Where are the Things of the Internet? Precise Time of Arrival Estimation for IoT Positioning Where are the Things of the Internet? Precise Time of Arrival Estimation for IoT Positioning

The question how a 5G communication system will look like has been addressed intensely in numerous research projects and in standardization bodies. In the massively connected world of the “ Internet of Things ” (IoT), it is getting more and more important to be aware of where all these “ things ” are located. Mobile radio-based technologies envisaged for a 5G system will play an essential role in providing high-accuracy positioning of the “ things. ” In this work, we will first address the fundamental Cramér-Rao lower bound (CRLB) of time of arrival (TOA) estimation in an orthogonal frequency-division multiplexing (OFDM)-based system (such as 4G and 5G) using the pilots. The achievable performance is compared with the 3GPP LTE and potential future 5G requirements. The Ziv-Zakai lower bound (ZZLB) is also considered for TOA estimation, as it is tighter than the CRLB for medium to low signal- to-noise ratios (SNRs). We show how to optimize the waveform in order to reduce the TOA estimation error. Then, we describe some practical low-complexity maximum likelihood (ML) methods for TOA estimation with enhanced first-arriving path detection. Simulation results show that such adaptive ML methods can in some cases (e.g., line of sight) achieve a performance close to the CRLB. Finally, we will briefly discuss cooperation-based positioning, which will become increasingly important for massively connected IoT.


Introduction
Mobile communication has become an integrated part of our daily lives. Today, whereas the state-of-the-art fourth generation (4G) wireless standard long-term evolution (LTE) has been in use for a decade, the fifth generation (5G) wireless standard called new radio (NR) is being specified for diverse applications in the next 10 years. In the first 5G NR release, Release 15, mainly the enhanced mobile broadband (eMBB) use cases have been considered. The ultra-reliable low latency communication (URLLC) use cases will be addressed in Release 16. Other use cases such as massive machine-type communication (mMTC) as well as the internet of things (IoT) are expected to be taken into account later. Although 5G NR standardization is still underway, a significant amount of details have already been agreed on. One important feature of 4G LTE and 5G NR is the support for accurate positioning of a user equipment (UE), i.e., the estimation of the position of the UE or the "thing" in the network, such as a car, a drone, etc. Especially in the massively connected world of IoT, it is getting more and more important to be aware of where all these things are located. Mobile radio-based technologies envisaged for a 5G system will play an essential role in providing high-accuracy positioning of the "things."

Overview on mobile radio positioning techniques
The 2G, 3G, and 4G cellular communication standards have specified a variety of positioning methods. These methods infer position information from received signals and include Cell-ID, received signal strength (RSS) as well as time difference of arrival (TDOA)-based methods. All these methods have in common that they use downlink signals. Propagation delay-based methods like TDOA require signal reception from three base stations (BSs) in order to calculate a 2D UE position as shown in Figure 1. To estimate the position in 3D, at least four BSs are needed. In many environments, the probability of receiving signals from three different BSs with sufficient quality has shown to be quite low. In the example shown in Figure 1, it is not possible to get a position fix for UE 3 since it receives the signal from BS 3 only. For increasing adjacent BS hearability, the idle period downlink (IPDL) has been implemented in 3G UMTS [1]. LTE has addressed this problem since its Release 9 with the specification of positioning reference signals (PRSs) [2]. However, multipath and non-line-of-sight (NLOS) propagation are still present and potentially cause severe positioning performance degradations. Usually, the probability of receiving signals under line-of-sight (LOS) condition decreases with increasing distance between BS and UE [3].
For 4G LTE, UE positioning is defined in [4]. There are two protocols, the LTE Positioning Protocol (LPP) [5], which specifies the protocol between the UE and the so-called location server, and LTE Positioning Protocol Annex (LPPa) [6], which specifies the protocol between the BS and the location server. There are the following methods in Release 13 [4]: (1) Observed TDOA (OTDOA), (2) assisted-global navigation satellite system (A-GNSS), (3) enhanced cell-ID (E-CID), (4) barometric sensor, (5) terrestrial beacon system (TBS), (6) WLAN, and (7) Bluetooth. The first three techniques have been in the standard since Release 9, and the next four have been added in Release 13 to fulfill the new FCC wireless indoor E-911 location accuracy requirements from 2015 [7]. A-GNSS is used to provide assistance data to the GNSS receiver in the UE. E-CID is a coarse positioning method, which can use the Cell-ID, the received signal power/quality at the UE, timing information, and the angles of arrival (AOA) at the BS to estimate the position. Barometric sensor positioning uses a barometric sensor to identify the height of the UE. WLAN positioning can use the (B)SSID of WLAN access points near the UE together with the RSS indicator (RSSI) and round-trip time. Bluetooth positioning can use Bluetooth beacon identifiers near the UE together with the RSSI. TBS can use Metropolitan Beacon Systems (MBS), a network of ground-based transmitters broadcasting highprecision time signals similar to the global positioning system (GPS).
LTE Release 11 also adds support for uplink TDOA, which means that the UE sends pilots for positioning and several BSs to measure the TDOA. LTE Release 13 and, recently 14, addressed positioning for "further enhancements for enhanced machine-type communication" (feMTC) and NarrowBand IoT (NB-IoT).
We focus here on downlink OTDOA, which is a multilateration method, as shown in Figure 1. Several BSs send the PRS to one UE, which estimates the TDOA with respect to some reference BS, and feeds back the (quantized) TDOA to the location server. Each TDOA measurement restricts the location of the UE to a hyperboloid. The location server then estimates the position of the UE based on the TDOAs.
The LTE standard specifies a set of downlink pilots or reference signals (RSs) with different time-frequency patterns, such as those shown in Figure 3. Note that the BS does not transmit on the data channels in the resource blocks used for the PRS. There are six possible frequency shifts for BSs operating at the same frequency. The PRS is repeated periodically. In order to further increase precision, the PRS of certain BSs can be muted in certain repetitions to reduce interference. The PRS of other BSs can be sent on the same or in a different frequency band as the serving BS. An overview can be found in [8].

UE positioning requirements
Services and applications based on accurate knowledge of the user position, such as locationsensitive billing, fraud detection, fleet management, and intelligent transportation systems  [9]: caller location must be provided to public-safety answering points (PSAPs) with 50 m accuracy for 67% of calls and 150 m accuracy for 95% of calls. In 2015, the FCC published the wireless indoor E-911 location accuracy requirements [7]. They include but are not limited to that within 6 years; for 80% of all wireless 911 calls, the horizontal location of the caller must be known within 50 m and the vertical location must fulfill some z-axis metric that still has to be approved by the FCC. Alternatively, the so-called dispatchable location can be provided, which is the address of the building together with a floor or apartment number. Furthermore, barometric sensor data must be made available for all UEs that support it.
The FCC requirements can be met by GNSS such as GPS in many environments. Typically, the GPS for civil applications can provide a positioning accuracy of a few meters. However in some cases, such as indoors or in urban canyons, the GPS signal may be too weak or scattered too much to provide the required accuracy. As a complement, wireless systems like GSM, UMTS, or LTE provide good coverage in such scenarios. Accordingly, requirements for TOA and TDOA measurements have been specified in 3GPP LTE Release 9 to ensure accurate UE positioning even under bad conditions (e.g., with channels quickly varying and SNRs being as low as À13 dB). Depending on use cases, 5G will have much stricter requirements; e.g., for V2X vulnerable road user discovery, accuracy as high as 10 cm may be required (see [10]).

What can 5G new radio (NR) do better for positioning?
3GPP, which is responsible for 5G standardization, has decided that OFDM will be used for 5G NR, as in 4G LTE. Specifically, the following parameters have been agreed on (see [11]): 1. Subcarrier spacing (SCS): for 4G, the subcarrier spacing is fixed to 15 kHz, except for multicast-broadcast single-frequency network (MBSFN) services for which a subcarrier spacing of 7.5 kHz is used. In contrast, 5G will deploy multiple subcarrier spacings ranging from 15 to 480 kHz, which are all integer multiples of 15 kHz.

2.
Cyclic prefix (CP): 5G has adopted the same approach as 4G, where the CP can be either normal CP (NCP) or extended CP (ECP). The choice of the CP depends on the expected signal dispersion. In 5G, ECP is expected to be associated with the 60 kHz subcarrier spacing.
3. Frame structure: in 4G, the transmission time interval (TTI) was specified to be 1 ms, which is the subframe duration, and a subframe consists of two slots. In 5G, a subframe can contain 1, 2, 4, 8, 16, and 32 slots. For both 4G and 5G, each slot consists of 14 OFDM symbols.

4.
Bandwidth: a single carrier of 5G is expected to support a bandwidth of up to 100 MHz for carrier frequency below 6 GHz, and up to 400 MHz for high (millimeter wave) carrier frequency. This leads to much higher accuracy for radio-based positioning.
Until now, 5G NR positioning has not yet been specified. Hence, this work will take 4G as an example. As 4G and 5G both employ OFDM and similar frame structure, the results obtained for 4G can be reasonably extrapolated to 5G; e.g., with a similar pilot signal density for TOA estimation, when 5G has five times the bandwidth of 4G, it can achieve five times as high positioning accuracy. Also, the following features envisaged in 5G are beneficial for positioning.
• Higher frequencies and large signal bandwidths: larger signal bandwidths allow a better resolution of the wireless channel in time, and therefore, more accurate estimation of multipath components, in particular, their signal propagation delays. In addition to the conventional frequency bands from about 450 MHz to 6 GHz ( [12], Section 5.5), 5G will also use millimeter wave frequency bands, e.g., at 28 or 60 GHz. At those frequencies, the attenuation of the channel is high, since the antennas need to be smaller for a similar directivity. This increases the probability of LOS reception conditions as any NLOS condition is likely to be blocked and reduces the risk of positioning errors due to the NLOS bias. Furthermore, higher frequencies together with massive multiple-input-multiple-output (MIMO) schemes allow tracking the individual terminals by beam forming with antenna arrays more accurately (see e.g., [10]).
• Dense networks: a denser grid of BSs reduces distances between UEs and BSs. With lower BS-UE distances, the probability of LOS signal reception increases. This reduces the risk of positioning errors due to the NLOS bias.
• Device-to-device (D2D) communications with a large number of connected devices: additional links provide additional signal observations that can be exploited to determine pseudoranges among UEs as shown in Figure 2. With D2D communication capabilities, UEs are inherently receiving signals from each other. Signal processing entities for D2D communications, in particular synchronization and channel estimation units, can be reused for signal propagation delay estimation. D2D communication provides a meshed  network structure rather than the star-shaped one for today's mobile cellular systems. Assuming a fully connected mesh as a best case, the number of D2D links grows quadratically with the number of UEs N UE . As the number of unknown positions increases linearly with N UE , D2D links provide significant redundancy in the number of observations to neglect links under disadvantageous propagation conditions like low SNR, NLOS, severe multipath, bad geometry, etc. Even unknowns like NLOS bias terms can be estimated with a sufficient number of observations. Consequently, precise positioning can be achieved by exploiting cooperation among UEs.

Cramér-Rao and Ziv-Zakai lower bound in an OFDM system
In this section, we will describe the Cramér-Rao lower bound (CRLB) and Ziv-Zakai lower bound (ZZLB) for T(D)OA estimation in an OFDM system transmitting over an additive white Gaussian noise (AWGN) channel. The CRLB follows the derivation in [13], but additionally allows a frequency shift of the subcarriers, which is needed for NB-IoT. Consider the following OFDM transmit signal (without the CP) where S l k ½ is the signal allocated to the kth subcarrier of the lth OFDM symbol, N is the number of subcarriers and κ shifts the subcarriers in frequency domain. Let us transform this signal into continuous time domain to estimate the continuous delay τ, the TOA. By removing the periodic replicas in frequency domain by multiplying with the rectangular function we have the frequency-domain representation where T is the sampling time interval. In time domain, the same signal becomes Then, we sample this signal delayed by τ for n ¼ 0, …, N À 1, The Fifth Generation (5G) of Wireless Communication Now consider the system transmitting over an AWGN channel The variance and the CRLB for any unbiased estimate b τ of τ from the measurement vector as long as the regularity condition E ∂ln p yjτ For the AWGN channel, the CRLB can be expressed as when N symb OFDM symbols are used to estimate τ.
This expression can be simplified as where the Kronecker delta δ mk comes from the orthogonality of the subcarriers, i.e., In this way, we obtain the CRLB [13] Var As the PRS does not carry any time stamp, there are ambiguities in the TOA estimation. Therefore, TDOA estimation is usually used. The CRLB for TDOA estimation is where τ ref is the time delay to the reference BS, which, e.g., serves the UE, b τ ref is its estimate, and we assume that τ and τ ref are statistically independent. We will focus on CRLB b τ ð Þ in the following and abbreviate its standard deviation as Note that this is the standard deviation of the TOA, which can be translated to a standard deviation of the distance d by multiplying with the speed of light in free space c 0 , i.e., where b d is the estimate of d.

Achievable TOA measurement accuracy using pilots in 3GPP LTE
Different pilots or RSs have been specified in LTE, e.g., the primary synchronization signal (PSS), the secondary synchronization signal (SSS), and the cell-specific RS (CRS). In general, all or parts of these pilots can also be used for TDOA estimation (see Figure 3). The graphs in Figure 4 show σ CRLB , computed according to Eqs. (11) and (13) [2]. Note the lowest bound (i.e., the highest measurement accuracy) is obtained by utilizing all the four pilots (PSS, SSS, CRS, and PRS) simultaneously. Among all available pilots in LTE, the PRS, as expected, achieves the highest accuracy in terms of the CRLB since it almost spans the whole bandwidth and there are also more PRS symbols available than, say, CRS symbols (see Figure 3). As it can be seen, using the PRS instead of the CRS can have a gain of about 3 dB. When CRS in addition to PRS is used, about 1 dB can be gained. As shown in the next section, an adaptive ML detector can have an estimation accuracy close to the CRLB, especially for scenarios where the first path is dominant.

CRLB for LTE and LTE NB-IoT
In what follows, we will focus on the PRS. LTE supports several bandwidths of the PRS, from 6 to 100 physical resource blocks (PRBs), consisting of 12 subcarriers each.  Figure 3. In each PRB, two subcarriers are allocated for the PRS in each of the eight OFDM symbols. If we average over the six different cyclic shifts, the PRS corresponds to an equal power allocation over all usable subcarriers. Figure 5 shows the CRLB for different bandwidths of the PRS for a single subframe having the same subframe sum power allocated to the PRS In 5G, for Δf ¼ 15 kHz, the supported range of channel bandwidths is from 5 to 50 MHz (c.f. Table 1). In general, the usable downlink bandwidth is larger for the same channel bandwidth,  as more physical resource blocks are used. No PRS has been standardized for 5G yet. To estimate the future accuracy of 5G, we assume the LTE PRS but extended to the different number of PRBs. As we can see in Figure 5, the accuracy of the same channel bandwidth is expected to be slightly better than in LTE since the usable downlink bandwidth increases.    Figures 5 and 6). Therefore, the PRS has been optimized for LTE-M, and a new narrowband PRS (NPRS) has been introduced for NB-IoT in Release 14 [15]. Those improvements decrease the so-called periodicity of the PRS or increase the length of the PRS, up to about 0.5 s. This increases the energy spent on the PRS and decreases the efficiency of the system meaning that fewer resources can be allocated to data transmission. In order to increase the effective bandwidth of the PRS, which decreases the energy and time needed for the PRS, LTE-M supports frequency hopping, but NB-IoT currently only supports artificial frequency hopping by configuring the PRS onto multiple NB-IoT carriers [15], see e.g., [16] for a study on its performance. Frequency hopping in NB-IoT can be more difficult than in LTE-M since NB-IoT can operate in individual small unused gaps in the spectrum, while LTE-M uses (parts of an) LTE channel. Similarly, in order to increase the effective bandwidth, carrier aggregation can be employed [17].
In contrast to the conventional LTE downlink, we have κ ¼ 1=2 for NB-IoT-at least in guard band and standalone operation mode. NB-IoT occupies one PRB, i.e., the 12 subcarriers À6, …, 5 in the downlink [2]. The NPRS occupies at least 10 subframes consisting of 14 subsequent OFDM symbols each, which are all used for the NPRS in guard band and standalone operation mode [2]. Depending on the cell ID, the NPRS is shifted circularly in the occupied subcarriers by ν ∈ 0; …; 5 f gsubcarriers. In each subframe, each subcarrier is allocated twice with the NPRS, except for subcarriers k ¼ ν and k ¼ ν À 6, which are allocated four times. The allocation pattern is similar to the one for the PRS (c.f. Figure 3). Let P symb denote the power of each allocated symbol in a subcarrier. Then for one subframe,   (16) holds, where the nominal FFT size for NB-IoT is N ¼ 128 (c.f. Table 1). That means simplifying the average CRLB for TOA estimation yields As for the LTE PRS, this corresponds to an equal power allocation on all usable subcarriers, but with κ ¼ 1=2 instead of κ ¼ 0. As shown in Figure 6, the positioning accuracy of the NPRS, even with 1280 subframes, is still a bit worse than the 10 MHz PRS with one subframe.

ZZLB and waveform optimization
In LTE, all PRS and NPRS symbols are sent with the same power. But when we consider the CRLB in Eq. (11), the optimum power allocation strategy is to allocate all power to positioning symbols in those subcarriers that are furthest from the center frequency. That means, compared to Eq. (17), we get for one subframe So σ CRLB improves by a factor of about 1:6. Consequently, the TOA estimation time with the NPRS can be reduced from about 0.5 to about 0.31 s, in order to achieve the same accuracy.
In practice, however, when we approximate the power allocation by a Dirac in the edge frequencies, this waveform is not optimal for all SNRs in general-especially at low SNRsince its autocorrelation has got large sidelobes, which the estimator can confuse with the main lobe [18] (see Figure 7). There are tighter bounds for the estimation error that take this into account, e.g., the ZZLB [19,20], which is given by for TOA estimation, where we assume the prior information that τ is uniformly distributed in 0; T a ½ with the observation time interval T a and where r τ ð Þ is the real-valued normalized autocorrelation function of the positioning symbols. In LTE, the UE gets the required prior information on the expected delay via the LPP [5]. Note that the optimum waveform w.r.t. ZZLB also depends on the SNR, in contrast to the CRLB. Therefore, depending on the region of the SNR of interest, the waveform that minimizes the ZZLB may be different.
In [18], the optimization w.r.t. ZZLB in continuous time over a so-called triangular waveform with the parameter α ∈ 0; 1 ½ and over a Dirac-rectangular waveform with parameter γ ∈ 0; 1 ½ with power spectral densities is shown, where B is the bandwidth (see Figure 8). Figure 9 shows the ZZLB, with.
For a very low SNR, the σ ZZLB s are slightly below T a = ffiffiffiffiffi 12 p , which is the standard deviation of the uniform distribution we use as a priori information for the ZZLB. The CRLB does not consider the a priori information. For a high SNR, the ZZLB converges to the CRLB. For NB-IoT, we have B ≈ 11Δ f ¼ 165 kHz and thus T a ≈ 60:6 μs for the same configuration as in [18]. There it was shown that the optimal triangular waveform is the one with α ¼ 1, but for the Dirac-rectangular waveform, the optimum value of γ depends on P sum =σ 2 . For small P sum =σ 2 , a Where are the Things of the Internet? Precise Time of Arrival Estimation for IoT Positioning http://dx.doi.org/10.5772/intechopen.78063 triangular waveform is better than a Dirac-rectangular waveform, but for large P sum =σ 2 , it is the other way round. We observe the same behavior in Figure 9.
Sampling the Dirac-rectangular waveform with γ < 1 or the triangular waveform with α ¼ 1 could be a good candidate for the power allocation of the PRS for IoT in 5G, but the positioning accuracy will not improve by the full factor of 1.6, corresponding to the CRLB optimal allocation.

Maximum likelihood (ML) timing estimation
The reference signal s l n ð Þ, such as CRS and/or PRS, is embedded in the received signal y l n ð Þ. The target of the TOA estimation is to determine the position τ in the received signal y l , say, using the maximum likelihood (ML) criterion. Notice that the ML estimator has the asymptotic properties of being unbiased and achieving the CRLB [14]. Consider the other paths as interference, the ML criterion for timing estimation of the first path reduces to a correlation-based criterion. The correlation-based method can be realized in time or frequency domain. In the following, we focus on the time domain-based method [13].
The received signal y l n ð Þ is correlated with the replica of the transmitted signal s l n ð Þ, i.e., where W ¼ 2G is chosen as the search window size. To ease the analysis, we first assume s l n ð Þ has ideal autocorrelation property, and the power of the transmit signal s l n ð Þ is P s . Then, with some derivations, the correlation can be written as where R res t ð Þ represents the total residual noise and interference part resulting from correlation between s l n ð Þ and y l n þ t ð Þ.
Assume the channel is unknown but remains invariant for N symb OFDM symbols, then the noncoherent detector can be employed. The metric for the TOA detection, which is also called the correlation profile, is given here by n o is used to denote the statistical average of R t ð Þ j j 2 over multiple subframes containing RS signals. In LTE, a group of several consecutive subframes containing the RS is sometimes referred to as a positioning occasion. Usually, an LTE positioning measurement is done on one or more occasions.

Signal arrival region determination
We now determine the arrival region of the RS. For a multipath channel, the signal arrival region will have multiple taps corresponding to the taps of the channel. The signal paths are, therefore, reflected by the channel paths. A moving sum is computed as The signal can be regarded as arrived in the time region When t À τ ⩾ L or t À τ < 0, only the noise power related term, the noise floor N f ≔ P s N symb σ 2 remains in the correlation. N f , which is used here as σ 2 , can be calculated by averaging the terms outside the signal region.
For a single path channel, such as in the case of the LOS signal, the TOA can be detected, by searching for the path with the strongest signal power. For a multipath channel, in particular, when the first arriving path is not the strongest (e.g., under ETU channel), the TOA estimation becomes biased. Usually, a threshold is needed to determine the first arriving path. Especially in the case of strong noise and interference from multiple cells, the metric Λ t ð Þ may not provide sufficient accuracy. Consider where SNR t ð Þ ≔ Psγ tÀτ ð Þ σ 2 is the SNR for each correlation sample, and it holds The following criterion then takes a fixed SNR value as a threshold to estimate the first tap SNR th is the required SNR for detection, which can be set as, e.g., À13 dB for 3GPP Release 9 OTDOA measurement.

Adaptive-threshold-based first tap detection
As s l n ð Þ is not ideally autocorrelated, the noise floor N f would contain further terms besides P s N symb σ 2 . Therefore, we can express the noise floor as where ε N symb À Á is a parameter related to N symb , s l n ð Þ, and y l n ð Þ and y l n ð Þ is in turn dependent on the channel and the interference.
Here, we use a criterion, which jointly considers the noise power and the received signal power to determine a varying (adaptive) detection threshold. Assume the metric peak relying on the signal power and noise is The adaptive threshold can then be defined as where α is a design parameter, β ∈ 0; 1 ½ is a constant trading-off between the noise floor and the metric peak. α and β were determined through simulations, to have a trade-off for different channels and different SNRs.
Given the threshold, the criterion for the adaptive threshold detection can be expressed as This criterion usually leads to better performance especially under a multipath channel, and in some cases can achieve performance close to the CRLB [13].
LTE supports bandwidths up to 20 MHz, which corresponds to a sampling rate of 30:72 Â 10 6 samples/s in the baseband signal. For a bandwidth smaller than 20 MHz, the processing can be done at a smaller sampling rate to reduce the processing load; e.g., when the channel has a bandwidth of 1:4 MHz, 1=16 of the rate is sufficient. However, better accuracy can be obtained by a higher sampling rate due to the receive diversity gain.  In such areas, we find a lot of "things" that will be connected. Such devices are, e.g., smartphones, laptops, WLAN, or 5G access points (APs), but also consumer electronics like smart TVs or even home appliances like fridges, dishwashers, washing machines, etc. Many of these "things" of the internet are stationary as shown in the example in Figure 10a. Still, their position might be unknown and must be determined similar to the mobile devices. The a priori knowledge that they do not move can be exploited in that context. Highly mobile things of daily use, like glasses, dog, or cat collar, may be equipped with low-cost transmitters in future. Thus, also these items, which are often lost, become traceable with cooperative positioning methods. Signals from outside the home, like BSs, GPS-equipped UEs outside, etc., might also be received under good LOS propagation conditions. These observations extend the mesh of connected devices and allow positioning in a global coordinate system. In shopping mall areas, as shown in Figure 10b, the density of mobile communication devices like smartphones is usually high. With a dense mesh of such devices, LOS propagation conditions among adjacent devices are highly probable, providing accurate ranging capabilities. The mesh reaches outdoor areas through devices near entrances or windows. Meshed devices outdoors can use GPS positioning and serve as a kind of anchor for devices' indoors. Also, stationary indoor APs can serve as anchors. Their positions may have to be determined.

Cooperative position calculation in mobile radio networks
• Centralized, network centric: UEs transmit their measured ranges to adjacent UEs to a network positioning entity, which calculates the positions of the UEs and provides the position estimates to the UEs. This needs a protocol for exchanging information between UEs and the positioning entity. The protocol overhead might cause latency for position estimation, which might be negligible for pedestrians. State-of-the-art mobile radio positioning (TDOA) Figure 11. Cooperative vs. non-cooperative positioning performance.
• Decentralized, UE based: UEs share their currently estimated state (including uncertainty) to their vicinity. A protocol, which allows broadcasting this information, is needed for that purpose. The state to be shared (broadcasted) includes position and timing estimates, i.e., the offset of the local UE time base to the global system time base. Based on this, individual UEs can estimate their own position locally. This approach allows a "listen-only" mode. A "listen-only" UE does not share its own state estimates, but is still able to calculate a position fix based on the observed signals and state estimates from its neighboring UEs. Figure 11 shows results about the expectable cooperative positioning performance versus the UE density [21]. UEs have been uniformly distributed in a triangular area between three BSs as shown in Figure 2. The simulation parameters are summarized in Table 2. For noncooperative positioning, the UEs' positions are calculated individually. Thus, the positioning error does not depend on the UE density. For cooperative positioning, however, there is a significant performance gain for UE densities in the order of 1000 UEs per km 2 and above. The example shown in Figure 12 provides a relation to a density of 1000 UEs per km 2 , which comprises four sites in a typical urban living area. Each of the living sites may contain devices  as shown in Figure 10a. In shopping malls, as shown in Figure 10b, user densities are usually much higher. 5G envisages device densities of 10 6 per km 2 or 1 UE per m 2 .

Conclusions
5G is envisaged to support a variety of use cases and therefore needs to support precise positioning in many cases. With higher carrier bandwidth, TOA and related measurements can be done precisely. Cooperative positioning will benefit from the dense network and D2D communications. All these will contribute to high-accuracy positioning. In this chapter, we overviewed positioning requirements for wireless communications and the relevant radiobased positioning techniques. Then, we discussed the CRLB and ZZLB. With a simple MLbased adaptive threshold method, the first path of the radio signal can be detected with high accuracy for many wireless channels, especially when LOS is strong. In massively connected IoT, cooperative positioning will provide a further way for precise radio-based positioning.