Open access peer-reviewed chapter

Where are the Things of the Internet? Precise Time of Arrival Estimation for IoT Positioning

Written By

Wen Xu, Armin Dammann and Tobias Laas

Submitted: 27 October 2017 Reviewed: 29 April 2018 Published: 05 November 2018

DOI: 10.5772/intechopen.78063

From the Edited Volume

The Fifth Generation (5G) of Wireless Communication

Edited by Ahmed Kishk

Chapter metrics overview

1,260 Chapter Downloads

View Full Metrics


The question how a 5G communication system will look like has been addressed intensely in numerous research projects and in standardization bodies. In the massively connected world of the “Internet of Things” (IoT), it is getting more and more important to be aware of where all these “things” are located. Mobile radio-based technologies envisaged for a 5G system will play an essential role in providing high-accuracy positioning of the “things.” In this work, we will first address the fundamental Cramér-Rao lower bound (CRLB) of time of arrival (TOA) estimation in an orthogonal frequency-division multiplexing (OFDM)-based system (such as 4G and 5G) using the pilots. The achievable performance is compared with the 3GPP LTE and potential future 5G requirements. The Ziv-Zakai lower bound (ZZLB) is also considered for TOA estimation, as it is tighter than the CRLB for medium to low signal-to-noise ratios (SNRs). We show how to optimize the waveform in order to reduce the TOA estimation error. Then, we describe some practical low-complexity maximum likelihood (ML) methods for TOA estimation with enhanced first-arriving path detection. Simulation results show that such adaptive ML methods can in some cases (e.g., line of sight) achieve a performance close to the CRLB. Finally, we will briefly discuss cooperation-based positioning, which will become increasingly important for massively connected IoT.


  • Cramér-Rao lower bound
  • Ziv-Zakai lower bound
  • time (difference) of arrival
  • radio-based positioning
  • cooperative positioning

1. Introduction

Mobile communication has become an integrated part of our daily lives. Today, whereas the state-of-the-art fourth generation (4G) wireless standard long-term evolution (LTE) has been in use for a decade, the fifth generation (5G) wireless standard called new radio (NR) is being specified for diverse applications in the next 10 years. In the first 5G NR release, Release 15, mainly the enhanced mobile broadband (eMBB) use cases have been considered. The ultra-reliable low latency communication (URLLC) use cases will be addressed in Release 16. Other use cases such as massive machine-type communication (mMTC) as well as the internet of things (IoT) are expected to be taken into account later. Although 5G NR standardization is still underway, a significant amount of details have already been agreed on. One important feature of 4G LTE and 5G NR is the support for accurate positioning of a user equipment (UE), i.e., the estimation of the position of the UE or the “thing” in the network, such as a car, a drone, etc. Especially in the massively connected world of IoT, it is getting more and more important to be aware of where all these things are located. Mobile radio-based technologies envisaged for a 5G system will play an essential role in providing high-accuracy positioning of the “things.”


2. Overview on mobile radio positioning techniques

The 2G, 3G, and 4G cellular communication standards have specified a variety of positioning methods. These methods infer position information from received signals and include Cell-ID, received signal strength (RSS) as well as time difference of arrival (TDOA)-based methods. All these methods have in common that they use downlink signals. Propagation delay-based methods like TDOA require signal reception from three base stations (BSs) in order to calculate a 2D UE position as shown in Figure 1. To estimate the position in 3D, at least four BSs are needed. In many environments, the probability of receiving signals from three different BSs with sufficient quality has shown to be quite low. In the example shown in Figure 1, it is not possible to get a position fix for UE3 since it receives the signal from BS3 only. For increasing adjacent BS hearability, the idle period downlink (IPDL) has been implemented in 3G UMTS [1]. LTE has addressed this problem since its Release 9 with the specification of positioning reference signals (PRSs) [2]. However, multipath and non-line-of-sight (NLOS) propagation are still present and potentially cause severe positioning performance degradations. Usually, the probability of receiving signals under line-of-sight (LOS) condition decreases with increasing distance between BS and UE [3].

Figure 1.

Today’s cellular mobile system, where UEs require signals from at least three different BSs in order to calculate their position in 2D. The UEs operate independently from each other without any cooperation.

For 4G LTE, UE positioning is defined in [4]. There are two protocols, the LTE Positioning Protocol (LPP) [5], which specifies the protocol between the UE and the so-called location server, and LTE Positioning Protocol Annex (LPPa) [6], which specifies the protocol between the BS and the location server. There are the following methods in Release 13 [4]: (1) Observed TDOA (OTDOA), (2) assisted-global navigation satellite system (A-GNSS), (3) enhanced cell-ID (E-CID), (4) barometric sensor, (5) terrestrial beacon system (TBS), (6) WLAN, and (7) Bluetooth. The first three techniques have been in the standard since Release 9, and the next four have been added in Release 13 to fulfill the new FCC wireless indoor E-911 location accuracy requirements from 2015 [7]. A-GNSS is used to provide assistance data to the GNSS receiver in the UE. E-CID is a coarse positioning method, which can use the Cell-ID, the received signal power/quality at the UE, timing information, and the angles of arrival (AOA) at the BS to estimate the position. Barometric sensor positioning uses a barometric sensor to identify the height of the UE. WLAN positioning can use the (B)SSID of WLAN access points near the UE together with the RSS indicator (RSSI) and round-trip time. Bluetooth positioning can use Bluetooth beacon identifiers near the UE together with the RSSI. TBS can use Metropolitan Beacon Systems (MBS), a network of ground-based transmitters broadcasting high-precision time signals similar to the global positioning system (GPS).

LTE Release 11 also adds support for uplink TDOA, which means that the UE sends pilots for positioning and several BSs to measure the TDOA. LTE Release 13 and, recently 14, addressed positioning for “further enhancements for enhanced machine-type communication” (feMTC) and NarrowBand IoT (NB-IoT).

We focus here on downlink OTDOA, which is a multilateration method, as shown in Figure 1. Several BSs send the PRS to one UE, which estimates the TDOA with respect to some reference BS, and feeds back the (quantized) TDOA to the location server. Each TDOA measurement restricts the location of the UE to a hyperboloid. The location server then estimates the position of the UE based on the TDOAs.

The LTE standard specifies a set of downlink pilots or reference signals (RSs) with different time-frequency patterns, such as those shown in Figure 3. Note that the BS does not transmit on the data channels in the resource blocks used for the PRS. There are six possible frequency shifts for BSs operating at the same frequency. The PRS is repeated periodically. In order to further increase precision, the PRS of certain BSs can be muted in certain repetitions to reduce interference. The PRS of other BSs can be sent on the same or in a different frequency band as the serving BS. An overview can be found in [8].

2.1. UE positioning requirements

Services and applications based on accurate knowledge of the user position, such as location-sensitive billing, fraud detection, fleet management, and intelligent transportation systems have become increasingly important. In 1996, the United States Federal Communications Commission (FCC) mandated all US wireless network operators and mobile devices to provide location information for Enhanced-911 (E-911) [9]: caller location must be provided to public-safety answering points (PSAPs) with 50 m accuracy for 67% of calls and 150 m accuracy for 95% of calls. In 2015, the FCC published the wireless indoor E-911 location accuracy requirements [7]. They include but are not limited to that within 6 years; for 80% of all wireless 911 calls, the horizontal location of the caller must be known within 50 m and the vertical location must fulfill some z-axis metric that still has to be approved by the FCC. Alternatively, the so-called dispatchable location can be provided, which is the address of the building together with a floor or apartment number. Furthermore, barometric sensor data must be made available for all UEs that support it.

The FCC requirements can be met by GNSS such as GPS in many environments. Typically, the GPS for civil applications can provide a positioning accuracy of a few meters. However in some cases, such as indoors or in urban canyons, the GPS signal may be too weak or scattered too much to provide the required accuracy. As a complement, wireless systems like GSM, UMTS, or LTE provide good coverage in such scenarios. Accordingly, requirements for TOA and TDOA measurements have been specified in 3GPP LTE Release 9 to ensure accurate UE positioning even under bad conditions (e.g., with channels quickly varying and SNRs being as low as −13 dB). Depending on use cases, 5G will have much stricter requirements; e.g., for V2X vulnerable road user discovery, accuracy as high as 10 cm may be required (see [10]).

2.2. What can 5G new radio (NR) do better for positioning?

3GPP, which is responsible for 5G standardization, has decided that OFDM will be used for 5G NR, as in 4G LTE. Specifically, the following parameters have been agreed on (see [11]):

  1. Subcarrier spacing (SCS): for 4G, the subcarrier spacing is fixed to 15 kHz, except for multicast-broadcast single-frequency network (MBSFN) services for which a subcarrier spacing of 7.5 kHz is used. In contrast, 5G will deploy multiple subcarrier spacings ranging from 15 to 480 kHz, which are all integer multiples of 15 kHz.

  2. Cyclic prefix (CP): 5G has adopted the same approach as 4G, where the CP can be either normal CP (NCP) or extended CP (ECP). The choice of the CP depends on the expected signal dispersion. In 5G, ECP is expected to be associated with the 60 kHz subcarrier spacing.

  3. Frame structure: in 4G, the transmission time interval (TTI) was specified to be 1 ms, which is the subframe duration, and a subframe consists of two slots. In 5G, a subframe can contain 1, 2, 4, 8, 16, and 32 slots. For both 4G and 5G, each slot consists of 14 OFDM symbols.

  4. Bandwidth: a single carrier of 5G is expected to support a bandwidth of up to 100 MHz for carrier frequency below 6 GHz, and up to 400 MHz for high (millimeter wave) carrier frequency. This leads to much higher accuracy for radio-based positioning.

Until now, 5G NR positioning has not yet been specified. Hence, this work will take 4G as an example. As 4G and 5G both employ OFDM and similar frame structure, the results obtained for 4G can be reasonably extrapolated to 5G; e.g., with a similar pilot signal density for TOA estimation, when 5G has five times the bandwidth of 4G, it can achieve five times as high positioning accuracy. Also, the following features envisaged in 5G are beneficial for positioning.

  • Higher frequencies and large signal bandwidths: larger signal bandwidths allow a better resolution of the wireless channel in time, and therefore, more accurate estimation of multipath components, in particular, their signal propagation delays. In addition to the conventional frequency bands from about 450 MHz to 6 GHz ([12], Section 5.5), 5G will also use millimeter wave frequency bands, e.g., at 28 or 60 GHz. At those frequencies, the attenuation of the channel is high, since the antennas need to be smaller for a similar directivity. This increases the probability of LOS reception conditions as any NLOS condition is likely to be blocked and reduces the risk of positioning errors due to the NLOS bias. Furthermore, higher frequencies together with massive multiple-input-multiple-output (MIMO) schemes allow tracking the individual terminals by beam forming with antenna arrays more accurately (see e.g., [10]).

  • Dense networks: a denser grid of BSs reduces distances between UEs and BSs. With lower BS-UE distances, the probability of LOS signal reception increases. This reduces the risk of positioning errors due to the NLOS bias.

  • Device-to-device (D2D) communications with a large number of connected devices: additional links provide additional signal observations that can be exploited to determine pseudoranges among UEs as shown in Figure 2. With D2D communication capabilities, UEs are inherently receiving signals from each other. Signal processing entities for D2D communications, in particular synchronization and channel estimation units, can be reused for signal propagation delay estimation. D2D communication provides a meshed network structure rather than the star-shaped one for today’s mobile cellular systems. Assuming a fully connected mesh as a best case, the number of D2D links grows quadratically with the number of UEs NUE. As the number of unknown positions increases linearly with NUE, D2D links provide significant redundancy in the number of observations to neglect links under disadvantageous propagation conditions like low SNR, NLOS, severe multipath, bad geometry, etc. Even unknowns like NLOS bias terms can be estimated with a sufficient number of observations. Consequently, precise positioning can be achieved by exploiting cooperation among UEs.

Figure 2.

5G envisages D2D communications, where UEs may cooperate with each other for positioning. If the mesh of D2D links is sufficiently dense, positioning works even if there are less than three BSs visible to individual UEs.


3. Cramér-Rao and Ziv-Zakai lower bound in an OFDM system

In this section, we will describe the Cramér-Rao lower bound (CRLB) and Ziv-Zakai lower bound (ZZLB) for T(D)OA estimation in an OFDM system transmitting over an additive white Gaussian noise (AWGN) channel. The CRLB follows the derivation in [13], but additionally allows a frequency shift of the subcarriers, which is needed for NB-IoT. Consider the following OFDM transmit signal (without the CP)


where Slk is the signal allocated to the kth subcarrier of the lth OFDM symbol, N is the number of subcarriers and κ shifts the subcarriers in frequency domain. Let us transform this signal into continuous time domain to estimate the continuous delay τ, the TOA. By removing the periodic replicas in frequency domain by multiplying with the rectangular function


we have the frequency-domain representation


where T is the sampling time interval. In time domain, the same signal becomes


Then, we sample this signal delayed by τ for n=0,,N1,


Now consider the system transmitting over an AWGN channel


The variance and the CRLB for any unbiased estimate τ̂ of τ from the measurement vector y=y0yN1T become ([14], Chapter 3)


as long as the regularity condition Elnpyττ=0τ is fulfilled. For the AWGN channel, the CRLB can be expressed as


when Nsymb OFDM symbols are used to estimate τ.

This expression can be simplified as


where the Kronecker delta δmk comes from the orthogonality of the subcarriers, i.e.,


In this way, we obtain the CRLB [13]


As the PRS does not carry any time stamp, there are ambiguities in the TOA estimation. Therefore, TDOA estimation is usually used. The CRLB for TDOA estimation is


where τref is the time delay to the reference BS, which, e.g., serves the UE, τ̂ref is its estimate, and we assume that τ and τref are statistically independent. We will focus on CRLBτ̂ in the following and abbreviate its standard deviation as


Note that this is the standard deviation of the TOA, which can be translated to a standard deviation of the distance d by multiplying with the speed of light in free space c0, i.e.,


where d̂ is the estimate of d.

3.1. Achievable TOA measurement accuracy using pilots in 3GPP LTE

Different pilots or RSs have been specified in LTE, e.g., the primary synchronization signal (PSS), the secondary synchronization signal (SSS), and the cell-specific RS (CRS). In general, all or parts of these pilots can also be used for TDOA estimation (see Figure 3). The graphs in Figure 4 show σCRLB, computed according to Eqs. (11) and (13), using different pilots specified in LTE and one receive antenna, with EsESlk2 being constant for the pilots specified in LTE systems, such as the PSS, SSS, CRS, and PRS. Here, a subframe of 1 ms contains 14 consecutive OFDM symbols, as in the case of the LTE normal CP. The PSS, SSS, CRS, and PRS are mapped to the corresponding resource elements [2]. Note the lowest bound (i.e., the highest measurement accuracy) is obtained by utilizing all the four pilots (PSS, SSS, CRS, and PRS) simultaneously. Among all available pilots in LTE, the PRS, as expected, achieves the highest accuracy in terms of the CRLB since it almost spans the whole bandwidth and there are also more PRS symbols available than, say, CRS symbols (see Figure 3). As it can be seen, using the PRS instead of the CRS can have a gain of about 3 dB. When CRS in addition to PRS is used, about 1 dB can be gained. As shown in the next section, an adaptive ML detector can have an estimation accuracy close to the CRLB, especially for scenarios where the first path is dominant.

Figure 3.

An example LTE signal pattern with a cell-specific reference signal (CRS) and positioning reference signal (PRS) in a single physical resource block (PRB).

Figure 4.

CRLB for TOA measurement using different pilots in one subframe.

3.2. CRLB for LTE and LTE NB-IoT

In what follows, we will focus on the PRS. LTE supports several bandwidths of the PRS, from 6 to 100 physical resource blocks (PRBs), consisting of 12 subcarriers each. The PRBs are placed symmetrically around the carrier frequency. Then, the usable bandwidth in the downlink is 1.095 to 18.015MHz, where the additional 15MHz come from the additional unused DC subcarrier. κ=0 corresponds to the conventional LTE downlink without considering the DC subcarrier. For bandwidths between 1.4 and 20 MHz [12], the (nominal) sampling rate of the system is T=16Ts to Ts, where Ts=1/30.72µs32.552ns is the LTE basic time unit. The (nominal) FFT size changes accordingly from N=128 to 2048 (c.f. Table 1).

Channel bandwidthNumber of PRBsUsable downlink bandwidthNominal FFT sizeT
NB-IoT: 200 kHz1180 MHz12816Ts
LTE: 1.4 MHz61.095 MHz12816Ts
LTE: 3 MHz152.715 MHz2568Ts
LTE: 5 MHz254.515 MHz5124Ts
LTE: 10 MHz509.015 MHz10242Ts
LTE: 15 MHz7513.515 MHz15364/3Ts
LTE: 20 MHz10018.015 MHz2048Ts
5G: 5254.5 MHz5124Ts
5G: 10529.36 MHz10242Ts
5G: 157914.22 MHz15364/3Ts
5G: 2010819.44 MHz2048Ts
5G: 2513323.94 MHz30722/3Ts
5G: 4021638.88 MHz4096Ts/2
5G: 5027040.5 MHz4096Ts/2

Table 1.

Some 4G LTE parameters [12] and 5G NR parameters for Δf=15kHz [11].

Consider the PRS for a normal CP when there are only one or two physical broadcast channel (PBCH) antenna ports ([2], Chapter 6.10). In each subframe for positioning, the PRS occupies 8 out of 14 OFDM symbols, as shown in Figure 3. In each PRB, two subcarriers are allocated for the PRS in each of the eight OFDM symbols. If we average over the six different cyclic shifts, the PRS corresponds to an equal power allocation over all usable subcarriers. Figure 5 shows the CRLB for different bandwidths of the PRS for a single subframe having the same subframe sum power allocated to the PRS


Figure 5.

CRLB of LTE (N)PRS with different bandwidths but with the same sum power for a single subframe (solid), including 5G performance estimate using the LTE PRS adjusted to the different number of physical resource blocks (dashed).

In 5G, for Δf=15kHz, the supported range of channel bandwidths is from 5 to 50 MHz (c.f. Table 1). In general, the usable downlink bandwidth is larger for the same channel bandwidth, as more physical resource blocks are used. No PRS has been standardized for 5G yet. To estimate the future accuracy of 5G, we assume the LTE PRS but extended to the different number of PRBs. As we can see in Figure 5, the accuracy of the same channel bandwidth is expected to be slightly better than in LTE since the usable downlink bandwidth increases.

Now let us consider IoT. Accurate positioning for IoT is challenging due to the small channel bandwidth for machine type communication (1.4 MHz in LTE-M) and NB-IoT systems (200 kHz in LTE NB-IoT). As σCRLB=OΔfN1, the positioning accuracy reduces considerably compared to a 10 MHz PRS with the same energy (c.f. Figures 5 and 6). Therefore, the PRS has been optimized for LTE-M, and a new narrowband PRS (NPRS) has been introduced for NB-IoT in Release 14 [15]. Those improvements decrease the so-called periodicity of the PRS or increase the length of the PRS, up to about 0.5 s. This increases the energy spent on the PRS and decreases the efficiency of the system meaning that fewer resources can be allocated to data transmission. In order to increase the effective bandwidth of the PRS, which decreases the energy and time needed for the PRS, LTE-M supports frequency hopping, but NB-IoT currently only supports artificial frequency hopping by configuring the PRS onto multiple NB-IoT carriers [15], see e.g., [16] for a study on its performance. Frequency hopping in NB-IoT can be more difficult than in LTE-M since NB-IoT can operate in individual small unused gaps in the spectrum, while LTE-M uses (parts of an) LTE channel. Similarly, in order to increase the effective bandwidth, carrier aggregation can be employed [17].

Figure 6.

CRLB of the LTE NPRS with different numbers of subframes and of the LTE PRS for a 10MHz channel.

In contrast to the conventional LTE downlink, we have κ=1/2 for NB-IoT—at least in guard band and standalone operation mode. NB-IoT occupies one PRB, i.e., the 12 subcarriers 6,,5 in the downlink [2]. The NPRS occupies at least 10 subframes consisting of 14 subsequent OFDM symbols each, which are all used for the NPRS in guard band and standalone operation mode [2]. Depending on the cell ID, the NPRS is shifted circularly in the occupied subcarriers by ν05 subcarriers. In each subframe, each subcarrier is allocated twice with the NPRS, except for subcarriers k=ν and k=ν6, which are allocated four times. The allocation pattern is similar to the one for the PRS (c.f. Figure 3). Let Psymb denote the power of each allocated symbol in a subcarrier. Then for one subframe,


holds, where the nominal FFT size for NB-IoT is N=128 (c.f. Table 1). That means simplifying the average CRLB for TOA estimation yields


As for the LTE PRS, this corresponds to an equal power allocation on all usable subcarriers, but with κ=1/2 instead of κ=0. As shown in Figure 6, the positioning accuracy of the NPRS, even with 1280 subframes, is still a bit worse than the 10MHz PRS with one subframe.

3.3. ZZLB and waveform optimization

In LTE, all PRS and NPRS symbols are sent with the same power. But when we consider the CRLB in Eq. (11), the optimum power allocation strategy is to allocate all power to positioning symbols in those subcarriers that are furthest from the center frequency. That means, compared to Eq. (17), we get for one subframe


So σCRLB improves by a factor of about 1.6. Consequently, the TOA estimation time with the NPRS can be reduced from about 0.5 to about 0.31 s, in order to achieve the same accuracy.

In practice, however, when we approximate the power allocation by a Dirac in the edge frequencies, this waveform is not optimal for all SNRs in general—especially at low SNR—since its autocorrelation has got large sidelobes, which the estimator can confuse with the main lobe [18] (see Figure 7). There are tighter bounds for the estimation error that take this into account, e.g., the ZZLB [19, 20], which is given by


for TOA estimation, where we assume the prior information that τ is uniformly distributed in 0Ta with the observation time interval Ta and where ρτ is the real-valued normalized autocorrelation function of the positioning symbols. In LTE, the UE gets the required prior information on the expected delay via the LPP [5]. Note that the optimum waveform w.r.t. ZZLB also depends on the SNR, in contrast to the CRLB. Therefore, depending on the region of the SNR of interest, the waveform that minimizes the ZZLB may be different.

Figure 7.

Comparison of the normalized autocorrelation of the Dirac-rectangular and the triangular waveform.

In [18], the optimization w.r.t. ZZLB in continuous time over a so-called triangular waveform with the parameter α01 and over a Dirac-rectangular waveform with parameter γ01 with power spectral densities


is shown, where B is the bandwidth (see Figure 8). Figure 9 shows the ZZLB, with.

Figure 8.

Power spectral density of the triangular and the Dirac-rectangular waveform (a) Triangular, (b) Dirac-rectangular.

Figure 9.

ZZLB of the Dirac-rectangular waveform and the triangular waveform for different parameters α,γ and the unrealistically large Ta60.6μs.


For a very low SNR, the σZZLBs are slightly below Ta/12, which is the standard deviation of the uniform distribution we use as a priori information for the ZZLB. The CRLB does not consider the a priori information. For a high SNR, the ZZLB converges to the CRLB. For NB-IoT, we have B11Δf=165kHz and thus Ta60.6μs for the same configuration as in [18]. There it was shown that the optimal triangular waveform is the one with α=1, but for the Dirac-rectangular waveform, the optimum value of γ depends on Psum/σ2. For small Psum/σ2, a triangular waveform is better than a Dirac-rectangular waveform, but for large Psum/σ2, it is the other way round. We observe the same behavior in Figure 9.

Sampling the Dirac-rectangular waveform with γ<1 or the triangular waveform with α=1 could be a good candidate for the power allocation of the PRS for IoT in 5G, but the positioning accuracy will not improve by the full factor of 1.6, corresponding to the CRLB optimal allocation.


4. Practical TOA estimation based on first tap detection

4.1. Maximum likelihood (ML) timing estimation

The reference signal sln, such as CRS and/or PRS, is embedded in the received signal yln. The target of the TOA estimation is to determine the position τ in the received signal yl, say, using the maximum likelihood (ML) criterion. Notice that the ML estimator has the asymptotic properties of being unbiased and achieving the CRLB [14]. Consider the other paths as interference, the ML criterion for timing estimation of the first path reduces to a correlation-based criterion. The correlation-based method can be realized in time or frequency domain. In the following, we focus on the time domain-based method [13].

The received signal yln is correlated with the replica of the transmitted signal sln, i.e.,


where W=2G is chosen as the search window size. To ease the analysis, we first assume sln has ideal autocorrelation property, and the power of the transmit signal sln is Ps. Then, with some derivations, the correlation can be written as


where Rrest represents the total residual noise and interference part resulting from correlation between sln and yln+t.

Assume the channel is unknown but remains invariant for Nsymb OFDM symbols, hlt=ht, then the noncoherent detector can be employed. The metric for the TOA detection, which is also called the correlation profile, is given here by


with γtEht2. ERt2 is used to denote the statistical average of Rt2 over multiple subframes containing RS signals. In LTE, a group of several consecutive subframes containing the RS is sometimes referred to as a positioning occasion. Usually, an LTE positioning measurement is done on one or more occasions.

4.2. Signal arrival region determination

We now determine the arrival region of the RS. For a multipath channel, the signal arrival region will have multiple taps corresponding to the taps of the channel. The signal paths are, therefore, reflected by the channel paths. A moving sum is computed as


The signal can be regarded as arrived in the time region


When tτL or tτ<0, only the noise power related term, the noise floor NfPsNsymbσ2 remains in the correlation. Nf, which is used here as σ2, can be calculated by averaging the terms outside the signal region.

For a single path channel, such as in the case of the LOS signal, the TOA can be detected, by searching for the path with the strongest signal power. For a multipath channel, in particular, when the first arriving path is not the strongest (e.g., under ETU channel), the TOA estimation becomes biased. Usually, a threshold is needed to determine the first arriving path. Especially in the case of strong noise and interference from multiple cells, the metric Λt may not provide sufficient accuracy. Consider


where SNRtPsγtτσ2 is the SNR for each correlation sample, and it holds


The following criterion then takes a fixed SNR value as a threshold to estimate the first tap


SNRth is the required SNR for detection, which can be set as, e.g., 13 dB for 3GPP Release 9 OTDOA measurement.

4.3. Adaptive-threshold-based first tap detection

As sln is not ideally autocorrelated, the noise floor Nf would contain further terms besides PsNsymbσ2. Therefore, we can express the noise floor as


where εNsymb is a parameter related to Nsymb, sln, and yln and yln is in turn dependent on the channel and the interference.

Here, we use a criterion, which jointly considers the noise power and the received signal power to determine a varying (adaptive) detection threshold. Assume the metric peak relying on the signal power and noise is


The adaptive threshold can then be defined as Λth=αΛmaxNf. Alternatively, the threshold can be defined as Λth=αβΛmax+1βNf, where α is a design parameter, β01 is a constant trading-off between the noise floor and the metric peak. α and β were determined through simulations, to have a trade-off for different channels and different SNRs.

Given the threshold, the criterion for the adaptive threshold detection can be expressed as


This criterion usually leads to better performance especially under a multipath channel, and in some cases can achieve performance close to the CRLB [13].

LTE supports bandwidths up to 20 MHz, which corresponds to a sampling rate of 30.72×106 samples/s in the baseband signal. For a bandwidth smaller than 20 MHz, the processing can be done at a smaller sampling rate to reduce the processing load; e.g., when the channel has a bandwidth of 1.4 MHz, 1/16 of the rate is sufficient. However, better accuracy can be obtained by a higher sampling rate due to the receive diversity gain.


5. Cooperation for accurate and reliable mobile radio positioning

5.1. Cooperative positioning principle

Future wireless technologies such as 5G enable UEs to cooperate with each other. By mutually observing their transmitted signals, UEs can estimate the ranges among themselves. If the mesh of mutually observed D2D links is sufficiently dense, positioning works even if there are less than three BSs visible to individual UEs as shown in Figure 2. For ranging, it is sufficient that the receiving UE knows at least parts of the signal transmitted by adjacent UEs. Pilots, such as CRS, PRS in 4G, which are multiplexed in a UE’s transmit signal stream anyway, can be used for that purpose. Another option is to transmit dedicated ranging signals, which are multiplexed into the UE’s transmit signal stream from time to time. However, there is no need to establish mutual connections between UEs.

Figure 10a and b shows examples for cooperative positioning in indoor environments. In such areas, we find a lot of “things” that will be connected. Such devices are, e.g., smartphones, laptops, WLAN, or 5G access points (APs), but also consumer electronics like smart TVs or even home appliances like fridges, dishwashers, washing machines, etc. Many of these “things” of the internet are stationary as shown in the example in Figure 10a. Still, their position might be unknown and must be determined similar to the mobile devices. The a priori knowledge that they do not move can be exploited in that context. Highly mobile things of daily use, like glasses, dog, or cat collar, may be equipped with low-cost transmitters in future. Thus, also these items, which are often lost, become traceable with cooperative positioning methods. Signals from outside the home, like BSs, GPS-equipped UEs outside, etc., might also be received under good LOS propagation conditions. These observations extend the mesh of connected devices and allow positioning in a global coordinate system. In shopping mall areas, as shown in Figure 10b, the density of mobile communication devices like smartphones is usually high. With a dense mesh of such devices, LOS propagation conditions among adjacent devices are highly probable, providing accurate ranging capabilities. The mesh reaches outdoor areas through devices near entrances or windows. Meshed devices outdoors can use GPS positioning and serve as a kind of anchor for devices’ indoors. Also, stationary indoor APs can serve as anchors. Their positions may have to be determined.

Figure 10.

Cooperative positioning indoors. The image on the right is licensed under CC BY-SA 3.0. It is built upon by Shahroozporia (own work) [CC BY-SA 3.0 (], via Wikimedia commons (a) Home area, (b) A shopping mall.

5.2. Cooperative position calculation in mobile radio networks

  • Centralized, network centric: UEs transmit their measured ranges to adjacent UEs to a network positioning entity, which calculates the positions of the UEs and provides the position estimates to the UEs. This needs a protocol for exchanging information between UEs and the positioning entity. The protocol overhead might cause latency for position estimation, which might be negligible for pedestrians.

  • Decentralized, UE based: UEs share their currently estimated state (including uncertainty) to their vicinity. A protocol, which allows broadcasting this information, is needed for that purpose. The state to be shared (broadcasted) includes position and timing estimates, i.e., the offset of the local UE time base to the global system time base. Based on this, individual UEs can estimate their own position locally. This approach allows a “listen-only” mode. A “listen-only” UE does not share its own state estimates, but is still able to calculate a position fix based on the observed signals and state estimates from its neighboring UEs.

Figure 11 shows results about the expectable cooperative positioning performance versus the UE density [21]. UEs have been uniformly distributed in a triangular area between three BSs as shown in Figure 2. The simulation parameters are summarized in Table 2. For non-cooperative positioning, the UEs’ positions are calculated individually. Thus, the positioning error does not depend on the UE density. For cooperative positioning, however, there is a significant performance gain for UE densities in the order of 1000 UEs per km2 and above. The example shown in Figure 12 provides a relation to a density of 1000 UEs per km2, which comprises four sites in a typical urban living area. Each of the living sites may contain devices as shown in Figure 10a. In shopping malls, as shown in Figure 10b, user densities are usually much higher. 5G envisages device densities of 106 per km2 or 1 UE per m2.

Figure 11.

Cooperative vs. non-cooperative positioning performance.

Carrier frequencyfc5 GHz
Base station TX powerPBS30 dBm
Base station TX signal bandwidthBBS5 MHz, uniform power spectrum density
Mobile terminal TX powerPUE20 dBm
Mobile terminal TX signal bandwidthBUE1 MHz, uniform power spectrum density
Noise power spectral densityN0N0=kBT
Boltzmann constantkB1.381×1023 J/K
Noise temperatureT300 K
Propagation model BS-UEWINNER C2 Typical Urban, additional ranging error of 150 m if link is in NLOS condition
Propagation model D2Dfree space, communication range is limited to rcom=50 m
Base station distancedBS400 m
Number of UEsNUE1,,160

Table 2.

System parameters for cooperative positioning simulations.

Figure 12.

1000 UEs per km2 means 1 UE per 1000 m2.


6. Conclusions

5G is envisaged to support a variety of use cases and therefore needs to support precise positioning in many cases. With higher carrier bandwidth, TOA and related measurements can be done precisely. Cooperative positioning will benefit from the dense network and D2D communications. All these will contribute to high-accuracy positioning. In this chapter, we overviewed positioning requirements for wireless communications and the relevant radio-based positioning techniques. Then, we discussed the CRLB and ZZLB. With a simple ML-based adaptive threshold method, the first path of the radio signal can be detected with high accuracy for many wireless channels, especially when LOS is strong. In massively connected IoT, cooperative positioning will provide a further way for precise radio-based positioning.



Part of this work has been performed in the framework of the Horizon 2020 project 5GCAR (ICT-761510) receiving funds from the European Union. The authors would like to acknowledge the contributions of their colleagues, although the views expressed in this contribution are those of the authors and do not necessarily represent the project or company.


  1. 1. 3GPP TS 25.305. UMTS—Stage 2 Functional Specification of UE Positioning in UTRAN. V14.0.0. 2017
  2. 2. 3GPP TS 36.211. E-UTRA—Physical Channels and Modulation (Rel. 14). V14.4.0. 2017
  3. 3. WINNER II Deliverable D1.1.2. WINNER II Channel Models. 2007. Available from:
  4. 4. 3GPP TS 36.305. E-UTRAN—Stage 2 Functional Specification of UE Positioning in E-UTRAN (Rel. 13). V13.0.0. 2015
  5. 5. 3GPP TS 36.355. E-UTRA—LTE Positioning Protocol (LPP) (Rel. 13). V13.3.0. 2016
  6. 6. 3GPP TS 36.455. E-UTRA—LTE Positioning Protocol A (LPPa) (Rel. 13). V13.1.0. 2016
  7. 7. FCC 15-9. Wireless E911 Location Accuracy Requirements. 2015
  8. 8. Fischer S. Observed Time Difference of Arrival (OTDOA) Positioning in 3GPP LTE. Qualcomm Technologies, Inc. 2014. Available from:
  9. 9. FCC 99-245. Third Report and Order. Federal Communications Commission (FCC). 1999
  10. 10. Wymeersch H, Seco-Granados G, Destino G, et al. 5G mmWave positioning for vehicular networks. IEEE Wireless Communications. 2017;24(6):80-86
  11. 11. 3GPP TS 38.101-1. NR; UE Radio Transmission and Reception; Part 1: Range 1 Standalone (Rel. 15). V15.0.0. 2017
  12. 12. 3GPP TS 36.101. E-UTRA—UE Radio Transmission and Reception (Rel. 14). V14.5.0. 2017
  13. 13. Xu W, Huang M, Zhu C, Dammann A. Maximum likelihood TOA and OTDOA estimation with first arriving path detection for 3GPP LTE system. Transactions on Emerging Telecommunications Technologies. 2016;27(3):339-356. DOI: 10.1002/ett.2871
  14. 14. Kay SM. Fundamentals of Statistical Signal Processing: Estimation Theory (Vol. 1 of Prentice-Hall Signal Processing Series). Upper Saddle River, New Jersey, USA: Prentice Hall PTR; 1993
  15. 15. Lin X et al. Positioning for the internet of things: A 3GPP perspective. IEEE Communications Magazine. 2017;55(12):179-185. DOI: 10.1109/MCOM.2017.1700269
  16. 16. del Peral-Rosado JA et al. Impact of frequency-hopping NB-IoT positioning in 4G and future 5G networks. In: Proceedings of the 5th IEEE ICC Workshop on Advances in Network Localization and Navigation (ANLN); 2017. DOI: 10.1109/ICCW.2017.7962759
  17. 17. Xu W et al. Techniques for determining localization of a mobile device. Patent application PCT/EP2017/070798
  18. 18. Raulefs R, Dammann A, Jost T, et al. The 5G localization waveform. In: Proceedings of the ETSI Workshop on Future Radio Technologies: Air Interfaces; 2016
  19. 19. Ziv J, Zakai M. Some lower bounds on signal parameter estimation. IEEE Transactions on Information Theory. 1969;15(3):386-391. DOI: 10.1109/TIT.1969.1054301
  20. 20. Musso C, Ovarlez JP. Improvement of the Ziv-Zakai lower bound for time delay estimation. In: Proceedings of the 15th European Signal Processing Conference (EUSIPCO); 2007
  21. 21. Dammann A, Raulefs R, Zhang S. On prospects of positioning in 5G. In: Proceedings of the 2015 IEEE International Conference on Communication Workshop (ICCW); 2015. DOI: 10.1109/ICCW.2015.7247342

Written By

Wen Xu, Armin Dammann and Tobias Laas

Submitted: 27 October 2017 Reviewed: 29 April 2018 Published: 05 November 2018