"Microsoft Location Finder" - how is it supposed to work ?

[POSTED TO alt.internet.wireless - REPLY ON USENET PLEASE]

There's more to GPS than A-GPS in the handset -- GPS is also used to locate towers, and the location of the handset can be estimated from tower data without handset A-GPS or the permission of the subscriber, as with U-TDOA.

Yep and really weird. Cingular is allegedly not using GPS handsets for positioning. That's the real benifit to using TDOA. However, Cingular will not provision a handset that does not have GPS capeabilities. Now, why would they do that?

Translation. Cingular was desperate for something that worked and didn't require issuing new handsets to everyone. TDOA also has a big benfit in the weird rules setup by the FCC allow for half the accuracy for network based solutions (100 meters) as for handset based solutions (50 meters). Any semblence to the FCC stacking the deck in favor of non-GPS solutions is stricty coincidental.

Excavated from:

Phase II of the E-911 mandate began in October 2001 and is scheduled for completion by the end of 2005. For network-based solutions, the mandate requires wireless operators to locate 67% of all emergency calls within 100 meters and 95% of the calls within 300 meters. For handset-based solutions, 67% of the calls must be positioned with an accuracy of 50 meters or better and 95% of the calls within 150 meters. In addition, wireless carriers deploying handset-based solutions must ensure that a minimum of 95% of the handsets used by their subscribers can support E-911 service by December 31, 2005.

Mind if I play cynical? My limited experience in using TDOA for direction finding has been dismal. Multipath and the requirement that three or more cell sites simultaneously hear the handset are in my never humble opinion, fatal problems. Personally, I don't believe the press releases and announcments, but have no way to verify the accuracy of the claims.

Incidentally, from my palatial house in Ben Lomond, I can see two Cingular cell sites (using the test mode). Not enough for an accurate fix. If I drive down the road about 1000ft, I lose one of the sites. The situation is no better in downtown Santa Cruz, where many locations can see only one Cingular cell site.

Comparison of various location systems:

That doesn't have anything to do with GPS being under the limited control of the user. TDOA is available but lacks the accuracy that the FCC and NENA want. It also requires that at least two cell sites hear the handset and determine a range. Even with two, there's a possible ambiguity, which requires a 3rd cell site to resolve. However, if all you care to know is the general area of the caller, just one cell site is usually sufficient.

Of course, there are other applications for tracking cell phones:

that this is yet another government inspired project.

Cingular Switches to U-TDOA for E-911 Positioning

Date Posted: Dec 17, 2002, 12:25 AM Source: Wireless Week

Cingular has decided to switch technologies for meeting the FCC's E-911 mandate for locating 911 callers. Cingular has told the FCC that after completing successful field trials involving TruePosition's network-based U-TDOA technology, it was moving away from E-OTD, which so far has failed accuracy tests, resulting in delays and financial penalties. Cingular in October suspended shipments of E-OTD gear and began testing TruePosition's solution.

TruePosition and Cingular Sign National Multi-Year Agreement For GSM Location Solution

TruePosition's U-TDOA Location Solution Provides High Accuracy For Anyphone, Anywhere

KING OF PRUSSIA, Pa. and ATLANTA, Ga., March 10, 2003

[POSTED TO alt.internet.wireless - REPLY ON USENET PLEASE]

Interesting, but not under the control of the subscriber, the original point at issue.

Yes, but that was NOT the original point. TDOA based locations are network based and therefore not under the control of the subscriber. However, my comments were for _GPS_ cell phones. Quoting your original comments: "GPS cell phone location info under the control of the client? Not AFAIK." Note the word "GPS". My original point was for VoIP phones using RFC3825 for E911 location, which is mostly under the control of the client. You're the one that dragged Cingular and TDOA into the puzzle.

Incidentally, do you have any idea why Cingular would insist on users buying GPS enabled phones when they're allegedly not using GPS? I've asked a few techy types and one sales droid and never received a decent answer. They mumbled something about an FCC order demanding that only GPS phones be sold. I could find no evidence of such an order, only that they be E911 enabled.

[POSTED TO alt.internet.wireless - REPLY ON USENET PLEASE]

Fair enough. My comments were for GPS-based positioning in general, whether entirely external to mobile device or assisted by mobile device. Your "GPS" cell phones are actually Assisted GPS (A-GPS) which depend on external processing for actual positioning, not unlike U-TDOA. You may be able to turn off A-GPS, but you can't turn off external positioning based on external GPS. That was my point.

Not exactly sure what you mean by that.

Intermediate routers can have a RFC1918 address without any problems. The normal user has no need to know or care what their address is, is highly unlikely to have an account on the router they can log into, and the routers don't offer services of any kind (routing is not a service) to any user. Consequently - a number of organizations will use those addresses instead of a real address that can be leased/rented to a paying customer. For that matter, two of my ISPs use RFC1918 addresses for customer services like "inside" DNS (as opposed to the public DNS servers accessed by non-customers), news, mail, and the "customer information" web page. The only thing "magic" about RFC1918 addresses is that they are not supposed to be used across "enterprise" boundaries. This means that a customer could use such a range, but the ISP should drop them at it's interface, because if they received a packet from 192.168.1.1, they wouldn't have a clue where they should direct the reply - _which_ customer is using that?

Looking at traceroute outputs, I've seen it used on national backbones, never mind ISPs. An ICMP error packets (such as types 3, 4, 11, and so on) do not allow for a reply (see the last paragraph on the first page of RFC0792). Those who follow RFC2827/3704 will normally drop packets with RFC3330 addresses (RFC1918 and a whole lot more) as source, because of the inability to use them with TCP, but may pass ICMP with the same source addresses.

0792 Internet Control Message Protocol. J. Postel. Sep-01-1981. (Format: TXT=30404 bytes) (Obsoletes RFC0777) (Updated by RFC0950) (Also STD0005) (Status: STANDARD) 2827 Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing. P. Ferguson, D. Senie. May 2000. (Format: TXT=21258 bytes) (Obsoletes RFC2267) (Updated by RFC3704) (Also BCP0038) (Status: BEST CURRENT PRACTICE) 3330 Special-Use IPv4 Addresses. IANA. September 2002. (Format: TXT=16200 bytes) (Status: INFORMATIONAL) 3704 Ingress Filtering for Multihomed Networks. F. Baker, P. Savola. March 2004. (Format: TXT=35942 bytes) (Updates RFC2827) (Also BCP0084) (Status: BEST CURRENT PRACTICE)

IANA registry requirements is a minimum of two servers.

They should only keep the data for as long as the TTL given in the reply from an authoritative server. Even though our servers at work have had the same addresses for nearly 20 years, when you look them up you receive a TTL of 86400 seconds (24 hours) from the .com root servers. All of our DNS zone files have the same TTL. The 13 "root" servers advertise a TTL of 604800 (a week). Some of the anti-spam blacklists will list an IP address (a negative) if the default TTL is less than 7200 or 10800 (2 or 3 hours).

Neither am I, but RFC1712 pertained to all hosts, not just DNS servers. The examples in the RFC used hosts that were potent enough to be servers (a pair of SGI Indigos), as well as bottom of the line stuff (Sun IPCs - about the horsepower of a 386DX-25). The system type is from the 'HINFO' DNS records - another one that's exceptionally rare today.

Old guy

Totally agree. Because these services are not using circular polarization on both ends of the link, the multipath is the killer.

Out in the flatland boonies, this might work assuming sufficient cells within reach - get into hills, or an area with lots of large buildings and all bets are off. Receiving television in the New York metro area used to be a huge problems because the transmitters were down town (originally the Empire State Building, then building 2 at the World Trade Center) and the reflections caused horrible ghosts - and a ghost separated by a tenth of the width of the picture is a position error (longer path) of about 1.1 miles. That 300 meter spec equates to a ghost spacing of just 1.6% of the width of the picture.

So hopefully, they don't get more than 1 of 20 of those emergency calls.

Old guy

[POSTED TO alt.internet.wireless - REPLY ON USENET PLEASE]

IANA? You mean Internic? ;) Regardless, while that "requirement" is commonly observed, it's not rigidly enforced.

I can fake the response that traceroute sees on machines that I have control. For a while, I was having my firewall report that it was routed through an IP address owned by the CIA.

Agreed. It just looks weird for traceroute. I was never quite sure if it was acceptable practice or just offended my sense of propriety. My only real complaint was that if the subnet matched the one I was using for my inside LAN, reverse DNS would report that it was a local machine.

Just about all Cisco ACL's drop non-routeable source IP's at the external interface as a security measure to prevent outside attackers from spoofing that they're coming from inside the firewall. Where the fun starts is when the ISP assigns dual IP's to an external interface, and one of them is RFC1918 non-routeable. That's what TCI (now Comcast) did for some unknown reason. Fortunately, it didn't last more than a few months.

Yep. That's how I spoofed the traceroute results without breaking the routeing. I haven't seen any non-routeable IP's on the traceroute results in quite a while.

The authoritative DNS servers for one of my domains are in Germany and New Yuck. Another is in Pennsylvania and Smog Angeles. Globalization in action.

I've lost count of how many DNS servers run dual IP's in order to meet that requirement. It's actually the same server, but it shows up as primary and backup DNS servers.

OK, then it was one of the early attempts to do geographic routing. The theory was that everyone would eventually connect to everyone else forming a networking "cloud". Instead of fixed routes, routes would be assigned dynamically by the shortest distance the packet travelled. That made quite a bit of sense in the days of dialup Telebit modems, UUCP, and NFSNet running on DS0 (56Kbit/sec) lines.

Drifting the subject a bit more.... The way some combination GPS and PCS mobile antenna conglomerations get their isolation is that the GPS antenna is right hand circular polarization, while the PCS part is left hand. However, this does nothing when the cell site antennas are all vertically polarized.

In about 1974, I was doing reflection testing in metropolitan downtown San Jose. The method was simple. The central site would belch a pulse at 800MHz. The receiver would hear the direct pulse, but also listen for subsequent delayed pulses, which are the reflections. We were testing the effects of reflections on TDMA (time slice) systems, where the reflected and delayed pulse would trample on subsequent time slices. There was some interest in playinig direction finder, but that was way down the priority list. During the testing, we often lost the direct path, and heard nothing but reflections. Moving the test back to the company hind quarters, in the SJO airport area, which is very flat, I could barely find a reflection.

I helped throw this page together in 2001 and haven't really updated it since then:

SCZ County map at: the location of cell site. Note the large areas where there are no cell sites. Cingular sites are the circles. Cell One (AT&T and now Cingular, are the stars. The area has many large hills seperating sites. Note the large areas where there is only one Cingular or Cell One site in range. Only in the downtown area, would I expect the three Cingular or Cell One sites to be within range of a user. Let's just say that I'm very suspicious of TruePosition/Cingular and their TDOA claims of impressive accuracy.

Incidentally, the various colored areas on the map are where the county has decided that there shall be no additional cell sites installed. That include residential areas, forest, and salamander protected areas. It's amazing that cellular service even functions in the Peoples Republic of Santa Cruz.

[POSTED TO alt.internet.wireless - REPLY ON USENET PLEASE]

In general, without testing, based on 4-year old coverage data for one small area? ;)

IMHO the real issue isn't whether or not U-TDOA is perfect -- no technology is perfect -- but whether its Good Enuf(tm). TruePosition U-TDOA has performed well in field trials.

A-GPS likewise has limitations; e.g., it doesn't work at all well indoors, and accuracy can actually be much worse than U-TDOA.

[POSTED TO alt.internet.wireless - REPLY ON USENET PLEASE]

Not to mention Good Internet Practice.

Yep. I just happen to live in that small area and have a better than average idea of where the cell sites are located and approximate coverage area. One of the things I planned to do was to use Radio-Mobile to plot the coverage areas of the various cell sites by service provider. That would give me a more realistic estimate of coverage area and will also show locations where one can be heard by 3 or more cell sites necessary to get an unambiguous fix with TDOA.

Please note that I'm "very suspicious" which means one can easily change my mind with claims of technical improvements and test reports.

I'm not sure what is considered sufficient by the PSAP and the FCC. It's obvious from the specs that the FCC has stacked the deck in favour of network based location technology. My experience with FCC specs is that if they want some specified level of preformance, they'll spec it to perhaps 4-10 times better. That's because they know that everyone tweaks their test numbers, customizes equipment for the tests, and later gets sloppy in implimentation. A 300 meter radius for 95% accuracy is quite sloppy for any location technology and probably can be achieved with TDOA if 3 cell sites are visible and there are no reflection issues. What I'm very suspicious of is mostly the general lack of the necessary overlapping coverage and the ability to function in a reflective environment.

Incidentally, I couldn't find any specific reports of TDOA field trials. That doesn't mean they don't exist as field trials with other systems are also absent. If you run into any reports, please let me know.

Good Enough(tm) also includes the ability to record a running location fix. That's where the handset samples a last good (raw) location data in some previous position. If there's insufficient cell sites available for a current location, it will transmit the last good data before it lost the optimimum location. Note that I said "data" not "location". The handset does not know its own location with A-GPS or TDOA schemes and relys on the network to do the number crunching. That's usually sufficient to get a location fix before the user enters a building or shielded automobile (van or truck). I know some GPS modules have this feature as it's used to improve hot standby response time. No clue on TDOA.

As for accuracy, I have more than a little experience with using TDOA and other locaton and direction finding technology. Admittedly, my experience is not in the cellular area, but is still relevent. I suspect that there are areas where neither TDOA and GPS will work well. That's why Trueposition is covering the possibility by offering a hybird system:

may also explain why Cingular is pushing GPS handsets, while claiming not to use GPS.

As long as your upstream isn't filtering non-block sources per RFC2827 and RFC3704, that's fine. BTW, are you doing that for all packets that arrive with a TTL of 1 or so? The UNIX version of traceroute defaults to UDP and can be set to use ICMP, but there is also

[compton ~]$ whatis tcptraceroute tcptraceroute (8) - A traceroute implementation using TCP packets [compton ~]$

and I have other tools that work with other protocols besides TCP/UDP/ICMP.

There's nothing that prohibits (or even frowns upon) it in the RFCs.

Yeah, that happens.

I assume you mean as source addresses - actually RFC2267 (from 1998) which predates RFC2827 is from a guy at Cisco.

What do you mean by an external interface? I can't imagine why an interface between (example) Comcast and Level3 or BBN would have a non-routeable address (unless there was some agreement before hand). The interface in the home between "the customer" and the ISP doesn't count.

I don't recall what I was tracing to, but I saw one earlier this week... I think it was in Africa. Wasn't important, so I didn't lock in the details.

Happens all the time. At work, we carry it a bit further by having the DNS respond with regional answers - if you query from Asia, you'll get an IP located in China that has everything in Big8, Hangul, Kanji, and ISO8859-15 so that you can have a better chance of reading it. These are maintained by the overseas branches.

False economy. When that one server goes down, or links to it go p00f, your site is unreachable, even if it's in the next room to you. Most of the registrars will offer redundant backup for a fee.

Maybe you ought to glance at the RFC - it's online.

1. Introduction

It has been a long standing problem to relate IP numbers to geographical locations. The availability of Geographical location information has immediate applications in network management. Such information can be used to supplement the data already provided by utilities such as whois [Har85], traceroute [VJ89], and nslookup [UCB89]. The usefulness and functionality of these already widely used tools would be greatly enhanced by the provision of reliable geographical location information.

It dates from 1994, so routing wasn't a problem.

Old guy

All the mobile units I've seen are just a single quarter wave vertical (or similar), though it would help with people who hold the phone every way except up and down. This doesn't make much sense from an isolation standpoint - I'd provide an internal leakage path (suitably attenuated) phased 180 degrees from the normal leakage between the two. Also, don't forget that when a circularly polarized wave hits a reflection, the sense of polarization is reversed.

Familiar - one of the other things I did was work on LORAN - and ground wave verses skywave was a big thing - horrible at 2 MHz for LORAN-A, and a noticeable problem at 100 KHz (LORAN C/D).

Trying to remember when they moved the San Jose VOR - it used to be between 12L/R just South of taxiway G (about where Airport Parkway enters the airport between terminals A and C). They moved it to the field between De La Cruz, Central Expressway, the Bayshore, and the railroad at the NW end of the airport sometime between 1985 and 1990 after some new high rise construction in downtown San Jose - may have been around the Civic Center. The new building put some nasty wiggles in the final approach to the VOR30 approach. The original VOR was a standard type - five Alford Loops like the marks of a 5 face on a dice a couple of feet on the diagonals inside a truncated cone radome, on top of a 30 foot ground plane. The new one was a wide aperture Doppler VOR, with 52 Loops in a 44 foot circle atop a 100+ foot ground plane - used because it's more resistant to multipath. This inconvenienced the airlines at the time, because they used the VOR for guidance even in clear weather - when the normal active runway is 30L/R. During rainy weather, 12L/R is usually the active, and it had no problems.

Old guy

Not all are like that. The antennas for telematics devices and tall vehicles (busses, trains, trucks), that can't easily accomidate a vertical whip antenna, tend toward the exotic. Some use aircraft style PIFA antennas which are horizontally polarized. Some compromise with a 45 degree swept back vertical that's well... weirdly polarized. The one I was refering to is a dual patch pancake affair designed for very low profile installations. The vertical cardiod pattern didn't exactly work well towards the horizon, but was wonderful for urban canyons, where the cell sites are on the overhead rooftops. Naturally, I can't find a photo of the antenna on the web. Argh.

Take a close look at the internal antennas on some cell phones that do not have a projecting antenna. It's a ceramic substrate meandering

1/4 wave element that's invariably mounted horizontally near the top of the phone. It's horizontally polarized.

Nice idea if you have control over the location of the ground plane. With a vehicular install, that's not guaranteed. One could include a large ground plane as part of the antenna, but that would be messy and ugly. However, without the integral ground plane, the distance between the elements and the reflective ground would vary causing a shift in the null point. It's doable but I would hate to be the installer (or manufacturer) and deal with the inevitable lack of isolation (desensitization) issues.

You left out Omega running at 10-14KHz. Is a summer job, I worked on repairing mechanical gear calculators for Omega navigation systems and test equipment. If there were any reflections, I never saw them on the scope.

(...)

I was working at Intech (behind the Coleman Still) on the Coleman Ave side of the airport in the 1970's. It was still near the terminal at the time I left in about 1980. Incidentally, we were next to the touch and go strip. About once a year, someone would do a ground loop and end up upside down on the runway. When that happened, the entire company would declare a holiday, waste an hour taking pictures, and then go back to work. Same with most of the other businesses along the strip.

Most of the new construction was in the late 1970's and early 1980's. I think (not sure) the move was part of the roughly every 10 years terminal expansion programs and may not have had anything to do with reflections. Incidentally, SJO recently announce that they're "scaling back" (which means killing) the proposed terminal and 30L runway expansion plans.

Incidentally, Intech made direction finders for the Coast Guard, among other products. We setup a temporary experimental doppler DF system at the airport on 121.5Mhz and used it to find some ELT's around the airport. Dopper DF is enormously sensitive to reflections and multipath. We learned quite a bit about what works and what doesn't with that exercise.

Ok. That indicates that fixes are in performed in pairs resulting in a hyperbolic line of position. To get a fix, requires to intersecting lines of position. That means that to obtain that level of accuracy, the mobile needs to hear at least 3 cell sites (two pairs) almost simultaneously. If the number of cell sites in the area are sufficient, it can be made to work.

Looking at Wilmington, DE over what I guess would be 20 square miles (4x5 miles):

find that it's rather flat. However, the downtown area does have some tall buildings so I guess it's a fair test. I also note that the above trial showed that this area had 17 cell sites in a 20 square mile area or 0.85 sites per square mile. A rough calculation of the downtown Santa Cruz thru Capitola area shows a total of 10 Cingular plus AT&T cell sites in approximately the same 20 square miles. guess Wilmington has a somewhat denser cell site distribution than Santa Cruz but not unusually so. I would be happier if I saw the actual testing proceedures and results as I'm still quite suspicious.

Digging... it seems that the technology is covered under US Patents 6,119,013 4,728,959 6,108,555

From the first patent, I find: "Localization with TDOA measurements requires reception at three or more sites, since each pair of sites only enables one TDOA measurement, and each TDOA measurement only specifies a hyperbola (in two dimensions) along which the transmitter can be."

That patent is too long to quote, but it mentions the use of "collateral information" as in the assumption that the vehicle is located on a road with a known location. "Combining collateral information with the timing information from two (rather than three or more) base stations can define the location of a mobile radio transceiver well enough to make it possible to dispatch emergency and roadside assistance services." This is nice because it reduces the necessary number of cell sites that must hear the signal from 3 to 2. However, it does nothing for the in building situation. It also appears that the 1500 moving tests were probably (my guess) performed on roadways of known location.

The patent goes on to mention: "Knowledge of the terrain conditions along the approximate paths of signal arrival can be used in estimating their effect on signal propagation. Furthermore, geographic features, such as hills or water boundaries, limit the domain of candidate positions at which the transceiver could likely be located in known ways. Thus, such topographic information can also be used as collateral information to enhance the efficiency and accuracy of any determination of location." In other words, they map (calibrate) the local propogation and eliminate improbable locations. That means a call from a boat or unusual location may have problems. It's also fair to assume that if the caller is moving, they're located on a roadway.

It appears that TruePosition's technology includes quite a bit of local information and some assumptions to reduce errors. However, the same assumptions and local information can be applied to A-GPS to yield what I would guess would be compareable results.

LBS services:

E911 location using Wi-Fi: 's interesting to note that SkyHook is pushing indoor location technology while everyone else is pushing outdoor. My understanding is the number of 911 calls are about equally distributed between mobile and fixed with mobile having a high degree of duplicate calls about the same incident. It would seem to me that indoor would be more important.

Yep. I had a Magellan Map 410 GPS in my truck. Every weekday, I pass through the Hwy 9 corridor parts of which are near vertical canyons with lots of RF aborbing trees on the slopes. Position accuracy goes totally off the screen and stays that way until I get a better view of the sky. In such an environment, GPS will give a wrong location, which I guess is worse than no location.

You missed my point. It appears that TruePosition is offering a fallback technology possibly for the future, where GPS enabled handhelds will be more ubitquitous. Kinda rings familiar with Cingular's insistance that users buy A-GPS enabled handsets, even though Cingular is not using A-GPS. I would feel a bit better about their claims of U-TDOA superiority if they didn't offer the competing technology.

handheld. Looks like GSM only at this time. Wi-Fi is an add-on. My guess is that common GPS enabled cell phone will eventually have Lat-Long display. However, it will probably come via the cellular provider at a cost. There are several such services available now.