Hybrid TOA AOA Location Positioning Techniques in GSM Networks

Transcription

1 Wireless Pers Commun DOI /s x Hybrid TOA AOA Location Positioning Techniques in GSM Networks Nikos Deligiannis SpirosLouvros Springer Science+Business Media, LLC Abstract Positioning algorithms and their implementation in mobile networks are being investigated in the literature due to their importance in location services. Nowadays, the need for superior accuracy has cast attention to hybrid positioning techniques. In this paper, we introduce a novel algorithm for the identification of NLOS propagation using both angle and time estimates, which leads to enhanced versions of the Time of Arrivals and Angle of Arrivals positioning methods. Furthermore, a novel GSM procedure for the implementation of the latter techniques is proposed. In contrast to specified network-based GSM solutions (U-TDOA), the proposed requires minimum modifications in the GSM Phase 2+ infrastructure and protocol stack, and therefore increases the upgrade flexibility and minimizes the implementation cost. The proposed GSM positioning procedure has been experimentally validated using a GSM emulator and the modified signalling messages given by a measurement tool of the emulator are exhibited. Finally, the enhanced cost functions are experimentally evaluated using several GSM-like, high-capacity simulation environments and the results have shown significant reduction of the location error compared to the conventional techniques. Keywords Time of arrivals Angle of arrivals Hybrid techniques GSM procedure Paging signalling Access delay N. Deligiannis Department of Electronics & Informatics (ETRO)-Interdisciplinary Institute for Broadband Technology (IBBT), Vrije Universiteit Brussel (VUB), Pleinlaan 2, B-1050 Brussels, Belgium ndeligia@etro.vub.ac.be S. Louvros (B) Department of Telecommunication Systems & Networks, Technological Educational Institute of Mesologgi, Nafpactos, Hellas, Greece splouvros@teimes.gr

2 N. Deligiannis, S. Louvros 1 Introduction Positioning algorithms are of great importance in mobile cellular telecommunications as means of providing LoCation Services (LCS), mainly, in areas with high concentration of subscribers. These services support applications which make use of the knowledge of the position of the mobile station and can be classified into Commercial LCS, Internal LCS, Emergency LCS and Lawful Intercept LCS. Solutions for implementing a mobile location positioning system are classified into handset-based and network-based positioning. The former techniques require the legacy handsets to be redesigned in order to meet new requirements, while the latter necessitate adjustments only in the base stations (BS) or the switching centers. Global System for Mobile communications (GSM) networks, with an approximate number of 1.5 billion subscribers, are attractive platforms for emerging location aware applications. Although Wideband Code Division Multiple Access (WCDMA) is growing and lately the LTE enhancement is appearing in the 3rd Generation Partnership Project (3GPP) specifications for 3,5G networks, GSM is still vital from the coverage, the capacity and the services point of view. The importance of developing an accurate positioning technique based on GSM technology is emphasized by the coverage possibilities that the GSM cells still offer in an heterogeneous cellular environment. Combined network strategies, from a planning and dimensioning point of view for GSM/GPRS and WCDMA, aims at providing efficient radio resource utilization for the operator and a seamless service experience for the subscriber. WCDMA and GSM are to be seen as complementary systems, where GSM contributes with a well built-out coverage and WCDMA adds new services and higher bit-rates at mostly hotspot areas. Inter-working between these systems enables subscribers with Inter-Radio Access Technology (Inter-RAT) capable terminals to reach WCDMA services on WCDMA while using GSM as a fallback access technology outside WCDMA coverage. In most countries nowadays the pure WCDMA geographical coverage solution is still not feasible due to cost investments and deployment. In these cases, the GSM network is providing an underlay full geographical coverage solution while the WCDMA is mostly a high capacity and services network in an overlay hot-spot coverage solution. Therefore, from the location positioning point of view a GSM-based solution is essential since in most of the cases the handset resides on GSM cellular coverage. Moreover, GSM phones have constant connectivity and are usually at hand and powered on. In the GSM-EDGE Radio Access Network (GERAN), Cell Identification (CID) [1], Enhanced Observed Time Difference (E-OTD) [2], Uplink Time Difference of Arrivals (U-TDOA) [3] and Assisted Global Positioning System (A-GPS) [4], are specified to perform location estimation of the mobile station (MS). The CID method determines the position of the subscriber using the coverage information of the serving BS. This knowledge can be obtained by paging, location update or location area (LA) update. The CID s accuracy depends on the cell size. For pico and micro solutions (indoor or in-building coverage) where the cell size is considered to be very restricted ( m) the CID s accuracy is satisfactory. Yet, in macrocells which have a cell coverage of 1 35 km the CID does not contribute anymore to accurate location positioning. It is possible to improve CID s accuracy by utilising the Timing Advance parameter (TA), especially in macrocells, but still the granularity of the TA parameter is 554 m. Although CID shows poor accuracy in cells served by omnidirectional antennas, it can have reasonable performance in sectored cells. U-TDOA estimates the position of a mobile station by measuring the time difference of arrivals between the signal received at the serving BS and the same transmission received at other surrounding BSs. By using at least three BSs to resolve ambiguities, the MS s position is given by

3 Hybrid TOA AOA Location Positioning Techniques in GSM Networks the intersection of hyperbolas. Precise synchronization of BSs is required in this technique. E-OTD is the handset-based alternative to U-TDOA based on the OTD feature already existing in GSM. An substitute method which measures the TDOAs from several BSs and then solves the optimization problem through a cooperative stochastic algorithm was recently presented in [5]. The basic idea of A-GPS is to establish a GPS reference network whose receivers have clear views of the sky and that can operate continuously. This reference network is also connected with the GSM infrastructure, continuously monitors several parameters such as satellite visibility, Doppler, clock correction, etc. At the request from the MS, the assistance data from the reference network is transmitted to the handset to increase the performance of the GPS sensor. E-OTD and A-GPS are included in handset-based positioning requiring modifications in the legacy GSM handsets. On the contrary, network-based technologies involve changes only in the infrastructure of the network. In general, network-based techniques are preferable due to their fair implementation complexity, the limited cost and the satisfactory performance. Typical representatives are Time of Arrivals (TOA) [6 10], which rely on calculating accurate time estimates at several BSs and Angle of Arrivals (AOA) [11] in which BS antenna arrays are required to measure the angle of the received signal. Though not yet established in GSM networks, research is ongoing for smart BS antennas which can provide precise angle estimates in mobile cellular networks [12]. In recent years, the trend for exploiting the benefits of both TOA and AOA techniques simultaneously, has cast attention to hybrid solutions [13 18]. In this work, we revise the mathematical rudiments of both TOA and AOA techniques and we introduce a novel algorithm which makes use of TOA and AOA estimates, supported by data regarding the BSs environments, to identify the degree of non-line-of-sight (NLOS) propagation at each measurement. Thereafter, appropriate weights, related to the degree of NLOS degradation at each BS, are incorporated in the typical TOA and AOA cost functions resulting to improved positioning accuracy. Moreover, we introduce a novel GSM procedure to obtain accurate time and angle estimates from three BSs and transfer them to the network for positioning processing under TOA, AOA or the proposed Enhanced-TOA (E-TOA), Enhanced-AOA (E-AOA) techniques. Time measurements are carried from the BS to the network using the existing GSM parameter called Access Delay while AOA measurements are transmitted using a modified Measurement Report message. The proposed procedure is liberated from the U-TDOA drawbacks including BSs synchronization, hearability and capacity loss. Furthermore, it is entirely compatible with the Phase 2+ GSM infrastructure and requires minimum modifications in the existing networks. Since it is a network-based technique, it works with legacy handsets and can be easily implemented in the software releases of the switches and loaded as a simple change delivery on the GSM nodes. The feasibility of the proposed procedure has been investigated using a GSM network emulator provided by Teledrom/Ericsson and the required modifications in the legacy signalling messages are given. Regarding the validation of the proposed E-TOA and E-AOA algorithms, we conduct experiments using several GSM-like, high-capacity simulation environments. Following the latest achievements in GSM cell planning for high capacity, the optimized macro/micro-cellular coverage scenario is considered in the simulation environments. For the propagation of wideband radio channels, a 2-D ray-trace model combined with a well-established probabilistic model have been employed. All the results indicate the superior positioning accuracy of the proposed hybrid TOA AOA techniques compared to the corresponding conventional ones. The remainder of this paper is organised as follows. Section 2 summarises the mathematical background of TOA and AOA techniques and reports the corresponding enhanced

4 N. Deligiannis, S. Louvros algorithms. The proposed GSM procedure for the implementation of conventional/hybrid TOA and AOA techniques, as well as the required modifications in the existing signalling messages as provided by a GSM software emulation are presented in Sect. 3. The validation of the proposed hybrid techniques in several simulation environments exhibiting a variety of NLOS and multipath degradation is provided in Sect. 4. Finally, Sect. 5 draws the conclusions of this work. 2 Proposed Hybrid Positioning Techniques Various wireless location positioning techniques, which have been extensively investigated in the literature, can be classified into time- or angle-based. Both categories have their own advantages and limitations, and therefore it is reasonable to consider hybrid approaches to integrate the merits of both techniques. In [14], a technique which combines TDOA measurements from several BSs with the AOA at the serving BS has been proposed for WCDMA systems. To overcome the drawbacks of the Taylor series approach, this scheme uses a leastsquare (LS) estimator, initially proposed in [19]. Furthermore, Thomas et al. [17] proposed a positioning technique for UMTS networks, which processes TDOA estimates with the AOA at the serving BS using a Kalman filter (KF) tracking state. In contrast to [14,17], in [18] all AOA data along with TDOA information from all BSs are processed centrally using the extended Kalman filter (EKF) to determine the handset s position in ultra wideband (UWB) systems. Towards a simple approach, Chen et al. [13] introduced an algorithm which selects the best position outcome from TOA, AOA, and hybrid TOA/AOA by comparing the distance of each estimated position with their mean. To mitigate the NLOS location error in mobile communications several techniques have been proposed in the literature. Initially, a polynomial fitting was applied to all range measured data for variance calculation and data smoothing [20]. It was noticed that the standard deviation of the range measurements is much higher for NLOS than for LOS propagation. However, since a block of measured data is not always available, real time positioning may not be possible. Towards more realistic solutions, biased versions of the KF have been proposed to reduce the impact of NLOS propagation [21,22]. Nonetheless, to obtain fair location accuracy, a rule-determined coefficient for the measurement noise covariance matrix is required. For positioning in UMTS networks, a modified Kalman algorithm with NLOS bias estimation was introduced in [23]. Regarding the mitigation of the location error due to NLOS propagation in the AOA positioning technique, Xiong [24] presented a selective algorithm which excludes the NLOS signals during the position estimation. The selective criterion used was the root mean square of the angular errors. Based on our recent findings [15], in this section we propose the combined use of TOA and AOA estimates, measured at three BSs, supported by some minimal information about the neighborhood environment of each BS to determine the NLOS BSs in a GSM network. Thereafter, appropriate weights associated to the degree of LOS degradation at each BS are incorporated in the typical TOA and AOA cost functions. 2.1 Enhanced Time of Arrivals Technique Revisiting the fundamentals of the TOA technique, the location of the Mobile Station (MS) derives from measuring the time needed for a signal to travel from a number of BSs to the MS. The equation d = c t provides the distance between MS and BS. Geometrically, the

5 Hybrid TOA AOA Location Positioning Techniques in GSM Networks MS lies on a circle centred at the BS s location and radius distance d. By using at least three BSs, the position of the MS is given by the intersection point of the three circles. Quite a few methods have been proposed as solutions to obtain the time estimates including phase estimation, pulse transmission, burst transmission, signalling and spread spectrum techniques. In the first technique, phase detectors are employed in the BSs and synchronization of the BSs used for positioning is required. In pulse transmission and spread spectrum systems, the time estimates are computed by implementing correlation techniques [10]. Due to measurement errors in time estimates the circles do not intersect at a single point. In that case, location algorithms have been introduced in the literature to resolve the problem [19]. Moreover TOA method suffers from NLOS propagation. In this case, the signal does not travel directly from the MS to the BS but it reaches the latter through reflections or diffractions on buildings, cars, obstacles, etc. Therefore, Turin et al. [10] modified the location algorithm taking into consideration that in NLOS propagation the measured distance d BSi = c t BSi is greater than the true one c (t BSi t) where t is the NLOS propagation error, and thus the possible MS s location lies inside the circle centred in BS s position. For the three BSs TOA technique, the intersection of the three circles provides an area where the MS can possibly lie. The location estimate is calculated using a non-linear least square solution. According to this, for each BS used in location process, the following function is formed [10]: g i (x, y) = cτ BSi (x x BSi ) 2 + (y y BSi ) 2, (1) where (x BSi, y BSi ) are the coordinates of the BS i. Then, the feasible area, here denoted by E, can be appointed by the following inequality: E ={(x, y) g i (x, y) 0, i = 1,...N BS }. (2) Combining (2) with (1) leads to: E ={(x, y) (x x BSi ) 2 (y y BSi ) 2 (c t BSi ) 2, i = 1,...N BS }, (3) where N BS is the number of the BSs. Then, the following cost function can be derived: N BS G TOA (x, y) = (x, y), (4) i=1 where α i are weights reflecting the signal strength as received at the BS i,(i = 1...N BS ).If no information about signal strength is available or not taken into account, it is possible to set α i = 1, i = 1...N BS. The location estimate is finally given by the couple (x, y) that minimizes the cost function inside the feasible region. To improve the accuracy of the TOA s cost function (4), in environments where NLOS propagation is frequent we present a novel method which enables the network to identify the NLOS BSs To implement the proposed method, the network requires (a) antenna arrays installed in the BSs in order to measure the angle of the received signal, and (b) a Geographical Interface System (GIS) available to the network operator in order to derive information about the surroundings of each BS involved in the positioning estimation of the mobile terminal. Hence, the network can apply the Sentinel Function (SF) [16], denoted by ϕ(θ), which is defined as the Euclidean distance between a BS and the nearest obstacle found along the azimuth direction identified by angle θ of the received signal. Note that, the network can derive ϕ(θ) from a GIS system by sampling the surrounding environment with a certain step size ε [0,γ], whereγ is the angle spread of the BS s antenna. The more complex the a 2 i g2 i

6 N. Deligiannis, S. Louvros clutter in the BS neighborhood is, the smaller the sampling step required. Even in demanding surroundings, however, a small amount of memory is needed to store the samples. For the angle (direction) of an incoming signal, the distance between the BS and the MS (provided by the TOA measurement) is compared with the first obstacle s distance at the same direction. If ϕ(θ) c t BSi 0 then the MS is considered in LOS with the BS i. On the contrary, if ϕ(θ) c t BSi < 0 then the MS is considered in NLOS with the BS i. Additionally, the network is able to determine the degree of NLOS propagation in each NLOS BS, denoted by BS NLOS. This is done by comparing the absolute differences c t BS NLOS ϕ i BS NLOS (θ) of i the NLOS BSs. We notice that, the absolute difference c t BS NLOS ϕ i BS NLOS (θ) expresses i the covered distance by the reflected signal before the final reflection above the obstacle, which will direct the signal to the BSi NLOS. The greater this absolute difference is, the longer the distance the reflected signal has covered due to NLOS propagation. These reflections cause the erroneous increment in TOA or in other words, they increase the deviation between the estimated, d BSi = c t BSi and the true distance between the MS and the BSi NLOS. Thereafter, in order to reduce the affect of NLOS erroneous measurements, we propose the inclusion of appropriate weights, denoted by l i, i = 1...N BS,intheTOA cost function (4). In this work, we suggest that l i = 1 is assigned to the LOS BSs while the value of the l i coefficients for the NLOS BSs are reduced by an order of magnitude proportionally to the value of the absolute difference c t BS NLOS ϕ i BS NLOS (θ). Toset i an example, in case one BS is in NLOS then we set l i = 10 1.IncasetwoBSsarein NLOS and c t BS NLOS ϕ 1 BS NLOS (θ) < c t 1 BS NLOS ϕ 2 BS NLOS (θ) then we set l 1 = and l 2 = Finally, if all three BSs are in NLOS and c t BS NLOS 1 c t BS NLOS 2 ϕ BS NLOS 2 (θ) < c t BS NLOS 3 ϕ BS NLOS 3 ϕ BS NLOS (θ) < 1 (θ) then the values of the coefficients are set as l 1 = 10 1,l 2 = 10 2 and l 3 = 10 3, respectively. Notice that, these values have been chosen by the authors since they have shown the minimum location error in several experiments. However, the employ of alternative coefficient s values and/or ways to mitigate the NLOS error, remain to be investigated. In this direction, our forthcoming work is targeting more accurate and sophisticated solutions regarding the coefficient s tuning based on scattering principles and probabilistic models. After the introduction of the l i coefficients the TOA cost function is reformed as follows: 2.2 Enhanced Angle of Arrivals Technique N BS G ETOA (x, y) = l i ai 2 g2 i (x, y). (5) i=1 In the AOA technique [11], the angles of arrivals of a signal from the MS at a pair -or more- BSs are measured by using antenna arrays (or adaptive antennas). The position of the MS is defined by the intersection of at least two directional lines of bearing. Location errors occur in AOA technique by reason of NLOS propagation and multipath. Due to NLOS propagation the reflected signal received at BS antenna array has different AOA than the direction of the MS. Moreover, even in LOS propagation, multipath which means scattered signals near and around the BS would still alter the measured AOA. Because of measuring limitations of the devices, the higher the distance between MS and BS, the more the precision of the method decreases. In proportion to the TOA technique the location positioning using the AOA technique implements the minimization of a cost function [15]. As the MS s location lies on a beeline determined by the AOA of the signal received at the BS and BS s coordinates (Fig. 2), the following function is assumed:

7 Hybrid TOA AOA Location Positioning Techniques in GSM Networks f i (x, y) = (y y BSi ) tan φ i (x x BSi ) (6) where φ i is the angle of arrival of the signal received at the BS i from the MS. The coordinates of the MS are those that minimize the following cost function: N BS F AOA (x, y) = ai 2 fi 2 (x, y), (7) i=1 Following the algorithm discussed in Sect. 2.1, the network can determine the NLOS BSs as well as the degree of measurement degradation due to NLOS propagation. Similarly to Sect. 2.1, the AOA location error due to NLOS propagation can de reduced by the use of appropriate AOA coefficients l i. The role and the demands of these coefficients are approximately the same with the corresponding in the enhanced TOA technique. Correspondingly to E-TOA, the implementation of AOA LOS coefficients require the formation of the Sentinel Function φ(θ). However, on the contrary to E-TOA, l i coefficients are used to remove the contribution of the NLOS BSs in the E-AOA cost function. Therefore their value is binary (0 or 1): In case that all three BSs are in LOS with the MS then we set l i = 1, i = 1 =...N BS. An exception may be if the AOA received at a BS is φ = π/2. Since tan φ = we set l = 0 to remove the ambiguity. When one BS is in NLOS with the MS then we set l = 0 and the cost function estimates the position by the minimization of the remaining directional lines. In that case, the NLOS propagation error is removed and assuming an environment without scattering, the location error drops to zero. When two BSs are in NLOS with the MS we set l = 0 for the BS which corresponds to the greatest absolute difference c t BS NLOS i ϕ BS NLOS (θ). This is why, the greater this i absolute difference is, the more the number of the reflections undertaken by the signal. In general, an increase in the reflections number causes greater error in the measured AOA. Similarly, when all three BSs are in NLOS, the algorithm picks out the BS which corresponds to the greatest c t BS NLOS i ϕ BS NLOS (θ) absolute difference. i Finally, incorporating the NLOS coefficients in (7), the coordinates of the MS are provided by the minimization of the following cost function: N BS F EAOA (x, y) = l i ai 2 fi 2 (x, y) (8) i=1 3 Proposed Network-Based GSM Positioning Technique To date GSM uplink time-based positioning technology i.e. U-TDOA, faces several problems. When the MS is very close to the serving BS the hearability of the MS degrades severely. Furthermore, the network can exhibit capacity loss due to handovers to sub-optimal BSs. An additional restriction is the need for strict synchronization of the BSs which is not straightforward in a GSM network [4,25]. Finally, in rural environments where cell site spacing is very large and geometries are limited by constrained network coverage (e.g. very rural highways, mountainous areas, etc.), the hyperbolic approach of U-TDOA is deficient.

8 N. Deligiannis, S. Louvros In this section, we present a novel network-based procedure for the implementation of (Enhanced-)TOA and (Enhanced-)AOA positioning techniques in the legacy GSM Phase 2+ infrastructure and protocol stack. Specifically, the proposed procedure allows the GSM network to obtain accurate time and angle measurements from several BSs using the Paging signalling and transfer them to a central node for processing. An essential requirement of the proposed procedure is that the target handset remains in idle mode. When in busy mode, the target MS can be located using U-TDOA which uses forced handovers to sub-optimal BSs but then, apart from the inherent disadvantages of U-TDOA it is no longer possible to transfer angle estimates without severe modifications in the network. What is more, forced handovers result in degradation of the call quality and reduction of the network s capacity. Thus, special care has been taken for a viable solution requiring the least modifications in the current network signalling. In fact, the proposed can be easily implemented in an existing GSM network as a change delivery update to the networks nodes. 3.1 GSM Architecture for Positioning Support In a typical GSM Phase 2+ network, the coverage area is divided into a number of cells, each distinguished by a unique cell global identity (CGI), which among others includes the cell identifier (CID), and served by its own BS. More than one BS are controlled by a Base Station Controller (BSC) and in turn, several BSCs are controlled by a Mobile Switching Centre (MSC). One MSC acts as a Gate-MSC (GMSC) which serves as an interface with external networks. Furthermore, useful information are stored in several databases, i.e. Visitor Location Register (VLR), Home Location Register (HLR) and Equipment Identity Register (EIR). Commonly, the BSCs together with the BSs are referred to as the Base Station Sub-System (BSS) while the Network and Switching Sub-System (NSS) consists of the MSCs and the databases. According to the 3rd Generation Partnership Project (3GPP) specifications [26 31], in order to support location services (LCS), the GSM architecture is modified as shown in LMUA I Air EIR GMSC External Network BS I F I Abis I Air LMU B BSC I A MSC I Lg GMLC I Le External Client M T SMLC VLR I Lh I D HLR I H AuC Fig. 1 GSM infrastructure for LCS support as specified by 3GPP

9 Hybrid TOA AOA Location Positioning Techniques in GSM Networks Fig.1. The External LCS Client is an entity setting a request for location information on a specific MS. The Gateway Mobile Location Centre (GMLC) is the first node an external LCS client accesses in the network. The GMLC may request routing information from the HLR via the Lh interface. After performing registration authorization, it sends positioning requests to and receives final location estimates from the GMSC via the Lg interface. The Service Mobile Location Centre (SMLC) which is responsible for the calculation of the final position estimate is an update of the BSC. The SMLC controls a number of Location Measurements Units (LMU) for the collection of the radio interface measurements to locate the MS subscriber in the area it serves. The estimated position of the subscriber is sent back to the corresponding MSC/VLR. An LMU can be defined either as type A which is accessed over the normal GSM air interface or type B which is accessed over the Abis interface. The MSC contains functionality responsible for MS subscription authorization and managing call-related and non-call related positioning requests of GSM LCS. The MSC is accessible to the GMLC via the Lg interface and the SMLC via the Ls interface. The HLR contains LCS subscription data and routing information. 3.2 Proposed GSM Procedure for the Implementation of Hybrid TOA AOA Techniques In order to provide network-based hybrid TOA AOA positioning in GSM networks we introduce minimum software modifications in the BSS, NSS and mobile handsets of the Phase 2+ network architecture. This means that in this work we investigate the least necessary modifications in the signalling between the MSC/VLR and the MS. In other words, the proposed positioning procedure is initiated by the MSC where the target MS lies, after a location positioning request has been successfully performed. The inherent advantage of the proposed technique is based on the state of the handset. Performing positioning while the handset is in idle mode, quality diminution while maintaining a data connection, as well as capacity loss in the network are avoided. An MS shall be considered in idle mode when it is attached to a Public Land Mobile Network (PLMN) and a Traffic channel (TCH) is not reserved for any purpose. However, the idle mode is the most challenging since the mobile handset is known in the MSC/VLR only according to its location area/routing area (LAC/RAC) identity. Moreover, the network (BSC/MSC) does not have any other information since the neighbouring cells signal strength (SS) measurements, that the idle mode mobile handset executes after been informed about the neighbouring cell existence from the BCCH logical channel of the serving cell, are interpreted only by the mobile to decide about cell reselection (based on C2 criteria in case of GSM or C31/C32 criteria when GPRS connectivity and Master PDCH is provided in the cell) and never transmitted on the uplink to the network. Hence the proposed signalling modifications should be implemented in three different steps. The first step is to extract, out of the LAC/RAC, the cell that the mobile is camping in idle mode. Camping cell extraction is necessary in order to request a special paging message towards only the camping (serving) cell and NOT towards the whole LAC/RAC geographical area. With this innovation we reserve signalling resources from overload. This cell information on first step is achieved by using the idea of forced location update, since after the location update request initiated by the network is performed the mobile will answer by asking access through the cell resources to the network. From this request the BSC will find out the CID of the camping cell and it will be forwarded to the MSC. As a result, the VLR has refreshed the LAC of the target MS before the more precise positioning occurs. The signalling message flow of the periodic location update as given by a Nethawk protocol analyser can be found in [32]. The

10 N. Deligiannis, S. Louvros VLR MSC BSC BS 3 BS 2 BS 1 MS IC cell info Page MT UDT Locate Subscriber Command Paging Command Paging Request (PCH) Channel Required Channel Request (RACH) Paging signaling from BS1 Channel Activation Channel Activation ACK. Immediate Assignment Command Immediate Assignment (AGCH) Paging Response Establish Indication Paging Response (SDCCH) Measurements request UA (SDCCH) Measurements req (SDCCH) Measurement acquisition Measurements results Meas. res. (SDCCH) Channel Activation (SDCCH TS in BS2) Channel Activation ACK. Forced cell reselection to BS2 Immediate Assignment Command Imm. Assign. Cmd (AGCH) RF release (SDCCH TS in BS1) RF release Acknowledgment Single Paging Command Single Paging Request (PCH) Channel Required Channel Request (RACH) Channel Activation Single Paging signaling from BS2 Channel Activation Ack. Immediate Assignment Command Immediate Assignment (AGCH) Single Paging Response Establish indication Single Paging Response (SDCCH) SAMB AOA measurement results UA (SDCCH) Fig. 2 Signalling Message Flow of the proposed GSM procedure which enables the implementation of hybrid TOA AOA positioning in GSM Networks

11 Hybrid TOA AOA Location Positioning Techniques in GSM Networks VLR MSC BSC BS 3 BS 2 MS Channel Activation (SDCCH TS in BS3) Channel Activation Ack. Forced cell reselection to BS3 Immediate Assignment Command RF release (SDCCH TS in BS2) Imm. Assign. Cmd (AGCH) RF release Acknowledgment Single Paging Command Single Paging Request (PCH) Channel Required Channel Request (RACH) Single Paging signaling from BS2 Channel Activation Channel Activation Ack. Immediate Assignment Cmd Immediate Assignment (AGCH) (E-)TOA or (E-) AOA positioning algorithm runs UDT Locate Subscriber Response Single Paging Response AOA measurement results RF Channel release RF Channel release Ack. Single Paging Response (SDCCH) SAMB UA (SDCCH) Fig. 2 continued second step is to force the mobile to send the idle mode measurements up to the network for further interpretations by the MSC locating. The third step is to force the mobile to reselect the two strongest neighbouring cells, based on the forced received measurements of SS on the uplink from step two. This is novel since by having the mobile reselecting totally three cells and by performing three forced paging messages, the triangulation process is enabled. The analytical signalling message flow of the proposed positioning procedure is demonstrated in Fig. 2. In more details, immediately after the forced periodic location update (named as first step above), a paging signalling procedure follows in order to obtain the time estimate from the serving BS. The time measurement is similar to the computation of Timing Advance but in our approach, the fact that the MS is in idle mode allows for the BS to measure the propagation delay between the Paging channel (PCH) and the Random Access channel (RACH) using existing conventional techniques [33 37]. In this point it has to be clarified that the mobile gets a RACH channel from a BCCH multiframe after more than one attempt, depending on the traffic load and the cell parameters. The network defines the maximum number of re-attempts to get access through the RACH channel based on a parameter (in Ericsson networks it is called MAXRET). This procedure poses a time offset in the time estimation, however in our case it has been supposed that the MAXRET parameter has been set into the minimum value meaning that after a first access attempt failure the forced paging procedure is restarted. Hence this time offset is kept very low, minimum affecting the overall time estimation. For larger MAXRET values, a probabilistic study

12 N. Deligiannis, S. Louvros of the influence of the cellular traffic load to the accuracy of the obtained time estimate could be further investigated. The obtained round trip time estimate is divided by two and conveyed (using the Access Delay parameter) to the BSC via the Channel Request message. In addition, a BS equipped with antenna arrays can measure the angle of the received signal. Thereafter, the algorithm searches for the best three Base Stations (BSs) (one is the camping cell and two others from the best SS cells received in the uplink measurement report) to force coordination with the MS. In case of Idle Mode condition, the MS keeps for itself measurements about the received signal power from the nearest and the 6 adjacent BSs. In order to acquire the measurements from the MS a Link Access Protocol on D-channel (LAPD) Measurement Request message is introduced. The message is transmitted to the MS from the serving BS through the established Stand-alone Dedicated Control channel (SDCCH). The MS responds through the SDCCH and the measurement report is forwarded to the BSC through LAPD DCM Layer 3 Measurement Results (ID hex = 36) message. Notice that, the serving BS includes the AOA measurements in the previous message. Out of the 6 BSs listed, BSC chooses those two corresponding to the greater signal power under the condition to be controlled by itself. As a result, additional signalling through the MSC is avoided. Moreover, to obtain the time estimate and the AOA measurements from the other two BSs a novel proposed LAPD Paging Command message is introduced. The proposed signalling resembles to paging signalling but with a change: The proposed single paging message contains the Cell Global Identity (CGI) and the Temporary Mobile Subscriber Identity (TMSI) of the MS (meaning that it will be transmitted downlink only by one cell), while the normal paging signal contains the total cells belonging to the LAC and the TMSI. By using this message, a paging signalling is exchanged between just one BS and the target MS, while a common paging signal is forwarded from all BSs of a LAC to the target MS. Hence, useless signalling overhead is avoided. After the BSC s decision, the MS is sequentially coordinated to each of the two selected BSs by using a novel Forced Cell Reselection (FCR) signalling procedure. The BSC activates a new SDCCH to the second BS, forces the MS to coordinate with the new SDCCH channel (through the first BS) and deactivates the previous. Then, the BSC/BS2 sends a Single Paging Request message to the MS through Paging Channel (PCH) and the MS transmits a Channel Request message through the RACH. When the paging signalling from BS2 is terminated, the BSC obtains the AOA measurements using the novel BTSM AOA Measurements Results message. Then it activates a SDCCH in BS3, forces the MS to coordinate with this (through BS2) and releases the previous SDCCH channel in BS2. Again, the single paging procedure through BS3 takes place the AOA measurements are obtained and the SDCCH is released. Note that, in this work we consider the use of three BSs in the positioning process. For N BS > 3, the above signalling is extended similarly. An important advantage of the proposed FCR procedure is that it initiates forced coordination from the Abis Interface and thus, enables the network to resolve the synchronization and hearability issues that state-of-the-art U-TDOA technique suffers from. Finally, the required data (time and angle measurements) has been obtained by the BSC which incorporates a SMLC and the position estimation of the MS using the proposed cost functions (Sects. 2.1 and 2.2) takes place. Note that to employ the proposed cost functions, the BSC/SMLC stores GIS data for each BSs that controls. The estimated subscriber s position is sent to the network via the Locate Subscriber Response message which is transmitted from the BSC to the MSC.

13 Hybrid TOA AOA Location Positioning Techniques in GSM Networks AXE dump Related tools Virtual AXE Configuration File (config.exe) SEA Configuration Wizard Component Library Abis Interface BS1 MSC A Interface BSC/SMLC BS2 MS EmuSliTool Abis Interface Abis Interface BS3 EmuSeqTool Fig. 3 Experimental emulation setup for the proposed GSM positioning procedure 3.3 Required Modifications in the Existing Signalling Messages To validate the feasibility and the applicability of the proposed GSM positioning procedure a GSM AXE emulation has been performed, as shown in Fig. 3. The employed emulator, known as Simulated Test Environment (STE) was provided by Ericsson. A normal test case should be performed in a real test bed environment including all the network nodes (MSC, BSC, BTS, MS) based on the AXE Ericsson architectures. However, performing these activities in a simulated environment reduces the hours per test case and improves the flexibility of controlling the case and measuring the signalling flow. In particular, the AXE Emulation enables the user to build or adapt an AXE node (or a network of nodes) using computer simulation without using the real Signalling Transfer points (STP) unless it is absolutely necessary. The SEA block control centre of STE offers the possibility to create and use several functional nodes with the appropriate operating software and functionalities, as it is the case for MSC, BSC and BTS. Currently, SEA is available in three versions where APZ Emulator (1st Generation) and APZ 212xx Emulator (2nd Generation) have been the first steps towards a complete 3rd Generation AXE emulation which was our test case software version. Towards realistic precision, the 3rd Generation AXE emulator uses a real software backup copy of an AXE switch node, called dump file. This file is loaded in the server in which the emulator is running. This dump file is redesigned using Ericsson specific software development language and incorporates

14 N. Deligiannis, S. Louvros the proposed signalling messages. Also, in order to emulate the functionalities and the PSTN/PLMN traffic of a user equipment (UE), an EmuSliTool has been used. An additional tool called EmuSeqTool, is employed to read the signalling messages created in the interfaces among the nodes. Below, we provide the context of the modified messages as given by the emulator, followed by a brief explanation for each message. To improve their presentation the modified messages are mapped into the well known format of Nethawk. The interested reader can find the context of the remainder unmodified messages in [32,38,39]. Paging for Positioning Command (MSC to BSCs, BSSMAP) This message is created by the BSS Management Application Part (BSSMAP) GSM protocol and supplied via the A Interface to all the BSCs of the Location Area (LA) where the MS lies. It consists of the necessary data for positioning, i.e. International Mobile Subscriber Identity (IMSI), TMSI, LAC, cell identities of the LA. Also, it contains a request towards the network to provide the subscriber s position (longitude, latitude). This message is formed when the location request is sent from the External Client to the MSC (where the target MS lies) via the GMSC. Since a location update procedure precedes the proposed positioning procedure, the VLR has updated the subscriber s LAC. Hence the message is conveyed to the correct MSC. BSSMAP (length: 52, 34h) PAGING FOR POSITIONING Info IMSI -length: 8 (08h) -identity contains an IMSI MS target IMSI -mobile country code: 202 -mobile network code: 01 -MSIN: TMSI MS target TMSI -length: 4 (04h) -TMSI value: CA2A0100h Cell Identifier - length: 29 (1Dh) -cell identified with LAC+CI -location area code: 1369 (0559h) -cell identifier: 171 (00ABh) -location area code: 1369 (0559h) -cell identifier: 172 (00ACh) -location area code: 1369 (0559h) -cell identifier: 173 (00ADh) -location area code: 1369 (0559h) -cell identifier: 174 (00AEh) -location area code: 1369 (0559h) -cell identifier: 175 (00AFh) -location area code: 1369 (0559h) -cell identifier: 176 (0060h) -location area code: 1369 (0559h) -cell identifier: 177 (0061h) POSITIONING REQUEST RESULTS -length: 2 (02h) -provide latitude -provide longitude Cells where paging takes place Idle Measurement Request (BSC to BS1, BTSM L3) The BSC sends the following message of the LAPD DCM Layer 3 protocol via the Abis interface to the serving BS requesting the AOA and the signal power measurements. In our experimental implementation the identity of the proposed message is ID hex = 35. An alternative identity number can be also used without influencing the applicability of the proposed procedure. The BS transfers the request for signal power measurements to the target MS via the established SDCCH channel.

15 Hybrid TOA AOA Location Positioning Techniques in GSM Networks IDLE_MEAS_REQ (DCh) T=0 Channel Nr. -SDCCH/8 subchannel 6 -timeslot: 1 Idle_Meas_Req Nr -value: 10 (0ah) Uplink Measurements -length: 1 (1h) -provide meas. AOA Downlink Measurements -serving cell rxlev_full -serving cell rxlev_sub -number of neigh cells meas request: 6 -rxlev[1] -neighbor BA index[1] -BSIC[1] -rxlev[2] -neighbor BA index[2] -BSIC[2] -rxlev[3] -neighbor BA index[3] -BSIC[3] -rxlev[4] -neighbor BA index[4] -BSIC[4] -rxlev[5] -neighbor BA index[5] -BSIC[5] -rxlev[6] -neighbor BA index[6] -BSIC[6] SDCCH between BS and MS AOA measurements request Power Level Measurements request Single Paging Command (BSC to BS2, BTSM) The novelty of this message belonging to the BTS Management (BTSM) GSM protocol is that it contains the CGI of the BS target rather than the LAC of the whole area, preventing useless signalling overhead. In other words, this message is exchanged between just one BS and the target MS, while a common paging message is forwarded from all BSs of a LAC to the target MS. PAGING CMD (CCh) T=0 Channel Nr -downlink CCCH (PCH+AGCH) -timeslot: 0 Paging Group -value: 2 (02h) MT identity -TMSI: CA2A0100 Paging group and channel declaration TMSI declaration Channel Required (BS to BSC, BTSM) Using this message, belonging to the BTSM protocol, the BS provides the computed time estimates to the BSC using the access delay parameter. Apart from the time estimate, the message contains the channel number, the used timeslot, the established cause and the Time Division Multiple Access (TDMA) frame number so the BSC can identify the received time estimate. Zero time estimates have been assigned in the current experiment. CHAN RQD (CCh) T=0 Channel Nr -uplink CCCH (RACH) -timeslot: 0 Req. Ref -answer to paging -random reference: 25 (19h) -N32: 10 (ah) -N26: 23 (17h) -N51: 34 (22h) -Access Delay -value: 0 (00h) TDMA frame number

16 N. Deligiannis, S. Louvros AOA Measurement Results (BS to BSC, BTSM) This message, belonging to the BTSM protocol of the Abis Interface, contains the AOA measurements and their mean value. Moreover, it reports the channel number of the SDCCH and CCCH channels whose AOAs were measured. Zero angle estimates have been assigned in the current experiment. AOA MEAS. REP. (DCh) T=0 Channel Nr 1 -uplink CCCH (RACH) -timeslot: 0 Channel Nr 2 -SDCCH/8 subchannel 3 -timeslot: 1 Meas. Res. Nr -value: 3 (03h) -Uplink Meas. -length: 6 (06h) -Channel 1 AOA: -Channel 2 AOA: -mean AOA: AOA measurements and mean value Paging for Positioning Response (BSC to MSC, BSSMAP) As the answer of the Paging For Positioning Command message, this message of the BSS Management Application Part protocol (BSSMAP) consists of the IMSI, the TMSI, the LAC, the CI and the coordinates of the subscribers position. This message can be forwarded to the External Clients via the Gate Mobile Location Centre as a respond to its request for location positioning of the target MS. Note that pre-specified position coordinates have been assigned to this message. BSSMAP (length: 30, 1Eh) Mobile Terminal Info IMSI -length: 8 (08h) -identity contains an IMSI IMSI -mobile country code: 202 -mobile network code: 01 -MSIN: TMSI TMSI -length: 4 (04h) -TMSI value: CA2A0100h Cell Identifier - length: 5 (05h) -cell identified with LAC+CI -location area code: 1369 (0559h) -cell identifier: 173 (00ADh) POSITIONING REQUEST RESULTS -length: 4 (04h) -latitude: (26.3Fh) -longitude: (15.2Fh) Location Area and Cell Identifier where the subscriber lies Subscriberís position coordinates: Ag. Nikolaou & Korinthou, Patras 4 Experimental Validation In this section, we evaluate the location accuracy of the proposed E-TOA and E-AOA positioning algorithms presented in Sects. 2.1 and 2.2, respectively. Our experimental investigations are performed using several GSM-like, high-capacity simulation environments developed in C programming. Normally, 2-D environments are employed to test location algorithms in outdoor settings, while the 3-D case is used for indoor environments [14]. In the following, we describe the considered cell planning for high capacity GSM coverage, the model used

17 Hybrid TOA AOA Location Positioning Techniques in GSM Networks to capture the electromagnetic propagation and the experimental environments. Last, we report the location positioning performance of the proposed compared to the conventional positioning techniques. 4.1 Simulation Environments We begin by referring to the considered GSM cell planning. Nominal cell planning, used in the early years of the GSM 2G network planning, considers the coverage of a specific geographical area using several clearly separated layers, i.e. picocell, microcell, and macrocell planning. After the introduction of the 2.5G phase in the network, the sensitivity of the network in the radio propagation environment and the demand for capacity forced the planners to incorporate many classical microcells, i.e. antenna height from 4 to 10 m, in city centers and also semi-urban and rural areas e.g. train stations, shopping malls, industrial areas, etc. However, the problem raised was the increase in the interference level which influenced the user throughputs and affected the service QoS. As a result, the combined optimized macro/micro-cellular coverage has recently emerged [40,41]. According to this planning, the building heights and the average user densities in the considered area are taken into account. The planners choose the highest buildings in the area and they place on roof-top antennas with classical macrocell characteristics. Thereafter, some of the macrocell characteristics are modified in order to achieve restricted microcell coverage. This is performed by appropriately fixing the antenna s tilt to be down-tilted towards the buildings and the surrounded roads. Abiding by this state-of-the-art cell planning, in the following simulations, we consider antennas in high heights i.e. roof-top level, but with restricted coverage and increased capacity, achieved by high down-tilts and many TRXs per cell. Since in the considered GSM cell planning the BS antennas are mounted at a level higher than the surrounding scatterers, the received signal at the BS results mainly from the scattering process at the vicinity of handset. In this case, a popular model for the reception at the BS is that effective scatterers are evenly spaced on a circular ring about the handset [42,43]. Measurements given in [44,45] conclude that the angle-of-arrival is stationary Gaussian with angle spreads of approximately φ n 5. Similarly, for wideband radio channels, measurements centered at 1,800 MHz (GSM DCS-1800 band) confirm that most of the received signal energy is concentrated in a small region φ n 5 in rural, semi-urban and urban environments [44]. In complete accordance to these findings [42 46] and state-of-the-art work on location positioning [5,13,14,18,24], we model the reception at the BS using the Gaussian stationary uncorrelated scattering model. Specifically, the electromagnetic field is modeled to a first-order ray trace contribution and the signal reaches the BS directly (LOS propagation) or through reflections or diffractions on the buildings walls (NLOS propagation). The TOA estimate at the BS is given by a halved Gaussian distribution with a mean t BSi calculated by the t BSi = d BSi /c equation and a standard deviation σ tbsi = t n t BSi. Furthermore, the AOA estimates are given by a Gaussian distribution with a mean calculated by the following formula: ϕ i = tan 1 y y BS i, (9) x x BSi where (x BSi, y BSi ) are the coordinates of the BS i, i = and(x, y) are the coordinates of the MS (LOS propagation) or the coordinates of the point where the final reflection occurred. Notice that, in contrast to AOA measurements, the TOA bias needs to be always additive and positive. This is the reason why the halved Gaussian distribution is employed to

18 N. Deligiannis, S. Louvros Fig. 4 Experimental simulation environments: a rural, b semi-urban and c urban environment (a) (b) BS1 BS1 BS 2 BS 2 BS3 BS3 Fig. 5 Experimental simulation environments: a urban type A and b urban type B characterize the time-of-arrival estimated at the BS. According to the literature [5,13,14,18, 24], typical values for the TOA and AOA standard deviations are t n = 0.05, σ ϕbsi = 1 for low scattering conditions and t n = 0.1, σ ϕbsi = 5 for high conditions environments. Furthermore, since the antenna is highly down-tilted towards the buildings and the surrounding roads, then the propagation will face obstacles, e.g. walls of neighbouring buildings. Therefore, a Sentinel Function (SF), denoted by ϕ(θ), is stored for each BS by sampling its surrounding environment with a step size of ε = 0.5. The developed environments see Figs. 4 and 5, have a coverage area of m 2 and they include buildings which are made of reinforced concrete and streets which are made of asphalt. The white squares represent possible subscriber s positions while, the grey ones represent buildings. In the first set of our experiments, we assess the accuracy of the proposed algorithms in three different macro/micro-cellular simulation scenarios, i.e. rural, semi-urban and urban. Note that, apart from urban, the considered combined optimized macro/micro-cellular coverage is also used in rural and semi-urban environments, e.g. industrial complexes, entertainment areas, highly used highways, shopping malls, etc. The reason lies on the increased number of users in these areas in addition to the simultaneous demand for high throughput

19 Hybrid TOA AOA Location Positioning Techniques in GSM Networks services. According to our simulation scenarios, the subscriber is placed in a grid of 44 m. In the rural environment, the subscriber is suggested to move on a highway or two rural roads, i.e. the grey bold lines in Fig. 4a. Three BSs are located at the points of coordinates BS 1 = (198 m, 66 m), BS 2 = (154 m, 374 m) and BS 3 = (330 m, 198 m). In the semi-urban model environment two BSs are located at the points of coordinates BS 1 = (418 m, 242 m) and BS 3 = (22 m, 418 m) while a BS is located on the corner of a building at the point of coordinates BS 2 = (154 m, 110 m). The subscriber s position follows two different roads which are indicated with the grey lines in Fig. 4b. Finally, in the urban environment, depicted in Fig.4c, the subscriber is assumed to lie on every possible position in the grid (white squares). There are three BSs located at the points of coordinates BS 1 (110 m, 418 m), BS 2 (242 m, 242 m) and BS 3 (418 m, 154 m). In order to demonstrate the statistical average of the achieved location accuracy given by the proposed algorithms for a large number of different BSs positions, we add independent Gaussian components, n xi, n yi, with a zero mean and a large standard deviation i.e. 44 m, to the initial coordinates x BSi, y BSi of each BS i. This means that the BSs can lie on different positions with an independently large deviation, horizontally and vertically. The height of the antenna is considered constant, i.e. always above roof-top level and highly down tilted. Since, it is computationally very expensive to construct, we have kept the initial SF system of each BS. Notice that in this case, the SFs of the BSs are not very accurate anymore allowing for the validation of the proposed algorithms in a less idealistic scenario which is closer to reality. In the second set of our experiments, we focus on the assessment of the proposed algorithms in urban environments. In this context, two additional urban environments, namely urban type A and B, are considered see Fig.5a and b. These environments exhibit a wide variety of buildings positions and shapes and BSs positions. Moreover, a finer spacing between grid points, i.e. 5 m, is assumed. As a result, 3264 and 3328 actual user positions are considered in the urban type A and type B, respectively. Initially, the three BSs are placed in specific positions within the environment where a good coverage can be achieved. Specifically, in the type A urban environment, the BSs are located at the points of coordinates BS 1 = (280 m, 400 m), BS 2 = (160 m, 280 m) and BS 3 = (280 m, 40 m). Regarding the type B environment, the BSs are located at the points of coordinates BS 1 = (420 m, 360 m), BS 2 = (40 m, 240 m) and BS 3 = (280 m, 140 m). Thereafter, to simulate a large number of possible BSs positions and test the algorithms when the SFs are not very precise, the Gaussian independent components with a large standard deviation, i.e. 40m, have been included in the initial coordinates of the BSs. We point out that, in order to include statistical relevance, average values over 1,000 experiments are reported in the simulations which consider the Gaussian models. 4.2 Simulation Results In every possible MS s position, in all the environments, the location error (in meters) caused by the use of any positioning technique: ε r = (x MS ˆx MS ) 2 + (y MS ŷ MS ) 2 (10) is obtained by using the estimated location position (x MS, y MS ) given by the minimization of TOA, AOA, E-TOA or E-AOA cost function and the true location ( ˆx MS, ŷ MS ). Initially, in order to set a reference for the reduction of the location accuracy when using multipath corrupted estimates, we test the performance of the proposed algorithms in ideal

20 N. Deligiannis, S. Louvros (a) Location Error (m) TOA E-TOA AOA E-AOA Rural Environment Position Nr. (b) Location Error (m) Rural Environment TOA E-TOA AOA E-AOA Three BSs in LOS Two BSs in LOS One BS in LOS In all Positions Fig. 6 Location error in respect to a the position number and b the number of BSs in LOS for the rural environment of Fig. 4a; the ideal case (t n = 0, σ ϕbsi = 0 ) is assumed multipath error-free environments, i.e. t n = 0.0, σ φbsi = 0. In this case, we study the performance of the proposed algorithms when the location error is caused by NLOS propagation. Note that, research in the field of multipath rejection algorithms for GSM networks is ongoing [1]. In Figs. 6a, 7a, and 8a we present the incremental location error in meters given by every positioning technique for the three simulation environments of Fig. 4. Moreover, Figs. 6b, 7b, and 8b demonstrate the impact of the number of NLOS BSs in the location accuracy in the rural, semi-urban, urban environment, respectively. To be more specific, in the rural environment see Fig. 6, the location error caused by TOA, E-TOA and E-AOA is rather low. Especially when three BSs are in LOS the location error is close to zero. On the contrary, AOA shows a considerable diminution of the accuracy which increases severely in respect to the number of BSs in NLOS. In contrast to the TOA and the proposed techniques, the location error caused by AOA shows considerable increase when at least one BS is in NLOS condition. In all techniques, the more BSs are in NLOS the more the location error increases. In contrast to the rural environment, in the semi-urban environment see Fig. 7, AOA performs closer to TOA and the proposed techniques. Again, AOA is more sensitive to NLOS propagation. Overall positions, the E-TOA technique exhibits the higher accuracy. Figure 8 shows that the angle based techniques perform close to the respective time based ones in the urban environment. As expected, when the number of BSs with NLOS reception increases the overall location error introduced by all positioning techniques deteriorates. Over all environments and considering ideal multipath-free propagation, AOA causes the higher location error due to NLOS propagation. Overall, the results reveal that the proposed algorithms can face the NLOS propagation and offer significant improvement of the accuracy over the respective conventional methods. In Tables 1 and 2, we present the averaged values of the mean and the standard deviation of the location errors over 1,000 experiments, when including the probabilistic model for the electromagnetic propagation, which was discussed in Sect. 4.1, in the simulation environments of Fig. 4. To provide a reference, we also depict the multipath-free values. It is important to observe that apart from causing inaccuracies in the TOA and AOA estimates, multipath also affects the performance of the proposed algorithm (Sect. 2.1) forthe determination of the degree of NLOS propagation. Concerning Table 1, it is shown that the mean location error commonly increases when the scattering standard deviation parameters

21 Hybrid TOA AOA Location Positioning Techniques in GSM Networks (a) Location Error (m) TOA E-TOA AOA E-AOA Semi-urban Environmnet Position Nr. (b) Location Error (m) Semi-urban Environment TOA E-TOA AOA E-AOA Three BSs in LOS Two BSs in LOS One BS in LOS None BS in LOS In all Positions Fig. 7 Location error in relation to a the position number and b the number of BSs in LOS for the semi-urban environment of Fig. 4b; the ideal case (t n = 0, σ ϕbsi = 0 ) is assumed (a) Location Error (m) TOA E-TOA AOA E-AOA Urban Environment Position Nr. (b) Location Error (m) Urban Environment TOA E-TOA AOA E-AOA Three BSs in LOS Two BSs in LOS One BS in LOS None BS in LOS In All Positions Fig. 8 Location error in relation to a the position number and b the number of BSs in LOS for the urban environment of Fig. 4c; the ideal case (t n = 0, σ ϕbsi = 0 ) is assumed Table 1 Average mean location error for the rural, semi-urban and urban simulation environments of Fig. 4 Environment Time, Angle standard deviations (t n,σ ϕbsi ) Average mean location error (m) Rural Semi-urban Urban (0.0, 0 )(0.05, 1 )(0.1, 5 )(0.0, 0 )(0.05, 1 )(0.1, 5 )(0.0, 0 )(0.05, 1 )(0.1, 5 ) Positioning Technique TOA E-TOA Gain (%) AOA E-AOA Gain (%)

22 N. Deligiannis, S. Louvros Table 2 Average standard deviation of the location errors for the rural, semi-urban and urban simulation environments of Fig. 4 Environment Time, Angle standard deviations (t n,σ ϕbsi ) Average standard deviation of errors (m) Rural Semi-urban Urban (0.0, 0 )(0.05, 1 )(0.1, 5 )(0.0, 0 )(0.05, 1 )(0.1, 5 )(0.0, 0 )(0.05, 1 )(0.1, 5 ) Positioning Technique TOA E-TOA Gain (%) AOA E-AOA Gain (%) t n and σ φbsi increment. Yet, the proposed techniques show significant accuracy improvement over the conventional methods. What is more, notice that given an environment, the gain in accuracy introduced by the enhanced version in scattering conditions is at the same level with the respective gain in scattering-free conditions. For low scattering conditions (t n = 0.05, σ φbsi = 1 ), maximum gains were reported in the rural environment for E-AOA (69.27%) and in the urban scenario for E-TOA (36.71%). Similar gains have been also reported for high scattering conditions see Table 1. An additional remark is that, E-AOA shows better insensitivity to the scattering conditions compared to E-TOA in the urban environment. In fact, in high scattering environments is likely that the AOA of the reflected signal is closer to the real one. On the other hand, the time bias is always positive and thus, high multipath can only decrease the efficiency of time based techniques. As a means to demonstrate the statistical dispersion of the errors around their mean, Table 2 summarizes the average standard deviation of the location errors over 1,000 experiments in respect to the results of Table 1. It is shown that remarkable improvements of up to 58.39% for E-AOA and 52.02% for E-TOA have been brought by the proposed techniques compared to the current methods. Tables 3 and 4 depict the averaged values of the mean and the standard deviation of the location errors over 1,000 experiments, when including the probabilistic model for the electromagnetic propagation and considering the independent Gaussian components in the initial coordinates of the BSs, as well. Compared to the previous experiment, an increase in the location error is observed, mainly due to sub-optimal BSs positions, in terms of coverage. Notice that, in this experiment, where the SFs are not so accurate anymore, the proposed algorithms still offer a significant improvement in the location accuracy. The highest improvement in the location accuracy offered by E-TOA, i.e %, is reported in the urban environment when high scattering occurs. Regarding E-AOA, the maximum accuracy gain, i.e %, incurs in the rural environment. Similar gains can be observed in the average standard deviation of the location errors see Table 4. In the following, we validate the performance of the proposed algorithms in the demanding urban environments of Fig. 5. In the beginning, the BSs are positioned as shown in Fig. 5 and the averaged values of the mean and the standard deviation of the location errors over 1,000 experiments, when including the probabilistic model for the electromagnetic propagation are givenintables5 and 6, respectively. We notice that although it is more sensitive in scattering

23 Hybrid TOA AOA Location Positioning Techniques in GSM Networks Table 3 Average mean location error for the rural, semi-urban and urban simulation environments of Fig. 4; independent zero mean Gaussian components with a standard deviation of 44 m are included in the initial coordinates of the BSs Environment Time, Angle standard deviations (t n,σ ϕbsi ) Average mean location error (m) Rural Semi-urban Urban (0.0, 0 )(0.05, 1 )(0.1, 5 )(0.0, 0 )(0.05, 1 )(0.1, 5 )(0.0, 0 )(0.05, 1 )(0.1, 5 ) Positioning Technique TOA E-TOA Gain (%) AOA E-AOA Gain (%) Table 4 Average standard deviation of the location errors for the rural, semi-urban and urban simulation environments of Fig. 4; independent zero mean Gaussian components with a standard deviation of 44 m are included in the initial coordinates of the BSs Environment Time, Angle standard deviations (t n,σ ϕbsi ) Average standard deviation of errors (m) Rural Semi-urban Urban (0.0, 0 )(0.05, 1 )(0.1, 5 )(0.0, 0 )(0.05, 1 )(0.1, 5 )(0.0, 0 )(0.05, 1 )(0.1, 5 ) Positioning Technique TOA E-TOA Gain (%) AOA E-AOA Gain (%) conditions, time-based positioning is more accurate than the respective angle-based. Moreover, we note that the proposed algorithms outperform significantly the conventional ones. In particularly, E-TOA improves the accuracy of TOA up to 29.55% and 29.41% in the urban type A and B environment, respectively. Similarly, E-AOA offers gains of up to 46.07% and 48.73% in the urban type A and B environment, respectively. Similar improvements are also reported for the standard deviation of errors. Finally, in Tables 7 and 8 we validate the performance of the proposed algorithms in the urban type A and B environment, when a large number of different BSs locations is simulated using the Gaussian independent components in the initial BSs coordinates. Similar to the previous experiment, a decrease in the location accuracy is encountered because of sub-optimal BSs positions. Although as mention before, the SFs are less precise in this case, the proposed algorithms still introduce a significant reduction of the location mismatch. Specifically, compared to the conventional TOA, E-TOA introduces gains of up to 19.90% and 16.78% in the urban type A and B environment, respectively. Also, compared to AOA,

24 N. Deligiannis, S. Louvros Table 5 Average mean location error for the urban type A and type B simulation environments of Fig. 5 Environment Time, Angle standard deviations(t n,σ ϕbsi ) Average mean location error (m) Urban type A Urban type B (0.0, 0 ) (0.05, 1 ) (0.1, 5 ) (0.0, 0 ) (0.05, 1 ) (0.1, 5 ) Positioning Technique TOA E-TOA Gain (%) AOA E-AOA Gain (%) Table 6 Average standard deviation of the location errors for the urban type A and type B simulation environments of Fig. 5 Environment Time, Angle standard deviations(t n,σ ϕbsi ) Average standard deviation of errors (m) Urban type A Urban type B (0.0, 0 ) (0.05, 1 ) (0.1, 5 ) (0.0, 0 ) (0.05, 1 ) (0.1, 5 ) Positioning Technique TOA E-TOA Gain (%) AOA E-AOA Gain (%) E-AOA is more precise up to 31.24% and 28.95% in the urban type A and B environment, respectively. As expected, similar gains are observed in the standard deviation of the errors. Overall experiments, the proposed enhancements always outperform the respective conventional ones. In relation with the proposed GSM procedure which is shown that can be easily implemented in the existing GSM infrastructure see Sect. 3.3, the proposed approachescan become a competitive solution for GSM positioning. 5 Conclusions and Future Directions In this paper, we have introduced a novel GSM procedure enabling the network nodes to obtain and transfer accurate time and angle estimates from three BSs. Neither TOA nor AOA have been specified for GERAN, as far. Yet, the proposed procedure, which is based on the current GSM Phase 2+ infrastructure and protocol stack, is fully compatible with the 3GPP technical specifications for GSM location services. The proposed procedure is validated using a GSM emulator and the results corroborate that minimum modifications in existing signalling messages are required, making the procedure easily implemented as a simple software

25 Hybrid TOA AOA Location Positioning Techniques in GSM Networks Table 7 Average mean location error for the urban type A and type B simulation environments of Fig. 5; independent zero mean Gaussian components with a standard deviation of 40 m are included in the initial coordinates of the BSs Environment Time, Angle standard deviations(t n,σ ϕbsi ) Average mean location error (m) Urban type A Urban type B (0.0, 0 ) (0.05, 1 ) (0.1, 5 ) (0.0, 0 ) (0.05, 1 ) (0.1, 5 ) Positioning Technique TOA E-TOA Gain (%) AOA E-AOA Gain (%) Table 8 Average standard deviation of the location errors for the urban type A and type B simulation environments of Fig. 5; independent zero mean Gaussian components with a standard deviation of 40 m are included in the initial coordinates of the BSs Environment Time, Angle standard deviations(t n,σ ϕbsi ) Average standard deviation of errors (m) Urban type A Urban type B (0.0, 0 ) (0.05, 1 ) (0.1, 5 ) (0.0, 0 ) (0.05, 1 ) (0.1, 5 ) Positioning Technique TOA E-TOA Gain (%) AOA E-AOA Gain (%) patch delivery in any GSM node. It is important to point out that the proposed resolves the hearability and synchronisation drawbacks caused by the state-of-the-art U-TDOA using the novel FCR algorithm. Also it operates in the idle mode and thus no capacity loss is witnessed. Furthermore, we have introduced a novel algorithm for the identification of the degree of NLOS reception combining angle and time estimates with some minimal information about the surroundings of a BS, which leads to enhanced versions of the TOA and AOA positioning methods. The proposed enhanced techniques have been evaluated using several simulations environments with a variety of NLOS propagation and scattering conditions. The results indicate the remarkable accuracy improvement offered by the proposed compared to the respective conventional techniques. Based on this paper, numerous directions for future work can be followed. Of particular interest is the extension of the proposed GSM positioning procedure to incorporate more than three BSs. Though it will improve the accuracy, a high number of paging signalling initiations can cause delays which introduce error, especially for high speed subscribers. The compromise between the number of BSs involved in the positioning and the acquired

26 N. Deligiannis, S. Louvros accuracy remains to be investigated. Possible extensions can incorporate additional features of the GSM network, such as the slow frequency hopping. Each GSM logical channel may transmit successive SDCCH bursts on a different frequency channel according to an allocation scheme. The diversity effect can benefit the proposed procedure, particularly in the presence of multipath. Moreover, a deterministic propagation model can be employed to assess the location accuracy of the proposed positioning techniques. According to these models, the electromagnetic field is given by the vector sum of several ray contributions. Similar to [16], the AOA and TOA for each ray can be measured, weighted by an appropriate coefficient, and used in the total cost function, resulting in improved location performance. However, the implementation of such an approach without severe modifications in the current network s infrastructure is a rather intricate issue. Finally, as above mentioned, future work might head towards the improvement of the weight coefficients in the enhanced proposed model based on scattering principles and probabilistic models. Acknowledgments The authors gratefully acknowledge many valuable discussions with Prof. Adrian Munteanu and Prof. Peter Schelkens in this work. Furthermore, the authors would like to thank the anonymous reviewers whose meticulous comments vastly improved the quality and the presentation of this paper. References 1. Drane, C., Macnaughtan, M., & Scott, C. (1998). Positioning GSM telephones. IEEE Communications Magazine, 36(4), GPP TS (March, 2002). Stage 2 functional specification of UE positioning. 3. 3GPP TR (June, 2002). Feasibility study on Uplink TDOA in GSM and GPRS. 4. Zhao, Y. (2002). Standardization of mobile phone positioning for 3G systems. IEEE Communications Magazine, 40(7), Azaro, R., Donelli, M., Benedetti, M., Rocca, P., & Massa, A. (2008). A GSM signals-based positioning technique for mobile applications. Microwave and Optical Technology Letters, 50(8), Caffery, J. J., & Stuber, G. L. (1998). Overview of radiolocation in CDMA cellular systems. IEEE Communications Magazine, 36(4), Fang, B. T. (1990). Simple solutions for hyperbolic and related position fixes. IEEE Transactions on Aerospace and Electronic Systems, 26(5), Feuerstein, M., & Pratt, T. (1989). A local area position location system. In International conference on mobile radio and personal communications, December 1989 (pp ). 9. Foy, W. (1976). Position-location solutions by taylor series estimation. IEEE Transactions on Aerospace and Electronic Systems, 12(2), Turin, G., Jewell, W., & Johnston, T. (1972). Simulation of urban vehicle-monitoring systems. IEEE Transactions on Vehicular Technology, VT-21(1), Sakagami, S., Ayoama, S., Kuboi, K., Shirota, S., & Akeyama, A. (1992). Vehicle position estimates by multibeam antennas in multipath environments. IEEE Transactions on Vehicular Technology, 41(1), Blanz, J. J., Papathanassiou, A., Haardt, M., Furió, I., & Baier, P. W. (2000). Smart antennas for combined DOA and joint channel estimation in time-slotted CDMA mobile radio systems with joint detection. IEEE Transactions on Vehicular Technology, 49(2), Chen, T. Y., Chiu, C. C., & Tu, T. C. (2003). Mixing and combining with AOA and TOA for the enhanced acurracy of mobile location. In IEE 5th European personal mobile communications conference, April 2003 (pp ). 14. Cong, L., & Zhuang, W. (2002). Hybrid TDOA/AOA mobile user location for wideband CDMA cellular systems. IEEE Transactions on Wireless Communications, 1(3), Deligiannis, N., Louvros, S., & Kotsopoulos, S. (2007). Optimizing location positioning using hybrid TOA AOA techniques in mobile cellular networks. In ACM international conference on mobile multimedia communications, MobiMedia, August 2007 (Vol. 329, pp. 1 7). 16. Porretta, M., Nepa, P., Manara, G., Giannetti, F., Dohler, M., Allen, B., & Aghvami, A. H. (2004). A novel single base station location technique for microcellular wireless networks: Description and validation by a deterministic propagation model. IEEE Transactions on Vehicular Technology, 53(5),

27 Hybrid TOA AOA Location Positioning Techniques in GSM Networks 17. Thomas, N. J., Cruickshank, D. G. M., & Laurenson, D. I. (2001). Performance of a TDOA-AOA hybrid mobile location system. In IEE international conference on 3G mobile communications, March 2001 (pp ). 18. Wann, C.-D., Yeh, Y.-J., & Hsueh, C.-S. (2006). Hybrid TDOA/AOA indoor positioning and tracking using extended Kalman filters. In IEEE Vehicular Technology Conference, VTC 2006, Melbourne, Australia, 7 10 May 2006 (Vol. 3, pp ). 19. Chan, Y. T., & Ho, K. C. (1994). A simple and efficient estimator for hyperbolic location. IEEE Transactions on Signal Processing, 42, Wylie, M. P., & Holtzman, J. (1996). The non-line of sight problem in mobile location estimation. IEEE international conference on universal personal communications (ICUPC 1996), September 1996 (Vol. 2, pp ). 21. Le, B. L., Ahmed, K., & Tsuji, H. (2003). Mobile location estimator with NLOS mitigation using Kalman filtering. IEEE wireless communications and networking conference (WCNC 2003), March 2003 (Vol. 3, pp ). 22. Thomas, N. J., Cruickshank, D. G. M., & Laurenson, D. I. (2000). A robust location estimator architecture with biased Kalman filtering of TOA data for wireless systems. In IEEE international symposium on spread-spectrum techniques and applications, September 2000 (Vol. 1, pp ). 23. Najar, M., Vidal, J. (2003). Kalman tracking for mobile location in NLOS situations. In IEEE international symposium on Personal, Indoor and Mobile Radio Communications (PIMRC 2003), September 2000 (Vol. 3, pp ). 24. Xiong, L. (1998). A selective model to suppress NLOS signals in angle-of-arrival (AOA) location estimation. In IEEE international symposium on Personal, Indoor and Mobile Radio Communications (PIMRC 2003), 8 11 September 1998 (Vol. 1, pp ). 25. Dropping, B. (2005). Changes in base station backhaul drive new synchronization solutions. RF Design Magazine, GPP TS v (March, 2001). Digital cellular telecommunications system (Phase 2+), Location Services (LCS), Service description, Stage GPP TS v (May, 2004). Digital cellular telecommunications system (Phase 2+), Location Services (LCS), Functional Description GPP TS v (January, 2005). Digital cellular telecommunications system (Phase 2+); Location Services (LCS); Mobile Station (MS) Serving Mobile Location Center (SMLC); Radio Resource LCS Protocol (RRLP) GPP TS v (July, 2002). Digital cellular telecommunications system (Phase 2+); Mobile radio interface layer 3 Location Services (LCS) specification GPP TS v (May, 2002). Digital cellular telecommunications system (Phase 2+); Location Services (LCS); Serving Mobile Location Center (SMLC) Serving Mobile Location Center (SMLC); SMLC Peer Protocol (SMLCPP) GPP TS v (May, 2004). Digital cellular telecommunications system (Phase 2+); Location Services (LCS); Base Station System Application Part LCS Extension (BSSAP-LE). 32. NokiaTelecommunicationsOy1198. GSM 900/1800 BSS signaling training document. 33. Caffery, J. J., & Stuber, G. L. (1994). Vehicle location and tracking for IVHS in CDMA microcells. In IEEE international symposium on Personal, Indoor and Mobile Radio Communications, PIMRC, September 1994 (Vol. 4, pp ). 34. Goud, P., Sesay, A., & Fattouche, M. (1991). A spread spectrum radiolocation technique and its application to cellular radio. In IEEE Pacific rim conference on communications, computers and signal processing, 9 10 May 1991 (Vol. 2, pp ). 35. Holmes, J. (1982). Coherent spread spectrum systems. Wiley. 36. Knapp, C., & Carter, G. (1976). The generalized correlation method for estimation of time delay. IEEE Transactions on Acoustics, Speech and Signal Processing, ASSP-24(4), Ziemer, R., & Peterson, R. (1985). Digital communications and spread spectrum systems. Macmillan. 38. Heine, G., (1998). GSM networks: Protocols, terminology and implementation. Artech House Publishers. 39. Mouly, M., & Paulet, M.-B. (1992). The GSM system for mobile communications. Palaiseau, France. 40. Flemming Hermann, P. (2007). Examining telia-sonera Denmark s microcellular approach to solving specific special coverage projects for 2G/2.5G environments. In International conference on in-building & enhanced coverage solutions, May Wisely, D. (2007). BT convergence case study: Effectively deploying cellular/short range converged solution for advanced multimedia services. In International conference on in-building & enhanced coverage solutions, May Jakes, W. C. (1994). Microwave mobile Communications. New York: IEEE Press.

28 N. Deligiannis, S. Louvros 43. Lee, W. C. Y. (1997). Mobile communications engineering theory and applications (2nd ed.). New York: McGraw-Hill. 44. Aszetly, D. (1996). On antenna arrays in mobile communications systems: Fast fading and GSM base station receiver algorithms. PhD dissertation, Royal Institute Technology, Sweden, March Klukas, R., & Mattouche, M. (1998). Line-of-sight angle of arrival estimation in the outdoor multipath environment. IEEE Transactions on Vehicular Technology, 47, Klein, A., Mohr, W., Thomas, R., Weber, P., & Wirth, B. (1996). Direction-of-arrival of partial waves in wideband mobile radio channels for intelligent antenna concepts. In IEEE Vehicular Technology Conference, VTC 1996 (pp ). Author Biographies Nikos Deligiannis was born in Kalamata, Greece in April He received the Diploma of Electrical and Computer Engineering from the University of Patras (UoP), Greece, in November From December 2006 to September 2007, he was a researcher at the Wireless Telecommunications Laboratory, University of Patras. He joined the Department of Electronics and Informatics (ETRO) at the Vrije Universiteit Brussel (VUB) in October Since then, he is pursuing a PhD in the area of Distributed Video Coding. His research interests include statistical modelling, Distributed Video Coding, wireless cellular networks, location positioning and services. Dr. Spiros Louvros received his Bachelor in Physics from the University of Crete, Hellas and his Master of Science in telecommunications from the University of Cranfield, U.K. with a graduate scholarship from the Alexandros Onassis Institution. In 2004 he received his PhD from the University of Patras (UoP), Hellas, in mobile communications. He has worked for Siemens as a microwave engineer, Vodafone as a switching engineer and Cosmote S.A. as section manager in the Operations & Optimization Department. He is currently an Assistant Professor in the Technological Educational Institution of Messologi, Department of Telecommunication Systems & Networks. He holds several papers in international journals, conferences and book chapters and he has participated in several research projects regarding mobile communications. His area of interest is in QoS for mobile networks, Telecommunication Traffic Engineering, Planning /Dimensioning and Tuning of Heterogeneous Networks and Next Generation Mobile Networks (LTE). He is an external researcher with Ericsson and also member of FITCE and Hellenic Physics Union.