ArticlePDF Available

Scalable Wi-Fi Client Self-Positioning Using Cooperative FTM-Sensors

Authors:

Abstract and Figures

This paper presents a protocol that enables an unlimited number of Wi-Fi users to position themselves within a meter-level accuracy and navigate indoors using time-delay-based Wi-Fi measurements. The proposed protocol, called collaborative time of arrival, is broadcast-based and relies on cooperation between the network sensors that support IEEE 802.11 fine-timing measurements (FTMs) capabilities, which are enabled in state-of-the-art Wi-Fi chipsets. The clients can estimate and track their position by passively listening to timing measurements that are exchanged between the FTM-sensors. The passive nature of the clients' operation enables them to maintain their privacy by not exposing their presence to the network. This paper outlines the principles of the protocol and the mathematical background of the position estimation algorithms. Both theoretical analysis of the expected positioning accuracy, as well as real-life system performance examples, are provided. The protocol's performance analysis is based on a publicly available database of real network measurements. **************************************************************************************** **************************************************************************************** Full text is freely available at https://ieeexplore.ieee.org/document/8579543 ****************************************************************************************
Content may be subject to copyright.
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
IEEE TRANSACTIONS ON INSTRUMENTATION AND MEASUREMENT 1
Scalable Wi-Fi Client Self-Positioning Using
Cooperative FTM-Sensors
Leor Banin, Ofer Bar-Shalom , Nir Dvorecki, and Yuval Amizur
Abstract This paper presents a protocol that enables an
unlimited number of Wi-Fi users to position themselves within a
meter-level accuracy and navigate indoors using time-delay-based
Wi-Fi measurements. The proposed protocol, called collaborative
time of arrival, is broadcast-based and relies on cooperation
between the network sensors that support IEEE 802.11 ﬁne-
timing measurements (FTMs) capabilities, which are enabled in
state-of-the-art Wi-Fi chipsets. The clients can estimate and track
their position by passively listening to timing measurements that
are exchanged between the FTM-sensors. The passive nature of
the clients’ operation enables them to maintain their privacy by
not exposing their presence to the network. This paper outlines
the principles of the protocol and the mathematical background
of the position estimation algorithms. Both theoretical analysis
of the expected positioning accuracy, as well as real-life system
performance examples, are provided. The protocol’s performance
analysis is based on a publicly available database of real network
measurements.
Index Terms—IEEE 802.11 standard, indoor navigation,
Kalman ﬁlters, maximum-likelihood estimation, multisensor sys-
tems, position measurement, time-difference-of-arrival (TDoA),
time measurement.
I. INTRODUCTION
RANGING based on time-delay measurements for wire-
less local area network (WLAN) 1mobile devices has
evolved signiﬁcantly during the past decade. The bandwidth
increases from 20 MHz up to 160 MHz, combined with
the multiple-input-multiple-output (MIMO) technology, has
ignited a rapid standardization effort of a ﬁne-timing mea-
surement (FTM) protocol [1], [2]. This has facilitated the
development of accurate, time-delay-based Wi-Fi indoor posi-
tioning and navigation systems [5]–[14]. FTM is a point-to-
point (P2P) single-user protocol, which includes an exchange
of multiple message frames between an initiating Wi-Fi sta-
tion (ISTA) and a responding station (RSTA). The ISTA
(which is typically a mobile Wi-Fi client such as a mobile
phone) attempts to measure its range with respect to the
RSTA (e.g., Wi-Fi access point (AP) or a dedicated FTM
Manuscript received August 1, 2018; revised October 21, 2018; accepted
October 22, 2018. This work was supported by Intel Communication &
Devices Group (iCDG), Intel Corporation. The Associate Editor coor-
dinating the review process was Jesús Ureña. (Corresponding author:
Ofer Bar-Shalom.)
The authors are with the Intel’s Location Core Division, Petah Tikva 49527,
Israel (e-mail: ofer.bar-shalom@intel.com).
Color versions of one or more of the ﬁgures in this paper are available
online at http://ieeexplore.ieee.org.
Digital Object Identiﬁer 10.1109/TIM.2018.2880887
1Commonly referenced using the synonym “Wi-Fi,” which is the Wi-Fi
alliance owned trademark for WLAN technology.
Fig. 1. FTM protocol message ﬂow example.
“responder”). Obtaining an accurate time-delay estimate in a
dense-multipath environment is challenging and requires an
accurate detection of the ﬁrst signal path, which is asso-
ciated with the line of sight (LoS) between the two sta-
tions and estimation of its arrival time. This is implemented
using either superresolution methods [7], [8], or maximum-
likelihood methods [9], applied to the estimated channel
response. The channel response is estimated using train-
ing sequences of orthogonal frequency-division multiplexing
(OFDM) symbols with known subcarrier modulation included
in the exchanged messages [3]. A schematic description of the
message exchange of the FTM protocol is illustrated in Fig. 1.
The time of ﬂight (ToF) between the two stations is calcu-
lated using the following equation:
ToF =(t4t1)(t3t2)
2(1)
where t1denotes the time of departure (ToD) measured by
the RSTA, and t4denotes the time of arrival (ToA), which
is estimated by the RSTA. The values of t1and t4are
reported back to the ISTA after the completion of the FTM
0018-9456 © 2018 IEEE. Translations and content mining are permitted for academic research only. Personal use is also permitted,
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
2IEEE TRANSACTIONS ON INSTRUMENTATION AND MEASUREMENT
measurement phase. The values of t1and t4are reported
at picosecond granularity using a 48-bit counter that wraps
around approximately every 281.5 s (=248·1012). The 48-bit
format was deﬁned mainly to enable a uniﬁed timing measure-
ment report format for both “millimeter-wave” 802.11 systems
(e.g., 60 GHz) and Wi-Fi systems operating in the <7-GHz
band. Yet, the achievable timing accuracy for the latter type
is in the order of 1 ns (30 cm) [13]. The ISTA combines
the values of t1and t4along with its own estimated ToA (t2)
and measured ToD (t3) values, to obtain a range estimate with
respect to the RSTA.2
Being a P2P, single-user protocol, the FTM protocol is
limited in scenarios where a large number of users are request-
ing positioning services simultaneously. Given that obtaining
a single range measurement takes roughly 30-ms per client
station (cSTA) [16], each AP may only be able to service
approximately 30 cSTAs per second (while exhausting its
capacity, leaving it with no bandwidth to provide any data
services). Moreover, with more and more navigating users
attempting to execute FTM sessions, the likelihood of frame
collision increases. This decreases the likelihood of successful
range measurement, thereby reducing the number of cSTAs
that can be serviced. This is likely to happen in large stadiums
hosting rock concerts or major sports events, large airport
terminals, central public transportation terminals, and so on.
Providing an adequate level of positioning and data services
to a user capacity of such magnitude would require the
deployment of a network that consists of thousands of FTM
responders. The collaborative ToA (CToA) protocol is aimed
to provide a cost-effective solution for such use cases.
CToA is a geolocation protocol designed to provide posi-
tioning and navigation services to a large scale of users. This
can be achieved using a broadcast approach rather than a
P2P or a point to multipoint ranging approach. The proto-
col operates over an unmanaged network of unsynchronized
and independent units called “broadcasting stations” (bSTA),
which together form a high-precision geolocation network.
The bSTAs, deployed at known locations, are implemented
using either standard Wi-Fi APs capable of measuring accurate
ToA or network detached, responderlike units with FTM
capabilities. According to the protocol [16], the bSTA units
serve several purposes. Every bSTA:
1) periodically broadcasts CToA “beacons,” which consist
of a packet used for timing measurements and some data
information elements;
2) measures the ToD of its own beacons and announces it
within the beacon;
3) listens for CToA beacons broadcast by its neighbor
bSTAs, and measures their ToA;
4) maintains a log of its current ToD and ToA measure-
ments and publishes its most recent measurements log
as part of its next CToA beacon broadcast; and
5) periodically announces its location as part of its CToA
2The exchange of the FTM measurement message and its acknowledg-
ment (ACK) frame, which has to be sent out after exactly a short interframe
spacing (SIFS) of 16μs, is assumed to ﬁnish within a short period, during
which the clocks of the two stations do not drift appreciably.
Fig. 2. CToA beacon broadcast example.
The protocol may be visioned as the indoor counterpart of
the global navigation satellite systems (GNSSs). It is designed
for enabling an unlimited number of clients to estimate their
location and navigate while maintaining their privacy. The
cSTAs only passively listen to the bSTA broadcasts. Once a
in their beacons, to determine its current position. Since the
cSTAs do not transmit, their presence is unexposed and their
privacy is maintained.
Fig. 2 illustrates an example of CToA beacon broadcast
and its reception. It assumes a CToA network, which consists
of three unsynchronized bSTA units and a single cSTA.
These units are assigned with (simpliﬁed) medium access con-
trol (MAC) addresses: “10:01,” “10:02,” and “10:03,” while the
cSTA has a MAC address of “55:55.” As illustrated in Fig. 2,
at a time indicated by ToD time-stamp of “199678” (measured
in picoseconds and referenced to the time base of bSTA#1),
bSTA#1 broadcasts a CToA beacon associated with packet
identiﬁcation (PID) “1551.” The ToD and the PID are logged
in a “CToA location measurement report” (CLMR) log-ﬁle
maintained by bSTA#1, which also includes the MAC address
of the bSTA. The CLMR broadcast by bSTA1 also includes
the time-stamps it has measured for previous broadcasts it
received from bSTA#2 and #3. The beacon propagates through
the channel, and as illustrated in Fig. 2, is received by bSTA
#2 & #3, and the cSTA, which update their measurement
logs accordingly: bSTA#2 measured the beacon’s ToA as
“329673” (referenced to its own time base) and updates that
value in its CLMR log, along with its own MAC address as
the receiving unit. Similarly, bSTA#3 and the cSTA estimate
and log the ToAs of that same beacon as “341006,” and
“133564,” respectively. The bSTAs also update their CLMR
logs with the additional time-stamps measured by bSTA#1 as
reported in its broadcast CLMR. The CLMR is managed as
a “sliding-window” of the time-stamps measured during the
past Xseconds. The size of that window may be tuned for
optimizing the overall system performance. The entries of the
CLMR log table undergo a time-stamp matching phase, during
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
BANIN & BAR-SHALOM et al.: SCALABLE Wi-Fi CLIENT SELF-POSITIONING USING COOPERATIVE FTM-SENSORS 3
Fig. 3. CToA beacon broadcast timing.
which the ToA measurements are matched with their corre-
sponding ToD value. As will be discussed in Section III-B, the
client feeds this timing information, along with the position
information of the bSTAs, (also broadcast periodically as part
of their beacons), into a Kalman ﬁlter that produces an updated
estimate of its current position. The messaging sequence of
the protocol is described in Fig. 3. The broadcast consists
of two transmitted frames separated by a standard, SIFS
of 16 μs [2]. The ﬁrst frame is called “null-data packet (NDP)
announcement” and has a twofold role: it announces the arrival
ToA, and it conveys the information elements that carry the
CLMR and the bSTA location information. A similar broadcast
messaging concept has been discussed in [15], for enabling
angular information for the navigating clients. The CToA
beacon duration varies between 100 and 500 μs (depending
on the amount of data contained in the CLMR). Every bSTA
broadcasts a CToA beacon once every 200 to 500 ms. Every
bSTA announces its CToA beacon broadcasting schedule to
facilitate the optimization of the cSTAs reception duration.
Once the cSTA is tracking its location, it may only wake up
for less than 500 μs every time it wishes to receive a new
timing measurement. The rate, at which the cSTA needs to
wake up, depends on its required location accuracy and the
accuracy of its crystal oscillator (XO).
A. Related Work and Paper Contributions
The concept of time synchronizationfor wireless sensor net-
works (WSN) using two-way time-stamps exchanges has been
addressed in [4] (and its referenced sources). The problem of
joint synchronization and ranging in a WSN between pairs of
nodes exchanging time-stamps has been considered in [12].
The localization of a blind node using time-difference-
of-arrival (TDoA) measurements enabled by time-stamps
exchange has been proposed in [10]. In [11], this solution was
extended for a network-centric architecture, enabling TDoA-
based localization and velocity determination of a noncoop-
erative node (namely, a node that does not announce the
ToD of the packets it transmits), using time-stamps exchanged
between sensor nodes in an asynchronous network. There,
the node localization was based on a discrete, least-squares-
based ﬁxing, rather than continuous tracking of its position
and network clock parameters. It may be worth noticing
that the solution in [11] is nonscalable in the sense that the
number of nonoverlapping transmissions, which may be sent
by the noncooperative nodes within a given time window,
is ﬁnite. Furthermore, as the noncooperative nodes transmit,
their privacy is compromised.
The contributions of this paper are given in the following.
1) A novel scalable, time-delay-based, client positioning
protocol for unsynchronized Wi-Fi networks.
2) A Kalman ﬁlter-based, client positioning engine (PE).
3) A theoretical analysis of the PE’s asymptotic accuracy.
4) Performance evaluation based on a real indoor network,
for which a measurement database is provided, along
with the MATLAB source code of the PE (see [17]).
B. Paper Organization
The remainder of this paper is organized as follows.
Section II formulates the client position estimation problem.
The position estimation algorithms are derived in Section III.
This section is divided into two parts; ﬁrst, Section III-A
outlines the measurement models and the maximum-likelihood
position estimators for client mode in the absence of clock
drifts. Then, Section III-B introduces the effect of the clock
drifts on the measurement models and details the Kalman
ﬁlter algorithm executed by the client device and used for
estimating and tracking all the time-varying parameters in the
system. The measurement models derived in Section III-A
are used in Section IV for obtaining bounds on the expected
positioning accuracy. System-level simulation and real-life
system performance are described in Section V. Further
insights and design aspects are discussed in Section VI, while
the ﬁnal conclusions are summarized in Section VII. Finally,
in the Appendix, the Cramér-Rao lower bounds (CRLBs)
for the positioning problem are derived. These are used for
illustrating the theoretical system performance discussed in
Section IV.
Notation: We use lowercase letters to indicate scalars, low-
ercase boldface letters to denote vectors, and uppercase bold-
face letters to express matrices. Other notations are described
next to their ﬁrst appearance.
II. PROBLEM FORMULATION
In Section II, the mathematical background of the client
position estimation is established. Section II-A outlines gen-
eral deﬁnitions that are used in Section II-B for deﬁning
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
4IEEE TRANSACTIONS ON INSTRUMENTATION AND MEASUREMENT
the client position estimation problem.3Finally, Section II-C
provides an analysis of problem solvability and the mini-
mal conﬁguration that is required for enabling the position
estimation.
A. Preliminary Deﬁnitions
A “measurement” is deﬁned as the ToF of a broadcast
transmission between the two endpoints, Aand B.The
transmitting endpoint, A, measures the ToD of its broadcast,
while the receiving endpoint, B, measures its ToA. Both
timing measurements are referenced to the client’s clock, and
thus have offsets marked by νAand νB, respectively. The
clock offsets also account for any timing biases that may
exist due to some obstruction in the propagation medium,
resulting in a non-LoS (NLoS) link between the two endpoints.
Mathematically, this may be expressed as
zToFAB =(ToA B+νB)(To D A+νA). (2)
By denoting the coordinates vectors of the endpoints as qA
and qB, respectively, the ToF between the two endpoints may
be expressed as
zTo F AB ToA BTo D A
=1
cqBqA+νBνA(3)
where the notation, x, designates the Euclidean norm of the
vector x,andcdenotes the speed of light.
If the client acts as the receiving endpoint, then νB0and
the noiseless ToF measurement is deﬁned as
z1
cqBqA−νA.(4)
B. CToA Problem Deﬁnition
Assume that a single cSTA, located at: p=[x,y,0]T,
attempts to estimate its position using time-delay measure-
ments it gathers from MbSTAs, whose locations are known
to the cSTA, where the mth bSTA is located at qm=
[xm,ym,zm]T.
The cSTA collects two types of time-delay measurements.
1) bSTAibSTAjmeasurements, where i,j1...M,
i= j. These time delays are measured by the bSTAs
and published in their beacon broadcast. The cSTA
collects Lmeasurements of this type, where the lth
measurement is denoted by ˜zl. Each measurement is
error with zero-mean and standard deviation of ˜σ,
denoted by ˜nlN(0,˜σ2).
2) bSTAicSTA, where i1...M. These time-delays
are measured by the cSTA itself, and the cSTA collects
Lmeasurements of this type, where the th measure-
ment is denoted by ¯z. Each measurement is subjected
to additive Gaussian measurement error distributed as
¯nN(0,¯σ2). Typically, ¯σ>˜σ.
Let νidenote the (unknown) offset between the cSTA
and bSTAiclocks. Assuming a single bSTAicSTA ToA
3Section II-A and Section II-B are excerpted from [16].
is unbiased, then it may be modeled as
¯z=1
cpqi−νin,=1,...,L.(5)
Similarly, the measurement of the lth broadcast transmitted
by the ith bSTA and received by the jth bSTA, may be
modeled as
˜zl=ToA jTo Diνi+νjnl
=1
cqjqi−νi+νjnl,l=1,...,L.(6)
C. Minimal System Conﬁguration Analysis
In the following section, we analyze what the minimal
network conﬁguration that enables positioning is. Assume
that the venue is covered by MbSTA units capable of
receiving each other’s broadcasts. Under the assumption that
the clock offsets are time-invariant, and ignoring any initial
system transients, a broadcast sent by the mth bSTA and
received by other (M1)bSTAs and the client, contains
the (M1)“inter-bSTA” previous measurements collected by
that bSTA. Hence, the client collects M(M1)“indirect”
measurements (which depend only on the unknown clock
offsets). However, it is easy to verify that only (M1)of
them are linearly independent. In addition, the client collects
M“direct” measurements, which depend both on its position
and the clock offsets. The number of unknowns is (M+2)
for the 2-D positioning case, and (M+3)for the 3-D case.
As there are a total of (M1)+Mlinearly independent
measurements, we require that
2M1M+2(7)
for solving the 2-D positioning problem. It is easy to see that
three bSTA would be sufﬁcient for solving the 2-D, whereas
four bSTAs would be required for 3-D case. Notice that this
result is equivalent to the GNSS positioning problem, in which
the entire satellite network is synchronized, but its clock
offset is unknown to the receiving client. Clearly, if the clock
offsets are time-varying then more (“historic”) measurements
are needed in order to estimate the statistics of these variables.
As explained in Section I, such measurements are included in
III. POSITIONING ALGORITHMS
In the following section,4the CToA positioning algorithms
are derived. To facilitate the explanation, the derivation is
split into two parts; ﬁrst, in Section III-A, we address the
client position estimation problem under the assumption that
the bSTA clocks do not drift over time, such that their offsets
with respect to the client’s clock are time-invariant. Under this
assumption, we derive the position estimators for two cases.
1) “First-Fix”—corresponds to the scenario, in which the
client ﬁrst attempts to sync and estimate its position.
2) “Tracking”—corresponds to the scenario where the
client already has an estimate of its position including
4This section is excerpted from [16].
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
BANIN & BAR-SHALOM et al.: SCALABLE Wi-Fi CLIENT SELF-POSITIONING USING COOPERATIVE FTM-SENSORS 5
the bSTA timing-related parameters and continues track-
ing them using a Kalman ﬁlter.
Then, in Section III-B, we outline the Kalman ﬁlter that
enables the client to simultaneously estimate and track its
own location coordinates, as well as the clock parameters of
the bSTAs.
A. Position Estimation in the Absence of Clock Drifts
In the following section, we derive the maximum-likelihood
estimates (MLEs) of the client position under the assumption
that the clocks of the client and the bSTA do not drift over
time, so that the clock offsets remain constant. For simplicity,
the derivation assumes a horizontal position only (which is of
most interest in indoor positioning scenarios). The extension
to 3-D positioning is straightforward.
1) MLE Solution for Client’s First-Fix: Let eidenote an
M×1 vector of zeros, whose ith entry is 1. Using this notation
νi=eT
iν(8)
νjνi=eT
jeT
iν(9)
where ν[ν1,...,ν
M]T,andxTdenotes the transposition of
the vector x. Now, the timing measurements may be recast as
¯z=1
cpqi−eT
iνn(10)
˜zl=1
cqjqi+eT
jeT
iνnl.(11)
We may further deﬁne the following vectors and matrices:
¯zz1,...,¯zL]T
˜zz1,...,˜zL]T
z¯z
˜z(12)
¯
d(p)pqi
˜
dlqiqj
¯
d(p)[¯
d1(p),..., ¯
dL(p)]T
˜
d[˜
d1,..., ˜
dL]T
d(p)¯
d
˜
d(13)
¯
E[−ei,1,...,ei,L]T
˜
E[(ej,1ei,1),...,(ej,Lei,L)]T
E¯
E
˜
E(14)
¯nn1,..., ¯nL]T
˜nn1,..., ˜nL]T
n¯n
˜n.(15)
Using the deﬁnitions of (12)–(15), we may recast (10) and (11)
as
z=c1d(p)+Eν+n.(16)
The measurement noise is assumed to be Gaussian-distributed
with the mean and covariance as follows:
E{n}=0
E{nnT}=¯σ2IL0
0˜σ2ILW(17)
where E{.}denotes the expectation operator and INdenotes
an N×Nidentity matrix.
Under these assumptions, the MLE of the cSTA position
vector, ˆp, may be obtained as
ˆp=argmin
p,ν
(zc1dEν)TW1(zc1dEν)(18)
where X1denotes the inverse of the matrix X.
The estimate of the clock offsets vector may be found using
weighted least-squares (WLS) criteria
ˆν=(ETW1E)1ETW1(zc1d). (19)
Deﬁne
B[W1W1E(ETW1E)1ETW1].(20)
Then, by substituting (19) back in (18) we get
ˆp=argmin
p(zc1d)TB(zc1d). (21)
The nonlinear minimization problem in (21) can be solved via
2-D grid search (or 3-D search, in case of three-positioning),
over all the possible locations.
2) MLE Solution for a Client in “Tracking Mode”: Once
the client receiver has converged to the true values of the bSTA
clock offsets and continuously tracks them, these clock offsets
may be considered as “known” (up to some estimation error).
In such case, it would be reasonable to assume that z¯z,
d¯
d.Dene
ζ¯z¯
Eˆν.(22)
The resulting measurement model in this case may be recast as
ζ=c1¯
d(p)n.(23)
The additive noise vector, ˇn, is assumed to be Gaussian-
distributed with the following properties:
En}=0
EnˇnT}¯σ2+σ2
r·IL(24)
where σrcorresponds to the standard deviation of the residual
estimation error of the clock offsets. The client position MLE,
in this case, is obtained by minimizing the following cost
function:
ˆp=argmin
p|ζc1¯
d(p)|2(25)
where again, the nonlinear minimization problem in (25) can
be solved via grid search over the position coordinates space.
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
6IEEE TRANSACTIONS ON INSTRUMENTATION AND MEASUREMENT
B. Position Estimation Under Clock Drifts
The analysis outlined in the former section ignored any
clock drifts, which result from the XO frequency deviations.
Such deviations may be caused by multiple effects such as
ambient temperature changes, phase noise, thermal noise,
crystal aging, and so on. Each bSTA measures the timing
related to the broadcast events (ToD or ToA). This timing is
referenced to its native time base. Once the measurements are
conveyed to the cSTA for enabling it to compute its location,
the cSTA needs to resolve the instantaneous clock offset of the
bSTA associated with that measurements and is a function of
the offset drift rate. Assuming the ﬁrst-order clock drift model,
the instantaneous value of the clock offset of the nth bSTA is
calculated using
νn(ti)=νn(ti1)νn·t(26)
where νn(ti1)corresponds to the previous estimated value
of the clock offset, (where νn(t0)denotes its initial value),
˙νndenotes the clock skew (or the change rate of the clock
offset), and t=titi1. In the following section, we outline
the algorithm, which enables the cSTA to estimate and track its
location under clock drifts. The Kalman Filter is the optimal
estimate for linear system models with additive-independent
white noise in both the transition and the measurement system
models. Yet, in many systems, including navigation systems,
the measurement model is not linearly dependent in the
parameters of interest. In such cases, the extended Kalman
ﬁlter (EKF), which is the nonlinear version of the Kalman
ﬁlter, is widely used [21]. In the EKF, the state transition and
observation models are not required to be linear functions of
the states, but instead, may only be differentiable functions.
The EKF is executed by the client, enabling it to estimate
and track its own position coordinates, as well as the timing
parameters of the stray bSTA units, from which it receives
the measurement broadcasts. An EKF is described by two
equations, which deﬁne the system and the observation (mea-
surement) models. These models are described next.
1) CToA EKF System Model: The system model is deﬁned
by the following recursive equation:
xk=Fkxk1+wk,k0 (27)
where the index kdenotes the discrete time-step. The vector xk
denotes an N×1 states vector, which describes the parameters
being estimated and tracked by the ﬁlter. The states vector for
the client mode consists of the client’s position coordinates
and per-bSTA clock parameters [clock offset and clock offset
change rate (or skew)]. The size of the EKF state vector is
thus N=3+2M,whereMdenotes the number of bSTAs
being received by the cSTA (both directly and indirectly)
pk[xk,yk,zk]T
νk[ν1,k,...,ν
M,k]T
˙νkν1,k,...,˙νM,k]T
xkpT
k,νT
k,˙νT
kT.(28)
The state vector xkis associated with a covariance matrix
Pk=E{(xk−¯xk)(xk−¯xk)T}(29)
where ¯xkE{xk}. When the ﬁlter initialized the
state-covariance matrix is assumed to be
P0=
˜
Pp,000
0σ2
ν,0IM0
00σ2
˙ν,0IM
(30)
where σν,0,σ˙ν,0denote the initial values for the standard
deviations of the clock offsets and drifts, and ˜
Pp,0denotes
the initial value of states covariance matrix, given by
˜
Pp,0
σ2
x,000
0σ2
y,00
00σ2
z,0
.(31)
The initial values of the standard deviations constructing
the initial states covariance matrix are commonly determined
empirically.
The dynamic system model linear transfer function is
denoted by Fk,anN×Nblock-diagonal matrix deﬁned as
follows:
Fk
I300
0I
MtIM
00 I
M
(32)
where tcorresponds to the elapsed time between the two
consecutive discrete time-steps.
The vector wkdenotes a random N×1 model noise vector,
which described the uncertainties in the system model and has
the following statistical properties:
E{wk}=0
EwkwT
k=Qk
EwkwT
j=0,k= j(33)
EwkxT
k=0,k.
In the EKF system model, the process noise, wkis assumed
to be Gaussian-distributed with zero-mean and a covariance
matrix, Qk, which is block-diagonal and given by
Qk=t·
Qp,k00
0˜σ2
νIM0
00˜σ2
˙νIM
(34)
where
Qp,k
˜σ2
x00
0˜σ2
y0
00˜σ2
z
.(35)
In general, the determination of the noise variance values
of Qk, is challenging, and is often obtained by some heuristic
methods. Commonly, it is assumed that most of the clock
deviation is dictated by the clock skew, rather than clock
measurement noise. The values of σ2
x,˜σ2
y,˜σ2
z}are deter-
mined according to the motion assumptions of the cSTA device
(e.g., pedestrian, vehicle/drone etc.).
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
BANIN & BAR-SHALOM et al.: SCALABLE Wi-Fi CLIENT SELF-POSITIONING USING COOPERATIVE FTM-SENSORS 7
2) EKF Measurement Model: The measurement model is
deﬁned as
zk=h(xk)+vk(36)
where zkis a J×1 vector of measurements, in which each
entry corresponds to a ToF measurement that follows the def-
inition of (2). The vector h(x)[h1(x), h2(x),...,hJ(x)]T,
denoting the nonlinear measurement model vector transfer
function, and vkdenotes the additive measurement noise that
has the following statistical properties:
E{vk}=0
E{vkvT
k}=Rk=σ2
mIδkj (37)
E{vkxT
k}=0,k
E{wkvT
j}=0,k,j
where δkj denotes the Kronecker delta. As discussed in
Section III-A, there are two types of transfer functions, which
depend on the type of the measurement (bSTAicSTA or
bSTAibSTAj). From (10) and (11), it is easy to see that
the corresponding measurement transfer functions are given by
h(xk)=1
cpkqi−eT
iνk(38)
hl(xk)=1
cqjqi+(ejei)Tνk.(39)
Since the measurement transfer function, h(·)is nonlinear,
it cannot be applied to estimate the measurements covariance
matrix directly. Instead, we linearize h(·)by replacing it with
its ﬁrst-order Taylor series expansion, calculated around ˆxk|k1
h(xk)
=h(ˆxk|k1)+Hk·(xk−ˆxk|k1)(40)
where the notation ˆxn|mrepresents the estimate of xat time n
given observations up to and including time mn.The
matrix Hkdenotes the Jacobian of the measurement model
function vector h(·),whichisa J×Nmatrix deﬁned as
Hk
h1
x1
h1
x2··· h1
xN
.
.
.....
.
.
hJ
x1
hJ
x2··· hJ
xN
[Hk]ij hi
xjxxk|k1
.(41)
The Jacobian is obtained by calculating the partial derivatives
of (38) and (39). Equations (42) and (43) deﬁne the corre-
sponding lines of the matrix Hk
[Hk]=(pkqn)T
cpkqn,eT
i,0T
M(42)
[Hk]l=0T
3,(ejei)T,0T
M.(43)
To accelerate the EKF convergence, the initial values for the
clock offset and the position states, ˆν0,ˆp0, may be obtained
using (19) and (21), respectively. An implementation of the
EKF algorithm was presented in [16] and a possible MATLAB
realization of this code is described [17].
IV. APPROXIMATE PERFORMANCE ANALYSIS
For obtaining theoretical performance bounds, the drift-
less measurement models derived in Section III-A were used
for calculating the respective CRLB. The derived bounds
are affected mainly by the geometrical properties of the
network deployment, as well as the additive noise levels. Yet,
these bounds ignore propagation models that may account for
the type of materials through which the signals propagate.
Under the assumption that the additive measurement noise is
Gaussian-distributed, for each location on a given grid, one
can calculate the circular error probable (CEP) that deﬁnes
the radius of the circle centered around the estimator’s mean
estimate (or the true receiver location in our case), in which
the receiver is contained with a probability, Pin [23, eqs. (63)
and (64)]
Pin =1
2πλ1λ2R
exp ζ2
1
2λ1ζ2
2
2λ2dζ1dζ2(44)
where Ris a circle deﬁned as
R1
2):ζ2
1+ζ2
2CEP(45)
and λ1
2(λ1λ2) denote the eigenvalues of the 2-D
positioning error covariance matrix for position p,whichis
predicted by the CRLB derived in the Appendix. The CEP for
probability, Pin, may be calculated using [23, eq. (72)]
Pin ·1+γ2
2γ=UL
0
exI01γ2
1+γ2·xdx (46)
where I0denotes the modiﬁed Bessel function of the ﬁrst kind
and
γ2λ2
λ1;UL (1+γ2)
4λ2·CEP2(47)
with
CEP(Pin)=pfCEP(Pin|p)f(p)dp(48)
where fCEP(Pin|p)is given by (46).
Fig. 4 depicts curves of the expected probabilities of differ-
ent CEP values for “First-Fix” and “Tracking mode” scenarios.
These curves were obtained for a typical ofﬁce network
deployment depicted in Fig. 5, where the red rings denote
the position of the bSTAs. The CEP values were evaluated
numerically as follows. On each of the 104sampling points
along the client’s trajectory denoted by the red dots as shown
in Fig. 5, the respective CRLB error covariance matrices
were calculated. These calculations were done assuming the
At each point, a position-dependent CEP curve was calculated
using (46) for 100, equally spaced, probability values between
0 and 1-. The ﬁnal curves in Fig. 4 are position-independent
and obtained by averaging the CEP curves over the entire
trajectory, assuming equal probability of the client’s position.
Mathematically, (48) may be approximated as
CEP(Pin)1
NLoc
NLoc
n=1
CEPn(Pin)(49)
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
8IEEE TRANSACTIONS ON INSTRUMENTATION AND MEASUREMENT
Fig. 4. Theoretical errors bounds along the client trajectory.
Fig. 5. Indoor ofﬁce system simulation.
where CEPn(Pin)denotes the CEP value corresponding to
probability Pin at the nth location sampling point, and NLoc is
the total number of location sampling points. The noise level
assumed were ¯σ=0.6m,˜σ=1.2m,andσr=0.3m.
The following proposition proves that given enough sam-
ples, the asymptotic accuracy of the client position in
“First-Fix” is equivalent to the one that can be attained with
the position tracking ﬁlter converged.
Proposition 1 (Asymptotic Performance): The asymptotic
positioning accuracy for a client in “First-Fix” mode,
approaches the accuracy attained in “Tracking mode,” given
˜
N→∞replicas of the bSTAbSTA timing measurements.
Proof: See Appendix.
V. PERFORMANCE IN AN INDOOR NETWORK
To validate the concept, the CToA system was tested
using both system-level simulations and an actual deployed
network. In the following section, we outline examples of
the positioning accuracy of a mobile client in an indoor
network. These results were obtained for both a simulated
network environment and a real-life network, deployed over
the same indoor venue. To analyze its accuracy, the position
estimates were compared against a “ground-truth” (reference)
the trajectory of the mobile client. This reference trajectory
was generated using a robotic ground-truth tool based on “light
detection and ranging” (LiDAR) [14]. The LiDAR system
used integrates a 270laser scanner, which uses a dedicated
map and laser measurements to estimate its position. Its output
is a series of position reports generated at a rate of 20 Hz
with an accuracy of 10–30 cm. The map was obtained in
advance through a survey of the venue using the LiDAR
system, during which a structure map was created using a
simultaneous localization and mapping algorithm (see [19]).
The reference trajectory of the mobile client was used for both
the system-level simulations, as well as for the real-life system
measurements. The remainder of this section outlines the sim-
ulation methodology and system implementation. This section
is concluded with a comparative analysis of the simulation and
the real system results.
A. Simulation Methodology
At its lower level, a typical geolocation system architecture
consists of a measurement engine (ME) and a PE. The ME
receives raw signal samples (e.g., the OFDM channel estima-
tion) and outputs raw timing measurements. The PE receives
the raw timing measurements from the ME and outputs an
estimate of the current position, where the PE implements the
EKF described in Section III-B. The system-level simulation
described here is focused on the PE while assuming an
“ideal” ME. It relies on a modeling of skewed bSTA clocks,
as described next. The ToA time-stamps fed into the PE
are referenced to the signal’s propagation distance, while
the channel impairments effect is simulated via Gaussian-
distributed errors added to the measured clock time-stamps,
which are fed to the PE.
1) Station Clock Modeling: The modeling of the bSTA and
client (cSTA) clocks’ behavior is at the heart of the system
simulation and is used for realizing the time-stamps fed into
the PE. The STA clock is modeled as a recursive random
process deﬁned as follows (see [22]):
˜ck=˜
Fk˜ck1nk(50)
where ˜ckdenotes the clock system states vector that contains
the following states: clock offset, clock skew (drift), and
skew rate, ˜
Fkdenotes the states-transition model matrix,
and ˜nkdenotes process noise, all of which are deﬁned as
follows:
˜ck
νk
˙νk
¨νk
(51)
˜
Fk
1t1
2t2
01 t
00 1
(52)
˜nkt·˜
Q˜n(53)
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
BANIN & BAR-SHALOM et al.: SCALABLE Wi-Fi CLIENT SELF-POSITIONING USING COOPERATIVE FTM-SENSORS 9
Fig. 6. Skewed clock realization example.
with
˜
Q
σν00
0σ˙ν0
00σ¨ν
(54)
˜n
N(0,1)
N(0,1)
N(0,1)
(55)
where for σν=σ˙ν=1010 and σ¨ν=107. Fig. 6 depicts
an example realization of the clock states. The clock model
also implements a mechanism to maintain the drift within the
speciﬁed boundaries of ±25 ppm.
2) Measurement Modeling: The ToD and ToA measure-
ments are realized as clock time-stamps of the bSTAs and the
client and rely on the clock model described in Section V-A1.
Although the modeled ToD time-stamps are fed into the PE
as-is, the ToA time-stamps also account for the geometrical
propagation distance between the transmitter and the receiver,
as well as a random bias to model the NLoS channel propa-
gation effect.
B. Real-Life System Performance
To study the actual system performance in an indoor envi-
ronment, a network of bSTA units was set up. The bSTA
units were implemented using Intel Wireless-AC8260 Wi-Fi
802.11ac, 2 ×2 dual-band chipsets [25], mounted in mini
personal computers. The position estimates were obtained for
a client device, built using the same Wi-Fi module mounted
on the robotic “ground-truth” vehicle. The OFDM channel
estimation and the ME (including the LoS detection and
ToA estimation mechanism) were implemented on the Wi-Fi
chipset in a combination of hardware and ﬁrmware that was
executed on the AC8260 processing cores.
The PE was executed on the client processor, where the EKF
also implemented several heuristic, range-based mechanisms
for outlier measurement rejection. A description of these
mechanisms can be found in [21, Ch. 15.3]. Both the real-life
as well as the simulated network measurements used for
generating the results presented in this paper, along with the
MATLAB code of the PE, are available in [17].
Fig. 7. Real data versus simulated data position estimates.
The test venue selected is a populated open space, cubical
ofﬁce ﬂoor. This is a highly congested Wi-Fi environment,
which is also heavily multipath dense due to the 1.5 m high,
metal-framed cubical ofﬁces that generate multiple reﬂections
of the transmitted signals. Moreover, the center of the venue
contains a structure of thick concrete walls forming the ﬂoor
shelter (notice the thick, black rectangle in Fig. 7). These walls
generate a constant NLoS propagation channel between some
of the bSTAs, as well as between the client and the bSTAs in
certain sections of the venue.
C. Performance Results
Fig. 7 depicts the reference and estimated client trajectories
used for both the simulation data and the real data (RD) mea-
surements. These estimates correspond to measurement frames
broadcast at a 40 MHz channel bandwidth. The true positions
of the client along the reference trajectory are denoted by p
and marked by red dots. The estimated client positions are
denoted by ˆpand marked by blue dots. The location of the
bSTAs in the network is marked by the red rings. The bSTAs
were placed on shelves at a height of 2.2 m. The simulation
was deﬁned such that each bSTA exchanges measurements
with its four nearest neighbor bSTAs. In addition, in every
point along the trajectory, the client used measurements from
the four nearest bSTAs. This restriction was applied to the
simulation environment to imitate the expected channel con-
ditions, in which not all the bSTAs are visible from every point
along the trajectory. This restriction does not apply to the real
system, such that the bSTAs attempt to measure transmissions
coming from any neighbor bSTA (even if there is no LoS
between them). Consequently, the client attempts to use any
were set to broadcast CToA beacons at 2 Hz. The real-life
system was set to broadcast the beacons with a bandwidth
of 40 MHz. Since the PE has no notion of signal bandwidth,
the additive error levels in the system simulation were set to
match the typical ranging errors expected for 40 MHz OFDM
transmissions. The positioning accuracy is described by means
of the cumulative distribution function (CDF) of the client’s
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
10 IEEE TRANSACTIONS ON INSTRUMENTATION AND MEASUREMENT
Fig. 8. Theoretical and empirical client positioning error CDF.
positioning errors, which are deﬁned as
ε=ˆpp.(56)
Fig. 8, which depicts the CDF, contains three curves: the
blue curve describes the CDF of the client’s positioning
error measured during a real-life recordings of the system.
The real-life recording is compared against the positioning
accuracy predicted by the simulation (dashed-dotted red curve)
and against the theoretical accuracy predicted by the CRLB
(black dotted curve). The latter curve was obtained for the
“tracking mode” as explained in Section V.
As can be seen from this analysis, the system achieves an
accuracy better than 1.5 m in 67% of the cases and about
2 m in 95% of the cases. The deviation between the error
distributions of the real system and the theoretical/simulated
system may be attributed to the outliers and range biases,
which are introduced, by nature, in real network measured
data, but do not exist in the model generating the simulated
data. The outliers may be ﬁltered-out using outlier rejection
mechanisms that can be applied to the EKF code.
VI. DISCUSSION
Although client mode CToA5may be perceived as the
indoor counterpart of GNSS, it imposes different imple-
mentation challenges. GNSS networks implement a similar
time-stamped broadcast approach to enable an unlimited num-
ber of client receivers to navigate simultaneously worldwide.
Yet, two fundamental differences distinct the time tracking of
receivers in a GNSS network compared to CToA network: ﬁrst,
a GNSS network is synchronized, whereas the CToA network
is not. Second, due to its multiple-access nature, the broadcasts
sent by the network satellite vehicles (SVs) are received at the
client simultaneously, while in a CToA network, the broadcasts
are staggered in time. Let us delve into these two differences
and explore them in detail.
5Portions of the following discussion are excerpted from the Discussion
Section in [16].
In GNSS networks the SVs are synchronized using onboard
atomic clocks, which have a frequency stability of approxi-
mately 1014. This frequency stability translates into a clock
drift of roughly 1 ns per day [20] (equivalent to a ranging
error of about 35 cm - an error that is further corrected by the
GNSS system). Since GNSS networks are fully synchronized
in terms of timing parameters, the GNSS client receiver needs
to estimate only the offset and the drift between its internal
clock, and the network clock. The client receiver’s clock is
typically generated using an XO with a frequency stability
in the order of 106(commonly expressed in units of parts-
per-million). Tracking these parameters (along with additional
system states such as position and velocity)6is done using a
Kalman ﬁlter algorithm [21].
In the CToA network, since the bSTAs are unsynchronized,
each bSTA contributes a clock offset and drift that need to be
estimated and tracked. Furthermore, different MAC methods
used by GNSS and CToA impose an additional challenge.
In GNSS networks, the multiplexing at the code space (code
division multiple access) or the frequency space (frequency-
division multiple access) ensures that broadcast transmissions
from all SVs are received simultaneously at the client. Con-
versely, CToA relies on the “listen-before-talk” MAC of the
IEEE 802.11, which effectively results in timing measurements
being staggered in time. Given that a typical Wi-Fi XO has an
accuracy of ±25 ppm, consecutive timing measurements taken
from the same broadcasting source may accumulate signiﬁcant
time drift [18]. This implies that while one bSTA clock offset
is measured, other bSTAs clock offsets keep on drifting apart.
The Kalman ﬁltering combined with the broadcasting nature
of the protocol enables several levels of system robustness. For
instance, the ﬁlter’s state-covariance matrix enables tracking
of interconnections between hidden nodes, which are received
indirectly via other bSTAs. These indirect measurements
enable the client to synchronize with those bSTAs even before
receiving them directly. Additional immunity against frame
losses enabled as the beacons can be received by multiple
neighbor bSTAs near the bSTA so their measurements can be
The protocol enables multiple degrees of freedom that can
be tuned for optimizing the overall network performance.
For example, the amount of data included in the beacon
that deﬁnes the minimal subrate, at which the clients may
wake up, and the beacon broadcasting rate. Consider, for
instance, a broadcasting rate of 2 Hz, where each beacon
contains the last second of timing measurements (both ToA
and ToD) captured by that bSTA. Such rate enables the cSTAs
to wake up only once a second to update their position
and clock estimates. Furthermore, the timing measurements
history-window length affects the “First-Fix” scenario as the
accuracy of the position and clock offsets initial estimates is
proportional to the amount of data included. On the other
6The SVs orbital motion generates a substantial Doppler offset on the
GNSS carrier frequency, which enables to estimate the GNSS receiver’s
3-D speed. Thus, the EKF state vector in GNSS receivers typically includes
a total of 6+2N states: three states for the receiver position, three states for
the 3-D receiver speed, and two additional states for the clock model, which
are tracked per satellite constellation (i.e., GLONASS, Galileo etc.).
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
BANIN & BAR-SHALOM et al.: SCALABLE Wi-Fi CLIENT SELF-POSITIONING USING COOPERATIVE FTM-SENSORS 11
contain affect the Wi-Fi network trafﬁc and its level of
congestion. For a typical Wi-Fi network, which relies on a
±25 ppm XO stability, a 2–5 Hz bSTA beacon broadcasting
rate and 600 ms of history-window are sufﬁcient for cSTAs
to track the clock behavior of the bSTAs in the network.
Being an unmanaged and unidirectional protocol (without
any REQUEST-ACK scheme between the network nodes),
CToA facilitates a rather simple interoperability between
AP/bSTA and cSTA units produced by different vendors.
Furthermore, as the bSTAs may be network detached units,
which implies they do not require any wired “backbone”
network infrastructure and thus may be easily moved around
the venue. This gives yet another degree of ﬂexibility during
the network deployment and performance tuning phase for
achieving optimal performance.
VII. CONCLUSION
A novel protocol for scalable Wi-Fi client self-positioning
using cooperative FTM-sensors was presented. The CToA
protocol is designed to enable scalability of existing IEEE
802.11/Wi-Fi FTM-based, geolocation systems. It relies on a
periodic broadcast of time-delay measurement frames trans-
mitted by an unmanaged network of bSTAs placed at known
locations called bSTA. These measurements, which may be
collected independently by an unlimited number of receiving
clients, are combined with similar time-delay measurements
reported by the bSTAs and enable passive clients to estimate
their location within the network and navigate indoors while
maintaining their privacy. The network can also be used
simultaneously for tracking thousands of broadcasting clients,
which enables the support of a variety of applications, such
as asset tracking, data analytics, and so on.
Due to the
infrequent nature of the broadcasts and the clock source
quality of both the client and bSTAs, the clocks tend to drift
appreciably between the measurement events. To solve this,
the client uses a Kalman ﬁlter for estimating and tracking the
clock-related system parameters, as well as its instantaneous
position coordinates.
System-level simulations and real-life system experiments
indicate that the network is capable of reaching a positioning
accuracy roughly 2 m in 95% of the cases in congested,
multipath-dense Wi-Fi indoor environments.
APPENDIX
The following Appendix is excerpted from [16].
A. CToA Cramér Rao Lower Bound
We shall now derive the CRLB for the method in the
absence of clock drifts. The CRLB provides a lower bound
on the covariance matrix of any unbiased estimator.
1) CRLB Client in “First Fix” Mode: Since the observations
vector, z, is distributed as, zN(μ,W),theijth entry
of the Fisher information matrix (FIM) may be obtained as
[25, Ch. 8, eq. (8.36)]
Jij =tr W1W
∂ψiW1W
∂ψj+2μT
∂ψiW1μ
∂ψj(57)
where ψiis the ith element of the parameters vector, ψ
[pT,νT]T. Since the noise covariance matrix, W, is free of
any unknown parameters, (57) becomes
Jij =2μT
∂ψiW1μ
∂ψj.(58)
For μc1d+Eν, the partial derivatives with respect to the
client’s position coordinates are given by
μ
x=c1˙
dxc1˙
¯
dT
x,0T
LT
μ
y=c1˙
dyc1˙
¯
dT
y,0T
LT(59)
μ
∂νi=Eei
where ˙
¯
dx,˙
¯
dydenote the vectors containing the partial deriv-
atives with respect to the client’s position coordinates, which
are given by
¯
di
x=− (xix)
(xix)2+(yiy)2(60)
¯
di
y=− (yiy)
(xix)2+(yiy)2.(61)
Using (59), the FIM elements can be found as
Jxx =2c2˙
dT
xW1˙
dx=2
c2¯σ2˙
¯
dT
x˙
¯
dx
Jxy =Jyx =2c2˙
dT
xW1˙
dy=2
c2¯σ2˙
¯
dT
x˙
¯
dy
Jyy =2c2˙
dT
yW1˙
dy=2
c2¯σ2˙
¯
dT
y˙
¯
dy(62)
Jxνi=2c1˙
dT
xW1Eei
Jyνi=2c1˙
dT
yW1Eei
Jνiνj=2eT
iETW1Eej.
Deﬁne
Jpp Jxx Jxy
Jyx Jyy (63)
JpνJxν
Jyν.(64)
The FIM is given by
J=Jpp Jpν
JT
pνJνν .(65)
The CRLB is obtained by inverting the complete FIM (see
[25, Ch.8, eq. (8.166)])
J1=Jpp JpνJ1
νν JT
pν1()
() () .(66)
The bound on the position coordinates is given by the top-left
block of J1
C1stFix
pp =Jpp JpνJ1
νν JT
pν1.(67)
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
12 IEEE TRANSACTIONS ON INSTRUMENTATION AND MEASUREMENT
2) Approximate CRLB for a Client in “Tracking Mode”:
When the EKF is converged and the bSTA clock offsets are
known (up to some residual error), and are being continuously
tracked, then μc1d,andψp.
Consequently
Jij 2
c2(¯σ2+σ2
r)μT
∂ψi
μ
∂ψj.(68)
The partial derivatives are obtained using (59), and the CRLB
on the position coordinates estimation error is obtained by
CTracking
pp 1
JxxJyy J2
xy Jyy Jxy
Jxy Jxx
=σ2
xx σxy
σxy σ2
yy .(69)
B. Proof of Proposition 1
Assume that every broadcast includes ˜
Nreplicas of the
timing measurements collected by the bSTA. Recall that L
denotes the number of broadcast timing measurements that
were measured by the client itself, then if the clock offsets
were time-invariant then one could deﬁne
ˇ
E¯
E
1˜
N˜
E,ˇ
W¯σ2IL0
0˜σ2I˜
N×L.(70)
Next, from (62), we have
Jνiνj=2eT
iETW1Eej.(71)
Then, under (70), Jνiνjbecomes
ˇ
Jνiνj=2eT
iˇ
ETˇ
W1ˇ
Eej
=2eT
i¯σ2¯
ET˜σ21T
˜
N˜
ET¯
E
1˜
N˜
EEej
=2eT
i(¯σ2¯
ET¯
E+˜
N·˜σ2˜
ET˜
E)ej
˜
N→∞
2˜
N˜σ2eT
i˜
E˜
ETej.(72)
Recall that from (67), we have
C1stFix
pp =Jpp JpνJ1
νν JT
pν1.(73)
Hence, under ˜
N→∞,ˇ
Jpνˇ
J1
νν ˇ
JT
pν0.
Thus, given enough bSTAbSTA measurements (equivalent
to an EKF in “Tracking mode”), C1stFix
pp CTracking
pp (up to
This concludes the proof.
ACKNOWLEDGMENT
An earlier version of this paper has been presented
as a whitepaper during the September 2017 meeting of
IEEE 802.11 TGaz in Waikoloa, HI (see [16]). Speciﬁcally,
Sections II-A and II-B, the great majority of Section III, most
of the discussion in Section VI, and the Appendix have been
reused from that whitepaper.
REFERENCES
[1] E. Au, “The latest progress on IEEE 802.11mc and IEEE 802.11ai
[standards],” IEEE Veh. Technol. Mag., vol. 11, no. 3, pp. 19–21,
Sep. 2016.
[2] IEEE Standard for Information Technology–Telecommunications and
Information Exchange Between Systems Local and Metropolitan Area
Networks–Speciﬁc Requirements—Part 11: Wireless LAN Medium
Access Control (MAC) and Physical Layer (PHY) Speciﬁcations, IEEE
Standard 802.11-2016, 2016.
[3] E. Perahia and R. Stacey, Next Generation Wireless LANs: 802.11n and
802.11ac, 2nd Ed. Cambridge, U.K.: Cambridge Univ. Press, 2013.
[4] B. Sundararaman, U. Buy, and A. D. Kshemkalyani, “Clock synchro-
nization for wireless sensor networks: A survey,” Ad Hoc Netw.,vol.3,
no. 3, pp. 281–323, 2005.
[5] A. Makki, A. Siddig, and C. J. Bleakley, “Robust high resolution time
of arrival estimation for indoor WLAN ranging,” IEEE Trans. Instrum.
Meas., vol. 66, no. 10, pp. 2703–2710, Oct. 2017.
[6] P. Serrano, P. Salvador, V. Mancuso, and Y. Grunenberger, “Experi-
menting with commodity 802.11 hardware: Overview and future direc-
tions,” IEEE Commun. Surveys Tuts., vol. 17, no. 2, pp. 671–699,
2nd Quart., 2015.
[7] X. Li and K. Pahlavan, “Super-resolution TOA estimation with diversity
for indoor geolocation,” IEEE Trans. Wireless Commun., vol. 3, no. 1,
pp. 224–234, Jan. 2004.
[8] F.X.Ge,D.Shen,Y.Peng,andV.O.K.Li,“Super-resolutiontime
delay estimation in multipath environments,” IEEE Trans. Circuits Syst.
I, Reg. Papers, vol. 54, no. 9, pp. 1977–1986, Sep. 2007.
[9] P. J. Voltz and D. Hernandez, “Maximum likelihood time of arrival
estimation for real-time physical location tracking of 802.11a/g mobile
stations in indoor environments,” in Proc. IEEE Position Location
Navigat. Symp. (PLANS), Apr. 2004, pp. 585–591.
[10] F. Bandiera, A. Coluccia, G. Ricci, F. Ricciato, and D. Spano, “TDOA
localization in asynchronous WSNs,” in Proc. 12th IEEE Int. Conf.
Embedded Ubiquitous Comput., Milano, Italy, Aug. 2014, pp. 193–196.
[11] F. Ricciato, S. Sciancalepore, F. Gringoli, N. Facchi, and G. Boggia,
“Position and velocity estimation of a non-cooperative source from
asynchronous packet arrival time measurements,” IEEE Trans. Mobile
Comput., vol. 17, no. 9, pp. 2166–2179, Sep. 2018.
[12] R. T. Rajan and A. J. V. D. Veen, “Joint ranging and synchronization for
an anchorless network of mobile nodes, IEEE Trans. Signal Process.,
vol. 63, no. 8, pp. 1925–1940, Apr. 2015.
[13] L. Banin, U. Schatzberg, and Y. Amizur, “Next generation indoor
positioning system based on WiFi time of ﬂight,” in Proc. 26th Int. Tech.
Meeting Satellite Division Inst. Navigat., Nashville TN, USA, Sep. 2013,
pp. 975–982.
[14] L. Banin, U. Schatzberg, and Y. Amizur, “WiFi FTM and map
information fusion for accurate positioning,” in Proc. Int. Conf. Indoor
Positioning Indoor Navigat. (IPIN), Alcalá de Henares, Spain, Oct. 2016.
[Online]. Available: http://www3.uah.es/ipin2016/usb/app/descargas/
215_WIP.pdf
[15] N. Dvorecki, O. Bar-Shalom, and Y. Amizur, “AoD-based positioning
for Wi-Fi OFDM receivers,” in Proc. 30th Int. Tech. Meeting Satellite
Division Inst. Navigat. (ION GNSS), Portland, OR, USA, Sep. 2017,
pp. 2883–2893.
[16] L. Banin, O. Bar-Shalom, N. Dvorecki, and Y. Amizur, High-Accuracy
Indoor Geolocation Using Collaborative Time of Arrival(CToA)—
Whitepaper, document IEEE 802.11-17/1387R0, Sep. 2017.
[Online]. Available: https://mentor.ieee.org/802.11/dcn/17/11-17-1387
-00-00az-high-accuracy-indoor-geolocation-using-collaborative-time-of-
arrival-ctoa-whitepaper.pdf
[17] L. Banin, O. Bar-Shalom, N. Dvorecki, and Y. Amizur. Reference-PE-
and-Measurements-DB-for-WiFi-Time-Based-Scalable-Location. Acces-
sed: Apr. 2018. [Online]. Available: https://github.com/intel/Reference-
PE-and-Measurements-DB-for-WiFi-Time-based-Scalable-Location
[18] H. Kim, X. Ma, and B. R. Hamilton, “Tracking low-precision clocks
with time-varying drifts using Kalman ﬁltering, IEEE/ACM Trans.
Netw., vol. 20, no. 1, pp. 257–270, Feb. 2012.
[19] J. J. Leonard, H. F. Durrant-Whyte, and I. J. Cox, “Dynamic map
building for an autonomous mobile robot,” Int. J. Robot. Res., vol. 11,
no. 4, pp. 286–298, Aug. 1992.
[20] M. A. Lombardi, T. P. Heavner, and S. R. Jefferts, “NIST primary
frequency standards and the realization of the SI second,” NCSLI Meas.,
vol. 2, no. 4, pp. 74–89, 2007.
[21] P. D. Groves, Principles of GNSS, Inertial, and Multisensor Integrated
Navigation Systems, 1st ed. Boston MA, USA: Artech House, 2008.
This article has been accepted for inclusion in a future issue of this journal. Content is final as presented, with the exception of pagination.
BANIN & BAR-SHALOM et al.: SCALABLE Wi-Fi CLIENT SELF-POSITIONING USING COOPERATIVE FTM-SENSORS 13
[22] A. Pásztor and D. Veitch, “PC based precision timing without GPS,”
ACM SIGMETRICS Perform. Eval. Rev., vol. 30, no. 1, pp. 1–10,
Jun. 2002.
[23] D. J. Torrieri, “Statistical theory of passive location systems,” IEEE
Trans. Aerosp. Electron. Syst., vol. AES-20, no. 2, pp. 183–198,
Mar. 1984.
[24] H. L. Van Trees, Optimum Array Processing: Part IV of Detection,
Estimation, and Modulation Theory. New York, NY, USA: Wiley, 2002.
[25] Intel Dual Band Wireless-AC 8260: Product Brief. Accessed: 2015.
[Online]. Available: https://www.intel.com/content/www/us/en/wireless-
products/dual-band-wireless-ac-8260-brief.html
Leor Banin received the B.Sc. degree (magna cum
laude) in electrical engineering from Tel-Aviv Uni-
versity, Tel Aviv, Israel, in 2001, with a focus on
digital signal processing and communications.
He has been involved in very large scale inte-
gration chip design, DSP ﬁrmware, and algorithms
development for wireless communications systems.
Since 2010, he has been a Researcher with Intel’s
Location Core Division, Petah Tikva, Israel. He has
co-authored several conference papers. He holds
over 30 patents in the ﬁeld of wireless communi-
cations and geolocation applications. His current research interests include
signal processing, geolocation and inertial navigation systems, and machine
learning applications.
Ofer Bar-Shalom received the B.Sc. degree in
mechanical engineering and the M.Sc. and Ph.D.
degrees in electrical engineering from Tel-Aviv Uni-
versity, Tel Aviv, Israel, in 1997, 2001, and 2015,
respectively.
He has been involved in cellular and wireless
connectivity systems development for over 20 years.
He is currently a Researcher with Intel’s Location
Core Division, Petah Tikva, Israel. He has authored
multiple journal and conference papers. He holds
over 15 patents in the ﬁelds of wireless communica-
tions, real-time systems, multimedia, and geolocation applications. His current
systems, and machine learning applications.
Nir Dvorecki received the B.Sc. degree in electrical
engineering, and the B.Sc. degree in physics in 2012,
and the M.Sc. degree in electrical engineering in
2015, all from Tel-Aviv University, Tel Aviv, Israel.
Since 2015, he has been a Researcher with the
Intel’s Location Core Division, Petah Tikva, Israel.
His current research interests include geolocation,
inertial navigation systems, and machine learning
applications.
Yuv al A mi zu r received the B.Sc. degree (summa
cum laude) in electrical engineering from the
Technion—Israel Institute of Technology, in 1996,
and the MBA degree (magna cum laude) and the
M.Sc. degree (summa cum laude) in electrical engi-
neering from Tel-Aviv University, Tel Aviv, Israel,
in 2002 and 2008, respectively.
He has been involved in cellular and wireless
connectivity systems development for over 20 years.
He has been leading Intel’s Location Core Division
Algorithms Group in Petah Tikva, Israel. He has
co-authored several conference papers, and holds over 30 patents in the ﬁeld
of wireless communications and geolocation applications. His current research
interests include signal processing, geolocation, inertial navigation systems,
and machine learning applications.
... Analyzing the composition, characteristics, and distribution of the errors is helpful to construct an accurate ranging model. Research has been conducted on the factors that affect FTM signal propagation including the clock skew, bandwidth effect, sampling effect, multipath effect, and positiondependent error in different scenarios [30][31][32][33]. However, some of these errors are hardware related and the compensation algorithms have been incorporated into the firmware. ...
... The variance of the fusion positioning result is calculated in (31), which is smaller than the variances of the two methods. ...
... Figure 5 demonstrates the process of fusion positioning. The above Equation (31) shows that the fusion positioning result is more stable than the single positioning result. Figure 5 demonstrates the process of fusion positioning. ...
Article
Full-text available
The Wi-Fi fine time measurement (FTM) protocol specified in the IEEE 802.11-2016 standard provides a new two-way ranging approach to enhance positioning capability. Similar to other wireless signals, the accuracy of the real-time range measurement of FTM is influenced by various errors. In this work, the characteristics of the ranging errors is analyzed and an abstract ranging model is introduced. From the perspective of making full use of the range measurements from FTM, this paper designs two positioning steps and proposes a fusion method to refine the performance of indoor positioning. The first step is named single-point positioning, locating the position with the real-time range measurements based on the geometric principle. The second step is named the improved matching positioning, which constructs a distance database by utilizing the existing scene information and uses the modified matching algorithm to obtain the position. In view of the different positioning accuracies and error distributions from the results of the aforementioned two steps, a fusion method using the indirect adjustment principle is proposed to adjust the positioning results, and the advantages of the matching scene information and the range measurements are served simultaneously. Finally, a number of tests are conducted to assess the performance of the proposed method. The experimental results demonstrate that the precision and stability of indoor positioning are improved by the proposed fusion method.
... In order to allow for the scalability of Wi-Fi NGP, researchers have presented passive localization techniques. That is, in [8,9], the authors propose a passive localization technique named Collaborative Time of Arrival (CToA), utilizing early IEEE 802.11az fea-tures with customized Wi-Fi FTM APs to form a highprecision geolocation network. It is unclear if CToA is to be adopted in Wi-Fi NGP, since documents published by the task group in 2019 indicate it is instead set to support a passive ranging mode named Passive Location Ranging [18]. ...
... Recall that, in order for a Wi-Fi FTM client to measure its distance with another station, a minimum of three frames and their acknowledgments are required (i.e., a request and two response frames for a single-shot measurement). Researchers found that a measurement may take up to 30 ms to complete, and as such, a responding station can support approximately 30 singleshot measurements per second [8]. However, the total duration of a session largely depends on the configured parameters (e.g., the Samples Per Burst (SPB) and Min Delta FTM parameters), and thus may vary significantly per its respective setup. ...
Article
Full-text available
With the standardization of Wi-Fi Fine Timing Measurement (Wi-Fi FTM; IEEE 802.11mc), the IEEE introduced indoor positioning for Wi-Fi networks. To date, Wi-Fi FTM is the most widely supported Wi-Fi distance measurement and positioning system. In this paper, we perform the first privacy analysis of Wi-Fi FTM and evaluate devices from a wide variety of vendors. We find the protocol inherently leaks location-sensitive information. Most notably, we present techniques that allow any client to be localized and tracked by a solely passive adversary. We identify flaws inWi-Fi FTM MAC address randomization and present techniques to fingerprint stations with firmware-specific granularity further leaking client identity. We address these shortcomings and present a privacy-preserving passive positioning system that leverages existing Wi-Fi FTM infrastructure and requires no hardware changes. Due to the absence of any client-side transmission, our design hides the very existence of a client and as a side-effect improves overall scalability without compromising on accuracy. Finally, we present privacy-enhancing recommendations for the current and next-generation protocols such as Wi-Fi Next Generation Positioning (Wi-Fi NGP; IEEE 802.11az).
... Recently, considerable attention has been devoted to employ other radio frequency (RF) signals, such as ultra-wideband (UWB) signals [6], [7], Bluetooth signals [8], [9], Wi-Fi signals [10], [11], radio frequency identification (RFID) signals [12], [13], or signals from cellular networks [14], [15], for high-accuracy indoor positioning. Among them, the fifthgeneration new radio (5G NR) signal is particularly noteworthy from the following aspects. ...
Article
Full-text available
The ubiquity, large bandwidth, and spatial diversity of the fifth-generation (5G) cellular signal render it a promising candidate for accurate positioning in indoor environments where the global navigation satellite system (GNSS) signal is absent. In this article, a joint angle and delay estimation (JADE) scheme is designed for 5G picocell base stations (gNBs), which addresses two crucial issues to make it both effective and efficient in realistic indoor environments. First, the direction dependence of the array modeling error for picocell gNB and its impact on JADE is revealed. This error is mitigated by fitting the array response measurements to a vector-valued function and precalibrating the ideal steering vector with the fit function. Second, based on the deployment reality that 5G picocell gNBs only have a small-scale antenna array but have a large signal bandwidth, the proposed scheme decouples the estimation of time-of-arrival (TOA) and direction-of-arrival (DOA) to reduce the huge complexity induced by 2-D joint processing. It employs the iterative-adaptive approach to resolve multipath signals in the TOA domain, followed by a conventional beamformer to retrieve the desired line-of-sight DOA. By further exploiting a dimension-reducing preprocessing module and accelerating spectrum computing by fast Fourier transforms, an efficient implementation is achieved for real-time JADE. Numerical simulations demonstrate the superiority of the proposed method in terms of DOA estimation accuracy. Field tests show that a triangulation positioning error of 0.44 m is achieved for 90% cases using only DOAs estimated at two separated receiving points.
... In outdoor environments, the global navigation satellite systems (GNSS) provide robust and accurate positioning information, while in deep urban canyons and indoor environments, they are unreliable owing to the severe blockage of the line-of-sight (LOS) signals. Manuscript Recently, considerable attention has been devoted to employ other radio frequency (RF) signals, such as ultra-wideband (UWB) signals [5], [6], Bluetooth signals [7], [8], Wi-Fi signals [9], [10], radio frequency identification (RFID) signals [11], [12], or signals from cellular networks [13], [14], for high-accuracy indoor positioning. Among them, the fifthgeneration new radio (5G NR) signal is particularly noteworthy from the following aspects. ...
Preprint
Full-text available
The ubiquity, large bandwidth, and spatial diversity of the fifth generation (5G) cellular signal render it a promising candidate for accurate positioning in indoor environments where the global navigation satellite system (GNSS) signal is absent. In this paper, a joint angle and delay estimation (JADE) scheme is designed for 5G picocell base stations (gNBs) which addresses two crucial issues to make it both effective and efficient in realistic indoor environments. Firstly, the direction-dependence of the array modeling error for picocell gNB as well as its impact on JADE is revealed. This error is mitigated by fitting the array response measurements to a vector-valued function and pre-calibrating the ideal steering-vector with the fitted function. Secondly, based on the deployment reality that 5G picocell gNBs only have a small-scale antenna array but have a large signal bandwidth, the proposed scheme decouples the estimation of time-of-arrival (TOA) and direction-of-arrival (DOA) to reduce the huge complexity induced by two-dimensional joint processing. It employs the iterative-adaptive-approach (IAA) to resolve multipath signals in the TOA domain, followed by a conventional beamformer (CBF) to retrieve the desired line-of-sight DOA. By further exploiting a dimension-reducing pre-processing module and accelerating spectrum computing by fast Fourier transforms, an efficient implementation is achieved for real-time JADE. Numerical simulations demonstrate the superiority of the proposed method in terms of DOA estimation accuracy. Field tests show that a triangulation positioning error of 0.44 m is achieved for 90% cases using only DOAs estimated at two separated receiving points.
... Owing to the availability of FTM-capable devices, several papers investigated the benefits of the FTM protocol. Initially, Banin et al. demonstrated the positioning accuracy [29] and investigated low-level fundamentals, such as the impact of clock drift on ranging performance [30]. Additionally, both ranging and positioning performances have been widely evaluated using the FTM protocol in various indoor and outdoor environments [31]- [48]. ...
Preprint
Full-text available
The fine timing measurement (FTM) protocol is designed to determine precise ranging between Wi-Fi devices using round-trip time (RTT) measurements. However, the multipath propagation of radio waves generates inaccurate timing information, degrading the ranging performance. In this study, we use a neural network (NN) to adaptively learn the unique measurement patterns observed at different indoor environments and produce enhanced ranging outputs from raw FTM measurements. Moreover, the NN is trained based on an unsupervised learning framework, using the naturally accumulated sensor data acquired from users accessing location services. Therefore, the effort involved in collecting training data is significantly minimized. The experimental results verified that the collection of unlabeled data for a short duration is sufficient to learn the pattern in raw FTM measurements and produce improved ranging results. The proposed method reduced the ranging errors in raw distance measurements and well-calibrated ranging results requiring the collection of ground truth data by 47-50% and 17-29%, respectively. Consequently, positioning error reduced by 17-30% compared to the result with well-calibrated ranging.
Article
Full-text available
Indoor high-precision positioning is currently one of the most interesting topics in the location-tracking and positioning research area. Although the WiFi round-trip-time (RTT) provides a promising ranging and positioning method, it faces two issues that need to be addressed. One is the ranging error drift, and the other is the ranging information loss. Existing research has mainly focused on the ranging error, and several solutions have been proposed. However, these solutions are mostly applied to the data level, and the cause of phase distortion error has not been found. The loss of ranging information has been simply attributed to the poor external environment. In this work, the impact of clock drift on WiFi RTT positioning is investigated and considered the root cause of the abovementioned issues. On this basis, a theory of the clock drift model is established and experimentally verified. This model can effectively explain the mechanism of the ranging error drift and the ranging information loss. Furthermore, the impact of the clock drift on missing positioning observations is investigated in three actual applicational situations, including the sampling rate, multipath effect, and power-saving mode. Therefore, the proposed model is important for improving the accuracy and reliability of WiFi RTT-based positioning because it provides the basis for solving subsequent problems. This model provides a theory to capture the moment when the communication status changes accurately. Furthermore, the ranging error drift can be corrected to obtain high-precision positioning results.
Article
Full-text available
The indoor positioning system is now an important technique as part of the Internet-of-Things (IoT) ecosystem. Among indoor positioning techniques, multiple Wi-Fi Access Points (APs)-based positioning systems have been researched a lot. There is a lack of research focusing on the scene where only one Wi-Fi AP is available. This work proposes a hybrid indoor positioning system that takes advantage of the Fine-Timing Measurements (FTM) technique that is part of the IEEE 802.11mc standard, introduced back in 2016. The system uses one single Wi-Fi FTM AP and takes advantage of the built-in inertial sensors of the smartphone to estimate the device’s position. We explore both Loosely Coupled (LC) and Tightly Coupled (TC) integration schemes for the sensors’ data fusion. Experimental results show that the proposed methods can achieve an average positioning accuracy of about 1 m without knowing the initial position. Compared with the LC integration method, the median error accuracy of the proposed TC fusion algorithm has improved by more than 52% and 67%, respectively, in the two experiments we set up.
Article
We present FALCON, a novel autonomous drone network system for sensing, localizing, and approaching RF targets/sources such as smartphone devices. Potential applications of our system include disaster relief missions in which networked drones sense the Wi-Fi signal emitted from a victim’s smartphone and dynamically navigate to accurately localize and quickly approach the victim, for instance, to deliver the time-critical first-aid kits. For that we exploit Wi-Fi’s recent fine time measurement (FTM) protocol to realize the first on-drone FTM sensor network that enables accurate and dynamic ranging of targets in a mission. We propose a flight planning strategy that adapts the trajectory of the drones to concurrently favor localizing and approaching the target. Namely, our approach jointly optimizes the drones’ diversity of observations and the target approaching process, while flexibly trading off the intensities of the potentially conflicting objectives. We implement FALCON via a custom-designed multidrone platform and demonstrate up to $2\times$ localization accuracy compared to a baseline flocking approach, while spending 30% less time localizing targets.
Article
The fine timing measurement (FTM) protocol is designed to determine precise ranging between Wi-Fi devices using round-trip time (RTT) measurements. However, the multipath propagation of radio waves generates inaccurate timing information, degrading the ranging performance. In this study, we use a neural network (NN) to adaptively learn the unique measurement patterns observed at different indoor environments and produce enhanced ranging outputs from raw FTM measurements. Moreover, the NN is trained based on an unsupervised learning framework, using the naturally accumulated sensor data acquired from users accessing location services. Therefore, the effort involved in collecting training data is significantly minimized. The experimental results verified that the collection of unlabeled data for a short duration is sufficient to learn the pattern in raw FTM measurements and produce improved ranging results. The proposed method reduced the errors in raw distance measurements and well-calibrated ranging results requiring the collection of ground truth data by 47–50% and 17–29%, respectively. Consequently, positioning errors were reduced by 17–30% compared to the well-calibrated ranging scenario.
Article
Full-text available
We tackle the problem of identifying the trajectory of a moving radio source from Time-of-Arrival (TOA) measurements collected by a set of cooperating receivers. The considered system is completely asynchronous: nodes clocks are affected by unknown time and frequency offsets, and no control is exerted over packet transmission times. In the proposed solution, the receiver clock offset terms are estimated from TOA measurements on packets originated by non-cooperative reference transmitters, possibly but not necessarily coincidental with reference receivers. Transmission time ambiguity is resolved by exploiting the redundancy associated to the reception of the same packet at multiple receivers. A distinguishing feature of the proposed solution is that it seeks to identify the parameters of the trajectory as a whole, rather than the individual points of transmission as done in traditional point-based approaches. This allows the effective exploitation of TOA measurements collected in lossy scenarios, where the generic packet is received by a smaller subset of the available receivers (at least two). For the problem at hand we provide distinct estimators based on TOA and Time-Difference-of-Arrival (TDOA) and prove their equivalence. Numerical results from simulations and from a real WiFi testbed are provided to validate the effectiveness of the proposed method.
Conference Paper
Full-text available
Wi-Fi client self-positioning based on estimated azimuth and elevation angles of departure (AoD), is presented. The devised method takes advantage of the Wi-Fi OFDM symbol structure, and enables an unlimited number of (single-antenna) Wi-Fi client stations operating simultaneously, to obtain a simple and direct estimate of the transmitted signal AoD. Unlike other AoD positioning methods, the method outlined eliminates the client's need to estimate any signal phase differences. The transmitter applies different beamforming to the modulating signal of each OFDM tone, thereby effectively steering its array beam to a different direction for each tone. Furthermore, the burden of calibrating and compensating for the transmitter's array spatial response is undertaken by the transmitter itself. The following paper formulates the problem and outlines the beamforming criteria, for which numerical performance analysis results are presented.
Article
Full-text available
Article
Full-text available
This paper proposes a novel robust high resolution time of arrival (TOA) estimation method for IEEE 802.11g/n range estimation in indoor environments. The algorithm identifies the TOA of ranging symbols by means of baseband signal processing using a single 802.11 channel. A subsample signal model provides high timing resolution. The CLEAN deconvolution algorithm, coupled with a parameter optimization step, provides robustness to multipath. Two ranging symbols are investigated: the 802.11 standard long training sequence and an impulsive symbol. In real-world wireless line of sight experiments, at ranges of up to 25 m, the method when applied to impulsive symbols was found to provide median ranging errors of 0.34 and 0.93 m with directional and omnidirectional antennas, respectively.
Conference Paper
Full-text available
WiFi-based positioning has recently drawn attention since the Fine Timing Measurement protocol was defined as part of the 802.11 standard. This protocol allows very accurate range measurements based on Round Trip Time estimation. In this paper we discuss the challenges of evaluating performance, present a ground truth acquiring tool and analyze results. We further discuss the problem of obtaining a reliable position estimation given the unique nature of the measurement error. We argue that a standard Kalman Filter (KF) has some shortcomings that can be overcome by using additional information sources. The more general Bayesian Filter (BF) offers a method for integrating map information with any other non-linear information, to provide a more accurate position estimation.
Article
Full-text available
This paper proposes a procedure based on time-difference of arrival measurements to localize a blind node in an asynchronous network where a set of nodes with known position is present. The proposed method computes the time-difference of arrival of each transmitted signal to any pair of receiving nodes in order to get rid of the unknown transmission time. A range-based localization procedure is implemented: first a least-squares estimator is used to compute a set of pseudo-ranges involving the blind node, then an iterative least-squares method is used to localize the blind node. The effectiveness of the proposed scheme is illustrated via simulations.
Article
Full-text available
The huge adoption of 802.11 technologies has triggered a vast amount of experimentally-driven research works. These works range from performance analysis to protocol enhancements, including the proposal of novel applications and services. Due to the affordability of the technology, this experimental research is typically based on commercial off-the-shelf (COTS) devices, and, given the rate at which 802.11 releases new standards (which are adopted into new, affordable devices), the field is likely to continue to produce results. In this paper, we review and categorise the most prevalent works carried out with 802.11 COTS devices over the past 15 years, to present a timely snapshot of the areas that have attracted the most attention so far, through a taxonomy that distinguishes between performance studies, enhancements, services, and methodology. In this way, we provide a quick overview of the results achieved by the research community that enables prospective authors to identify potential areas of new research, some of which are discussed after the presentation of the survey.
Article
IEEE 802.11 is a working group operating under the sponsorship of the IEEE Local Area Network (LAN)/Metropolitan Area Network Standards Committee (LMSC). It is responsible for writing standards focusing on wireless LANs (WLANs). A WLAN's typical transmission range is up to 100 m. Unlicensed spectrum is generally considered, including 2.4 GHz, 5 GHz, and 60 GHz, with a few exceptions, such as the lightly licensed spectrum being considered in IEEE 802.11y and the TV whitespace being considered in IEEE 802.11af.
Book
If you’ve been searching for a way to get up to speed on IEEE 802.11n and 802.11ac WLAN standards without having to wade through the entire specification, then look no further. This comprehensive overview describes the underlying principles, implementation details and key enhancing features of 802.11n and 802.11ac. for many of these features the authors outline the motivation and history behind their adoption into the standard. A detailed discussion of key throughput, robustness, and reliability enhancing features (such as MIMO, multi-user MIMO, 40/80/160 MHz channels, transmit beamforming and packet aggregation) is given, plus clear summaries of issues surrounding legacy interoperability and coexistence. Now updated and significantly revised, this 2nd edition contains new material on 802.11ac throughput, including revised chapters on MAC and interoperability, plus new chapters on 802.11ac PHY and multi-user MIMO. An ideal reference for designers of WLAN equipment, network managers, and researchers in the field of wireless communications.
Article
A derivation of the principal algorithms and an analysis of the performance of the two most important passive location systems for stationary transmitters, hyperbolic location systems and direction-finding location systems, are presented. The concentration ellipse, the circular error probability, and the geometric dilution of precision are defined and related to the location-system and received-signal characteristics. Doppler and other passive location systems are briefly discussed.