technique does not meet the business requirements because of the too high uncertainty that is usually greater than 100 meters. People & Pet tracking or Shared Micromobility are typical use cases in which the tracker moves across tough environment but it's required to always achieve a reasonable accuracy to locate the IoT device at street level.

Most of the time, in these scenarios, you can relax the location accuracy from few meters to 15-20 meters, but the cellular location technology cannot achieve this business requirement.

CellLocate service includes the capability to estimate the device location using Wi-Fi sniffing with fingerprinting technology. It uses the nearby Wi-Fi access points information (MAC address and signal strength) to estimate where the device is located. With Wi-Fi location you can achieve an accuracy in the range 5-50 meters depending on the density of the Wi-Fi access points.  


Before reading the next sections, you are suggested to:

If you are not yet familiar with  the basic information on how to connect to Wi-Fi and Cellular modules through AT commands please check the suggested documents at the end of this guide.

To leverage Wi-Fi Location through CellLocate service you are requested to use u-blox products. It allows you to experience a solid integration between hardware and service with the result of minimizing the time to market and being ready-to-go for field tests in few minutes.

If your device contains hardware not designed by u-blox but you want to use Cell ID and Wi-Fi location technologies, we invite you to contact our support to help you.

How to get a position estimation

There are three simple steps to get a location:

Step 1 -  Trigger the AP scan.

As first step you need to  connect to WiFi module and trigger the scan using this AT command



The response provided by the Wi-Fi module is:


where the <content> is in binary format.

The scan usually lasts few seconds.

Step 2 - Send the scan to CEL modem

Once the Wi-Fi modules provides the AT response, if the scan contains a valid output (See  the Error handling section), you can send the <content> to the Cellular modem using the AT command


where <ULOCEXT_string> is the scan obtained in the previous step. 

Step 3 - Trigger a location request 

Finally, to obtain the location estimation from the service, use the AT+ULOC command as described in the Getting started guide using the sensor 10. 


The Cellular module performs a Cell Id scan and send the location request to CellLocate service jointly to the Wi-Fi scan. The service estimates the best possible position with the input provided.

Note: even when using Wi-Fi Location, CellLocate service uses automatically  as fallback the cellular location in case it's not possible to estimate a position using the list of Wi-Fi AP provided in input. 

Error handling

Please note that

Testing the service  - Sample code

The easiest way to test the service is to purchase an XPLR-IOT-1 kit (or newer versions) that includes all the required hardware and the sample code to perform an end-to-end testing. The code is available on GitHub in the Location example repository

General notes

The Wi-Fi scan is the process performed by the Wi-Fi module to verify which are the nearby Wi-Fi access points. The module does not need to connect to any Wi-Fi network, exactly as it happens when the Wi-Fi chip of a laptop shows to the user the available access points around the PC. 

Therefore the feature works both with password protected and hidden Wi-Fi networks.

You can set the Wi-Fi channels to be scanned through the AT+UWCL command in case you need to change the default configuration

Reference documentation