It is known that two methods can be used to get a rough position:
How is the first one done? There needs to be software in the phone which communicates with the GSM towers and gets the rough location somehow. But does it do triangulation (which I know is used to log the location of both ends of every call and every SMS, together with the IMEIs of both phones, but that is a system function, for law enforcement / surveillance, not a phone function) or is there some means of merely connecting to anybody’s GSM tower (without any payment i.e. even another company’s one) and obtaining its lat/long?
What if you are abroad and have roaming disabled i.e. no voice, sms or data? Or have a PAYG SIM on which the balance is zero? I am fairly sure that GPS assistance via GSM towers doesn’t transfer billable data.
On the WIFI location method, I know Google got into hot water over using their photo cars to collect WIFI MAC numbers (it could not be IPs because you need to do DHCP to get that, and nearly all APs are encrypted these days, and anyway DHCP would take too long for a drive-by login attempt) so Google now have a database of WIFI MAC numbers and their lat/long. But is that going to be licensed to phone makers and be inside the phone? And if it is not inside the phone, it must need a billable data connection to do the lookup.
I recall reading that Apple have that database (and use WIFI for GPS assistance) but they need to do a data connection (WIFI or GPRS/3G) back to Apple HQ to do the lookup, which is obviously billable. But then IOS devices transfer little bits of data to Apple HQ all day long anyway.
I am asking this because I have found that without a SIM card, my Nokia 808 GPS does absolutely nothing (not even 1 satellite reported visible, and not even getting GPS time) for about 10 minutes (a very long time) and then it suddenly wakes up and works great. This has been corroborated by others. I just haven’t tested it with a non-working or zero-balance SIM, and I can say for sure that the phone doesn’t bring up the WIFI connection in this situation.
I think cell towers broadcast their lat/long.
Peter, did you try this within range of WiFi (not necessarily yours) or somewhere w/o ANY signal (other than satellite)?
I think that the location data from the GSM tower is only necessary for the first fix, otherwise the iPhone GPS would not work in flight.
That’s the whole idea behind A-GPS, to get a quick first fix
I think cell towers broadcast their lat/long.
That would be smart, but how much of a SIM card’s functionality is needed to get that data?
did you try this within range of WiFi (not necessarily yours) or somewhere w/o ANY signal (other than satellite)?
Yes to the former, no to the latter. But the phone does not bring up the wifi connection in any apparent way, just because a GPS app is trying to get a fix. It could be getting the MAC # but it certainly isn’t doing DHCP. Anyway, if a SIM-less phone was able to get a position fix over wifi that would imply it contains a world database of wifi MAC numbers (each one is 48 or 64 bits long?) and their lat/long, which is hugely unlikely IMHO. The whole ROM flash package for the 808 is about 200MB (I have just flashed two of them with customised firmware) and that includes a pointless 20MB underwater video and other stuff 
I think that the location data from the GSM tower is only necessary for the first fix, otherwise the iPhone GPS would not work in flight.
Definitely.
The way A-GPS works is that if you have a rough location, you can tighten the behaviour of the phase locked loop of the GPS correlator. That PLL design can be optimised for a rapid time-to-fix (but then you get poor tracking during motion) or precise tracking (for say aircraft use) but not both.
The JDAM guided bomb package uses INS to “guide” the GPS, and that method is used all over the place to get precise GPS tracking during rapid platform motion.
So the principle seems well known. I just wonder how exactly phones do it. I don’t think they can be using wifi without passing data over it.
I don’t think you need any SIM functionality to get your location assist (other than the very basic function to start a GSM session)
I think the steps are
1 – look out and see if you can see a mast in your carrier’s frequency range
2 – if 1 fails, see if you can see a mast in any supported frequency range
3 – if there are multiple masts, find the masts from your carrier
these steps all require AIUI the mast to periodically make identification transmissions (which I think contain lat lon and some other identifying information)
4 – select the mast with the strongest signal and try to establish a connection on the connection channel
5 – MSISDN and IMEI transmitted for the ground network to validate if it wishes to service you (ie you are known customer with credit, phone not blocked etc.)
This would suggest the GPS assist needs the phone to try and connect (which it shouldn’t even bother to try without a sim). It may (I don’t know enough of the detail ) fail at step 2 if you have all roaming turned off (not just data roaming) and in your location no one is using your main Carrier’s frequency range, but this should be rare.
It should have its assisted position (knowing which cell it is going to try to connect to ) prior to step 5, so not need any service credit of valid billing information.
it contains a world database
AFAIK it phones home for that, at least it asks permission to do just that…
The way A-GPS works is that if you have a rough location, you can tighten the behaviour of the phase locked loop of the GPS correlator.
Erm well no. The point of the assistance data is to more quickly get the Almanach. And possibly a fairly precise time, to tighten the search window in the time direction.
Problem is, if you have acquired enough satellite signals, but don’t know where the satellites are, you still can’t compute a position. You need to get the Almanach. If you download it from the GPS satellites with 50bit/s, it takes 12.5 minutes for the whole almanach (or approx one minute error free reception for the ephemeris of one satellite). Now if you can download the almanach from somewhere else, you can avoid the delay between acquisition and computing a position. The Almanach needs to be fresh though. Anything older than a day is pretty much worthless.
Furthermore, I’m fairly sure that the dynamics settings (i.e. whether you’re a pedestrian or a supersonic fighter) have no influence on the tracking loop parameters. Why should it? The satellites move so fast that they completely dwarf any speed difference between a snail and a supersonic aircraft. What this setting influences, however, is the Kalman filter, that filters the position and velocity vector.
That PLL design can be optimised for a rapid time-to-fix (but then you get poor tracking during motion) or precise tracking (for say aircraft use) but not both.
The PLL loop parameters have nothing to do with time-to-fix, simply because until fix is achieved it is simply not a loop.
Getting a fix means searching for a signal in three dimensions: time, frequency and code (that is satellite number). So it’s obvious how to speed up this process: either by limiting the search space (eg. by knowing a better time estimate, tightening the frequency offset window, knowing which satellites may possibly be in view), or by throwing more hardware at the problem; modern receivers have ~64 correlator channels, sometimes additional hardware to speed up.
AFAIK it phones home for that, at least it asks permission to do just that…
But how can it, if there is no SIM card, or there is a SIM card which has no GPRS/3G data enabled on it?
What this setting influences, however, is the Kalman filter, that filters the position and velocity vector.
That’s what I meant 
This is digressing (and I am sure you know much more about it than I do) but why do so many GPSs have huge problems getting a fix if they are powered up in a moving vehicle?
Say 50mph is nothing compared to the ~20000mph of the satellites, yet the receiver is unable to get a fix.
A common explanation is that trees passing by can interrupt the signal briefly which stops the almanac getting received, but I can prove that is not happening (in an open space) yet the device won’t get a fix.
but why do so many GPSs have huge problems getting a fix if they are powered up in a moving vehicle
presumably because the velocity vector estimate is initialized to zero, which means that the position error is increasing quickly, reaching the threshold for reinitialization
that’s what I watched a garmin GPS receiver doing on a ship with a constant ~24kts cruise, that was the main problem, and there were certainly no tree
