We are IntechOpen, the world's leading publisher of Open Access books Built by scientists, for scientists

Open access books available 5,300

130,000 155M

International authors and editors

Downloads

Our authors are among the

most cited scientists 154 TOP 1%

Selection of our books indexed in the Book Citation Index in Web of Science™ Core Collection (BKCI)

# Interested in publishing with us? Contact book.department@intechopen.com

Numbers displayed above are based on latest data collected. For more information visit www.intechopen.com

## **Where are the Things of the Internet? Precise Time of Arrival Estimation for IoT Positioning**

Wen Xu, Armin Dammann and Tobias Laas

Additional information is available at the end of the chapter

http://dx.doi.org/10.5772/intechopen.78063

#### Abstract

The question how a 5G communication system will look like has been addressed intensely in numerous research projects and in standardization bodies. In the massively connected world of the "Internet of Things" (IoT), it is getting more and more important to be aware of where all these "things" are located. Mobile radio-based technologies envisaged for a 5G system will play an essential role in providing high-accuracy positioning of the "things." In this work, we will first address the fundamental Cramér-Rao lower bound (CRLB) of time of arrival (TOA) estimation in an orthogonal frequency-division multiplexing (OFDM)-based system (such as 4G and 5G) using the pilots. The achievable performance is compared with the 3GPP LTE and potential future 5G requirements. The Ziv-Zakai lower bound (ZZLB) is also considered for TOA estimation, as it is tighter than the CRLB for medium to low signalto-noise ratios (SNRs). We show how to optimize the waveform in order to reduce the TOA estimation error. Then, we describe some practical low-complexity maximum likelihood (ML) methods for TOA estimation with enhanced first-arriving path detection. Simulation results show that such adaptive ML methods can in some cases (e.g., line of sight) achieve a performance close to the CRLB. Finally, we will briefly discuss cooperation-based positioning, which will become increasingly important for massively connected IoT.

Keywords: Cramér-Rao lower bound, Ziv-Zakai lower bound, time (difference) of arrival, radio-based positioning, cooperative positioning

## 1. Introduction

Mobile communication has become an integrated part of our daily lives. Today, whereas the state-of-the-art fourth generation (4G) wireless standard long-term evolution (LTE) has been in use for a decade, the fifth generation (5G) wireless standard called new radio (NR) is being specified for diverse applications in the next 10 years. In the first 5G NR release, Release 15,

© 2018 The Author(s). Licensee IntechOpen. This chapter is distributed under the terms of the Creative Commons Attribution License (http://creativecommons.org/licenses/by/3.0), which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

mainly the enhanced mobile broadband (eMBB) use cases have been considered. The ultra-reliable low latency communication (URLLC) use cases will be addressed in Release 16. Other use cases such as massive machine-type communication (mMTC) as well as the internet of things (IoT) are expected to be taken into account later. Although 5G NR standardization is still underway, a significant amount of details have already been agreed on. One important feature of 4G LTE and 5G NR is the support for accurate positioning of a user equipment (UE), i.e., the estimation of the position of the UE or the "thing" in the network, such as a car, a drone, etc. Especially in the massively connected world of IoT, it is getting more and more important to be aware of where all these things are located. Mobile radio-based technologies envisaged for a 5G system will play an essential role in providing high-accuracy positioning of the "things."

### 2. Overview on mobile radio positioning techniques

The 2G, 3G, and 4G cellular communication standards have specified a variety of positioning methods. These methods infer position information from received signals and include Cell-ID, received signal strength (RSS) as well as time difference of arrival (TDOA)-based methods. All these methods have in common that they use downlink signals. Propagation delay-based methods like TDOA require signal reception from three base stations (BSs) in order to calculate a 2D UE position as shown in Figure 1. To estimate the position in 3D, at least four BSs are needed. In many environments, the probability of receiving signals from three different BSs with sufficient quality has shown to be quite low. In the example shown in Figure 1, it is not possible to get a position fix for UE<sup>3</sup> since it receives the signal from BS<sup>3</sup> only. For increasing adjacent BS hearability, the idle period downlink (IPDL) has been implemented in 3G UMTS [1]. LTE has

Figure 1. Today's cellular mobile system, where UEs require signals from at least three different BSs in order to calculate their position in 2D. The UEs operate independently from each other without any cooperation.

addressed this problem since its Release 9 with the specification of positioning reference signals (PRSs) [2]. However, multipath and non-line-of-sight (NLOS) propagation are still present and potentially cause severe positioning performance degradations. Usually, the probability of receiving signals under line-of-sight (LOS) condition decreases with increasing distance between BS and UE [3].

For 4G LTE, UE positioning is defined in [4]. There are two protocols, the LTE Positioning Protocol (LPP) [5], which specifies the protocol between the UE and the so-called location server, and LTE Positioning Protocol Annex (LPPa) [6], which specifies the protocol between the BS and the location server. There are the following methods in Release 13 [4]: (1) Observed TDOA (OTDOA), (2) assisted-global navigation satellite system (A-GNSS), (3) enhanced cell-ID (E-CID), (4) barometric sensor, (5) terrestrial beacon system (TBS), (6) WLAN, and (7) Bluetooth. The first three techniques have been in the standard since Release 9, and the next four have been added in Release 13 to fulfill the new FCC wireless indoor E-911 location accuracy requirements from 2015 [7]. A-GNSS is used to provide assistance data to the GNSS receiver in the UE. E-CID is a coarse positioning method, which can use the Cell-ID, the received signal power/quality at the UE, timing information, and the angles of arrival (AOA) at the BS to estimate the position. Barometric sensor positioning uses a barometric sensor to identify the height of the UE. WLAN positioning can use the (B)SSID of WLAN access points near the UE together with the RSS indicator (RSSI) and round-trip time. Bluetooth positioning can use Bluetooth beacon identifiers near the UE together with the RSSI. TBS can use Metropolitan Beacon Systems (MBS), a network of ground-based transmitters broadcasting highprecision time signals similar to the global positioning system (GPS).

LTE Release 11 also adds support for uplink TDOA, which means that the UE sends pilots for positioning and several BSs to measure the TDOA. LTE Release 13 and, recently 14, addressed positioning for "further enhancements for enhanced machine-type communication" (feMTC) and NarrowBand IoT (NB-IoT).

We focus here on downlink OTDOA, which is a multilateration method, as shown in Figure 1. Several BSs send the PRS to one UE, which estimates the TDOA with respect to some reference BS, and feeds back the (quantized) TDOA to the location server. Each TDOA measurement restricts the location of the UE to a hyperboloid. The location server then estimates the position of the UE based on the TDOAs.

The LTE standard specifies a set of downlink pilots or reference signals (RSs) with different time-frequency patterns, such as those shown in Figure 3. Note that the BS does not transmit on the data channels in the resource blocks used for the PRS. There are six possible frequency shifts for BSs operating at the same frequency. The PRS is repeated periodically. In order to further increase precision, the PRS of certain BSs can be muted in certain repetitions to reduce interference. The PRS of other BSs can be sent on the same or in a different frequency band as the serving BS. An overview can be found in [8].

#### 2.1. UE positioning requirements

Services and applications based on accurate knowledge of the user position, such as locationsensitive billing, fraud detection, fleet management, and intelligent transportation systems have become increasingly important. In 1996, the United States Federal Communications Commission (FCC) mandated all US wireless network operators and mobile devices to provide location information for Enhanced-911 (E-911) [9]: caller location must be provided to public-safety answering points (PSAPs) with 50 m accuracy for 67% of calls and 150 m accuracy for 95% of calls. In 2015, the FCC published the wireless indoor E-911 location accuracy requirements [7]. They include but are not limited to that within 6 years; for 80% of all wireless 911 calls, the horizontal location of the caller must be known within 50 m and the vertical location must fulfill some z-axis metric that still has to be approved by the FCC. Alternatively, the so-called dispatchable location can be provided, which is the address of the building together with a floor or apartment number. Furthermore, barometric sensor data must be made available for all UEs that support it.

The FCC requirements can be met by GNSS such as GPS in many environments. Typically, the GPS for civil applications can provide a positioning accuracy of a few meters. However in some cases, such as indoors or in urban canyons, the GPS signal may be too weak or scattered too much to provide the required accuracy. As a complement, wireless systems like GSM, UMTS, or LTE provide good coverage in such scenarios. Accordingly, requirements for TOA and TDOA measurements have been specified in 3GPP LTE Release 9 to ensure accurate UE positioning even under bad conditions (e.g., with channels quickly varying and SNRs being as low as 13 dB). Depending on use cases, 5G will have much stricter requirements; e.g., for V2X vulnerable road user discovery, accuracy as high as 10 cm may be required (see [10]).

#### 2.2. What can 5G new radio (NR) do better for positioning?

3GPP, which is responsible for 5G standardization, has decided that OFDM will be used for 5G NR, as in 4G LTE. Specifically, the following parameters have been agreed on (see [11]):


Until now, 5G NR positioning has not yet been specified. Hence, this work will take 4G as an example. As 4G and 5G both employ OFDM and similar frame structure, the results obtained for 4G can be reasonably extrapolated to 5G; e.g., with a similar pilot signal density for TOA estimation, when 5G has five times the bandwidth of 4G, it can achieve five times as high positioning accuracy. Also, the following features envisaged in 5G are beneficial for positioning.


Figure 2. 5G envisages D2D communications, where UEs may cooperate with each other for positioning. If the mesh of D2D links is sufficiently dense, positioning works even if there are less than three BSs visible to individual UEs.

network structure rather than the star-shaped one for today's mobile cellular systems. Assuming a fully connected mesh as a best case, the number of D2D links grows quadratically with the number of UEs NUE. As the number of unknown positions increases linearly with NUE, D2D links provide significant redundancy in the number of observations to neglect links under disadvantageous propagation conditions like low SNR, NLOS, severe multipath, bad geometry, etc. Even unknowns like NLOS bias terms can be estimated with a sufficient number of observations. Consequently, precise positioning can be achieved by exploiting cooperation among UEs.

## 3. Cramér-Rao and Ziv-Zakai lower bound in an OFDM system

In this section, we will describe the Cramér-Rao lower bound (CRLB) and Ziv-Zakai lower bound (ZZLB) for T(D)OA estimation in an OFDM system transmitting over an additive white Gaussian noise (AWGN) channel. The CRLB follows the derivation in [13], but additionally allows a frequency shift of the subcarriers, which is needed for NB-IoT. Consider the following OFDM transmit signal (without the CP)

$$s\_l[n] = \frac{1}{\sqrt{N}} \sum\_{k=-N/2}^{N/2-1} S\_l[k] \exp\left(j\frac{2\pi}{N}(k+\kappa)n\right), \quad 0 \le \kappa < 1,\tag{1}$$

where S<sup>l</sup> ½ k is the signal allocated to the kth subcarrier of the lth OFDM symbol, N is the number of subcarriers and κ shifts the subcarriers in frequency domain. Let us transform this signal into continuous time domain to estimate the continuous delay τ, the TOA. By removing the periodic replicas in frequency domain by multiplying with the rectangular function

$$\text{rect}(\omega) = \begin{cases} 1 & \text{for } \frac{-\pi}{T} \le \omega < \frac{\pi}{T'} \\ 0 & \text{else,} \end{cases} \tag{2}$$

we have the frequency-domain representation

<sup>S</sup>lð Þ¼ <sup>ω</sup> ffiffiffiffiffiffi 2π N r <sup>N</sup> X =21 k¼N=2 Sl ½ <sup>k</sup> δ ω ð Þ <sup>k</sup> <sup>þ</sup> <sup>κ</sup> 2π NT , (3)

where T is the sampling time interval. In time domain, the same signal becomes

$$s\_l(t) = \frac{1}{\sqrt{N}} \sum\_{k=-N/2}^{N/2-1} S\_l[k] \exp\left(j2\pi(k+\kappa)\frac{t}{NT}\right). \tag{4}$$

Then, we sample this signal delayed by <sup>τ</sup> for <sup>n</sup> <sup>¼</sup> <sup>0</sup>, …, N 1,

$$s\_{\mathbb{R},1}[n] \coloneqq \mathfrak{s}(nT - \tau) = \frac{1}{\sqrt{N}} \sum\_{k=-N/2}^{N/2-1} \mathcal{S}\_{l}[k] \exp\left(j2\pi(k+\kappa)\Delta f(nT-\tau)\right), \quad \Delta f = \frac{1}{NT}.\tag{5}$$

Now consider the system transmitting over an AWGN channel

$$y\_l[n] = s\_{\mathbb{R},l}[n] + z\_l[n], \quad z\_l[n] \sim \mathcal{CN}\left(0, \sigma^2\right). \tag{6}$$

The variance and the CRLB for any unbiased estimate <sup>b</sup><sup>τ</sup> of <sup>τ</sup> from the measurement vector <sup>y</sup> <sup>¼</sup> ½ <sup>y</sup>½ <sup>0</sup> ;…; y N½ <sup>1</sup> T become ([14], Chapter 3)

Varð Þ <sup>b</sup>τð Þ <sup>y</sup> <sup>≥</sup> CRLBð Þ¼ <sup>b</sup><sup>τ</sup> 1 E ∂ ∂τ ln <sup>p</sup>ð Þ <sup>y</sup>j<sup>τ</sup> <sup>2</sup> h i (7)

as long as the regularity condition E <sup>∂</sup>ln <sup>p</sup>ð Þ <sup>y</sup>j<sup>τ</sup> ∂τ h i <sup>¼</sup> <sup>0</sup> <sup>∀</sup><sup>τ</sup> is fulfilled. For the AWGN channel, the CRLB can be expressed as

$$\text{CRLB}(\widehat{\tau}) = \frac{\sigma^2}{2 \sum\_{l=0}^{N\_{\text{symb}}-1} \sum\_{n=0}^{N-1} \left| \frac{\partial}{\partial \widehat{\tau}} \text{s}\_{\text{R},1}[n] \right|^2}. \tag{8}$$

when Nsymb OFDM symbols are used to estimate τ.

This expression can be simplified as

$$\sum\_{n=0}^{N-1} \left| \frac{\partial}{\partial \tau} s\_{\mathbb{R}, 1}[n] \right|^2 = \sum\_{n=0}^{N-1} \left| \frac{\partial}{\partial \tau} \frac{1}{\sqrt{N}} \sum\_{k=-N/2}^{N/2-1} S\_l[k] \exp \left( j2\pi (k+\kappa) \Delta f(nT-\tau) \right) \right|^2$$

$$= \frac{4\pi^2 (\Delta f)^2}{N} \sum\_{m=-N/2k=-N/2}^{N/2-1} \sum\_{n=-N/2}^{N/2-1} (m+\kappa)(k+\kappa) S\_l^\circ[m] \text{S}\_l[k] \exp \left( j\frac{2\pi}{N} (k-m)n \right) \text{N} \delta\_{m\lambda} \tag{9}$$

where the Kronecker delta δmk comes from the orthogonality of the subcarriers, i.e.,

$$\begin{bmatrix} \overbrace{\phantom{\smile}}^{\boxed{\dots}} \end{bmatrix}^{\boxed{\dots}} \begin{bmatrix} \overbrace{\phantom{\smile}}^{\boxed{\dots}} \end{bmatrix} \begin{pmatrix} \overbrace{\phantom{\smile}}^{\boxed{\dots}} \exp(j2\pi\Delta f(m-k)nT) = N\delta\_{mk} \underbrace{\left(\overbrace{\phantom{\smile}}^{\boxed{\dots}}\right)\left(\overbrace{\phantom{\smile}}^{\boxed{\dots}}\right)}^{\boxed{\dots}} \begin{pmatrix} \overbrace{\phantom{\smile}}^{\boxed{\dots}} \end{pmatrix} \tag{10}$$

In this way, we obtain the CRLB [13]

$$\text{Var}\{\hat{\tau}\} \ge \text{CRLB}(\hat{\tau}) = \frac{\sigma^2}{8\pi^2 \left(\Delta f\right)^2 \sum\_{l=0}^{N\_{\text{symb}}-1} \sum\_{k=-N/2}^{N/2-1} (k+\kappa)^2 S\_l[k]^2}. \tag{11}$$

As the PRS does not carry any time stamp, there are ambiguities in the TOA estimation. Therefore, TDOA estimation is usually used. The CRLB for TDOA estimation is

$$\text{CRLB}\_{\text{TD}} = \text{CRLB}(\hat{\tau}\_{\text{ref}}) + \text{CRLB}(\hat{\tau}) \tag{12}$$

where <sup>τ</sup>ref is the time delay to the reference BS, which, e.g., serves the UE, <sup>b</sup>τref is its estimate, and we assume that <sup>τ</sup> and <sup>τ</sup>ref are statistically independent. We will focus on CRLBð Þ <sup>b</sup><sup>τ</sup> in the following and abbreviate its standard deviation as

$$
\sigma\_{\rm CRLB} = \sqrt{\text{CRLB}(\widehat{\tau})}.\tag{13}
$$

Note that this is the standard deviation of the TOA, which can be translated to a standard deviation of the distance d by multiplying with the speed of light in free space c0, i.e.,

CRLB bd <sup>¼</sup> <sup>c</sup>0CRLBð Þ <sup>b</sup><sup>τ</sup> , (14)

where bd is the estimate of d.

#### 3.1. Achievable TOA measurement accuracy using pilots in 3GPP LTE

Different pilots or RSs have been specified in LTE, e.g., the primary synchronization signal (PSS), the secondary synchronization signal (SSS), and the cell-specific RS (CRS). In general, all or parts of these pilots can also be used for TDOA estimation (see Figure 3). The graphs in Figure 4 show σCRLB, computed according to Eqs. (11) and (13), using different pilots specified in LTE and one receive antenna, with E<sup>s</sup> ≔ E Sj j <sup>l</sup>ð Þk 2 n o being constant for the pilots specified in LTE systems, such as the PSS, SSS, CRS, and PRS. Here, a subframe of 1 ms contains 14 consecutive OFDM symbols, as in the case of the LTE normal CP. The PSS, SSS, CRS, and PRS are mapped to the corresponding resource elements [2]. Note the lowest bound (i.e., the highest measurement accuracy) is obtained by utilizing all the four pilots (PSS, SSS, CRS, and PRS) simultaneously. Among all available pilots in LTE, the PRS, as expected, achieves the highest accuracy in terms of the CRLB since it almost spans the whole bandwidth and there are also more PRS symbols available than, say, CRS symbols (see Figure 3). As it can be seen, using the PRS instead of the CRS can have a gain of about 3 dB. When CRS in addition to PRS is used, about 1 dB can be gained. As shown in the next section, an adaptive ML detector can have an estimation accuracy close to the CRLB, especially for scenarios where the first path is

Figure 3. An example LTE signal pattern with a cell-specific reference signal (CRS) and positioning reference signal (PRS) in a single physical resource block (PRB).

Where are the Things of the Internet? Precise Time of Arrival Estimation for IoT Positioning http://dx.doi.org/10.5772/intechopen.78063 67

Figure 4. CRLB for TOA measurement using different pilots in one subframe.

#### 3.2. CRLB for LTE and LTE NB-IoT

In what follows, we will focus on the PRS. LTE supports several bandwidths of the PRS, from 6 to 100 physical resource blocks (PRBs), consisting of 12 subcarriers each. The PRBs are placed symmetrically around the carrier frequency. Then, the usable bandwidth in the downlink is 1.095 to 18:015 MHz, where the additional 15 MHz come from the additional unused DC subcarrier. κ ¼ 0 corresponds to the conventional LTE downlink without considering the DC subcarrier. For bandwidths between 1.4 and 20 MHz [12], the (nominal) sampling rate of the system is T ¼ 16T<sup>s</sup> to Ts, where T<sup>s</sup> ¼ 1=30:72 µs ≈ 32:552 ns is the LTE basic time unit. The (nominal) FFT size changes accordingly from N ¼ 128 to 2048 (c.f. Table 1).

Consider the PRS for a normal CP when there are only one or two physical broadcast channel (PBCH) antenna ports ([2], Chapter 6.10). In each subframe for positioning, the PRS occupies 8 out of 14 OFDM symbols, as shown in Figure 3. In each PRB, two subcarriers are allocated for the PRS in each of the eight OFDM symbols. If we average over the six different cyclic shifts, the PRS corresponds to an equal power allocation over all usable subcarriers. Figure 5 shows the CRLB for different bandwidths of the PRS for a single subframe having the same subframe sum power allocated to the PRS

$$P\_{\text{sum}} := \sum\_{l=0}^{N\_{\text{symb}}-1} \sum\_{k=-N/2}^{N/2-1} |\mathcal{S}\_l[k]|^2. \tag{15}$$

In 5G, for Δf ¼ 15 kHz, the supported range of channel bandwidths is from 5 to 50 MHz (c.f. Table 1). In general, the usable downlink bandwidth is larger for the same channel bandwidth,


Table 1. Some 4G LTE parameters [12] and 5G NR parameters for Δf ¼ 15 kHz [11].

as more physical resource blocks are used. No PRS has been standardized for 5G yet. To estimate the future accuracy of 5G, we assume the LTE PRS but extended to the different number of PRBs. As we can see in Figure 5, the accuracy of the same channel bandwidth is expected to be slightly better than in LTE since the usable downlink bandwidth increases.

Figure 5. CRLB of LTE (N)PRS with different bandwidths but with the same sum power for a single subframe (solid), including 5G performance estimate using the LTE PRS adjusted to the different number of physical resource blocks (dashed).

Now let us consider IoT. Accurate positioning for IoT is challenging due to the small channel bandwidth for machine type communication (1.4 MHz in LTE-M) and NB-IoT systems (200 kHz in LTE NB-IoT). As σCRLB ¼ O ð Þ ΔfN <sup>1</sup> , the positioning accuracy reduces considerably compared to a 10 MHz PRS with the same energy (c.f. Figures 5 and 6). Therefore, the PRS has been optimized for LTE-M, and a new narrowband PRS (NPRS) has been introduced for NB-IoT in Release 14 [15]. Those improvements decrease the so-called periodicity of the PRS or increase the length of the PRS, up to about 0.5 s. This increases the energy spent on the PRS and decreases the efficiency of the system meaning that fewer resources can be allocated to data transmission. In order to increase the effective bandwidth of the PRS, which decreases the energy and time needed for the PRS, LTE-M supports frequency hopping, but NB-IoT currently only supports artificial frequency hopping by configuring the PRS onto multiple NB-IoT carriers [15], see e.g., [16] for a study on its performance. Frequency hopping in NB-IoT can be more difficult than in LTE-M since NB-IoT can operate in individual small unused gaps in the spectrum, while LTE-M uses (parts of an) LTE channel. Similarly, in order to increase the effective bandwidth, carrier aggregation can be employed [17].

In contrast to the conventional LTE downlink, we have κ ¼ 1=2 for NB-IoT—at least in guard band and standalone operation mode. NB-IoT occupies one PRB, i.e., the 12 subcarriers 6, …, 5 in the downlink [2]. The NPRS occupies at least 10 subframes consisting of 14 subsequent OFDM symbols each, which are all used for the NPRS in guard band and standalone operation mode [2]. Depending on the cell ID, the NPRS is shifted circularly in the occupied subcarriers by ν∈f g 0; …; 5 subcarriers. In each subframe, each subcarrier is allocated twice with the NPRS, except for subcarriers k ¼ ν and k ¼ ν 6, which are allocated four times. The allocation pattern is similar to the one for the PRS (c.f. Figure 3). Let Psymb denote the power of each allocated symbol in a subcarrier. Then for one subframe,

Figure 6. CRLB of the LTE NPRS with different numbers of subframes and of the LTE PRS for a 10-MHz channel.

$$\sum\_{l=0}^{13} \sum\_{k=-N/2}^{N/2-1} (k+\kappa)^2 |S\_l[k]|^2 = \frac{1}{28} (4\nu^2 - 20\nu + 347) P\_{\text{sum}} \quad P\_{\text{sum}} = 28 P\_{\text{symb}} \tag{16}$$

holds, where the nominal FFT size for NB-IoT is N ¼ 128 (c.f. Table 1). That means simplifying the average CRLB for TOA estimation yields

CRLBNPRS, avgð Þ¼ <sup>b</sup><sup>τ</sup> 28σ 2 8π<sup>2</sup> ð Þ Δf 2 ð Þ 333 þ 2=3 Psum : (17)

As for the LTE PRS, this corresponds to an equal power allocation on all usable subcarriers, but with κ ¼ 1=2 instead of κ ¼ 0. As shown in Figure 6, the positioning accuracy of the NPRS, even with 1280 subframes, is still a bit worse than the 10MHz PRS with one subframe.

#### 3.3. ZZLB and waveform optimization

In LTE, all PRS and NPRS symbols are sent with the same power. But when we consider the CRLB in Eq. (11), the optimum power allocation strategy is to allocate all power to positioning symbols in those subcarriers that are furthest from the center frequency. That means, compared to Eq. (17), we get for one subframe

$$\sum\_{l=0}^{13} \sum\_{k=-N/2}^{N/2-1} (k+\kappa)^2 |\mathcal{S}\_l[k]|^2 = 14 \cdot 2 \cdot 5.5^2 P\_{\text{symb}} = 847 P\_{\text{symb}} = \frac{121}{4} P\_{\text{sum}}.\tag{18}$$

So σCRLB improves by a factor of about 1:6. Consequently, the TOA estimation time with the NPRS can be reduced from about 0.5 to about 0.31 s, in order to achieve the same accuracy.

In practice, however, when we approximate the power allocation by a Dirac in the edge frequencies, this waveform is not optimal for all SNRs in general—especially at low SNR since its autocorrelation has got large sidelobes, which the estimator can confuse with the main lobe [18] (see Figure 7). There are tighter bounds for the estimation error that take this into account, e.g., the ZZLB [19, 20], which is given by

Figure 7. Comparison of the normalized autocorrelation of the Dirac-rectangular and the triangular waveform.

Where are the Things of the Internet? Precise Time of Arrival Estimation for IoT Positioning http://dx.doi.org/10.5772/intechopen.78063 71

$$\text{ZZLB} = \int\_0^{T\_\mathbf{a}} \tau \left( 1 - \frac{\tau}{T\_\mathbf{a}} \right) \Phi \left( \sqrt{\frac{P\_{\text{sum}}}{\sigma^2} (1 - \rho(\tau))} \right) d\tau, \quad \Phi(\mathbf{x}) = \frac{1}{\sqrt{2\pi}} \int\_{\mathbf{x}}^{+\infty} e^{-\mathbf{u}^2/2} du,\tag{19}$$

for TOA estimation, where we assume the prior information that τ is uniformly distributed in ½ 0; T<sup>a</sup> with the observation time interval T<sup>a</sup> and where rð Þτ is the real-valued normalized autocorrelation function of the positioning symbols. In LTE, the UE gets the required prior information on the expected delay via the LPP [5]. Note that the optimum waveform w.r.t. ZZLB also depends on the SNR, in contrast to the CRLB. Therefore, depending on the region of the SNR of interest, the waveform that minimizes the ZZLB may be different.

In [18], the optimization w.r.t. ZZLB in continuous time over a so-called triangular waveform with the parameter <sup>α</sup><sup>∈</sup> ½ <sup>0</sup>; <sup>1</sup> and over a Dirac-rectangular waveform with parameter <sup>γ</sup>∈½ <sup>0</sup>; <sup>1</sup> with power spectral densities

$$|S\_{\rm tri}(f)|^2 = \begin{cases} (1-\alpha)\frac{2}{B} - \frac{4(1-2\alpha)}{B^2}|f|\, & |f| \le \frac{B}{2},\\ 0 & |f| > \frac{B}{2}, \end{cases} \tag{20}$$

$$\left|S\_{\mathrm{dr}}(f)\right|^2 = \begin{cases} \frac{1-\gamma}{B} + \frac{\gamma}{2} \left[\delta\left(f + \frac{B}{2}\right) + \delta\left(f - \frac{B}{2}\right)\right], & |f| \le \frac{B}{2}, \\ 0, & |f| > \frac{B}{2} \end{cases} \tag{21}$$

is shown, where B is the bandwidth (see Figure 8). Figure 9 shows the ZZLB, with.

$$
\sigma\_{\rm ZZLB} \coloneqq \sqrt{\rm ZZLB}.\tag{22}
$$

For a very low SNR, the σZZLBs are slightly below Ta= ffiffiffiffiffi <sup>12</sup> <sup>p</sup> , which is the standard deviation of the uniform distribution we use as a priori information for the ZZLB. The CRLB does not consider the a priori information. For a high SNR, the ZZLB converges to the CRLB. For NB-IoT, we have <sup>B</sup> <sup>≈</sup> <sup>11</sup>Δ<sup>f</sup> <sup>¼</sup> 165 kHz and thus <sup>T</sup><sup>a</sup> <sup>≈</sup> <sup>60</sup>:6μs for the same configuration as in [18]. There it was shown that the optimal triangular waveform is the one with α ¼ 1, but for the Dirac-rectangular waveform, the optimum value of γ depends on Psum=σ 2 . For small Psum=σ 2 , a

Figure 8. Power spectral density of the triangular and the Dirac-rectangular waveform (a) Triangular, (b) Dirac-rectangular.

Figure 9. ZZLB of the Dirac-rectangular waveform and the triangular waveform for different parameters α, γ and the unrealistically large T<sup>a</sup> ≈ 60:6μs.

triangular waveform is better than a Dirac-rectangular waveform, but for large Psum=σ 2 , it is the other way round. We observe the same behavior in Figure 9.

Sampling the Dirac-rectangular waveform with γ < 1 or the triangular waveform with α ¼ 1 could be a good candidate for the power allocation of the PRS for IoT in 5G, but the positioning accuracy will not improve by the full factor of 1.6, corresponding to the CRLB optimal allocation.

## 4. Practical TOA estimation based on first tap detection

#### 4.1. Maximum likelihood (ML) timing estimation

The reference signal slð Þ n , such as CRS and/or PRS, is embedded in the received signal y<sup>l</sup> ð Þ n . The target of the TOA estimation is to determine the position τ in the received signal y<sup>l</sup> , say, using the maximum likelihood (ML) criterion. Notice that the ML estimator has the asymptotic properties of being unbiased and achieving the CRLB [14]. Consider the other paths as interference, the ML criterion for timing estimation of the first path reduces to a correlation-based criterion. The correlation-based method can be realized in time or frequency domain. In the following, we focus on the time domain-based method [13].

The received signal y<sup>l</sup> ð Þ n is correlated with the replica of the transmitted signal slð Þ n , i.e.,

$$R(t) \coloneqq \sum\_{l=0}^{N\_{\text{symb}}-1} \sum\_{n=0}^{N-1} y\_l(n+t)s\_l^\*(n), \qquad t \in [0, W-1]. \tag{23}$$

where W ¼ 2G is chosen as the search window size. To ease the analysis, we first assume slð Þ n has ideal autocorrelation property, and the power of the transmit signal slð Þ n is P<sup>s</sup> . Then, with some derivations, the correlation can be written as

$$R(t) = P\_s \sum\_{l=0}^{N\_{\text{symb}}-1} h\_l(t-\tau) + R\_{\text{res}}(t) \tag{24}$$

where Rresð Þt represents the total residual noise and interference part resulting from correlation between slð Þ n and y<sup>l</sup> ð Þ n þ t .

Assume the channel is unknown but remains invariant for Nsymb OFDM symbols, hlðÞ¼ t h tð Þ, then the noncoherent detector can be employed. The metric for the TOA detection, which is also called the correlation profile, is given here by

$$\Lambda(t) \coloneqq \mathbb{E}\left\{|R(t)|^2\right\} = N\_{\text{symb}}^2 P\_\text{s}^2 \gamma(t-\tau) + P\_\text{s} N\_{\text{symb}} \sigma^2,\tag{25}$$

with γð Þt ≔ E j j h tð Þ <sup>2</sup> n o. E j j R tð Þ <sup>2</sup> n o is used to denote the statistical average of j j R tð Þ <sup>2</sup> over multiple subframes containing RS signals. In LTE, a group of several consecutive subframes containing the RS is sometimes referred to as a positioning occasion. Usually, an LTE positioning measurement is done on one or more occasions.

#### 4.2. Signal arrival region determination

We now determine the arrival region of the RS. For a multipath channel, the signal arrival region will have multiple taps corresponding to the taps of the channel. The signal paths are, therefore, reflected by the channel paths. A moving sum is computed as

$$\Lambda\_{\text{win}}(u) = \sum\_{t=u}^{u+G-1} \mathbb{E}\left\{ \left| R(t) \right|^2 \right\}, \qquad u \in [0, G-1] \tag{26}$$

The signal can be regarded as arrived in the time region

u<sup>0</sup> ⩽ t⩽ u<sup>0</sup> þ G 1 s:t: u<sup>0</sup> ¼ arg max u f g Λwinð Þ u (27)

When t τ⩾ L or t τ < 0, only the noise power related term, the noise floor N<sup>f</sup> ≔ PsNsymbσ 2 remains in the correlation. N<sup>f</sup> , which is used here as σ 2 , can be calculated by averaging the terms outside the signal region.

For a single path channel, such as in the case of the LOS signal, the TOA can be detected, by searching for the path with the strongest signal power. For a multipath channel, in particular, when the first arriving path is not the strongest (e.g., under ETU channel), the TOA estimation becomes biased. Usually, a threshold is needed to determine the first arriving path. Especially in the case of strong noise and interference from multiple cells, the metric Λð Þt may not provide sufficient accuracy. Consider

$$\frac{\mathrm{E}\left\{\left|R(t)\right|^{2}\right\}}{N\_{f}} = \frac{N\_{\mathrm{symb}}P\_{\mathrm{s}}\gamma(t-\tau)}{\sigma^{2}} + 1 = N\_{\mathrm{symb}}\mathrm{SNR}(t) + 1,\tag{28}$$

where SNRð Þt ≔ Psγð Þ tτ σ 2 is the SNR for each correlation sample, and it holds SNRðÞ¼ t 1 Nsymb E j j R tð Þ <sup>2</sup> n o Nf 1 0 @ 1 <sup>A</sup>: (29)

The following criterion then takes a fixed SNR value as a threshold to estimate the first tap

$$
\pi = \min\_{u\_0 \lessapprox t < u\_0 + G - 1} t \quad \text{s.t.} \quad \text{SNR}(t) \rhd \text{SNR}\_{\text{th}}.\tag{30}
$$

SNRth is the required SNR for detection, which can be set as, e.g., 13 dB for 3GPP Release 9 OTDOA measurement.

#### 4.3. Adaptive-threshold-based first tap detection

As slð Þ n is not ideally autocorrelated, the noise floor N<sup>f</sup> would contain further terms besides PsNsymbσ 2 . Therefore, we can express the noise floor as

$$N\_f = P\_\text{s} N\_\text{symb} \sigma^2 + \varepsilon \left( N\_\text{symb} \right) \tag{31}$$

where ε Nsymb is a parameter related to Nsymb, slð Þ n , and y<sup>l</sup> ð Þ n and y<sup>l</sup> ð Þ n is in turn dependent on the channel and the interference.

Here, we use a criterion, which jointly considers the noise power and the received signal power to determine a varying (adaptive) detection threshold. Assume the metric peak relying on the signal power and noise is

$$\text{U} = \overline{\text{U}} \cdot \overline{\text{A}}\_{\text{max}} = \max\_{u\_0 \lesssim t < u\_0 + G - 1} \text{E}\{ |\overline{R(t)}|^2 \}. \quad \overline{\text{U}} = \overline{\text{U}} \cdot \overline{\text{U}} \qquad \text{(32)}$$

The adaptive threshold can then be defined as Λth ¼ α ffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi ΛmaxN<sup>f</sup> p . Alternatively, the threshold can be defined as Λth ¼ α βΛmax þ 1 β N<sup>f</sup> , where α is a design parameter, β∈½ 0; 1 is a constant trading-off between the noise floor and the metric peak. α and β were determined through simulations, to have a trade-off for different channels and different SNRs.

Given the threshold, the criterion for the adaptive threshold detection can be expressed as

$$\tau = \min\_{u\_0 \lessapprox t < u\_0 + G - 1} t \quad \text{s.t.} \quad \mathbf{E}\left\{ |\mathbf{R}(t)|^2 \right\} \rhd \Lambda\_{\text{th}}.\tag{33}$$

This criterion usually leads to better performance especially under a multipath channel, and in some cases can achieve performance close to the CRLB [13].

LTE supports bandwidths up to 20 MHz, which corresponds to a sampling rate of 30:72 10<sup>6</sup> samples/s in the baseband signal. For a bandwidth smaller than 20 MHz, the processing can be done at a smaller sampling rate to reduce the processing load; e.g., when the channel has a bandwidth of 1:4 MHz, 1=16 of the rate is sufficient. However, better accuracy can be obtained by a higher sampling rate due to the receive diversity gain.

## 5. Cooperation for accurate and reliable mobile radio positioning

## 5.1. Cooperative positioning principle

Future wireless technologies such as 5G enable UEs to cooperate with each other. By mutually observing their transmitted signals, UEs can estimate the ranges among themselves. If the mesh of mutually observed D2D links is sufficiently dense, positioning works even if there are less than three BSs visible to individual UEs as shown in Figure 2. For ranging, it is sufficient that the receiving UE knows at least parts of the signal transmitted by adjacent UEs. Pilots, such as CRS, PRS in 4G, which are multiplexed in a UE's transmit signal stream anyway, can be used for that purpose. Another option is to transmit dedicated ranging signals, which are multiplexed into the UE's transmit signal stream from time to time. However, there is no need to establish mutual connections between UEs.

Figure 10a and b shows examples for cooperative positioning in indoor environments. In such areas, we find a lot of "things" that will be connected. Such devices are, e.g., smartphones, laptops, WLAN, or 5G access points (APs), but also consumer electronics like smart TVs or even home appliances like fridges, dishwashers, washing machines, etc. Many of these "things" of the internet are stationary as shown in the example in Figure 10a. Still, their

Figure 10. Cooperative positioning indoors. The image on the right is licensed under CC BY-SA 3.0. It is built upon https://commons.wikimedia.org/wiki/File:Mirdif\_City\_Centre\_indoor.JPG by Shahroozporia (own work) [CC BY-SA 3.0 (http://creativecommons.org/licenses/by-sa/3.0)], via Wikimedia commons (a) Home area, (b) A shopping mall.

position might be unknown and must be determined similar to the mobile devices. The a priori knowledge that they do not move can be exploited in that context. Highly mobile things of daily use, like glasses, dog, or cat collar, may be equipped with low-cost transmitters in future. Thus, also these items, which are often lost, become traceable with cooperative positioning methods. Signals from outside the home, like BSs, GPS-equipped UEs outside, etc., might also be received under good LOS propagation conditions. These observations extend the mesh of connected devices and allow positioning in a global coordinate system. In shopping mall areas, as shown in Figure 10b, the density of mobile communication devices like smartphones is usually high. With a dense mesh of such devices, LOS propagation conditions among adjacent devices are highly probable, providing accurate ranging capabilities. The mesh reaches outdoor areas through devices near entrances or windows. Meshed devices outdoors can use GPS positioning and serve as a kind of anchor for devices' indoors. Also, stationary indoor APs can serve as anchors. Their positions may have to be determined.

#### 5.2. Cooperative position calculation in mobile radio networks

• Centralized, network centric: UEs transmit their measured ranges to adjacent UEs to a network positioning entity, which calculates the positions of the UEs and provides the position estimates to the UEs. This needs a protocol for exchanging information between UEs and the positioning entity. The protocol overhead might cause latency for position estimation, which might be negligible for pedestrians.

Figure 11. Cooperative vs. non-cooperative positioning performance.

• Decentralized, UE based: UEs share their currently estimated state (including uncertainty) to their vicinity. A protocol, which allows broadcasting this information, is needed for that purpose. The state to be shared (broadcasted) includes position and timing estimates, i.e., the offset of the local UE time base to the global system time base. Based on this, individual UEs can estimate their own position locally. This approach allows a "listen-only" mode. A "listen-only" UE does not share its own state estimates, but is still able to calculate a position fix based on the observed signals and state estimates from its neighboring UEs.

Figure 11 shows results about the expectable cooperative positioning performance versus the UE density [21]. UEs have been uniformly distributed in a triangular area between three BSs as shown in Figure 2. The simulation parameters are summarized in Table 2. For noncooperative positioning, the UEs' positions are calculated individually. Thus, the positioning error does not depend on the UE density. For cooperative positioning, however, there is a significant performance gain for UE densities in the order of 1000 UEs per km<sup>2</sup> and above. The example shown in Figure 12 provides a relation to a density of 1000 UEs per km<sup>2</sup> , which comprises four sites in a typical urban living area. Each of the living sites may contain devices


Table 2. System parameters for cooperative positioning simulations.

Figure 12. 1000 UEs per km<sup>2</sup> means 1 UE per 1000 m<sup>2</sup> . as shown in Figure 10a. In shopping malls, as shown in Figure 10b, user densities are usually much higher. 5G envisages device densities of 10<sup>6</sup> per km<sup>2</sup> or 1 UE per m<sup>2</sup> .

## 6. Conclusions

5G is envisaged to support a variety of use cases and therefore needs to support precise positioning in many cases. With higher carrier bandwidth, TOA and related measurements can be done precisely. Cooperative positioning will benefit from the dense network and D2D communications. All these will contribute to high-accuracy positioning. In this chapter, we overviewed positioning requirements for wireless communications and the relevant radiobased positioning techniques. Then, we discussed the CRLB and ZZLB. With a simple MLbased adaptive threshold method, the first path of the radio signal can be detected with high accuracy for many wireless channels, especially when LOS is strong. In massively connected IoT, cooperative positioning will provide a further way for precise radio-based positioning.

## Acknowledgements

Part of this work has been performed in the framework of the Horizon 2020 project 5GCAR (ICT-761510) receiving funds from the European Union. The authors would like to acknowledge the contributions of their colleagues, although the views expressed in this contribution are those of the authors and do not necessarily represent the project or company.

## Author details

Wen Xu<sup>1</sup> \*, Armin Dammann<sup>2</sup> and Tobias Laas1,3

\*Address all correspondence to: wen.xu@ieee.org

1 Huawei Technologies Duesseldorf GmbH—European Research Center, Munich, Germany

2 Institute of Communications and Navigation, German Aerospace Center (DLR), Wessling, Germany

3 Department of Electrical and Computer Engineering, Germany and Technical University of Munich, Munich, Germany

## References

