Indoor Positioning Using LTE Signals

Marco Driusso∗ , Chris Marshall† , Mischa Sabathy‡ , Fabian Knutti‡ , Heinz Mathis‡ , and Fulvio Babich§

∗ u-blox Italia S.p.a., Sgonico, Italy. Email: marco.driusso@u-blox.com

† u-blox UK Ltd, Reigate, United Kingdom. Email: chris.marshall@u-blox.com
‡ Institute
for Communication Systems, University of Applied Sciences of Eastern Switzerland
Rapperswil, Switzerland. Email: {mischa.sabathy,fabian.knutti,heinz.mathis}@hsr.ch,
§ Department of Engineering and Architecture, University of Trieste, Trieste, Italy. Email: babich@units.it

Abstract—This paper presents an experiment using real Long-
Term Evolution (LTE) signals to extend positioning from out-
doors to indoors. LTE signals are of interest for positioning
applications because of their availability indoors, where GNSS
signal reception is limited. Different approaches for time of
arrival (TOA) extraction are evaluated for their positioning
performance, combined with an extended Kalman filter (EKF)
for movement tracking. The paper shows that the performance
is surprisingly good, with high visibility of cellular signals even
in the difficult indoor test environment, and with a positioning
error once indoors smaller than 8m in 50% of cases.
I. I NTRODUCTION
There are many different positioning systems for outdoor
scenarios, notably global navigation satellite systems (GNSS).
However, moving indoors GNSS reception is limited, mostly
as shadowing reduces the availability of the GNSS signals.
Cellular wireless signals are an attractive alternative for indoor
use, as the received signal levels are stronger than possible
with satellite systems, and cellular deployments are designed
to provide good coverage also indoors. In particular, the new
Long-Term Evolution (LTE) signals have high bandwidth and
a frame and synchronisation structure which could make them
well-suited for positioning purposes.
Previously in [1], [2], an outdoor positioning solution using
LTE signals was presented, and showed that LTE signals
could be used for practical positioning in a varied outdoor
environment. Best performance could be achieved using the
ESPRIT super resolution algorithm (SRA) combined with a
Kalman filter for measurement and tracking of the time of
arrival in sometimes-difficult multipath. Overall this showed
that LTE signals could deliver position estimates with an error
smaller than 21 m in 50% of cases (31m RMS), when outdoors
[2]. However, GNSS itself can provide good performance
outdoors - it is positioning indoors where the challenge lies, so
this paper explores the possibilities and limits of positioning
with LTE signals when moving into the indoor scenario.
There are few experimental works in the literature that
exploit LTE signals for indoor positioning. In [3], [4], different
LTE signals generated with prototyping hardware are exploited
for assessing the feasibility of indoor positioning based on
978-1-5090-2425-4/16/$31.00
2016
c IEEE
LTE signals time difference of arrival (TDOA) measurements,
and on the usage of particle filters. An experimental evalu-
ation is presented in [5], where the timing performance of
different hardware platforms is compared by using emulated
LTE signals in line-of-sight (LOS) multipath-free channels.
The authors of [6] propose and validate in the field a method
based on LTE femtocells for detecting the floor in which the
LTE receiver is located, for safety and emergency applications.
In [7], a test-bed is proposed for performing indoor ranging
measurements based on round trip delay estimation using LTE-
like OFDM signals. However, to the best of the authors’
knowledge, there are no works that present an indoor position-
ing experiment that exploits real LTE signals opportunistically
measured from a commercial network.
After an introduction to the relevant aspects of the LTE
signal used in Section II, the indoor environment and exper-
imental equipment are described in Section III. This section
also reviews the coverage of the GPS and the LTE signals vis-
ible (or not visible) in the difficult indoor test. The algorithms
used for measuring the time of arrival and for estimating the
range from the base station are set out in Section IV, optimised
for the indoor environment. Finally in Section V the position
of the rover device is estimated, a process which is slightly
complicated in this case by the need to estimate the clock
drift of the base station over the course of the experiment.
The results of various algorithms are compared in Section VI,
and the conclusions are summarized in Section VII.
II. T HE LTE PHYSICAL LAYER
Generally 3GPP Long-Term Evolution (LTE) distinguishes
between the time division duplexing (TDD) mode and the
frequency division duplexing (FDD) mode. FDD uses two
different frequency bands for uplink and downlink while in
TDD mode the uplink and downlink channels are shared. All
the work related to this paper considers the LTE FDD mode.
The downlink physical layer of LTE is based on the orthog-
onal frequency division multiplexing (OFDM) modulation. An
OFDM symbol is a wideband signal where the information is
streamed on Nsc multiple orthogonal narrowband frequency
sub-carriers, which are modulated independently and spaced
by ∆f . For the sub-carriers to be orthogonal, the separation
 2016 International Conference on Indoor Positioning and Indoor Navigation (IPIN), 4-7 October 2016, Alcalá de Henares, Spain
a slot - 0.5ms
hki6 = 5 p = 0, NID,1
hki6 = 4 p = 1, NID,1
hki6 = 3
p = 0, NID,2
hki6 = 2
p = 1, NID,2
hki6 = 1
hki6 = 0
∆f
hki6 = 5
hki6 = 4
hki6 = 3 ∆fCRS
hki6 = 2
hki6 = 1
hki6 = 0
l= 0 1 2 3 4 5 6
Fig. 1. CRS pattern within a resource block for two antenna ports p = {0, 1}
and two different cell IDs NID,1 and NID,2 . k is the sub-carrier index and l
is the OFDM symbol number within the slot.
has to be ∆f = 1/Ts , where Ts is the OFDM symbol
duration. The number of used sub-carriers Nsc depends on
the adopted channel transmission bandwidth. Six different
downlink bandwidth configurations are available in LTE, with
a channel bandwidth going from 1.4 MHz (Nsc = 72) up to
20 MHz (Nsc = 1200). The content of the OFDM sub-carriers
can be easily accessed by using a Nfft ≥ Nsc point discrete
Fourier transform (DFT) on the received signal samples [8].
In the time domain, an LTE downlink signal is organized in
10 ms long radio frames, each made up of 20 slots having a
DL
duration of 0.5 ms. Each slot contains Nsymb OFDM symbols,
each carrying its Nsc sub-carriers. According to the OFDM
principle, a cyclic prefix (CP) is inserted in the guard interval
before each transmitted lth OFDM symbol within the slot.
Finally, LTE addresses the spatial domain with the concept
of antenna port: the LTE base stations (BSs) can transmit
with different antenna port configurations, to be used either for
transmit diversity or spatial multiplexing. All the BSs received
in this experiment were using a 2 antenna port configuration.
In LTE, the basic resource is called a resource element (RE),
and corresponds to a specific sub-carrier within a specific
OFDM symbol transmitted from a specific antenna port. For
each antenna port, REs are grouped in resource blocks, which
are made of NscRB contiguous sub-carriers for the duration of
DL
one slot (i.e., for Nsymb subsequent OFDM symbols). Further
information about the LTE physical layer can be found in [9].
A. Suitable signals for ranging
The LTE signal to be used for positioning should take into
account a number of factors. The signal should preferably
occur in the downlink without user request, so that no specific
action by the network is needed, thus avoiding additional
network traffic and cost. The signal should be unique for a base
station, so that the signals from different base stations operat-
ing on the same frequency can be distinguished. Additionally,
the bandwidth of the transmitted signal should be maximized
within the channel bandwidth, so as to give a channel impulse
TABLE I
M EASURED LTE PHYSICAL LAYER DL PARAMETERS
parameter operator 1 operator 2 operator 3
DL bandwidth 20 MHz 15 MHz 15 MHz
Nsc 1200 900 900
DL mode FDD FDD FDD
center frequency fc 1815.1 MHz 1870 MHz 1850.1 MHz
Nfft 1536
∆f = 1/Ts 15 kHz
RB
Nsc 12
DL
Nsymb 7
response with a high resolution. The cell-specific reference
signal (CRS) was chosen in this study.
The LTE CRS is a specific signal intended for channel
estimation and coherent demodulation, and is defined as a set
of pilot tones peculiar to each base station and cell sector,
according to the cell-ID NID . Moreover, different CRSs are
transmitted from different antenna ports. The CRS itself is a
pseudo-random complex-valued sequence, initiated with the
NID as described in [9]. Fig. 1 shows the mapping of the
CRSs of two cells onto a resource block for a two-antenna-
port configuration. The complete mapping can be obtained
by vertically repeating the grid of Fig. 1 for Nsc /NscRB times,
until the full transmit bandwidth is filled. As one can see,
the CRS of a single OFDM symbol pertaining to an antenna
port p occupies one sub-carrier every six, leading to a total
of Ntot = Nsc /6 CRS pilots in that OFDM symbol, spaced
by ∆fCRS = 6∆f . The excellent cross-correlation properties
of the CRS, together with its particular mapping on the REs,
allow a receiver to distinguish between multiple cells received
on the same carrier frequency.
III. I NDOOR MEASUREMENT SCENARIO
The indoor LTE data was recorded in building 2 of the
Hochschule für Technik Rapperswil (HSR) in Rapperswil SG,
Switzerland. The data gathering experimental track is shown
in Fig.2a. It started and finished outdoors, about 3 m below
the surrounding ground level, in a limited open-sky scenario.
The measurement corridors do not have a view outside and
remain below the ground level. One of the four corridors is
shown in Fig. 2c. The duration of the whole experiment was
approximately 15 min. At the end of each straight path the
trolley on which the data-acquisition system was mounted was
stopped and rotated by 90 degrees. Then it was moved down
the next straight path at around 0.8 m/s. A raw IQ data block
of 100 ms was recorded every second for post-processing.
The signals from three LTE service providers were mea-
sured during the test, from a total of 5 base stations (BSs).
Table I lists the measured downlink parameters for the three
operators. The LTE configuration of the BSs were the same for
all the BSs of one LTE service provider. Fig. 3 shows four of
the received LTE BS locations, with the operators indicated by
the different markers and the BSs numbered for identification
 2016 International Conference on Indoor Positioning and Indoor Navigation (IPIN), 4-7 October 2016, Alcalá de Henares, Spain

Test route
start/stop Operator 1 2

Y-coordinate CH1903 (Grid 1km)

position Operator 2 183
Operator 3
52
1
53

239
1
237 238
86
1 84

(a)

231
start/stop
705
position X-coordinate CH1903 (Grid 1km)

Fig. 3. Indoor measurement track and received LTE BSs. The index inside
each marker is used to identify the different BSs. For each BS, the received
cells are also represented, with an approximate orientation.

(b)
LIDAR Lite
Laser distance sensor Patch Wide Band Antenna
Antenna Magnetic Mount
laser position fixes Built-in LNA - Gain: 3dBi peak

u-blox EVK-6N
timestamps GPS/GNSS Evaluation Kit
position fixes
1PPS
10MHz Ref
SRS FS725
1PPS
Rubidium Frequency Standard

USRP N210 - fC = 1815.1MHz

(c) Daughterboard: WBX 50-2200MHz RX/TX
Fig. 2. Indoor measurement track satellite view (a), view of the start/stop
position from the entrance (b), and view of one corridor (c).
USRP N210 - fC = 1870MHz
Daughterboard: WBX 50-2200MHz RX/TX
purposes, and their corresponding cell sectors. In addition,
the experimental track is indicated. An additional BS from USRP N210 - fC = 1850.1MHz
operator 2 was received, which is not shown in Fig. 3, located Daughterboard: WBX 50-2200MHz RX/TX
further south across the lake at a distance of roughly 3 km. Ethernet
1Gbps
A. Data acquisition system PC
- Data Recording Software
The data acquisition system (DAS) was adopted from [1],
and is shown schematically in Fig. 4. It consists of a set of Fig. 4. Data aquisition system for indoor experiment.
Universal Software Radio Peripheral (USRP) software defined
radios, each measuring an operator’s downlink LTE carrier
frequency, and of a reference track measuring system, which
is discussed in detail in Section III-B. of multipath, every USRP is time synchronized to a GPS-
An indoor positioning system based on opportunistically locked Rubidium frequency standard, keeping the receiver
measured LTE signals has to 74 deal with a number of factors, local clock constantly and precisely aligned to UTC. The
including heavy multipath72 3
propagation, low SNRs, BSs’ cov- collected IQ samples are time-stamped with the corresponding
73
erage and geometry, and BSs’ clock offsets. In order to be UTC epochs, in order to assist in the interpretation of the
able to handle and analyse the effects of BS clock offsets and signal measurements.
 2016 International Conference on Indoor Positioning and Indoor Navigation (IPIN), 4-7 October 2016, Alcalá de Henares, Spain
d[t, pR pR
1] 1 LTE BSs visible
DAS
DAS
building wall
d[t, p2R ]
DAS experimental track
pR
2
Fig. 5. Laser-based distance-to-reference point measurement during experi-
ment, top view.
B. Reference track
Compared to [1], the reference track could not be measured
by means of the GPS, because of absent indoor reception.
Since building plans were available, a so-called laser-based
distance-to-reference points (LRP) measurement system was
used as a solution to generate the reference track. A network
time protocol (NTP) UTC time synchronized personal com-
puter measured the distance to a particular active reference
point using the Lidar lite laser distance module. The Lidar lite
module provides measurement distances of up to 40 m with an
accuracy of ±0.025 m. Fig. 5 shows the working principle of
the LRP method. The distance d[t, pRn ] to a reference point in
position pRn was determined thanks to the laser distance mod-
ule throughout the whole measurement tour, with different ref-
erence points depending on the location along the experiment
track. For further processing the reference track is converted
into the same coordinate system as used by the algorithms. As
in [1], [2], the algorithms in this paper are also in the east-
north-up (ENU) plane [10], with its reference position set to
the first measurement outdoors. In this experiment the ENU
reference position was set manually since no accurate GPS
fix was possible at the starting location. The d[t, pRn ] distance
to reference point measurements were transformed into ENU
|
coordinates pLRP (t), where pLRP = xLRP y LRP z LRP ,
each corresponding to a UTC time t. These coordinates were
used as the ground truth in the experiment, for evaluating the
positioning performance.
C. GPS coverage
As one can see in Fig. 6, the GPS space vehicles (SV) re-
ception disappears during the indoor period of the experiment.
However, the experiment showed that the visibility of base
stations was not significantly affected by being indoors, and
up to five LTE BSs could still be received. All these received
LTE signals were measured and exploited for estimating time-
based ranges and evaluating the receiver position.
IV. T IME OF ARRIVAL ESTIMATION
The time of arrival (TOA) of the downlink LTE signals was
estimated by exploiting the CRS, described in Section II-A.
SVs usable
8
Number of SVs/BSs
6
4
0
8:32 8:34 8:36 8:38 8:40 8:42 8:44
UTC time
Fig. 6. Number of usable SV detected during the measurement period,
compared to the number of LTE BSs visible.
The approach for the TOA estimation is taken from previous
works documented in [2], [11]. However, improvements were
needed for dealing with low SNRs and strong multipath
conditions typical of indoor environments. These changes were
crucial for achieving a good performance in the considered
scenario, and are described in the following sections.
In a short observation window, the multipath channel en-
countered by a signal propagating from a BS to a mobile
receiver may be modeledP with a channel impulse response
L−1
(CIR) given by h(τ ) = l=0 hl δ(τ − τP l ), and a channel
L−1
frequency response (CFR) equal to H(f ) = l=0 hl e−j2πf τl ,
where δ(·) denotes the Dirac delta function, hl ∈ C is the
complex channel gain associated to the lth path, and τl is the
corresponding delay, with τ0 < · · · < τL−1 [8]. Using an
estimate τ̂0 of the direct path (DP) TOA τ0 , the pseudorange
ρ̂ = c0 · τ̂0 can be evaluated, which can be later corrected to a
distance estimate d, ˆ where c0 is the speed of light. The CFR
can be easily estimated by exploiting the pilot tones of the
LTE CRS, also thanks to the underlying OFDM modulation. In
particular, let Ĥps,l ∈ CNtot be the least squares CFR estimation
obtained as described in [12] from antenna port p, OFDM
symbol l within the slot s, in a particular measurement block
acquired at UTC time t from a certain visible cell. These CFR
estimates are used in this work for the DP TOA estimation.
A. CFR estimates time-frequency combining
Because of the low speeds v involved in the considered mea-
surement scenario, the channel can be considered correlated
both in amplitude and phase for long periods. In particular,
from the analysis of [13], it can be assumed that a fading
channel has amplitude and phase with correlation coefficient
greater than 0.9 in the interval ∆t if ∆tfC v/c ≤ 0.025,
where fC is the carrier frequency and v is the relative
speed between transmitter and receiver. A carrier frequency of
fC = 1850 MHz and a speed of v = 0.8 m/s (the average speed
of the DAS during the moving segments of the measurement
tour) determine a correlation interval of ∆t ≤ 5 ms, which
corresponds to a duration of 10 LTE slots. This high channel
correlation within 10 subsequent LTE slots was exploited in
two ways.
 2016 International Conference on Indoor Positioning and Indoor Navigation (IPIN), 4-7 October 2016, Alcalá de Henares, Spain
100 ŵ {τ̂l0 }6l=0 , L̂0 = 7
γth {τ̂l1 }6l=0 , L̂1 = 7
τ̂T
norm. amplitude
−1
10
10−2
10−3
0 500 1000 1500
offset [m]
Fig. 7. Example of TOA estimation from BS 1 operator 3 cell 237 at UTC
time t = 08:42:53. The time axis values are expressed as distance offsets in
respect to the coarse timing.
Firstly, thanks to the fact that the CRSs of the two OFDM
symbols within a slot occupy different sub-carriers (Fig. 1), the
two estimates Ĥps,0 and Ĥps,4 were merged in the frequency
domain, as described in detail in [2]. This time-frequency
combination permitted to obtain the length 2Ntot CFR estimate
Ĥps , which is characterized by a reduced frequency separation
between the samples (3∆f instead of 6∆f ). The benefits of
this merging procedure are an increased number of samples
for each CFR estimate Ĥps and a smaller frequency separation
between adjacent samples. Depending on the TOA estimation
algorithm adopted, this may correspond to increased resolution
and increased maximum TOA computable.
Secondly, the high channel correlation determined by pedes-
trian speeds was also exploited by coherently accumulating the
merged CFR estimates of up to NS = 10 subsequent slots. The
resulting CFR estimate is given by:
NS −1
1 X
Ĥp = Ĥp .
NS s=0 s
This leads to an improved SNR thanks to the averaging of
noise, which helps a lot in producing quality TOA estimates.
B. Threshold-to-noise ratio algorithm
The CFR estimate Ĥp ∈ C2Ntot can be used to evaluate
the discrete power delay profile (PDP) ŵp = |IDFT{Ĥp }|2
corresponding to antenna port p. The resolution of this PDP
is given by TPDP = 2Ntot13∆f , and the time interval spanned is
 1 1
  
− 6∆f , 6∆f = −11.11 µs, 11.11 µs . The approach used in
the work presented for estimating the TOA out of ŵp , builds
upon the assumption that the estimated CIR is made out of
the sum of a signal component and of a complex Gaussian
noise component. As a consequence, the samples of the PDP
ŵ = 21 (ŵ0 + ŵ1 ) resulting from the accumulation of the two
antenna ports’ PDPs can be considered as random variables
having a χ2 distribution. The threshold based estimator of [14]
Ĥ0 Ĥ1
L̂0 L̂1
ESPRIT MDL MDL ESPRIT
τ̂00 , ..., τ̂ 0 0 τ̂01 , ..., τ̂ 1 1
L̂ −1 L̂ −1
uncertainty
evaluation
measurement
P̂(t0 ) ζ̂(t0 ) selection
y(t) R(t)
ζ̂(t)
Kalman filter
P̂(t)
P̂(t − 1)
z −1
ζ̂(t − 1)
z −1
Fig. 8. Flow graph of the EKAT algorithm.
was tested, which exploits this fact for evaluating a closed
formula for the probability Ped to detect a false early TOA
[14]. It is shown in [14] that Ped is only a function of the
threshold-to-noise ratio (TNR), TNR = γth /σn2 , where σn2 is
the noise variance. Hence, a TNR achieving a target early
detection probability of, say, Ped = 10−3 can be evaluated,
and used to set a threshold γth based on the estimated noise
variance σ̂n2 . The TOA τ̂T is then evaluated as the first PDP
sample above the set threshold, where the suffix (·)T identifies
the TNR based estimator. An example of TNR TOA estimation
is shown in Fig. 7, together with the threshold γth used in the
estimation and the corresponding PDP.
C. EKAT algorithm
Besides the TOA estimation algorithm considered in Section
IV-B, an estimator which is more robust against multipath
and permits more insights on the feasibility of an indoor
positioning LTE system has been considered, at the cost of
an increased complexity. More particularly, the “ESPRIT and
(1) Kalman filter for time of Arrival Tracking” (EKAT) ranging
algorithm is employed, which is thoroughly described in [2],
[11], and briefly presented in the following. The algorithm
flow graph is shown in Figure 8. EKAT uses as an input the
CFR estimates Ĥp from the two antenna ports p = 0 and
p = 1. These are used to estimate the number of received
multipath components L̂p using the minimum description
length (MDL) criterion, and the multipath TOA τ̂0p , ..., τ̂L̂pp −1
using the ESPRIT SRA, similarly to the approach of [15]. An
example of ESPRIT TOA estimation is shown in Fig. 7, where
the multipath estimated from the two antenna ports p = 0 and
p = 1 is plotted against the corresponding combined PDP
ŵ. After the TOA estimation, for each antenna port p, the
DP is selected among the multipath TOA estimates, and the
measurement uncertainty is computed according to a bound
based approach described in [2], [11], [16]. Finally, the DP
TOA estimations from the two antenna ports, collected in the
vector y(t) ∈ R2 , and their uncertainties, collected in the
 2016 International Conference on Indoor Positioning and Indoor Navigation (IPIN), 4-7 October 2016, Alcalá de Henares, Spain

covariance matrix R(t) ∈ R2×2 , are fed into a conventional

200 ρ(t) − c0 D̂ c0 d̂ = 0.0491 m/s
Kalman filter, which performs a tracking in the pseudorange
ˆ 0 ) + (t − t0 )c0 d̂
d(t c0 D̂ = 36874 m
domain, according to the state-space model of [2], [17], [18]. 180

ranges [m]
The tracked TOA τ̂E at time t, where the suffix (·)E identifies ˆ (EKAT)
d(t)
the EKAT estimator, and its variance are given by the first 160 LRP range
component of the estimated state vector ζ̂(t) and the upper left
element of the estimated covariance matrix P̂(t), respectively. 140

D. Combining measurements from cells of the same BS 120

An estimate τ̂x , x ∈ {T, E}, of the DP TOA is computed 8:32 8:34 8:36 8:38 8:40 8:42 8:44
for each cell received in a particular measurement. It happens UTC time
frequently however that signals are received from a number (a)
of sector cells served by the same BS transmitter. The mea-
160
surements performed show that the cells controlled by the
same BS share the same clock. Hence, the TOA estimates
of cells pertaining to the same BS can be combined, in order 140

ranges [m]
to produce a single pseudorange measurement per BS.
For the TNR based algorithm, a simple strategy was
120
adopted, to choose the earliest between the TOA estimations
gathered in the same measurement from cells controlled by the
same BS. Meanwhile, for the EKAT algorithm, the tracked GPS range EKAT
100
TOA with the lowest estimated variance was chosen, as LRP range TNR
performed in [2]. 8:32 8:34 8:36 8:38 8:40 8:42 8:44
UTC time
V. D ETERMINATION OF THE ROVER POSITION (b)
A. Base station timing Fig. 9. Example of pseudorange correction (a) and corresponding range
estimations (b) from BS 1 operator 1. In (a), the EKAT pseudoranges are
Tests confirmed that all BSs have their unique clock, and so shown.
may differ relative to each other. To use the pseudoranges of
multiple BSs and LTE service providers, these clock offsets
must be taken into account. The estimated pseudorange is were retrieved from the information provided by the Swiss
ρ̂ = τ̂x · c0 , where τ̂x , x ∈ {T, E}, is the DP TOA estimate Federal Office of Communications (OFCOM) in [19]. Finally,
computed according to the methods of Section IV. The value the range estimation from the nth received BS at UTC time t is
of the pseudorange ρ depends on three factors, namely the true evaluated as dˆn (t) = ρ̂n (t)−c0 [D̂n +(t−t0 )d̂n ]. Fig. 9a shows
range d, the time offset to UTC at start time t0 called bias D an example of a pseudorange correction for BS 1 operator 1,
and the drift of the BS clock d, which models the change of and Fig. 9b shows the corresponding ranges resulting from
bias and is assumed linear in time. Hence, for each of the the correction of the EKAT and the TNR pseudoranges. The
N (t) received BSs at UTC time t, the pseudorange is: quantization resulting from the usage of a discrete PDP in the
TNR case is evident.
ρn (t) = dn (t) + c0 [Dn + (t−t0 )dn ], n = 1, . . . , N (t). (2) In a real application, the clock properties for the various re-
The correction of the pseudoranges is performed similarly ceived BSs can be gathered by a network of local measurement
to [1], [2], by fitting the estimated pseudoranges ρ̂ against units (LMUs) and made available to the positioning engine.
a true range d.¯ In particular, the offset and drift (D̂n , d̂n )
B. Positioning Solution
characterizing the nth BS are obtained as:
( ) As in [1], a classical extended Kalman filter (EKF) is used
2 to determine the receiver position, by exploiting the model
X
arg min ρ̂n (t)−c0 [D+(t−t0 )d]− d¯n (t) , (3)
(D,d)
t∈Tn
described in the following. Compared to [1], the acceleration
was taken into account in addition to the
 position and|velocity.
where Tn is the set of UTC epochs corresponding to all This leads to the state vector ξ = p| ṗ| p̈| where
the measurements from BS n. Since no GPS reception is p = [x y]| , x (east) and y (north) are the estimated receiver
guaranteed indoors, the true range d¯ is obtained differently coordinates, ṗ the estimated receiver velocity vector and p̈ the
with respect to [1], [2]. In this paper, the LRP positions corresponding acceleration. Under these conditions the linear
pLRP (t) are used, as: state transition model is a uniformly accelerated motion:
d¯n (t) = kpBS
n −p
LRP
(t)k, (4)  2
1 0 ∆t

0 ∆t /2 0
0 1 0 ∆t 0 ∆t2 /2 
where pBS th
n is the n BS location in the ENU coordinate ξ(t) =  0 0 1 0 ∆t 0  · ξ(t − 1), (5)
| 00 0 1 0 ∆t
column vector pn = xBS
BS
n ynBS znBS . The BS locations 00 0 0 1 0
00 0 0 0 1
 2016 International Conference on Indoor Positioning and Indoor Navigation (IPIN), 4-7 October 2016, Alcalá de Henares, Spain

TABLE II LRP ground CEP=8.97 m

231.260
R ANGING ERRORS STATISTICS R95=18.50 m
truth RMS=11.50 m

Op. BS ε̄ T [m] ε0.5 0.95 [m] ε̄ [m] ε0.5 [m] ε0.95 [m]
T [m] ε T E E E
N (t) ≤ 3

Y-coord. CH1903 (Grid 1km)

1 7.72 4.39 15.35 4.80 3.19 9.21
N (t) = 4
1 N (t) ≥ 5

231.240
2 14.17 9.14 21.70 9.45 7.98 17.42
1 9.94 5.91 19.48 7.94 5.02 14.62
2
2 21.50 9.35 50.67 18.98 8.63 46.01
3 1 20.98 9.96 44.98 13.00 8.83 22.16

231.220
where ∆t is the elapsed time since the last measurement.
The model for the measurement equation is given by z(t) =
[z1 (t), . . . , zN (t) ]| , where N (t) is the number of received BSs

231.200
at time t, and each component zn (t) is the measured range
between the receiver and the nth BS, which is:
704.440 704.460 704.480 704.500

zn (t) = pBS n − p(t) ,
n = 1, . . . , N (t), (6)
X-coord. CH1903 (Grid 1km)
2
with the vector pBS
n ∈ R representing the known 2D location (a)
th
of the n received BS.
For this experiment, the receiver clock bias is not included CEP=7.69 m
LRP ground

231.260
in the positioning model, as the local receiver time is aligned R95=17.13 m
truth RMS=9.61 m
with UTC, as explained in Section III-A, and has zero drift. In N (t) ≤ 3
the application being considered an estimate of the local clock Y-coord. CH1903 (Grid 1km) N (t) = 4
bias can be obtained outdoors thanks to a GNSS position fix,
231.240 N (t) ≥ 5
prior to moving indoors. The local clock is then assumed and
taken in this experiment to be known and with zero drift.
The EKF was built on the model of (5)-(6), which was
used to obtain a state estimation ξ̂(t) and hence a position
231.220

estimation p̂(t). The predict and update phases used for the
implementation of the EKF are described in [20]. The process
noise and the measurement noise matrices of the EKF were
assumed static and tuned manually. The same values were used
231.200

for both TOA measurement methods.

VI. R ESULTS
The performance of the various exploited TOA estimators
were evaluated by defining a ranging error for each received
BS as Ed = |dˆ− d|,
¯ where d¯ is the LRP true range, as defined
in Section V-A. A representative set of performance figures
were evaluated and shown in Tab. II, namely the root mean
square error (RMS), calculated as ε̄ = (E[Ed2 ])1/2 , the 50%
circular error probability (CEP) and the 95% radius (R95),
calculated as the value εp that satisfies the P (Ed < εp ) = p,
p = {0.5, 0.95}, respectively. As one can see, the ranging
accuracy for the set of BSs varies from 7.72 m to 21.50 m
RMS for the TNR estimator, and from 4.80 m to 18.98 m RMS
for the EKAT estimator.
Fig. 10 shows the positioning results for the different TOA
estimation methods. The marker colour indicates the number
of received BSs. For benchmarking and performance tests,
the positioning errors were calculated by exploiting the LRP
ground truth pLPR , as Ep = kp̂ − pLPR k. Fig. 11 shows the
corresponding positioning error cumulative density function
P (Ep < ε) for the two TOA estimation methods employed.
Performance figures similar to those of the ranging results
704.440 704.460 704.480 704.500
X-coord. CH1903 (Grid 1km)
(b)
Fig. 10. Indoor positioning results achieved with the ranges evaluated through
the TNR (a) and the EKAT (b) algorithms. The black solid line represents the
laser ground truth.
were evaluated for the positioning error Ep , namely the RMS,
the 50% CEP, and the R95.
As one can see from Fig. 10, both TOA estimation methods
obtain an RMS below 12 m. This is an impressive performance
result, bearing in mind the fact that the LTE signals used
have 15 MHz and 20 MHz bandwidth and are transmitted from
outside the building, while usually TOA based indoor ranging
systems use ultra-wideband signals (with a bandwidth of up
to hundreds of MHz) transmitted from indoor anchor points.
Looking in more detail, the region where both the TOA
estimation methods give poor positioning fixes is the first part
of the route, located outdoors, which is highlighted with an
 2016 International Conference on Indoor Positioning and Indoor Navigation (IPIN), 4-7 October 2016, Alcalá de Henares, Spain
1 of around 8m 50% CEP once moving through the test building,
0.8
P (|Ep | < ε)
0.6
EKAT
TNR
0.4
CEP
R95
0.2
RMS
0 [1] F. Knutti, M. Sabathy, M. Driusso, H. Mathis, and C. Marshall, “Posi-
0 5 10 15 20 25 30 35 40
ε [m]
Fig. 11. Indoor positioning error statistics achieved with the ranges evaluated
through the TNR and the EKAT algorithms.
orange ellipse in the plots of Fig. 10a and Fig. 10b. This part
of the route is in front of the entrance of the HSR building,
below the ground level, and surrounded by massive concrete
facilities, as Fig. 2b depicts. Hence, it is likely that in this
position, some of the LOS paths coming from the received BSs
are completely obstructed, leading to biased range estimations
and consequently to erroneous position fixes.
The TNR method achieves an RMS of 11.5 m, a 50%
CEP of 8.67 m, and a R95 of 18.5 m, which is a creditable
performance since the ranges are obtained with a simple
threshold crossing algorithm in mainly NLOS conditions. The
worst errors are obtained in the south eastern corner of the
building, as highlighted by the green ellipse of Fig. 10a, and
are probably due to the low SNRs and low number of BSs
visible in this locality.
The EKAT method achieves slightly better figures, with an
RMS of 9.61 m, a 50% CEP of 7.69 m, an R95 of 17.13 m,
and an overall smoother behaviour, probably due to the track-
ing performed both in the pseudorange and in the positions
domains. The EKAT position fixes result in a maximum error
of approximately 20 m, and an estimated receiver trajectory
which is clearly visible and always inside the building.
VII. C ONCLUSION
In the difficult indoor test environment (where there were
no GNSS signals) it was found that LTE signals from a total
of 3 to 5 base stations could be received, from three service
providers - sufficient to be able to perform a position fix by tri-
lateration. A combination of LTE CRS symbol measurements
was used to improve the estimates of the pseudoranges from
the receiver to each base station; across the width of the LTE
frequency channel (15-20MHz), over an extended time period
(10 LTE slots, corresponding to the typical slow movement
when indoors), and for the multiple (2-3) sector signals of
the same base station. The EKAT algorithm using SRAs was
found to be quite accurate, robust and smooth indoors, while
the TNR algorithm using a threshold does not perform as
well in the most difficult environments, but is simpler. Using
the combination techniques and either TOA estimators the
experiments showed a 2D horizontal positioning performance
using just these LTE signals.
Future work should consider improved dynamic models for
tracking the movement of the device, and should tackle some
of the typical problems of realistic applications, such as the
extension of the positioning trilateration algorithms to include
also the estimation of the local clock time and drift.
R EFERENCES
tioning Using LTE Signals,” in Europ. Navigation Conf., Apr. 2015.
[2] M. Driusso, F. Babich, F. Knutti, M. Sabathy, H. Mathis, and C. Mar-
shall, “Vehicular position tracking using LTE signals,” IEEE Transac-
tions on Vehicular Technology, accepted for publication, July 2016.
[3] C. Gentner, E. Munoz, M. Khider, E. Staudinger, S. Sand, and
A. Dammann, “Particle filter based positioning with 3GPP-LTE in
indoor environments,” in IEEE/ION Position Location and Navigation
Symposium, Apr. 2012, pp. 301–308.
[4] C. Gentner, S. Sand, and A. Dammann, “OFDM indoor positioning
based on TDOAs: Performance analysis and experimental results,” in
Intern. Conf. on Localization and GNSS, June 2012, pp. 1–7.
[5] J. A. del Peral-Rosado, J. M. Parro-Jimenez, J. A. López-Salcedo,
G. Seco-Granados, P. Crosta, F. Zanier, and M. Crisci, “Comparative
results analysis on positioning with real LTE signals and low-cost
hardware platforms,” in 7th ESA Workshop on Satellite Navigation
Technology and European Workshop on GNSS Signals and Signal
Processing, Dec 2014, pp. 1–8.
[6] J. A. del Peral-Rosado, M. Bavaro, J. A. Lopez-Salcedo, G. Seco-
Granados, P. Chawdhry, J. Fortuny-Guasch, P. Crosta, F. Zanier, and
M. Crisci, “Floor Detection with Indoor Vertical Positioning in LTE
Femtocell Networks,” in IEEE Globecom Workshops, Dec 2015.
[7] E. Staudinger and A. Dammann, “Round-trip delay indoor ranging
experiments with OFDM signals,” in IEEE International Conference on
Communications Workshops (ICC), June 2014, pp. 150–156.
[8] G. L. Stüber, Principles of Mobile Communication, 2nd ed. Kluwer
Academic, 2001.
[9] 3GPP TS 36.211, Evolved Universal Terrestrial Radio Access (E-
UTRA); Physical channels and modulation (Release 11), 3rd Generation
Partnership Project, V11.0.0, October 2012.
[10] G. Cai, B. M. Chen, and T. H. Lee, Unmanned Rotorcraft Systems.
Springer, 2011.
[11] M. Driusso, F. Babich, F. Knutti, M. Sabathy, and C. Marshall, “Estima-
tion and tracking of LTE signals time of arrival in a mobile multipath
environment,” in 9th International Symposium on Image and Signal
Processing and Analysis (ISPA), September 2015, pp. 276–281.
[12] Y. Liu, Z. Tan, H. Hu, L. Cimini, and G. Li, “Channel Estimation for
OFDM,” IEEE Communications Surveys and Tutorials, vol. 16, no. 4,
pp. 1891–1908, Fourth quarter 2014.
[13] W. C. Jakes, Microwave Mobile Communications. Wiley-IEEE Press,
1994.
[14] D. Dardari, C.-C. Chong, and M. Win, “Threshold-Based Time-of-
Arrival Estimators in UWB Dense Multipath Channels,” IEEE Transac-
tions on Communications, vol. 56, no. 8, pp. 1366–1378, August 2008.
[15] X. Li and K. Pahlavan, “Super-resolution TOA estimation with diversity
for indoor geolocation,” IEEE Transactions on Wireless Communica-
tions, vol. 3, no. 1, pp. 224–234, Jan 2004.
[16] F. Li, R. Vaccaro, and D. Tufts, “Performance analysis of the state-space
realization (TAM) and ESPRIT algorithms for DOA estimation,” IEEE
Trans. Antennas Propag., vol. 39, no. 3, pp. 418–423, Mar. 1991.
[17] J. Salmi, A. Richter, and V. Koivunen, “Detection and Tracking of
MIMO Propagation Path Parameters Using State-Space Approach,”
IEEE Trans. Signal Process., vol. 57, no. 4, pp. 1538–1550, Apr. 2009.
[18] T. Jost, W. Wang, U. C. Fiebig, and F. Perez-Fontan, “Detection and
Tracking of Mobile Propagation Channel Paths,” IEEE Trans. Antennas
Propag., vol. 60, no. 10, pp. 4875–4883, Oct 2012.
[19] OFCOM - Location of radio transmitters. Swiss Federal Office of Com-
munications (OFCOM). Accessed on: 2015-11-03. [Online]. Available:
http://www.bakom.admin.ch/themen/frequenzen/00652/00699/index.html
[20] T. K. Yaakov Bar-Shalom, X.-Rong Li, Estimation with applications to
tracking and navigation. Wiley-Interscience, 2001, pp. 506–537.