LTE Receiver Design And Multipath Analysis For Navigation .

SHAMAEI AND KASSAS657and carrier phase errors. Section 5 discusses the navigation framework. Section 6 presents experimental resultsfor a ground vehicle navigating exclusively with real LTEsignals and compares the proposed receiver against theESPRIT and EKAT algorithms. Section 7 concludes thepaper and provides future work.2LT E S I G NAL MODE LIn this section, the structure of the LTE signals is first discussed. Then, the signals that can be used for positioningin LTE systems are overviewed. Finally, the received signalmodel is presented.FIGURE 1 Block diagram of orthogonal frequency divisionmultiplexing (OFMD) encoding scheme for a digital transmission.Abbreviation: CP, cyclic prefix; IFFT, inverse fast Fourier transformTABLE 1 LTE system bandwidths and number of subcarriers2.1Frame structureIn LTE systems, the OFDM encoding scheme is used fordata transmission. In OFDM, the transmitted symbols aremapped to different carrier frequencies called subcarriers, where a Δf 15 kHz spacing is assigned betweendifferent subcarriers. Assuming that Nr subcarriers areallocated to data transmission, the transmitted serial datasymbols must be first divided into groups of length Nr andmapped to each of these subcarriers. The mapping processdepends on the LTE frame structure. Therefore, differentdata types are transmitted at different times and subcarriers. To reduce the interference on the received signal, aguard band is allocated to the OFDM signals, where nodata are transmitted on the subcarriers at both sides of theNr data subcarriers. This process is done by zero-paddingthe Nr data symbols to length Nc . Note that in LTE systems,no information is transmitted on direct current (DC) subcarrier. Next, an inverse fast Fourier transform (IFFT) istaken, resulting in an OFDM symbol in the time domain,which has a duration of Tsymb 1 Δf. The last LCP elements of the symbol are repeated at the beginning to provide the CP and are used to suppress the interference dueto multipath. Figure 1 summarizes the OFDM encodingscheme for a digital transmission.In LTE systems, the values of Nr and Nc , which representthe bandwidth, are not unique and can be assigned to thevalues presented37 in Table 1.The resulting OFDM symbols are grouped into frameswith a duration of Tf 10 milliseconds. In frequency division duplexing (FDD) transmission, each frame is dividedinto 20 slots with a duration of 0.5 millisecond. Each slotwith a normal CP allocation contains seven OFDM symbols. In a normal CP allocation, the CP of the first symbolof each slot has a duration of 5.21 𝜇s and the rest of thesymbols' CPs have a duration of 4.69 𝜇s.Since each data type is mapped to a specific time andsymbol, the UE needs to exactly know the frame start timeBandwidth,MHzTotal Numberof Subcarriers (Nc )Number ofSubcarriers Used (Nr 0Abbreviation: LTE, long-term evolution.to be able to extract its data. To provide the frame starttime to the UE, the PSS and SSS are transmitted in eachframe. The UE can estimate the frame start time by finding the peak of the correlation of the received signal withthe locally generated PSS and SSS. The structures of thePSS and SSS are discussed in details in the next subsection.Figure 2 shows an example of the LTE frame structure.2.2Ranging signalsThere are five different sequences in the received LTE signal that can be used for positioning: PSS, SSS, CP, PRS,and CRS. Note that these reference signals are broadcast inevery LTE frame regardless of whether any data are transmitted to any UE. Therefore, it is always possible to usethese reference signals for positioning. Besides, since theLTE reference signals are broadcast, the receiver does notneed to be an authorized UE to be able to exploit these reference signals for navigation. This makes it possible to usethe reference signals transmitted from eNodeBs of differentnetwork operators simultaneously.The PSS and SSS are continual pilot signals transmittedto provide the frame start time to the UE. The PSS is aZadoff-Chu sequence of length 62, which is transmitted onthe last symbols of slots 0 and 10. The PSS is transmitted inone form of three possible sequences, each of which mapsto an integer representing the sector ID of the eNodeB, ie,(2) {0, 1, 2}.NID

658SHAMAEI AND KASSASFIGURE 2 An example of the long-term evolution (LTE) framestructure with Nr 72. Primary synchronization signal (PSS) andsecondary synchronization signal (SSS) are transmitted on themiddle 62 subcarriers. The last symbols of slots 0 and 10 areallocated to PSS. SSS is transmitted on the sixth symbol of slot 0 or10. Cell-specific reference signal (CRS) is scattered in bothfrequency and time. CRS subcarriers are assigned based on the cellID and symbol numberThe SSS is also a sequence of length 62, which is transmitted on the sixth symbol of slot 0 or 10. This sequence(2)and the slot number in whichis defined based on NIDthe SSS is transmitted such that different eNodeBs' SSSsequences are orthogonal to each other. The SSS is transmitted in one of 168 possible forms, each of which maps toan integer representing the eNodeB's group identifier, ie,(1)(1)(2) {0, · · ·, 167}. By knowing NIDand NID, the UE canNID37,38obtain the eNodeB's cell ID asCellNID 3 (1)NID (2)NID.It has been shown analytically and experimentally that dueto the low transmission bandwidth of the PSS and SSS, theestimated position using the PSS and SSS can have significantly high error in multipath environments.27,39 Therefore, the PSS and SSS are more desirable for the acquisitionstage.An approach to estimate the time and frequency offsetin an additive white Gaussian noise channel with CP wasintroduced in van de Beek et al.40 However, the estimationresults may have high error in multipath environments.Besides, since the transmitted CPs for different eNodeBsare not orthogonal, it is not possible to estimate TOAs fordifferent eNodeBs using the CPs.The PRS is a scattered pilot signal, which was introduced in LTE Release 9 for network-based positioning.In positioning with the PRS, the dedicated resources tothe PRS are free from interference and the expected positioning accuracy is on the order of 50 m.41 However,PRS-based positioning suffers from a number of drawbacks: (1) The user's privacy is compromised since theuser's location is revealed to the network,42 (2) localization services are limited only to paying subscribers andfrom a particular cellular provider, (3) ambient LTE signalstransmitted by other cellular providers are not exploited,and (4) additional bandwidth is required to accommodatethe PRS, which caused the majority of cellular providersto choose not to transmit the PRS in favor of dedicatingmore bandwidth for traffic channels. To circumvent thesedrawbacks, UE-based positioning approaches that exploitthe CRS have been explored, where several advanced signal processing techniques were developed to achieve aperformance similar to the PRS.28,29,31,34,43The CRS is transmitted for channel estimation purposesand is scattered in time and bandwidth. The CRS sequenceis defined based on the cell ID, allocated symbol, slot,and transmission antenna port number, such that different eNodeBs' CRS sequences are orthogonal to each other.The eNodeB's cell ID indicates the designated subcarriersto the CRS. In this paper, the CRS transmitted on the kthsubcarrier and ith symbol is denoted by Si (k), where k mΔCRS 𝜅, m 0, · · · , M 1, M ⌊Nr ΔCRS ⌋, ΔCRS 6, and 𝜅 is a constant shift depending on the cell ID andthe symbol number i. In the sequel, for simplicity of notations, the subscript i is only used when it is required toindicate a specific symbol number. Figure 2 shows the PSS,SSS, and CRS.2.3Received signal modelsThe OFDM symbol is transmitted in a multipath fadingchannel, which is assumed to stay constant over the duration of a symbol and has the CIR ash(𝜏) L 1 𝛼(l) 𝛿(𝜏 𝜏(l)),l 0where L is the number of multipath components; 𝛼(l) and𝜏(l) are the relative attenuation and delay components,respectively, of the lth path with respect to the first path;𝛼(0) 1 and 𝜏(0) 0; and 𝛿 is the Dirac delta function. Therefore, the received symbol after removing theCP and taking a fast Fourier transform (FFT) in a perfectsynchronization condition will be R(k) C Y (k)H(k) W(k),for k 0, · · · , Nc 1,where Y(k) is transmitted OFDM symbol, C is the receivedsignal power due to the antenna gain and any implementation loss, W(k) (0, 𝜎 2 ), where (a, b) denotes thecomplex Gaussian distribution with mean a and varianceb, and

SHAMAEI AND KASSASH(k) 659L 1 𝛼(l)e 𝑗2𝜋𝜏(l)k Ts𝑦mb(1)l 0is the channel frequency response (CFR). In general, thereis a mismatch between the estimated received symbol timing and the actual one, which can be due to imperfectsynchronization, clock drift, Doppler frequency, and/orcarrier frequency offset. Assuming that time mismatch isless than the CP duration, the received signal at the ithsymbol can be rewritten as44,45 Ri (k) e𝑗𝜋e𝑓 e𝑗2𝜋(iNt LCP )e𝑓 Nc e𝑗2𝜋e𝜃 k Nc C Yi (k)Hi (k) Wi (k),for k 0, · · · , Nc 1,(2)𝑓where Nt Nc LCP ; e𝑓 Δ𝑓D ; fD is the total carrierfrequency offset due to the Doppler frequency, clock drift,and oscillators' mismatch; e𝜃 𝜃̂ 𝜃 is the symbol timingerror normalized by the sampling interval Ts Tsymb Nc ;and 𝜃̂ and 𝜃 are the normalized estimated and true symboltimings, respectively. Note that the first two exponentialsin (2) model the effects of the carrier frequency offset andthe third exponential models the effect of the symbol timing error. It is worth mentioning that Doppler frequencyfor each subcarrier is slightly different due to their different carrier frequencies. In this paper, this differenceis neglected and the Doppler frequency is defined withrespect to the center frequency fc (in Hz).33.1AcquisitionIn the acquisition stage, nodes A, B, and C are first connected to node 1, where an initial estimate of the framestart time is obtained by acquiring the PSS and SSS. Then,nodes A, B, and C switch to node 2, in which the initialtime estimate is refined using the ESPRIT algorithm andan initial estimate of the Doppler frequency is obtained. Inthis subsection, the acquisition stage is discussed in detail.3.1.1Initial acquisitionIn the first stage, nodes A, B, and C are connected to node1. Here, the carrier is wiped off and the baseband samples of the OFDM symbols and their corresponding CPs arereceived at the UE as shown in Figure 4. The UE may startreceiving a signal at any time of any frame. The UE needsto obtain the symbol start time to be able to remove the CPsand take the FFT to convert the signal to the frame structure. For this purpose, the UE first correlates the receivedsignal with the locally generated time-domain PSS.30 ThePSS is transmitted twice per frame. Hence, the correlationresult has two peaks in the duration of one frame, whichis 10 milliseconds. Since the transmitted PSS sequenceson slots 0 and 10 are the same, the UE cannot extract thesymbol numbers from the correlation result and only thesymbol start time can be obtained. Note that each type ofsignal is transmitted on a specific symbol and subcarrierof each frame. Therefore, knowing the symbol start time isRECEIVER ARCHITECTUREThe structure of the proposed LTE SDR is shown inFigure 3. The proposed receiver has two main stages,namely, acquisition and tracking. In the following, thestructure of each stage is discussed in detail.FIGURE 4 Received signal's samples structure. The receiver maystart receiving the samples at any random time. Abbreviation: CP,cyclic prefixFIGURE 3 Block diagram of the proposed long-term evolution (LTE) receiver architecture. Abbreviation: ESPRIT, estimation of signalparameters by rotational invariance techniques; FFT, fast Fourier transform; NCO, numerically controlled oscillator; PSS, primarysynchronization signal; SSS, secondary synchronization signal

660SHAMAEI AND KASSAŜ i (mΔ CRS 𝜅)̂ ′ (m) HH L 12𝜋mΔCRS 𝜏 ′ (l) 𝑗Ts𝑦mb𝛼 ′ (l)e W ′′ (m)l 0 aT (m)𝜶 W ′′ (m),(4)for m 0, · · ·, M 1.whereFIGURE 5 Primary synchronization signal (PSS) and secondarysynchronization signal (SSS) normalized correlation results withreal long-term evolution (LTE) signals [Color figure can be viewedat wileyonlinelibrary.com and www.ion.org]]T[𝜶 𝛼 ′ (0), · · · , 𝛼 ′ (L 1) ,[ 2𝜋k𝜏 ′ (0)]T′ 𝑗 𝑗 2𝜋k𝜏 (L 1),a(m) e Ts𝑦mb , · · ·, e Ts𝑦mb𝛼 ′ (l) 2𝜋(iNt LCP )e𝑓 𝑗 2𝜋𝜅𝜏(l)𝑗NcCe𝑗𝜋e𝑓 ee Ts𝑦mb 𝛼(l),𝜏 ′ (l) 𝜏(l) Ts e𝜃 ,not enough and the UE needs to exactly obtain the symbolnumbers in each frame. Therefore, the signal is next correlated with the locally generated time-domain SSS. TheSSS correlation result has only one peak, since the SSS istransmitted only once per frame. Since the SSS sequencedepends on the slot number, it is possible to obtain thesymbol number using the SSS correlation results. Figure 5shows an example of the correlation of locally generatedPSS and SSS with real LTE signals. The PSS and SSS haveapproximately 1 MHz bandwidth. The peak of the correlations may have a bias compared with the true frame timingin a multipath environment, which is modeled by symbol timing error presented in the received signal modelin (2). In addition, due to the receiver's and transmitter'soscillator mismatches and Doppler frequency, a carrier frequency offset may remain in the received signal after carrier wipeoff. This is modeled by the total carrier frequencyoffset in (2).3.1.2Acquisition refinementIn the second stage, nodes A, B, and C are connected tonode 2. Here, the symbol timing error and carrier frequency offset are estimated and removed from the receivedsignal. For this purpose, the CFR must first be estimated.In the symbols carrying the CRS, the transmitted signalY(k) is equal to the CRS sequence S(k). Since the CRSsequence is known at the receiver, it is possible to estimatethe CFR at the ith symbol aŝ i (k) Ri (k)S (k),HiL 12𝜋(iNt LCP )e𝑓 2𝜋 (e𝜃 𝜏(l) Ts )k𝑗𝑗NcNce C 𝛼(l)e𝑗𝜋e𝑓 e(3)l 0′ W (k),for k mΔCRS 𝜅, m 0, · · · , M 1, and W ′ (k) W(k)Si (k). The estimated CFR at the ith symbol and subcarriers allocated to the CRS can be rewritten asW ′′ (m) W ′ (mΔ CRS 𝜅).The set of estimated CFR over M different subcarriers canbe written as[ ′]̂′ Ĥ (0), · · · , Ĥ ′ (M 1) TH A𝜶 W ′′ ,whereA [a(0), · · ·, a(M 1)]T ,[]TW ′′ W ′′ (0), · · · , W ′′ (M 1) .̂ can beThe covariance matrix of the estimated channel Hwritten asRH AR𝛼 AH RW ,′where RH , R𝛼 , and RW are the covariance matrices of̂ ′ , 𝜶, and W ′′ , respectively, and H represents the HerHmitian operator. It can be shown that A has L linearlyindependent vectors, which span the L-dimensional signal subspace. The goal is to find L independent vectorsthat best fit the observed CFR. Several methods have beenproposed to solve this problem including multiple signalclassification (MUSIC) and ESPRIT. The ESPRIT methodhas lower complexity compared with other approaches. Ituses the rotational invariance properties of the subarrays ofthe subcarriers with respect to each other to estimate 𝜏 ′ .36,46To be able to use the ESPRIT algorithm, the channel lengthL must first be estimated. The minimum descriptive length(MDL) criterion is one approach to estimate L.47 In thissubsection, the MDL criterion and the ESPRIT algorithmare summarized. The details of the proof of each approachare provided in Roy and Kailath36 and Wax and Kailath.47Step 1: The data matrix X must first be constructed withsnap shots of estimated CFR aŝ ′ (0) H ̂′X H (1) ̂′ H (P 1)̂ ′ (1)Ĥ ′ (2)H ̂ ′ (P)Ĥ ′ (K 1) ··· Ĥ ′ (K) ··· H ,··· ̂ ′ (M 1) ··· H

SHAMAEI AND KASSAS661where P is the design parameter and K M P 1.Step 2: The channel length L can be estimated usingthe MDL metric. For this purpose, the singularvalue decomposition (SVD) of X UΣVH mustbe calculated, U and V are unitary matrices, andΣ is a rectangular diagonal matrix with singularvalues 𝜎 1 · · · 𝜎 P on the diagonal. Next,calculate the MDL criterion as P 1 𝜆1 (P 𝛾) l 𝛾 l MDL(𝛾) K(P 𝛾) log 1 P 1 𝜆 P 𝛾 l 𝛾 l 1 𝛾(2P 𝛾) log K,2for 𝛾 0, · · ·, P 1,where 𝜆l 𝜎l2 . The estimate of L is obtained asL̂ arg min MDL(𝛾).𝛾Step 3: By knowing the channel length, it is possible toorganize the eigenvectors corresponding to the]T[L̂ largest eigenvalues as Us U IL̂ 0L (P ,̂̂L)where Il is an identity matrix of size l and 0l pis an l-by-p matrix whose elements are zeros.Then, construct[]0(P 1) 1 Us ,U1 IP 1[]U2 0(P 1) 1 IP 1 Us .Step 4: Finally, the ESPRIT rotational matrix must beconstructed as() 1 HΨ UHU1 U2 ,1 U1and compute its eigenvalues 𝜓 l , for l 0, · · · , L̂ 1. The values of 𝜏 ′ (l) can be obtained as𝜏 ′ (l) 12𝜋Ts Δ𝑓 ΔCRSarg{𝜓l }.Since it was assumed that 𝜏(0) 0 and 𝜏 ′ (l) 𝜏(l) Ts e𝜃 , the normalized estimated symboltiming error can be obtained asê 𝜃 1min 𝜏 ′ (l).Ts lNote that in some environments, the direct signal may be blocked and the minimum of theestimated channel delays may not correspondto the LOS signal. However, differentiating theLOS signal from non-LOS (NLOS) signals is outof the scope of this paper.The normalized estimated symbol timing error ê 𝜃 canbe divided into two parts: integer, Int{·}, and fractional,Frac{·}, given byê 𝜃 Int{̂e𝜃 } Frac {̂e𝜃 },where 1 Frac {̂e𝜃 } 0.Next, the initial Doppler frequency can be estimated,by measuring the difference between the received signals'phases on the same symbols of two consecutive slots. Forthis purpose, define z(m) as (k)Si (k)z(m) Ri 7 (k)R i (k)Si 7𝑗2𝜋7Nt e𝑓 Nc Ce(5) Hi (k) W (k),2′for k mΔCRS 𝜅, m 0, · · · , M 1.Then, the initial carrier frequency offset is estimated as𝑓̂D 1Δ𝜑,2𝜋Tslotwhere Tslot 0.5 millisecond and[M 1] Δ𝜑 argz(m) .(6)(7)m 0Note that Δ𝜑 is a function of the difference between thephases of two received signals at two different symbols.Since in this paper the sampling clock frequency offsetis assumed to be negligible, Δ𝜑 is defined according to(7). As such, the Doppler frequency estimate (6) ignoresthe sampling clock frequency offset. To include the effectof this offset, an approach such as the one described inSpeth et al48 could be adopted. The normalized estimatedDoppler frequency is used to remove the initial phaseestimate from the time-domain received signal aŝr(n) e 𝑗 𝜙(n) r(n),̂where r(n) is the time-domain received signal, 𝜙(n) 2𝜋 𝑓̂D nTs .After removing the total carrier frequency offset estimate from the received signal r(n), the integer part of thesymbol timing error is used to control the FFT window.Then, the FFT is taken from r(n) to convert the signal tothe frequency domain R(k). Next, the fractional part of theestimated symbol timing error is removed from R(k) asR′ (k) e 𝑗2𝜋kFrac{̂e𝜃 } Nc R(k).Therefore, the ith received symbol on the subcarriers carrying the CRS after removing the symbol timing errorestimate can be written asR′i (k) e𝑗𝜋̃e𝑓 e𝑗2𝜋(iNt LCP )̃e𝑓 Nc e𝑗2𝜋̃e𝜃 k Nc CSi (k)Hi (k) Wi (k),for k mΔCRS 𝜅,m 0, · · · , M 1,(8)

662SHAMAEI AND KASSASwhere ẽ 𝑓 e𝑓 ê 𝑓 is the remaining carrier frequencyoffset and ẽ 𝜃 e𝜃 ê 𝜃 is the remaining symbol timingerror.3.2TrackingIn the tracking stage, nodes A, B, and C are connected tonode 3, where a PLL-aided DLL is used to track the symboltiming. In this subsection, the structures of the PLL andDLL are discussed in detail.3.2.1Phase-locked loopA PLL has three main components: a carrier phase discriminator function, a carrier loop filter, and a numericallycontrolled oscillator (NCO). The carrier phase discriminator function is defined as[M 1] ′ R (k)S (k) ,DPLL argm 0for k mΔCRS 𝜅,m 0, · · · , M 1.It can be shown that for ẽ 𝜃 0, the PLL discriminatorfunction for the ith received signal and in a multipath-freeenvironment can be written asDPLL Δ𝜙 NPLL,where Δ𝜙 𝜋̃e𝑓 2𝜋(iNt LCP )̃e𝑓 Nc and NPLL is azero-mean noise with variance()𝜎2𝜎21 .(9)var [NPLL ] 2MC2MCA second-order PLL is used to track the carrier phase,with a loop filter transfer function given byFPLL (s) 2𝜁 𝜔PLL 𝜔2PLL,(10)swhere 𝜔PLL is the undamped natural frequency of thephase loop and 𝜁 is the damping ratio. The dampingratio was set to 1 2 to have a step response that risesfast enough with little overshoot.49 Therefore, the PLLnoise-equivalent bandwidth is BPLL 0.53𝜔PLL .50 Theoutput of the filter is the rate of change of the carrierphase error 2𝜋 𝑓̂D expressed in rad/s. The phase loop filtertransfer function in (10) is discretized and realized in statespace. The loop update rate was set to a frame duration ofTf . An NCO is used to integrate the phase as3.2.2Delay-locked loopIn conventional DLLs (eg, dot product), the TOA error isobtained as a function of the early, late, and prompt correlations, which are the correlation of the received signalswith locally generated early (advanced), late (delayed), andprompt versions of the code sequence, respectively. TheCRS is scatt

paper and provides future work. 2 LTE SIGNAL MODEL In this section, the structure of the LTE signals is first dis-cussed. Then, the signals that can be used for positioning l model is presented. 2.1 Frame structure In LTE systems