Content uploaded by Yuval Amizur
Author content
All content in this area was uploaded by Yuval Amizur on Oct 01, 2017
Content may be subject to copyright.
1
High-Accuracy Indoor Geolocation using
Collaborative Time of Arrival
Leor Banin, Ofer Bar-Shalom, Nir Dvorecki, and Yuval Amizur
Abstract—Collaborative time of arrival (CToA) is the next
generation, indoor geolocation protocol, which is designed for
enabling scalability of the existing IEEE802.11/Wi-Fi-based, ge-
olocation systems. The protocol leverages on the IEEE802.11 fine
timing measurements (FTM) capabilities, enabled in state-of-
the-art Wi-Fi chipsets, and supports two concurrent operation
modes; the CToA “client-mode” enables “GPS-like” operation
indoors, and allows an unlimited number of clients to privately
estimate their position and navigate indoors, without exposing
their presence to the network. The CToA “network-mode” is
designed for large-scale asset-tracking applications, and enables
a centric positioning server to pinpoint objects equipped with
wireless, Wi-Fi-based, low-power electronic tags (e-Tags).
The CToA protocol is a broadcast-based protocol that operates
over an un-managed network, built out of cheap, unsynchronized
units called “CToA broadcasting stations” (bSTA). The bSTAs,
which are stationed at known locations, periodically broadcast
a unique beacon transmission and publish its time of departure
(ToD). Neighbor bSTA units and clients that receive the beacon
broadcast, measure and log its time of arrival (ToA). Every bSTA
publishes its most recent timing measurement log as part of its
next beacon broadcast. CToA clients combine their own ToA
measurements with those published by the bSTAs, in order to
estimate and track their location. CToA e-Tag clients act similar
to bSTAs, and simply wake-up sporadically to broadcast a CToA
beacon. The ToA of that broadcast is measured and logged by the
receiving bSTAs similarly to beacons broadcast by other bSTAs.
The timing measurement report is then delivered to a centric
positioning server that can estimate and track the location of
numerous CToA-based e-Tags, simultaneously.
The paper outlines the principles of the CToA protocol and the
mathematical background of the position estimation algorithms.
In addition, performance examples as well as theoretical analysis
of the expected positioning accuracy are provided.
Index Terms—geolocation, Indoor navigation, fine timing mea-
surement, FTM, time delay estimation, Maximum likelihood
estimation, WLAN, Wi-Fi, IEEE 802.11
I. INTRODUCTION
THE challenge of accurate indoor location and navigation
has been attracting an increasing amount of attention
since the mid 1990’s. Cultivated by the cellular revolution and
the U.S. federal communication committee (FCC) enhanced
911 services (E911) [1], indoor location has ignited a rapid
development of mobile location technologies. The ubiquity of
IEEE802.11TM wireless local area network (WLAN) technol-
ogy in mobile devices, which to date, has already reached an
attach-rate of 100% in the smart-device segment [2], facilitated
the development of WLAN-based indoor location systems.
Due to the lack of standard infrastructure for high-resolution
timing measurement capabilities in its early releases, existing
L. Banin, O. Bar-Shalom, N. Dvorecki and Y. Amizur are with Intel’s
Location Core Division, 94 Em Hamoshavot Rd., Petah Tikva 49527, Israel.
Corresponding author’s e-mail: oferbarshalom@gmail.com.
WLAN-based location technology relies, to a great extent, on
the WLAN received signal strength indicator (RSSI) infras-
tructure. The RSSI is a measure of the RF energy received by
the station. WLAN stations estimate the RSSI of the beacons
broadcast by access points (AP), and use this metric to sort
between the APs based on their signal quality and proximity.
The RSSI metric is measured in units of [dBm], and in general
is inversely proportional to the logarithm of the squared
distance between the transmitter and the receiver [16]. RSSI-
based mobile device positioning exists in two main flavors:
path-loss models, and “fingerprinting”. Path-loss models relate
the received signal power to the propagation distance. A set
of RSSI measurements obtained from different WLAN APs
in the vicinity of the client station, enable it to estimate its
position via trilateration methods [18], [19]. While this method
is relatively simple to implement, it is prone to yield fairly
inaccurate positioning results due to the large variations in the
RSSI measurements [6]. The alternative approach is to corre-
late the RSSI measurements against a pre-calibrated database
of RSSI “fingerprints”, measured over a pre-defined grid and
stored in a server. The fingerprint approach provides better
accuracy compared to the path-loss based RSSI. However, as
the method’s accuracy is sensitive to even minor changes in
the propagation channel (e.g., a placement of a new sales-stand
in a shopping mall), frequent re-calibrations and updates of
the fingerprints database are required. The high-maintenance
incurred by this type of positioning systems obviously limits
their scalability.
Facing the limited positioning accuracy enabled by
RSSI/path-loss based location technologies and the limited
scalability of fingerprint-based systems, industry vendors be-
gan seeking alternative WLAN-based positioning technolo-
gies, which will enable to achieve higher positioning accuracy.
Taking advantage of the high bandwidth supported by the
WLAN systems (ranging between 20-160 MHz), the approach
pursued was geolocation based on time-delay estimation [11].
Though the early releases of the IEEE802.11TM standard
included means for time delay estimation, the timing resolution
enabled by these mechanisms was in the microseconds level
- too coarse for any practical indoor positioning applications.
High-accuracy positioning in a dense multipath environment
imposed several hardware design changes in the existing
WLAN chipsets, in order to increase the timing resolution
from the microseconds level to the nanosecond level (or
even sub-nanosecond level). The solution that was endorsed
by the IEEE802.11TM group, was a novel time-delay based
ranging protocol called “fine-timing measurement” (FTM).
The FTM protocol enables a WLAN station to measure its
2
distance w.r.t. another station1. The range measurement is
based on high-resolution, time delay estimation, which also
accounts for the latency imposed by the chipset hardware. The
hardware-imposed latency (e.g. the receive/transmit filters’
group-delay and other hardware latencies), is measured and
pre-calibrated by the chipset in order to reach the required
timing resolution. Obtaining an accurate time delay estimate
in a dense-multipath environment is typically implemented
using some super-resolution method , which are applied to the
estimated channel response, [9], [10]. FTM is a point-to-point
(P2P), single-user protocol, which includes an exchange of
multiple message frames between an initiating WLAN station
(STA) and a responding STA. The initiating STA attempts to
measure its range w.r.t. the responding station (e.g., WLAN AP
or a dedicated FTM responder). The FTM message sequence
chart is illustrated in Fig. 1. The time of flight (ToF) between
ƚ
ϭ
/ŶŝƚŝĂƚŝŶŐ
^d
ZĞƐƉŽĚŝŶŐ
^d
ƚ
Ϯ
ƚ
ϯ
ƚ
ϰ
ϭϬŵƐ;ƌĞĐŽŵŵĞŶĚĞĚͿ
aϮϬŵƐ
Fig. 1. FTM Protocol Message Flow Example
the two stations is calculated using (1),
ToF =(t4−t1)−(t3−t2)
2(1)
where t1denotes the time of departure (ToD) measured by
responding station, and t4denotes the time of arrival (ToA),
which is estimated by the responding station. The values of t1
and t4are reported back to the initiating station2after the com-
pletion of the FTM measurement phase. The initiating station
1Notice that FTM only enables to measure the range between two stations.
Obtaining a position estimate based on multiple range measurements is out
of the standard scope. However, the standard does define mechanisms for the
responding stations to provide their location information (such as, absolute or
relative position coordinates, floor level etc.), in an information element (IE),
called location configuration information (LCI). The LCI of the responding
stations may be used by the initiating station to estimate its absolute or relative
position.
2The values of t1and t4are reported at picosecond granularity.
combines these parameters along with its own estimated ToA,
t2, and measured ToD, t3values, to obtain a range estimate
w.r.t. the responding station3. The FTM protocol has first
appeared in the 2016 release of the IEEE802.11TM standard
[23] (formerly known as IEEE802.11REVmc). Followed the
standard release, the Wi-Fi alliance - the organization that
promotes Wi-Fi technology - has announced in February 2017
on a Wi-Fi location certification program to certify WLAN
devices complying with the FTM protocol.
Being a P2P, single-user protocol, the FTM protocol is lim-
ited in scenarios where an extremely large number of users are
requesting positioning services simultaneously. Provided no
FTM message transactions are lost on the way due to temporal
channel interruptions, the initiating station should be able to
obtain a range estimate w.r.t. the responding station within
about 30ms. Hence, obtaining its position, which involves
ranges estimation towards 3 additional stations, should ideally
take about 100-120ms. This implies that each FTM responder
may be able to serve about 30 client stations per second.
Clearly, with more and more navigating stations attempting
to execute FTM sessions, the collision likelihood increases,
which effectively decreases the number of stations that can be
serviced. Consider for example, large stadiums hosting rock
concerts or major sports events. In such occasions it is easy
to imagine tens of thousands of users navigating throughout
the stadium area using location-based services. Servicing all
these users might require to deploy a network of thousands of
FTM responders around the stadium. The protocol described
in the sequel, dubbed “collaborative time of arrival” (CToA),
is aimed to provide a more cost-effective solution for such use
cases.
Paper Organization: The remainder of the paper is orga-
nized as follows. Section II gives an overview of the CToA
protocol and its challenges. The mathematical model for the
positioning problem considered, is formulated in section III.
This section is divided into three parts; the first part, ad-
dressed in section III-A, outlines the measurement models
and maximum-likelihood position estimators for client-mode
CToA in the absence of clock-skewness. These measurement
models are then used in section III-B for obtaining measures
for the expected positioning accuracy. The third part, which
is outlined in section III-C, introduces the effect of the clock-
drifts on the measurement models. This section also details
the Kalman filter algorithm that is executed by the client
device and used for estimating and tracking all the time-
varying parameters in the system. System-level simulation
performance are described in section IV. In the appendix
we derive the Cram´
er-Rao lower bounds for the positioning
problem and the associated concentration ellipses, both of
which are used in the main text to illustrate the theoretical
system performance discussed in section III-B.
Notation: We use lower-case letters to denote scalars,
lower-case, boldface letters to denote vectors, and upper-
case, boldface letters to denote matrices. We further
3The exchange of the FTM measurement message and its acknowledgement
(ACK) frame, which has to be sent out after exactly a short inter-frame spacing
(SIFS) of 16µs, is assumed to finish within a short period, during which the
clocks of the two stations do not drift appreciably.
3
use the following nomenclature throughout the paper.
{·}Ttranspose
diag{x}N×Ndiagonal matrix,
whose diagonal is the vector x
INN×Nidentity matrix
1NN×1vector of 1’s
0NN×1vector of 0’s
⊗Kronecker product
∥x∥norm of the vector x,
i.e. √xTx=ix2
i
argmin
x∥y(x)∥search for the value of xthat minimizes
the norm of y(x)
n∼ N(µ, σ)Gaussian-distributed noise with
mean, µ, and standard-deviation, σ.
E{.}Expectation operator
cThe speed of light,
c= 2.99792458 ·108m/s.
II. SC AL IN G-U P TH E FTM PROTOC OL
A. CToA Overview
CToA is a geolocation protocol designed for scaling up the
number of clients that could be serviced simultaneously. This
can be achieved through the use of broadcast approach rather
than a P2P or a point to multi-point ranging approach. The pro-
tocol operates over an un-managed network of unsynchronized
and independent units called “CToA broadcasting stations”
(bSTA), which together form a high-precision, geolocation
network. The bSTAs, which are deployed at known locations,
are implemented using either standard WLAN APs that have
the ability to measure accurate ToA or network-detached,
FTM-responders.
According to the CToA protocol, the bSTA units serve several
purposes. Every bSTA:
•Periodically broadcasts a CToA “beacon” and measures
the ToD of that beacon.
•Listens for CToA beacons broadcast by its neighbor
bSTAs, and measures their ToA.
•Maintains a log of its current ToD and ToA measure-
ments, and publishes its most recent measurements log
as part of its next CToA beacon broadcast.
•Periodically announces its location as part of its CToA
beacon broadcasts.
The CToA protocol supports two modes: a client-mode and
a network-mode. While both modes rely on the same protocol
principles, they are targeted towards different usage models:
•Client-Mode CToA - may be visioned as the indoor
counterpart of the global navigation satellite systems
(GNSS). It is designed for enabling an unlimited number
of clients to estimate their location and navigate, simul-
taneously, while maintaining their privacy. The CToA
client stations (cSTAs) only listen to the bSTA broadcasts.
Once a cSTA receives a broadcast, it measures its ToA
and combines it with the ToD/ToA measurements log
published by the bSTA in the CToA beacons, in order
to determine its position. Since the cSTAs do not trans-
mit, their presence is not exposed and their privacy is
maintained.
•Network-Mode CToA - designed to enable a network
administrator to simultaneously track the position of a
large number of clients. This mode is useful for large
scale asset tracking (e.g., using eTags4), fleet manage-
ment, law-enforcement, etc. CToA clients in operating
in the network-mode do not listen for CToA beacons,
but only transmit CToA beacons (at rather low rate), in
order to enable the network administrator to track their
position. The sporadic, short transmissions executed by
such devices enables them to operate for long periods
using small, coin-cell batteries.
As bSTAs activity in the two modes is identical, the CToA
network can support both modes simultaneously.
Since the protocol is based on broadcasting of CToA
beacons, it is uni-directional; the CToA beacons are unac-
knowledged if not received. Yet, the fact that beacons can
be received by multiple neighbor bSTAs in the vicinity of the
broadcasting bSTA, gives a level of redundancy and immunity
against frame losses. Each CToA beacon is associated with a
unique packet identification index (PID), which is assigned to
it by the broadcasting unit. The PID is typically implemented
as a running counter, and is independently maintained by every
bSTA. Each CToA beacon has a ToD time-stamp (measured by
the broadcasting unit), and multiple ToA measurements - all of
which are associated with the same PID. The PID enables the
CToA clients (operating in “client-mode”), or the positioning
server (in “network-mode”) to associate between the ToD and
its corresponding ToA measurements, collected either by the
client itself or different bSTAs.
In addition to the ToD, some of the CToA beacons broadcast
by every bSTA include also a data log of the timing mea-
surements collected by the bSTA during the past n-seconds.
This data log is called “CToA location measurement report”
(CLMR). The timing measurements included in the CLMR
reports are used by the cSTA, which combines them with
its own ToA measurements in order to estimate its position.
Although the CLMR logs are maintained by each of the
bSTAs independently, the protocol also enables the CLMR
logs broadcast by one bSTA to be aggregated by its neighbors,
thereby providing an immunity mechanism against “hidden-
nodes” in the wireless network.
Figures 2-3 illustrate an example of CToA beacon broadcast
and its reception. The example assumes a CToA network,
which consists of 3 bSTA units and a single cSTA. These units
are assigned with (simplified) medium-access control (MAC)
addresses: 10:01, 10:02 and 10:03, while the cSTA has a MAC
address of 55:55. As depicted in Fig. 2, at some point indicated
by ToD time-stamp of “199678” (measured in picoseconds and
referenced to the time-base of bSTA#1), bSTA#1 broadcasts
a CToA beacon associated with PID “1551”. The ToD and
the PID are logged in the CLMR log maintained by bSTA#1.
This log also includes the MAC address of the broadcasting
bSTA. The beacon propagates, and as illustrated in Fig. 3, it is
received by the neighbor bSTAs (#2 & #3), and by the cSTA
4An “e-Tag” refers to an electronic tag - a small, wireless-enabled device
that is attached to a larger object, and enables to remotely monitor various
measures related to the object including its location. In the context of this
paper the e-Tag is assumed to be Wi-Fi enabled.
4
- all of which update their CLMR logs accordingly: bSTA#2
measured the ToA of the beacon to be “329673” (referenced
to its own time-base) and updates that value in its CLMR log,
along with it MAC address as the receiving unit. Similarly do
bSTA#3 and the cSTA, which estimate the ToAs of that same
beacon to be “341006”, and “133564”, respectively.
ď^dηϭ
DϭϬ͗Ϭϭ
ď^dηϮ
DϭϬ͗ϬϮ
ď^dηϯ
DϭϬ͗Ϭϯ
dŽůŝĞŶƚ;Đ^dͿ
Dϱϱ͗ϱϱ
dŽĞĂĐŽŶƌŽĂĚĐĂƐƚ
ZyDdŽdyDdŽW/
ϭϬ͗Ϭϭϭϵϵϲϳϴϭϱϱϭ
Fig. 2. CToA Beacon Broadcast Example
ď^dηϭ
DϭϬ͗Ϭϭ
ď^dηϮ
DϭϬ͗ϬϮ
ď^dηϯ
DϭϬ͗Ϭϯ
dŽůŝĞŶƚ;Đ^dͿ
Dϱϱ͗ϱϱ
dŽĞĂĐŽŶZĞĐĞƉƚŝŽŶ
ZyDdŽdyDdŽW/
ϭϬ͗ϬϮϯϮϵϲϳϯϭϬ͗Ϭϭϭϵϵϲϳϴϭϱϱϭ
ZyDdŽdyDdŽW/
ϱϱ͗ϱϱϭϯϯϱϲϰϭϬ͗Ϭϭϭϵϵϲϳϴϭϱϱϭ
ZyDdŽdyDdŽW/
ϭϬ͗ϬϯϯϰϭϬϬϲϭϬ͗Ϭϭϭϵϵϲϳϴϭϱϱϭ
Fig. 3. CToA Beacon Reception Example
The CLMR logged by each of the bSTAs will be broadcast
as part of their next CToA beacon broadcast event, and the
CLMR logs will be updated accordingly. As will be explained
in sectionIII-C, the entries of the CLMR log table will undergo
a time-stamp matching step, in which the ToA measurements
will be matched with their corresponding ToD value. This
information, combined with the position information of the
bSTAs, (which is also provided as part of their CToA beacon
broadcasts), will be fed into a Kalman filter that will produce
an updated estimate of the cSTA’s current position.
B. The CToA Protocol
The CToA protocol follows the principles of the channel
sounding mechanism introduced for IEEE802.11ac standard
(a.k.a very high-throughput/VHT) [23]. The channel sounding
protocol, which was originally proposed for determining the
optimal beamforming weights at the transmitter side [17],
relies on a transmission of a null-data packet (NDP), which
consists of only a known sequence of OFDM symbols, but
with no data payload. The transmission of the NDP is pre-
ceded by a packet called NDP announcement (NDPA), which
informs the receivers of an NDP frame that is about to be
transmitted after a standard, short inter-frame spacing/SIFS
of 16µs from the end of the NDPA packet. The NDPA
contains information for the receiver for estimating the channel
response.
CToA relies on a similar protocol structure; the CToA
beacons broadcast by the bSTAs consist of an NDPA frame
announcing the upcoming transmission of the NDP frame,
which is used by the receivers for measuring its ToA. As
mentioned above, the NDPA also includes data that enables
the receiving clients to estimate their location. The protocol
messaging sequence for the client-mode is illustrated in Fig. 4.
As shown, cSTAs in this mode only receive, but do not trans-
mit any data, maintains their privacy. The protocol messaging
^/&^
dŽ
Ŷŝ
dŽ
ũŝ
dŽ
ŝ
ď^d
Ŷ
ď^d
ũ
Đ^d;ĐůŝĞŶƚͿ
dŽ
ŵů
ď^d
ŵ
^/&^ dŽ
ũů
dŽ
ů
dŽ
Ŷů
Fig. 4. The CToA Protocol - Client-Centric Operation
sequence for the network-mode CToA is illustrated in Fig. 5.
C. The Un-managed Operation of the CToA Network
Besides using unsynchronized broadcasting units, the CToA
network is also un-managed in the sense no that coordination
or scheduling protocol between the bSTAs (or the receiving
clients) is required for its operation. Ideally, if the bSTAs are
implemented as dedicated units, the CToA network could be
allocated with a unique operation channel (with bandwidth of
20MHz, 40MHz or 80MHz, depending on the spectrum band
in which the system operates). Any bSTA can first scan the
spectrum to detect prior CToA broadcast activity, and once
detected - the bSTA can contend on accessing that channel
5
^/&^
dŽ
ũŝ
ď^d
Ŷ
ď^d
ũ
Đ^d;ĞͲdĂŐͿ
dŽ
ŵů
ď^d
ŵ
dŽ
ũů
dŽ
Ŷů
^/&^
^/&^
dŽ
ŶdžŬ
dŽ
ũdžŬ
dŽ
ŵdžŬ
dŽ
džŬ
WŽƐŝƚŝŽŶŝŶŐ^ĞƌǀĞƌ
Fig. 5. The CToA Protocol - Network-Centric Operation
ĨƌĞƋƵĞŶĐLJ
ƚŝŵĞ
ď^dηϯ
ď^dηϰ
ď^dηϭ
ď^dηϭ
ď^dηϮ
ď^dηϯ
ď^dηϰ
>ĞŐĞŶĚ͗
͞EĂƚŝǀĞ͟WĐŚĂŶŶĞůʹdŽZyнWZy
dŽĞĂĐŽŶďƌŽĂĚĐĂƐƚďLJď^dηϭ
ŚĂŶŶĞůĂƌďŝƚƌĂƚŝŽŶ
WŶŽŶͲĂǀĂŝůĂďŝůŝƚLJǁŝŶĚŽǁŽŶ͞ŶĂƚŝǀĞ͟ĐŚĂŶŶĞů
EW
ϴϬϮ͘ϭϭĂnjEW
;dŽͲŽŶůLJͿ ^/&^
ƚŝŵĞ
ď^dηϮ
dŽĞĂĐŽŶďƌŽĂĚĐĂƐƚďLJď^dηϮ
Fig. 6. bSTA Frequency Management with AP-based bSTAs
for broadcasting its beacons, and listen to broadcasts of its
neighbor during the remaining time.
A more challenging case is when the bSTA functionality
is implemented as part of a standard Wi-Fi AP. In such case,
the AP is obligated to provide data transaction services to its
associated STAs. To ensure high-data throughput and capacity,
the Wi-Fi network typically consists of a grid of APs, where
each of them is set to operate at a different channel (aka, its
“native channel”). To enable an un-managed CToA network to
coexist with a live Wi-Fi data network, the scheme illustrated
in Fig. 6 may be used. According to this scheme, the AP/bSTA
periodically (e.g., once every few minutes) scans the spectrum
to detect CToA broadcast activity. Following the scan results,
the AP/bSTA announces to its associated STAs, on a short
“un-availability window” (such window should typically last 1
millisecond or less). During that window, the bSTA/AP hops
between the native channels of its neighbor bSTA/APs. On
each of these channels it broadcasts a short CToA beacon,
which only includes its ToD but lacks the CLMR. When the
AP returns to its native channel, it broadcasts a longer CToA
beacon that includes both its ToD and its recent CLMR.
This process is depicted in Fig. 6. This example illustrates
the frequency hopping process of two AP-based bSTAs (#1
and #2), in a CToA network that consists of a total of 4 AP-
based bSTAs. As shown, while bSTA#1 goes off of its native
channel, it hops between the channels occupied by AP/bSTAs
#2,#3 and #4, and on each channel it broadcasts a short bea-
con. The broadcasting process, including the standard WLAN
channel arbitration, lasts about 200µs while the beacon itself,
(which consists of NDPA-SIFS-NDP) consumes about 100µs.
When bSTA#1 returns to its native channel, it broadcasts a
longer beacon that includes also the CLMR log. A similar
process is executed by bSTA#2.
By scanning the medium, the CToA clients can detect the
CToA activity and infer the broadcast periodicity of the bSTAs.
Once the cSTA figures out this information, it simply needs
to hop between the native channels used by the bSTA/APs,
and collect the CLMRs broadcast on each of these channels.
Under the assumption of 5Hz beacon broadcasting rate, the
unavailability of the AP for its associated STAs is about
0.5% or less. Accordingly, within 200 milliseconds the client
should be able to gather sufficient information for estimating
its position.
D. The CToA Time-Tracking Challenge
The general approach described above, of synchronizing a
network using time-stamped broadcast transmissions, is well-
known [20]. However, whilst most network-based applications
(e.g., audio or video distribution) would be satisfied with
microsecond or even millisecond-level synchronization, ac-
curate geolocation applications require sub nanosecond-level
accuracy. Attaining such a high timing accuracy in a network
built out of unsynchronized, and independent broadcasting
units, which rely on low accuracy oscillators as their clock
source, is extremely challenging.
To understand the challenge, let us compare the problem of
client geolocation in a CToA network to a client geolocation in
a GNSS network. GNSS networks implement a similar time-
stamped broadcasts approach for enabling an unlimited num-
ber of client receivers to navigate simultaneously, worldwide.
Yet, there are two fundamental differences between the time-
tracking of receivers in a GNSS network compared to CToA
network.
1) The GNSS network is fully synchronized, whereas the
CToA network is not.
6
2) The broadcasts in a GNSS network are received simul-
taneously, while in a CToA network the broadcasts are
staggered in time.
Let’s delve into these two differences and explore them in a
bit more details. In GNSS networks the satellite vehicles (SV)
are synchronized using on-board atomic clocks, which have a
frequency stability of approx. 10−14. This frequency stability
translates into a clock-drift of roughly 1 nanosecond per day
[21], (which is equivalent to a ranging error of about 35cm -
an error, which is further corrected by the GNSS system).
Since GNSS networks are fully-synchronized, in terms of
timing parameters, the GNSS client receiver needs to estimate
only the offset and the drift between its internal clock, and
the GNSS network clock. The GNSS client receiver’s clock
is typically generated using a crystal oscillator/XO with a
frequency stability in the order of 10−6, which is commonly
expressed in units of parts-per-million/ppm). Tracking these
parameters (along with additional system states such as po-
sition and velocity), is done using a Kalman filter algorithm
[22].
In the CToA network, since the bSTAs are unsynchro-
nized, each bSTA contributes a clock-offset and drift that
need to be estimated and tracked. Furthermore, the different
medium-access control (MAC) methods used by GNSS and
CToA impose an additional challenge. In GNSS networks,
the multiplexing at the code space (CDMA) or the frequency
space (FDMA), ensures that broadcast transmissions from
all SVs are received simultaneously at the client. On the
other hand, CToA relies on the “listen-before-talk” MAC
of the IEEE802.11TM, which effectively results in timing
measurements being staggered in time. Given that a typical
Wi-Fi XO has an accuracy of ±25ppm, consecutive timing
measurements taken of the same broadcasting source may
accumulate significant time-drift [14]. This effectively means
that while one bSTA clock offset is being measured, the other
bSTAs clock offsets keep on drifting apart. As an example,
consider two bSTA broadcast timing measurements taken by
a static receiver, while the beacons are being broadcast at rate
of 5Hz. The drift of the second ToD time-stamp accumulates to
up to 5µs (w.r.t. its nominal value). This effectively translates
into a ranging error of: ≈5µs·3·108m/s = 1500m! Clearly,
the clock skewness poses a major challenge for the receiver,
which requires the application of filtering techniques for
tracking these changes over time. As will be described in the
sequel, the CToA client uses a Kalman filter for tracking the
various timing-related parameters as well as it own location.
Assuming the rate at which the clock offsets vary in time is
slow enough, a beacon broadcasting rate of 3-5Hz by each
bSTA is sufficient for the cSTAs to accurately track the clock
behavior of the bSTAs.
III. CTOA PROB LE M FOR MU LATI ON & POSITIONING
ALG OR IT HM S
In the following section, the mathematical background of
the CToA client position estimation is established. To facilitate
the explanation we split the derivation into two parts; first,
in section III-A, we address the position estimation problem
under the idealistic assumption that the bSTA clocks do not
drift over time, such that their offsets w.r.t. to the client’s
clock are time-invariant. Under this assumption we derive the
position estimators for two cases:
•”1st Fix” - corresponds to the scenario, at which the client
first attempts to sync and estimate its position.
•“Tracking” - corresponds to the scenario where the client
already has an estimate of its position and the bSTA
timing-related parameters, and continues tracking them
using a Kalman filter.
These measurement models are used for developing approxi-
mate performance bounds that can predict the expected posi-
tioning accuracy. Then, in section III-C, we define the Kalman
filter that enables the client to simultaneously estimate and
track its own location coordinates, as well as the clocks
parameters the bSTAs, (both of which it receives directly, as
well as of bSTAs received indirectly via other bSTA).
A. CToA MLE Solution in the Absence of Clock Drift
We shall now derive the maximum-likelihood estimates
(MLE) of the client position under the assumption that the
clocks of the client and the bSTA do not drift over time, so
that the clock offsets are fixed. For simplicity, the derivation
assumes a horizontal position only, (which is typically of most
interest in indoor-positioning scenarios). The extension to 3-
dimensional positioning is straightforward.
We define a “measurement” as the time-of-flight (ToF)
of a broadcast transmission between two endpoints, Aand
B. The transmitting endpoint, A, measures the broadcast’s
time of departure (ToD), while the receiving endpoint, B,
measures its time of arrival (ToA). Both timing measurements
are referenced to a 3rd party clock, and thus have offsets
marked by νAand νB, respectively.
z,ToFAB = (ToAB+νB)−(ToDA+νA)(2)
By denoting the coordinates vectors of the endpoints as qAand
qB, respectively, and ignoring any non-line of sight (NLoS)
timing biases, the ToF between the two endpoints may be
expressed as,
ToFAB ∼
=1
c∥qB−qA∥ ≡ ToAB−ToDA(3)
Combining (2) with (3) we obtain the definition of a noiseless
ToF measurement as,
˜z,1
c∥qB−qA∥+νB−νA(4)
If the 3rd party also acts as the receiving endpoint, then νB= 0
and the noiseless ToF measurement is defined as,
¯z,1
c∥qB−qA∥ − νA(5)
1) MLE Solution for CToA Client’s First Fix: Assume that a
single CToA client station (cSTA), located at: p= [x, y]T, at-
tempts to estimate its position using time-delay measurements
it gathers from MCToA bSTAs, whose locations are known to
the cSTA, where the mth bSTA is located at qm= [xm, ym]T.
The cSTA collects two types of time delay measurements:
7
•bSTAi→bSTAjmeasurements, where i, j ∈
1. . . M , ∀i̸=j. These time-delays are measured by the
bSTAs and published in their CToA beacon broadcast.
The cSTA collects Lmeasurements of this type, where
the lth measurement is denoted by ˜zl. Each measurement
is subjected to additive measurement error denoted by
˜nl∼ N(0,˜σ).
•bSTAi→cSTA, where i∈1. . . M . These time-delays
are measured by the cSTA itself, and the cSTA collects L
measurements of this type, where the ℓth measurement is
denoted by ¯zℓ. Each measurement is subjected to additive
measurement error denoted by ¯nℓ∼ N(0,¯σ). Typically,
¯σ > ˜σ.
Let νidenote the (unknown) offset between the cSTA &
bSTAiclocks. A single bSTAi→cSTA, ToA measurement
of the ℓth broadcast made by the ith bSTA, may be modeled
as,
¯zℓ=1
c∥p−qi∥ − νi+ ¯nℓ, ℓ = 1, . . . , L(6)
Similarly, the measurement of the lth broadcast that is received
by the jth bSTA, may be modeled as,
˜zl= ToFij −νi+νj+ ˜nl
= ToAj−ToDi−νi+νj+ ˜nl(7)
=1
c∥qj−qi∥+βij −νi+νj+ ˜nl, l = 1, . . . , L
Notice that the ToF (scaled by the propagation speed, c),
may represent a biased version of the range between the
two bSTAs. This may happen due to some obstruction in the
propagation medium, resulting in a non-line of sight (NLoS)
link between the two endpoints. The scalar βij >0represents
the NLoS ranging bias between the ith and jth bSTAs.
However, since the position of the bSTAs is assumed to be
known apriori, βij can be easily estimated and eliminated. For
the sake of derivation clarity, it shall be further assumed that
βij = 0,∀i, j. An example for timing measurements collected
under the assumptions that the bSTA clocks are stable and do
not drift over time is illustrated in Fig. 7.
E67$$
E67$%
F67$
FORFNRIIVHWVWLPHGLIIHUHQFH
PHDVXUHPHQWQRLVH
Fig. 7. Timing Measurements with Stable Clock
Let eidenote an M×1vector of zeros, whose ith entry is 1.
Using this notation,
νi=eT
iν(8)
νj−νi= (eT
j−eT
i)ν(9)
where, ν,[ν1, . . . , νM]T. Now, the timing measurements
may be recast as,
¯zℓ=1
c∥p−qi∥ − eT
iν+ ¯nℓ(10)
˜zl= ToFij + (eT
j−eT
i)ν+ ˜nl,
≈1
c∥qj−qi∥+ (eT
j−eT
i)ν+ ˜nl(11)
We may further define the following vectors and matrices,
¯
z,[¯z1, . . . , ¯zL]T,
˜
z,[˜z1, . . . , ˜zL]T,
z,¯
z
˜
z
¯
dℓ(p),∥p−qi∥
˜
dl,∥qi−qj∥
¯
d(p),[¯
d1(p), . . . , ¯
dL(p)]T
˜
d,[˜
d1, . . . , ˜
dL]T
d(p),¯
d
˜
d(12)
¯
E,[−ei,1, . . . , −ei,L]T
˜
E,[(ej,1−ei,1), . . . , (ej,L −ei,L)]T
E,¯
E
˜
E
¯
n,[¯n1, . . . , ¯nL]T
˜
n,[˜n1, . . . , ˜nL]T
n,¯
n
˜
n
Using the definitions of (12), we may recast (10)-(11) as,
z=c−1d(p) + Eν+n(13)
Assuming that the measurement noise is Gaussian-distributed
with the mean and covariance as follows,
E{n}=0
E{nnT}=¯σ2IL0
0˜σ2IL,W(14)
Then the maximum likelihood estimate (MLE) of the cSTA
position vector, ˆ
p, may be obtained as,
ˆ
p=argmin
p,ν
(z−c−1d−Eν)TW−1(z−c−1d−Eν)(15)
The estimate of the clock offsets vector may be found using
weighted least-squares (WLS) criteria,
ˆ
ν= (ETW−1E)−1ETW−1(z−c−1d)(16)
Define,
B,[W−1−W−1E(ETW−1E)−1ETW−1](17)
8
Then, by substituting (16) back in (15) we get,
ˆ
p=argmin
p
(z−c−1d)TB(z−c−1d)(18)
The nonlinear minimization problem in (18) can be solved via
2-dimensional grid search (or 3-dimensional search, in case of
3-positioning), over all the possible locations.
2) MLE Solution for a CToA Client in “Tracking” Mode:
Once the CToA client receiver has converged to the true values
of the bSTA clock offsets and continuously tracks them, these
clock offsets may be considered as “known” (up to some
estimation error). In such case it would be reasonable to
assume that z≃¯
z,d≃¯
d. Define,
ζ,¯
z−¯
Eˆ
ν(19)
The resulting measurement model in this case may be recast
as,
ζ=c−1¯
d(p) + ˇ
n(20)
The additive noise vector, ˇ
n, is assumed to be Gaussian
distributed with the following properties:
E{ˇ
n}=0
E{ˇ
nˇ
nT},¯σ2+σ2
r·IL(21)
where σrcorresponds to the standard deviation residual esti-
mation error of the clock offsets. The client position MLE in
this case is obtained by minimizing the following cost function
ˆ
p=argmin
p
ζ−c−1¯
d(p)
2(22)
where again, the nonlinear minimization problem in (22) can
be solved via grid search over the position coordinates space.
B. Approximate CToA Performance Analysis
In order to obtain theoretical performance bounds, the
skew-less measurement models derived in section III-A were
used for calculating the respective Cram´
er-Rao lower bounds
(CRLB). The derived bounds are affected mainly on the
geometrical properties of the network deployment, as well as
the additive noise levels. Yet, these bounds ignore propagation
models which may take into account the type of materials
through which the signals propagate.
To illustrate the expected positioning accuracy, the bounds
are depicted as “heat-maps”, where the colors are mapped to
the location according to the size of the minimal theoretical po-
sitioning error predicted by the CRLB. Under the assumption
that the additive measurement noise is Gaussian-distributed,
for each location on a given grid of locations one can calculate
the concentration ellipse that defines the smallest area at which
the CToA receiver is contained with a given probability. As
explained in Appendix C, the concentration ellipse is tightly
related to the position estimation error covariance matrix
predicted by the CRLB, which is derived in Appendix A.
Fig. 8- 9 describe the geometric-dependent accuracy of CToA
in a typical office network deployment, where the magenta
rings denote the position of the bSTAs. The color mapping
corresponds to the size of the major axis of the 95% percentile
concentration ellipse at that position (namely, 2σ), as the
measure of accuracy. The bound is calculated using,
Bound @ 95% = κ·λmax (23)
where κis calculated using (77) and λmax is evaluated for the
measurement models (13).
The bound was evaluated over a pre-defined grid covering
the office floor with a resolution of 0.5m×0.5m. The theo-
retical error was computed under the assumption is that at
each grid point the CToA client receives timing measurements
from only the 4 nearest bSTAs. Fig. 8 illustrates the expected
accuracy for a “1st-Fix” scenario, while Fig. 9 corresponds
to the “tracking” scenario. The measurement noise standard
deviations assumed in the “1st-Fix” scenario were ¯σ=1.5m,
and ˜σ=0.6m. For the “tracking” scenario the assumed residual
error was σr=0.3m.
Fig. 8. Accuracy of CToA at “1st-Fix” Mode in a Typical Office Environment
Fig. 9. Accuracy of CToA at Tracking Mode in a Typical Office Environment
As can be seen, once the CToA client has its EKF con-
verged, the positioning error over the entire area drops signifi-
cantly compared to the “1st-Fix” scenario. It can be further be
9
shown that positioning accuracy of the “1st-Fix” resembles to
the accuracy of a hyperbolic, time-difference of arrival (TDoA)
based, positioning system. When the client converges its time
tracking, the performance is similar to the performance that
can be achieved using ToA-based positioning system (namely,
an FTM-based system in which the client estimates ranges
(or round-trip time/RTT) to individual bSTAs). The following
proposition proves that the asymptotic accuracy of the client-
based CToA system is equivalent to “tracking” mode and
hence to the achievable RTT accuracy.
Proposition 1 (Asymptotic CToA Performance): The asymp-
totic positioning accuracy for a CToA client in “1st-Fix” mode,
approaches the accuracy attained in “tracking” mode, given
N→ ∞ replicas of the bSTA→bSTA timing measurements.
Proof: See Appendix B.
C. Coping with Clock Drifts Using Kalman Filtering
E67$
E67$
F67$
FORFNRIIVHWVWLPHGLIIHUHQFH
FORFNVNHZIUHTXHQF\GLIIHUHQFH PHDVXUHPHQWQRLVH
Fig. 10. Timing Measurements with Skewed Clocks
The analysis outlined in the former section ignored any
clock skews, which result from the XO’s frequency deviations.
Such deviations may be caused due to multiple effects such as:
ambient temperature changes, phase noise, thermal noise, ag-
ing, and so on. To illustrate the timing measurements collected
under clock skews, consider the example depicted in Fig. 10.
In this example there is a single client station (cSTA) and two
bSTAs marked #A and #B. Each of the bSTAs has an initial
timing offset w.r.t. the cSTA clock, which is denoted by νA(t0)
and νB(t0), respectively. In addition, the bSTAs XOs’ output
frequencies are skewed, such that the clock offsets drift over
time at rates, which are denoted by ˙νAand ˙νB, respectively.
To facilitate the explanation, the assumption in this illustration
is that the skew rate is time-invariant. Yet, in practice it may
change over time (e.g., due to ambient effects). Each bSTA
measures the broadcast events timing (ToD or ToA) relative
to its native time base. Once the measurements are conveyed
to the cSTA for enabling it to compute its location, then the
cSTA needs to resolve the instantaneous clock offset of the
bSTA, which is associated with that measurements and is a
function of the offset drift rate. Under the assumed 1st-order
clock skew model, the instantaneous value of the clock-offset
of the nth bSTA is calculated using,
νn(ti) = νn(ti−1) + ˙νn×∆t(24)
where νn(ti−1)corresponds to the previous estimated value of
the clock offset, (whose νn(t0), is its initial value), ˙νndenotes
the clock-skew (or the change rate of the clock offset), and
∆t=ti−ti−1.
In the following section we outline the algorithm, which
enables the client station to estimate and track its location. The
Kalman Filter is the optimal estimate for linear system models
with additive independent white noise in both the transition
and the measurement system models. Yet, in many systems,
including navigation systems, the measurement model is not
linearly dependent in the parameters of interest. In such cases,
the extended Kalman filter (EKF), which is the nonlinear
version of the Kalman filter, is widely used [22], [24]. In
the EKF, the state transition and observation models are not
required to be linear functions of the states, but instead, may
be only differentiable functions. In the client-mode CToA, the
EKF is executed by the client and is used by the client to
estimate and track its own position coordinates, as well as
the timing parameters of the stray bSTA units, from which
it receives the measurement broadcasts. In the network-mode
CToA, the EKF is executed at a centric positioning server,
connected to the CToA network, and is used for tracking the
position of multiple clients simultaneously, as well as tracking
the timing parameters of all the network bSTAs. Consequently,
the system states tracked by the EKF in each of the modes
are different; the network-mode EKF needs to track position
per client, as well as timing parameters of all network bSTA.
In the following section we focus on the client-mode CToA
EKF.
1) CToA EKF System Model: The EKF is described by
two equations: a system model equation and an observation
(measurement) model with additive noise. The system model
is defined by the following recursive equation,
xk=Fkxk−1+wk, k ≥0(25)
where the index kdenotes the discrete time-step. The vector
xkdenotes an N×1states vector, which describes the
parameters being estimated and tracked by the filter. The
states vector for the client-mode CToA consists of the client’s
position coordinates and per-bSTA clock parameters (clock
offset and clock offset change rate (or skew)). This vector is
defined as follows. The size of the EKF state vector is thus:
N= 3 + 2M, where Mdenotes the number of bSTAs being
10
received by the cSTA (both directly and indirectly)5.
pk,[xk, yk, zk]T
νk,[ν1,k, . . . , νM ,k]T
˙
νk,[ ˙ν1,k , . . . , ˙νM,k ]T
xk,pT
k,νT
k,˙
νT
kT(26)
The state-vector xkis associated with a covariance matrix,
Pk=E{(xk−¯
xk)(xk−¯
xk)T}(27)
where ¯
xk,E{xk}. When the filter is initialized the state-
covariance matrix is assumed to be,
P0=
˜
Pp,00 0
0σ2
ν,0IM0
0 0 σ2
˙ν,0IM
(28)
where σν,0,σ2
˙ν,0denote the initial values for the standard
deviations of the clock offsets and drifts, and ˜
Pp,0denotes
the initial value of states covariance matrix, given by
˜
Pp,0,
σ2
x,00 0
0σ2
y,00
0 0 σ2
z,0
(29)
The initial values of the standard deviations constructing
the initial states covariance matrix are commonly determined
empirically.
The dynamic system-model linear transfer function is denoted
by Fk, an N×Nblock-diagonal matrix defined as follows,
Fk,
I30 0
0 IM∆tIM
0 0 IM
(30)
where ∆tcorresponds to the elapsed time between two con-
secutive discrete time steps.
The vector wkdenotes a random N×1model noise vector,
which described the uncertainties in the system model and has
the following statistical properties:
E{wk}=0
E{wkwT
k}=Qk
E{wkwT
j}=0,∀k̸=j(31)
E{wkxT
k}=0,∀k
In the CToA EKF system model, the process noise, wkis
assumed to be distributed as, wk∼ N(0,Qk), where system
model noise covariance matrix, Qk, is a block-diagonal matrix
given by,
Qk= ∆t·
Qp,k 0 0
0˜σ2
νIM0
0 0 ˜σ2
˙νIM
(32)
5In a GPS system, since the entire GPS network is synchronized and uses
highly-stable atomic clocks, the receiver has to track only its clock offset
and drift w.r.t. the GPS system clock. Furthermore, the SVs orbital motion
generates a substantial Doppler offset on the GPS carrier frequency, which
enables to estimate the GPS receiver 3-dimensional speed. Thus, the EKF
state vector in the GPS receiver typically includes a total of 8 states: 3 states
for the receiver position, 3 states for the 3-dimensional receiver speed and 2
states for the clock model.
where,
Qp,k ,
˜σ2
x0 0
0 ˜σ2
y0
0 0 ˜σ2
z
(33)
In general, the determination of the noise variance values of
Qk, is challenging, and is often resorted to some heuristic
methods. Commonly it is assumed that most of the clock
deviation is dictated by the clock skew, rather than clock mea-
surement noise. The values of {˜σ2
x,˜σ2
y,˜σ2
z}are determined
according to the motion assumptions of the cSTA device (e.g.,
pedestrian, vehicle/drone etc.).
2) CToA EKF Measurement Model: The measurement
model is defined as,
zk=h(xk) + vk(34)
where zkis a J×1vector of measurements, in which each
entry corresponds to a ToF measurement that follows the def-
inition in (2). The vector h(x),[h1(x), h2(x), . . . , hJ(x)]T,
denoting the nonlinear measurement model vector transfer
function, and vkdenotes the additive measurement noise that
has the following statistical properties:
E{vk}=0
E{vkvT
k}=Rk=σ2
mI
E{vkvT
j}=0,∀k̸=j(35)
E{vkxT
k}=0,∀k
E{wkvT
j}=0,∀k, j
As discussed in sec. III-A, there are two types of transfer
functions, which depend on the type of the measurement
(bSTAi→cSTA or bSTAi→bSTAj). From (10)-(11) it
is easy to see that the corresponding measurement transfer
functions are given by,
hℓ(xk) = 1
c∥pk−qi∥ − eT
iνk(36)
hl(xk) = 1
c∥qj−qi∥+ (ej−ei)Tνk(37)
Since the measurement transfer function, h(·)is nonlinear, it
cannot be applied to estimate the measurements covariance
matrix directly. Instead we linearize h(·)by replacing it
with its first order Taylor series expansion, calculated around
ˆ
xk|k−1:
h(xk)∼
=h(ˆ
xk|k−1) + Hk·(xk−ˆ
xk|k−1)(38)
where the notation, ˆ
xn|mrepresents the estimate of xat time
ngiven observations up to and including time m≤n. The
matrix Hkdenotes the Jacobian of the measurement model
function vector h(·), which is a J×Nmatrix defined as,
Hk,
∂h1
∂x1
∂h1
∂x2··· ∂ h1
∂xN
.
.
.....
.
.
∂hJ
∂x1
∂hJ
∂x2··· ∂ hJ
∂xN
[Hk]ij ≡∂hi
∂xjx=ˆ
xk|k−1
(39)
11
The Jacobian is obtained by calculating the partial derivatives
of (36)-(37). Equations (40)-(41) define the corresponding
lines of the matrix Hk.
[Hk]ℓ=(pk−qn)T
c∥pk−qn∥,−eT
i,0T
M(40)
[Hk]l=0T
3,(ej−ei)T,0T
M(41)
The EKF is a recursive estimator, in which only the es-
timated state from the previous time step and the current
measurement are required for the computation of the estimate
for the current state. The state of the filter is represented by
two variables: the vector ˆ
xk|k, which denotes the aposteriori
state estimate at time kgiven observations up to and including
at time k, and Pk|k, the aposteriori error covariance matrix.
The CToA EKF algorithm is summarized in Algorithm 1.
Initialize
1. Use (16) and (18) for obtaining
an estimate for ˆ
p0and ˆ
ν0.
2. Set ˆ
x0= [ˆ
pT
0,ˆ
νT
0,0T
M]T
Predict
EKF time as well as EKF states, are predicted according
to the ToA of the received NDP packet.
Predicted state estimate:
ˆ
xk|k−1=Fkˆ
xk−1|k−1(42)
Predicted covariance estimate:
Pk|k−1=Fk−1Pk−1|k−1FT
k−1+Qk−1(43)
Update
The measurements included in the LMR conveyed by the
packet are updated according to the
new EKF predicted time.
Innovation (measurement residual):
˜
yk=zk−h(ˆ
xk|k−1)(44)
Innovation covariance:
Sk=HkPk|k−1HT
k+Rk(45)
Near-Optimal Kalman gain:
Kk=Pk|k−1HT
kS−1
k(46)
Updated state estimate:
ˆ
xk|k=ˆ
xk|k−1+Kk˜
yk(47)
Updated estimate covariance:
Pk|k= (I−KkHk)Pk|k−1(48)
Algorithm 1: CToA Client-Mode EKF Algorithm
IV. CTOA PERFORMANCE IN AN IND OO R NET WO RK
In the following section we outline some simulation perfor-
mance of an indoor CToA network. To analyze the accuracy of
the client position estimates, the EKF position estimates were
compared against a “ground truth” trajectory. The reference
trajectory was generated using a light detection and ranging
(LIDAR)-based ground truth tool [13]. The LIDAR system
used integrates a 270olaser scanner, which uses a dedicated
map and laser measurements to estimate its position. The
LIDAR output is a series of position reports generated at a
rate of 20Hz with an accuracy of 10-30 cm. The map is
obtained in advance by performing a survey of the venue using
the LIDAR, during which a structure map is created using
a simultaneous localization and mapping (SLAM) algorithm.
This is a one-time procedure, and the generated map is then
used in subsequent sessions for localization of the device.
Fig. 11 depicts the reference client trajectory (denoted by p
and marked by red dots), and the position estimates (denoted
by ˆ
pand marked by line-connected blue dots). The location
of the bSTAs is marked by the red rings. The simulation
generated independent clock sources for each of the bSTAs.
These clocks were generated with an accuracy of ±10ppm
and with Gaussian-distributed clock noise with zero mean
and standard deviation of ±10−9(1 ppb). The bSTAs were
set to broadcast CToA beacons at 2Hz. Each bSTA exchange
measurements its 4 nearest neighbor bSTAs. On every point
along the trajectory, the CToA client used measurement from
the 4 nearest bSTAs. The cumulative distribution function
(CDF) of the positioning errors is depicted in Fig. 12. As can
be seen, the estimation accuracy is equal or better to 1.5m for
95% of the position estimates along the trajectory.
Fig. 11. CToA bSTA Deployment a Typical Office Environment
V. CONCLUSIONS
Collaborative time of arrival (CToA), which is the next
generation, indoor geolocation protocol was presented. The
protocol is designed for enabling scalability of the existing
IEEE802.11/Wi-Fi-based, geolocation systems. The protocol
uses beacon broadcast-based fine-time delay measurements,
collected by both clients and un-managed bSTA units, in
order to concurrently enable an unlimited number of clients
to privately navigate indoors, and enable a positioning server
to track a plethora of clients of a different type (e-Tags).
12
012345678
Positioning Error [m]
0
10
20
30
40
50
60
70
80
90
100
CDF [%]
Client Positioning Error CDF
Fig. 12. CToA Client Positioning Error CDF in a Typical Office Environment
Due to the infrequent nature of the beacon broadcasts,
and the skewness of the clocks used by the network units,
the estimation of the position, as well as the clock-related
parameters is implemented using a Kalman filter, which is
executed by every CToA client independently (or by the
positioning server, for tracking the position of the CToA e-
Tags). System simulations indicate that the network is capable
of reaching a positioning accuracy of about 1.5m in a typical
office environment in 95% of the cases. These results also
match the theoretical performance predicated by the CRLB.
APP EN DI X
A. CToA Cram´
er Rao Lower Bound
We shall now derive the Cram´
er-Rao lower bound (CRLB)
for the CToA method in the absence of clock drifts. The
CRLB provides a lower bound on the covariance matrix of
any unbiased estimator.
1) CRLB CToA Client in “1st Fix” Mode: Since the ob-
servations vector, m, is distributed m∼ N(µ,W), the ijth
entry of the Fisher information matrix (FIM) may be obtained
as [29],
Jij = tr W−1∂W
∂ψi
W−1∂W
∂ψj+ 2 ∂µT
∂ψi
W−1∂µ
∂ψj(49)
where ψiis the ith element of the unknown parameters vector,
ψ,[pT,νT]T. Noticing that Wis free of any unknown
parameters, then
Jij = 2 ∂µT
∂ψi
W−1∂µ
∂ψj(50)
For, µ,c−1d+Eν, the partial derivatives w.r.t. the client’s
position coordinates are given by,
∂µ
∂x =c−1˙
dx≡c−1[˙
¯
dT
x0T
L]T
∂µ
∂y =c−1˙
dy≡c−1[˙
¯
dT
y0T
L]T(51)
∂µ
∂νi
=Eei
where ˙
¯
dx,˙
¯
dydenote the vectors containing the partial deriva-
tives w.r.t. the client’s position coordinates, which are given
by,
∂¯
di
∂x =−(xi−x)
(xi−x)2+ (yi−y)2(52)
∂¯
di
∂y =−(yi−y)
(xi−x)2+ (yi−y)2(53)
Using (51), the FIM elements can be found as,
Jxx = 2c−2˙
dT
xW−1˙
dx=2
c2¯σ2
˙
¯
dT
x˙
¯
dx
Jxy =Jyx = 2c−2˙
dT
xW−1˙
dy=2
c2¯σ2
˙
¯
dT
x˙
¯
dy
Jyy = 2c−2˙
dT
yW−1˙
dy=2
c2¯σ2
˙
¯
dT
y˙
¯
dy(54)
Jxνi= 2c−1˙
dT
xW−1Eei
Jyνi= 2c−1˙
dT
yW−1Eei
Jνiνj= 2eT
iETW−1Eej
Define,
Jpp ,Jxx Jxy
Jyx Jyy (55)
Jpν,Jxν
Jyν(56)
The FIM is given by,
J=Jpp Jpν
JT
pνJνν (57)
The CRLB is obtained by inverting the complete FIM.
J−1=Jpp −JpνJ−1
νν JT
pν−1()
() () (58)
The bound on the position coordinates is given by the top-left
block of J−1,
C1stFix
pp =Jpp −JpνJ−1
νν JT
pν−1(59)
2) Approximate CRLB for CToA client in “Tracking” Mode:
When the EKF is converged and the bSTA clock offsets are
known (up to some residual error), and are being continuously
tracked, then µ≃c−1d, and ψ,p.
Consequently,
Jij ≃2
c2(¯σ2+σ2
r)∂µT
∂ψi
∂µ
∂ψj(60)
The partial derivatives are obtained using (51), and the CRLB
on the position coordinates estimation error is obtained by,
CTracking
pp ≃1
JxxJyy −J2
xy Jyy −Jxy
−Jxy Jxx
=σ2
xx σxy
σxy σ2
yy (61)
13
B. Proof of Proposition 1
Assume that every CToA broadcast includes Nreplicas of
the timing measurements collected by the bSTA. If the clock
offsets were time-invariant then one could define,
ˇ
E,¯
E
1N⊗˜
E,ˇ
W,¯σ2IL0
0˜σ2IN×L(62)
Next, from (54) we have,
Jνiνj= 2eT
iETW−1Eej(63)
Then, under (62), Jνiνjbecomes,
ˇ
Jνiνj= 2eT
iˇ
ETˇ
W−1ˇ
Eej
= 2eT
i¯σ−2¯
ET˜σ−21T
N⊗˜
ET¯
E
1N⊗˜
EEej
= 2eT
i¯σ−2¯
ET¯
E+N·˜σ−2˜
ET˜
Eej
≈
N→∞ 2N˜σ−2eT
i˜
E˜
ETej.(64)
Recall that from (59) we have,
C1stFix
pp =Jpp −JpνJ−1
νν JT
pν−1(65)
Hence, under N→ ∞,ˇ
Jpνˇ
J−1
νν ˇ
JT
pν→0.
Thus, given enough bSTA→bSTA measurements (equivalent
to an EKF in “tracking” mode), C1stFix
pp ≈CTracking
pp (up to
additive noise level scaling).
This concludes the proof.
C. On the Relation between the Concentration Ellipse and the
CRLB
In [27], Torrieri derived the theory for bounding Gaussian-
distributed estimation errors. In the geolocation problem con-
sidered, the parameters of interests include the 2-D coordinates
vectors, which are defined as: p∈R2,p= [x, y]T. The
following appendix is based on the derivation in [27], and
outlines the relation between the concentration ellipse, which
provides a measure of accuracy for an unbiased estimator of
a 2-D Gaussian vector, and the CRLB.
Let ˆ
pdenote an unbiased estimate of p, then given that the
additive noise can be modeled as Gaussian, the probability
density function (pdf) of the estimation error is given by,
f(ˆ
p|p) = exp −1
2(ˆ
p−p)TΣ−1(ˆ
p−p)
(2π)n
2det(Σ)(66)
where,
Σ,E(ˆ
p−p)(ˆ
p−p)T(67)
The loci of constant density is defined as,
(ˆ
p−p)TΣ−1(ˆ
p−p),κ(68)
The scalar κis a constant that determines the size of the n-
dimensional region enclosed by the surface, which in the 2-D
case is an ellipse. The probability that ˆ
pis contained inside
that region is given by,
Pin = R
·· ·f(ˆ
p|p)dˆ
p(69)
where,
R=ˆ
p: (ˆ
p−p)TΣ−1(ˆ
p−p)≤κ(70)
As shown in [27, eq. (39)], for the 2-D case,
Pin = 1 −exp(−κ/2) (71)
Further we have,
Σ=E(ˆ
p−p)(ˆ
p−p)T=σ2
xx σxy
σxy σ2
yy (72)
The eigenvalues of Σcan be found by solving: det{Σ−λI}=
0.
λ1=1
2σ2
xx +σ2
yy +(σ2
xx −σ2
yy )2+ 4σ2
xy(73)
λ2=1
2σ2
xx −σ2
yy +(σ2
xx −σ2
yy )2+ 4σ2
xy(74)
J
J
[
[
-
N
O
NO
Fig. 13. Concentration ellipse and coordinate axes
As depicted in Fig. 13, assuming that the principle axes of
the concentration ellipse lie on the axes ξ1, ξ2, which are
counterclockwise rotated w.r.t. to axis system γ1, γ2by an
angle ϑ, then:
ξ1
ξ2=ATγ1
γ2(75)
where,
A=cos ϑ−sin ϑ
sin ϑcos ϑ(76)
is an orthogonal matrix (with eigenvectors as columns). Since
Σis symmetric positive-definite matrix, and thus, so is Σ−1,
the matrix ATΣ−1Ais diagonal, provided that |ϑ| ≤ π
4.
It can be shown that for a consecration ellipse defined by
γTΣ−1γ, the principle axes of the concentration ellipse are
given by 2√κλ1and 2√κλ2. In order to obtain a bound on
the maximal positioning error with a given probability, Pin,
at a specific position, one needs to evaluate the size of half
of the ellipse’s major axis that is given by √κλmax, where
λmax is obtained by (73) and,
κ=−2 ln(1 −Pin )(77)
14
To summarize, the concentration ellipse is defined by 3 pa-
rameters: its major axis, its minor axis and its rotation angle
- all of which can be obtained from the theoretical covariance
matrix defined by the CRLB. This concludes the appendix.
REF ER EN CE S
[1] “Wireless E911 Location Accuracy Requirements,” Federal Communi-
cations Commission, PS Docket No. 07-114, Feb. 3, 2015.
[2] “Mobile Device Feature Attach Rate and Penetration,” ABI Research,
August 14, 2014
[3] J. Zheng, C. Wu, H. Chu and P. Ji, “Localization Algorithm Based on
RSSI and Distance Geometry Constrain for Wireless Sensor Network,”
2010 International Conference on Electrical and Control Engineering,
Wuhan, 2010, pp. 2836-2839.
[4] J. Torres-Sospedra et al., “Comprehensive analysis of distance and sim-
ilarity measures for Wi-Fi fingerprinting indoor positioning systems,”
Expert Systems with Applications, vol. 42, no. 23, pp. 9263-9278, Dec.
2015.
[5] A. T. Parameswaran, M. I. Husain, S. Upadhyaya, “Is RSSI a Reliable
Parameter in Sensor Localization Algorithms: An Experimental Study,”
2009
[6] E. Elnahrawy, X. Li and R. P. Martin, “The limits of localization using
signal strength: a comparative study,” 2004 First Annual IEEE Commu-
nications Society Conference on Sensor and Ad Hoc Communications
and Networks, IEEE SECON 2004., 2004, pp. 406-414.
[7] K. Wu, J. Xiao, Y. Yi, D. Chen, X. Luo and L. M. Ni, “CSI-Based
Indoor Localization,” IEEE Trans. on Parallel and Distributed Systems,
vol. 24, no. 7, pp. 1300-1309, July 2013.
[8] Y. Shu et al., “Gradient-Based Fingerprinting for Indoor Localization
and Tracking,” IEEE Trans. on Industrial Electronics, vol. 63, no. 4,
pp. 2424-2433, April 2016.
[9] X. Li and K. Pahlavan, “Super-resolution TOA estimation with diversity
for indoor geolocation,” IEEE Trans. on Wireless Communications, vol.
3, no. 1, pp. 224-234, Jan. 2004.
[10] F. X. Ge, D. Shen, Y. Peng and V. O. K. Li, “Super-Resolution Time
Delay Estimation in Multipath Environments,” IEEE Trans. on Circuits
and Systems I: Regular Papers, vol. 54, no. 9, pp. 1977-1986, Sept.
2007.
[11] L. Banin, U. Schatzberg, Y. Amizur, “Next Generation Indoor Position-
ing System Based on WiFi Time of Flight,” 26th International Tech-
nical Meeting of the Satellite Division of The Institute of Navigation,
Nashville TN, Sept. 16-20, 2013.
[12] U. Schatzberg, L. Banin and Y. Amizur, “Enhanced WiFi ToF indoor
positioning system with MEMS-based INS and pedometric informa-
tion,” 2014 IEEE/ION Position, Location and Navigation Symposium -
PLANS 2014, Monterey, CA, 2014, pp. 185–192.
[13] L. Banin, U. Schatzberg and Y. Amizur, “WiFi FTM and Map Infor-
mation Fusion for Accurate Positioning,” 2016 International Confer-
ence on Indoor Positioning and Indoor Navigation (IPIN), Alcal´
a de
Henares, Spain, 4-7 October 2016.
[14] H. Kim, X. Ma and B. R. Hamilton, “Tracking Low-Precision Clocks
With Time-Varying Drifts Using Kalman Filtering,” IEEE/ACM Trans.
on Networking, vol. 20, no. 1, pp. 257–270, Feb. 2012.
[15] X. Cao et al., “Joint Estimation of Clock Skew and Offset in Pairwise
Broadcast Synchronization Mechanism,” IEEE Trans. on Comm., vol.
61, no. 6, pp. 2508–2521, June 2013.
[16] T. S. Rappaport, Wireless Communications: Principles and Practice,
Prentice Hall PTR, 1996.
[17] E. Perahia and R. Stacey, Next Generation Wireless LANs: 802.11n
and 802.11ac, and Wi-Fi Direct, Cambridge University Press, 2nd Ed.,
2013.
[18] A. J. Weiss, “On the Accuracy of a Cellular Location System Based
on RSS Measurements,” IEEE Trans. on Vehicular Technology, vol. 52,
no. 6, pp. 1508–1518, Nov. 2003.
[19] S. Mazuelas et al., “Robust Indoor Positioning Provided by Real-Time
RSSI Values in Unmodified WLAN Networks,” IEEE Jour. of Selected
Topics in Signal Processing, vol. 3, no. 5, pp. 821–831, Oct. 2009.
[20] J. Elson, L. Girod and D. Estrin, “Fine-Grained Network Time Syn-
chronization using Reference Broadcasts,” ACM SIGOPS Operating
Systems Review - OSDI ’02, vol. 36, no. SI, pp. 147-163, Winter
2002.
[21] M. A. Lombardi, T. P. Heavner and S. R. Jefferts, “NIST Primary
Frequency Standards and the Realization of the SI Second,” The
Journal of Measurement Science, vol. 2, no. 4, pp. 74-89, Dec. 2007.
[22] P. D. Groves, Principles of GNSS, Inertial, and Multisensor Integrated
Navigation Systems, Artech House Boston-London, 2008.
[23] IEEE Std 802.11TM-2016 (Revision of IEEE Std 802.11-2012) - Part
11: Wireless LAN Medium Access Control (MAC) and Physical Layer
(PHY) Specifications, IEEE 802.11 Working Group, December 7th,
2016.
[24] S. J. Julier and J. K. Uhlmann, “Unscented filtering and nonlinear
estimation,” Proc. of the IEEE, vol. 92, no. 3, pp. 401-422, Mar. 2004.
[25] G. A. Terejanu, “Extended Kalman Filter Tutorial,” available online:
https://www.cse.sc.edu/ terejanu/files/tutorialEKF.pdf
[26] D. Taniuchi, X. Liu, D. Nakai and T. Maekawa, “Spring Model
Based Collaborative Indoor Position Estimation With Neighbor Mobile
Devices,” in IEEE Jour. of Selected Topics in Signal Processing, vol.
9, no. 2, pp. 268–277, Mar. 2015.
[27] D. J. Torrieri, “Statistical Theory of Passive Location Systems,” IEEE
Trans. on Aerospace Systems, vol. AES-20, no. 2, pp. 183-198, Mar.
1984.
[28] Q. M. Chaudhari, E. Serpedin and K. Qaraqe, “On Maximum Likeli-
hood Estimation of Clock Offset and Skew in Networks With Expo-
nential Delays,” IEEE Trans. on Signal Processing, vol. 56, no. 4, pp.
1685-1697, April 2008.
[29] H. L. Van Trees, Optimum Array Processing. Part IV of Detection,
Estimation, and Modulation Theory, John Wiley & Sons, New York,
2002.