AN EVALUATION OF INDOOR LOCATION DETERMINATION TECHNOLOGIES

Transcription

1 AN EVALUATION OF INDOOR LOCATION DETERMINATION TECHNOLOGIES KEVIN CURRAN, EOGHAN FUREY, TOM LUNNEY, JOSE SANTOS, DEREK WOODS INTELLIGENT SYSTEMS RESEARCH CENTRE FACULTY OF COMPUTING AND ENGINEERING UNIVERSITY OF ULSTER, NORTHERN IRELAND, UK

2 SUMMARY The development of Real Time Locating Systems (RTLS) has recently and increasingly become an important enhancement to many existing location aware systems. Whilst GPS has solved most of outdoor RTLS problems, its primary limitation is that it does not work well, or even work at all, indoors. A number of technologies have been developed to address the indoor location aware/tracking problems. Systems have also been developed for tracking across diverse areas such as university campuses. The capacity to track accurately the location and movement of people and objects in an indoor location offers the potential for many innovative applications. These applications range from medical, military and logistical through industrial, commercial and social applications. However, a common characteristic of currently available systems is that they cannot provide continuous real time tracking of a moving target. Also, typically there is a loss of capability when local transmission conditions are less than perfect. While it is generally accepted that the deployment of real time indoor location-aware systems is technically very challenging, to date there has been relatively little research and no systematic study involving comparison of currently available commercial systems. As a consequence, there is no available resource available to inform potential users of the effectiveness of such systems, and to provide a base reference upon which they could make informed choices and decisions in the selection process. For example, IT departments who would benefit from accurate tracking of human and physical resources in confined areas. This report attempts to address this deficiency by providing an intensive, detailed, structured and current review of available position sensing/location aware sensing technologies.

3 TABLE OF CONTENTS Summary Introduction Location Determination Applications Summary & overview Positioning Systems Basic Positioning Methods WIFI Positioning Methods Cellular Positioning Methods RFID Positioning Methods Infra-RED (IR) Positioning Methods Bluetooth Location Determination Summary Indoor Positioning Systems PlaceLab Intel Research Trapeze Networks Location Appliance LA Ubisense Ekahau Real Time Location Systems (RTLS) RFID Radar Aeroscout Cisco Wireless Control System (WCS) Summary Selected Test Bed Determination Systems Placelab Trapeze Networks LA Ubisense Ekahau RFID RADAR Summary Evaluation of Location Determination Systems Placelab Trapeze Networks LA Ubisense Ekahau RFID Summary Findings Conclusion...57 Acknowledgements References...58

4 1 INTRODUCTION Mobile devices are associated with network technologies that have the potential to provide user location and context cues to the services they offer. Location data alone has little value, but when it is used to expand the variety of mobile applications through timely, personalised content reactive to dynamic environments, it offers great return for very little additional bandwidth use. The potential exists for the education community to deploy location-aware systems in a number of contexts to the direct benefit of their users, both in allowing mobile nodes to determine their own position and in allowing the network operator to monitor the position of nodes. The ability to track and check the location of people or equipment in real time has a large number of application areas such as child safety, prisoner tracking and supply chain to name but a few (Krzysztof & Hjelm, 2006). Figure 1 depicts an outline of the current wireless-based location positioning systems and their resolutions. Over the past two decades a large number of commercial and research location aware systems have been developed (Hazas at al., 2004). Generally, these systems have the goal of providing lower accuracy over a wide coverage area or providing high accuracy (<30 cm) in a small area. Accuracy systems often require extensive infrastructure, many sensors and time consuming calibration. AT&T Cambridge s Active Bats system (Addlesee et al., 2001) uses ultrasonic badges and requires one ultrasound receiver to be installed every square meter. Wide area coverage is most famously achieved by using the Global Positioning System (GPS). A constellation of satellites, very high above the earth s surface (~ 30,000 km) can cover the whole surface of the planet. The most ubiquitous of these is the American Global Positioning System (GPS). Others include the Russian Global Navigation Satellite System (GLONASS) and the European Space Agency (ESA) Galileo systems. These systems are usually terminal based but may be used in networked based mode by the military for espionage. The advantages of these systems are that they give almost global coverage outdoors and reasonable accuracy (< 10 m). The disadvantages are that the signals need a clear Line Of Sight (LOS) to at least 3 satellites to get a fix and they can also suffer from the shadowing effect which occurs when high walls, mountains and other obstacles block the signal. For this reason the systems do not work well indoors. In addition, there are high power overhead taking place at the terminal device and operation and costs are high especially when you consider that the life span of satellites are approximately 6 years (Borriello et al., 2005). Figure 1: Wireless base systems and their location range resolution (Liu et al., 2007) Cellular positioning systems work on the principle that networks such as GSM and UTMS can use various pieces of network information to locate a subscriber. Mobile phones, when switched on, send out a signal to cell towers within its vicinity. By comparing the time for the signal to arrive and relative signal strengths from multiple towers,

5 an estimated location of the handset can be obtained. Some mobile phone companies have begun to offer customers location-based services and applications, such as O2 s Friend Finder and Find My Nearest ATM. 1 Commercial products such as that of LocateMobiles.com are also available, which allow users to register online and track a specific handset on any of the UK s four major network operators (O2, Vodafone, Orange and T- Mobile). The location, accurate to within fifty meters, is plotted on a map of the UK and Ireland. A number of limitations are to be noted when considering this approach. Firstly, the accuracy of the location estimation is only to within an average of m2, depending on the surrounding landscape and the number of nearby phone masts. This means that this method would be best suited to applications that monitor a wide area, such as a city or county. Another limitation is that mobile phone location queries often work on a subscription or pay-by-query basis. This would not be a cost-effective approach for any application requiring almost real-time updates of a subject s current location. Radio Frequency Identification, is a technology used for the automatic identification and tracking of goods, animals and people. RFID can work indoors however it requires each person or piece of equipment that is to be tracked to have a RFID tag attached and additional RFID tag readers to be installed. There are two types of RFID tags, active and passive. Active tags have a small power supply used to send out a signal that gives them a range of a few meters while the passive tags have no power supply and are activated by a scanning signal which means they typically have a range of less than a meter. A typical system consists of three parts a transponder, a reader, and a controlling application. Transponders hold data on whatever person or object they are attached to, usually containing a unique code used for identification, such as a serial number. When within an appropriate range of a reader, the transponders transmit this data to the reader using radio waves. The reader decodes this radio signal into digital information, which is then relayed to a computer application that makes use of it. RFID technology is extremely widespread, used in many different applications such as security systems, public transport payment systems, the tracking of commercial goods, and livestock identification. Wi-Fi location determination is a technology that has been developed in recent years, that utilizes existing pieces of Wi-Fi equipment such as those installed in personal computers, personal data assistant s (PDA) and mobile phones. The technology uses modulated Wi-Fi transmission signals to detect the presence of a device, which does not necessarily have to be connected to the network in question, just visible to it, then the system is able to triangulate the position of the device based on the signals received from the other Access Points (AP). One of the first examples of using for location fixing was RADAR (Bahl & Padmanabhan, 2000; Krzysztof et al., 2006) developed at Microsoft. Microsoft also developed RightSPOT which used a ranking system of available Frequency Modulation (FM) radio stations rather than their relative signal strengths to determine location. With eight radio stations they were able to get an accuracy rate of approximately eighty percent (Krumm et al., 2003). Most commonly used inside large buildings like hospitals, university campuses and various business premises, indoor systems use various invisible signals as a means of positioning. Infrared, ultrasound and Wi-Fi signals are commonly used. These can be standalone systems which are not used for communication such as Ubisense which uses Ultra Wide Band (UWB) radio signals, or they can use an existing system like Ekahau which uses Wi-Fi signals (Steggles & Gschwind, 2005). Targets may be badges or tags carried by humans or attached to value items. An advantage of indoor infrastructures is that because of the short range of these technologies, power consumption is usually fairly low. Also, accuracy levels can be quite high but this depends on the system used. On the downside, these systems cannot compete with GPS or Cellular positioning systems in terms of universal coverage and they often need to be calibrated, leading to larger roll-out costs in terms of time

6 1.1 LOCATION DETERMINATION APPLICATIONS There are a number of location determination applications available which often can be classified as applications for users who do not want to disclose their position to anyone else, applications for users who display their position to a selected group, or applications for users who want disclose their position to everyone. Mappoint 3 is an example of an application for users who do not disclose their position to anyone else. It displays the user s position on a map and nearby points of interest. Dodgeball 4 is an example of an application for users who display their position to a selected group. It is used by mobile users and works by users telling dodgeball who their friends are. Then when a user is out and about they sent a text message to dodgeball with their location; dodgeball then send a text message to all their friends and reports back if there are any of their friends in the vicinity. LocateMobiles.com 5 is a service for people wishing to find the current location of their family or friends. Average accuracy of the location determination is about fifty meters albeit depending on the number of towers within the cell at the location and other factors such as interference from large buildings and the terrain. The Skyhook hybrid positioning system (XPS) is a hybrid location determination system that uses the location data from GPS, mobile cellular masts and nearby Wi-Fi access points to calculate the position of a mobile device, such as a dual-mode mobile phone, laptop or PDA. When calculating the position using Wi-Fi, a Skyhook database is utilised that contains millions of access point records from across Asia, Europe and North America. The records are collected by a fleet of vehicles that drive around the roads detecting the signal from access points. From an access point the Media Access Control (MAC) address is read, recorded and time stamped along with the vehicle s location at the time of detection. This means that the actual physical location of an access point is not recorded but rather a signal fingerprint from the access point. Then later when required to calculate a location it is the fingerprint that is actually used not the actual access point location 6. The use of Wi-Fi location determination technology could be utilised in a number of applications namely: Prisoner Monitoring - A system using tamper-proof Wi-Fi tags can be worn by prisoners for instance to restrict prisoners to certain areas of the prison by notifying prison wardens if prisoners enter restricted areas. This will also help to prevent escape attempts and allow prison guards to monitor prisoner whereabouts at all times. Child Safety - A Wi-Fi based system could be used by children in a school, crèche or theme park environment, some of the Ekahau tags have a call-button which a child could activate if they were distressed or in need of help. The system could be configured to notify the nearest teacher, carer or park staff about the issue. Indoor gaming - A large scale version of Pac-man could be played with people equipped with tags playing the roles of Pac-man and the Ghosts. Security - If valuable equipment is no longer detected in its normal area this action could activate an alarm for the security staff and then allow them to track and find it while it is in the range of the WLAN. Supply Chain - Wi-Fi tags could be attached to product in a warehouse to enable stock or inventory level tracking. Healthcare - Patients could wear wristband tags that allow them to be tracked throughout the hospital. If a patient tries to leave without being discharged, nurses are alerted to the situation and are able to get them and return them to their ward. This would be particularly useful for patients suffering from dementia or Alzheimer s disease. Additionally, important staff may wear tags so that in an emergency situation they can be quickly located (Stantchev, 2007)

7 1.2 SUMMARY & OVERVIEW Common approaches to determining location were discussed in this section. GPS (Global Positioning System) is able to show ones position on the Earth mainly in outdoor locations. GPS satellites, 24 in all, orbit at 11,000 nautical miles and float in geosynchronous orbit above the Earth. They are continuously monitored by ground stations located worldwide. GPS Receivers are cheap but the downside is that you need a line of sight to a satellite hence you need to be outdoors. Cellular Triangulation is a process by which the location of a radio transmitter can be determined by measuring either the radial distance, or the direction, of the received signal from 2 or 3 different points. The distance is determined by measuring the relative time delays in signals from the mobile set to 3 base stations. Most people carry mobile phones, however in reality most readings are quite coarse and can only be relied on to roughly pinpoint one to a geographical region. Wireless location determination systems consist of radio beacons, databases holding beacon location information and clients which estimate their location from the signal strength measurements. Leaders in the field include Ekahau, Trapeze Networks and Ubisense. It is a useful method as access points now exist in many residential and public buildings but it can be difficult to achieve accurate readings and intense planning/fingerprinting needs to be performed. RFID has seen widespread use across many different applications with the vast majority of these applications only using the data contained in tags within the reader s zone, rather than the location of the tag at any given time. Tags are quite cheap but it is relatively new and the distance for measurements can be quite restrictive. Ultra Wide Band (UWB) is precisely timed by short bursts of RF energy to provide accurate triangulation of the position of the transmitting tag. Since the short time UWB signal is very broad in frequency spread (typically 1 to 2 GHz wide) the system can operate on a very low power output and is robust against interference. It can be accurate to centimetres but deployment can be expensive and many systems only work in limited wide area spaces. The remainder of this report documents an investigation and provides a comparison into the use of location determination systems within a university campus environment. We present a comprehensive investigation into five methods of determining location and provide comparisons in order to allow those wishing to deploy such systems to make a more informed decision. What follows is an overview of the main aspects of positioning systems in current use where section 2 will provide an introduction to popular location determination systems in current use. Section 3 will provide a more detailed outline of systems selected for comparison in this study. Section 4 will outline the experiments conducted on each system. Section 5 will present the overall findings and section 6 will provide a conclusion to the study.

8 2 POSITIONING SYSTEMS Positioning is a process to obtain the spatial position of a target (Küpper, 2005). Any positioning system has at its core the measurement of a number of observable parameters. These include angles, velocity, ranges and range differences. These parameters usually measure the spatial relationship between some fixed point and the target whose position is to be determined. These measurements utilise the fundamentals of Radio, Infrared (IR) or Ultrasound signals. The positioning systems can be classified as radio-location or non-radiolocation, e.g. acoustic, optical. Position is determined by various mathematical methods including Angulation, Lateration, Dead Reckoning and Pattern Matching. For a positioning system to be implemented, various hardware and software components are needed. These physical infrastructures contain components such as Base Stations (BS) and Terminal Devices (TD). The base stations could be Satellites, GSM towers or Wi-Fi Access points. The terminals are usually small mobile pieces of hardware like a mobile phone, Wi-Fi enabled tag, laptop, PDA or a handheld GPS receiver. Other important elements of positioning systems include a Geographical Information System (GIS) database, some sort of server and/or control unit and various protocols applied between the control units and the BS and the BS and terminal devices (Curran and Hubrich, 2009). Integrated positioning infrastructures are those whose primary function is not positioning. This is usually some form of wireless network whose main purpose is communication. The positioning software runs on top of the standard communications hardware. A cellular network is an example of this. The base stations (cell towers) and terminal devices (mobile phones) can facilitate positioning even though it is not their primary function. An advantage of this type of approach is that roll-out and operating costs are manageable. A disadvantage is the extra traffic produced by the positioning network. A second disadvantage is because the hardware and software protocols used for communication were not originally designed for positioning so it can be difficult to integrate a positioning system with them. Standalone positioning infrastructures operate independently of the communications networks. They use their own base stations and terminal devices. Examples include GPS satellites which are only used for positioning. In an indoor environment, systems using ultrasound or infrared are sometimes set up in locations such as airports. These systems have a number of disadvantages including high rollout and operating costs and the need for non-standard mobile devices. In addition, communication between the positioning systems and the communications network requires separate interfaces to be designed. Advantages include more straightforward design and less competition for bandwidth from the communications network (Curran and Furey, 2007). Positioning infrastructures may also be classified as terminal or network based. This refers to where the actual position fix is carried out. In terminal based positioning systems, all the positioning (measurement, calculations and mapping) is conducted on the mobile device. For network based positioning systems, all the measurements and calculations are conducted by the network. For both of these options, the fix may be sent on to the network or back to the mobile device. A third option exists where the measurements are taken by the terminal device and then uploaded to the network for processing which is known as terminal assisted. The type of positioning infrastructure used depends on the type of location based service to be used. If further processing of the data is to be carried out at the target location, e.g. on a laptop, then the terminal-based approach may make most sense. However, with the network based approach, upgrades to the system can be carried out without the need for new terminal devices such as phones. This can assist cellular companies with smooth migration. 2.1 BASIC POSITIONING METHODS In recent years the need has arisen for the development of Location Based Services (LBS) which work in an indoor

9 environment. Large public buildings, universities, hospitals and shopping centres have become target areas. Because some of the major options, Satellite and Cellular positioning, either don t work indoors or the accuracy level is too poor, a need arose for standalone indoor systems. This section explains the most commonly used methods to calculate the unknown position of a target. Proximity Sensing is the simplest method of positioning within a network and it makes use of the limited range of the signal on a mobile device. The position of whichever Base Station the Mobile Device connects to is considered to be the position of the mobile device. Lateration is the range or range differences between the mobile device and at least 3 base stations. The targets position is then calculated by a number of non-linear equations. For three base stations it is known as trilateration. If range measurements are used a method known circular lateration is used. Hyperbolic lateration is used when range differences are known. A certain error is always involved in both these methods and a range of values are given as the results called pseudo ranges. When three base stations are known with their ranges to the target the coordinates of the unknown target can be calculated. Angulation is a method which uses prior knowledge of the locations of the BS. The angles between the BS and the target are measured and trigonometric positioning calculations are conducted on these. This may be conducted by the network or by the terminal but as an antenna-array is required to measure the angles it is usually done by the network. With two BS the angle of arrival of the signal from the mobile device is measured (using the same axis on both BS). Where the two lines intersect is determined to be the position of the target. Elementary geometry can calculate the position of the target. Again, an error is involved due to the low antenna array resolution. To instantiate the equation in which some angles are not known exactly, a solution must be approximated by a least squares fit that starts with a linearization using the Taylor Series expansion (Küpper, 2005). Dead Reckoning is a method used for centuries by sailors, dead reckoning is an abbreviation for deduced reckoning, also referred to as inertial navigation. Basically a target s current position can be calculated from knowledge of its previous position, its speed and its direction of travel (Fang at al., 2004). Dead reckoning is always used along with other technologies when they fail, e.g. when a ship is in heavy fog or when a number of BS cannot be seen, i.e. no Line Of Sight (LOS). At present, accelerometers, gyroscopes and odometers are used to calculate speed, direction and distance respectively. GPS also uses a form of dead reckoning in car navigation for instance, when a car enters a tunnel and loses line of sight to the satellites (Ochieng et al., 2003). Many of these methods when used alone give levels of accuracy which are insufficient for most uses. Accuracy standards have been imposed by the US and EU which push the use of a number of methods to supplement one another. An example of this is the use of dead reckoning along with GPS or indoor WLAN positioning to increase the accuracy of the detected position (Fang et al., 2004; Beauregard, 2006). Received Signal Strength (RSS) is a method of calculating the range from the base station to the target. The RSS takes into account the strength of the signal when it arrives allowing for attenuation and path loss as it travels. RSS is often used in indoor systems where the distances to be measured are small (~ < 10 m). With these short distances the time taken for the signal to arrive is very short as the radio waves travel at the speed of light making Time of Arrival (ToA) measurements difficult. Angle of Arrival (AoA) does not perform well indoors due to the number of obstacles that a signal may encounter. For these reasons RSS values are used. Unfortunately RSS measurements are highly inaccurate when compared to time measurements. Variations in RSS signals can be as great as 30-40dB over distances in the order of half a wavelength (Caffery, 1999). Many Wi-Fi positioning systems use their own intelligent methods to make use of these noisy RSS signals (Krzysztof et al., 2006).

10 2.1.1 WIFI POSITIONING METHODS Wi-Fi networks are available in many public buildings. The signals transmitted by the Access Points (APs) provide a readily available network of signals which may be used for positioning. The wide availability of existing Wi-Fi networks and of Wi-Fi enabled mobile devices makes WLAN positioning an attractive option due to the low roll-out and operational costs. The majority of systems in use today rely on measurements of RSS, Signal to Noise (SnR) ratio and Proximity Sensing. Each beacon (AP) sends out periodic broadcasts on the up or down link. Measurements are taken at the terminal device for RSS and SnR. Passive scanning is used to listen for the signals from the beacons. This is normally used to select the best signal for data communication. Each beacon emitted from an AP contains some information about the AP. For positioning purposes, one of the interesting properties is the Basic Service Set Identifier (BSSI) which acts like an individual name for the beacon. These beacons are emitted periodically and the time delay can be configured but is usually in the order of a few milliseconds. With the information gained from these beacons a number of positioning methods may be implemented. The AP with the strongest signal is considered to be the location of the mobile device. If the Base Station s (BS) coordinates are known to be (x, y), then with proximity sensing, the Mobile Device s coordinates are also considered to be (x, y). WLAN fingerprinting is the most successfully used method in commercial systems available today. It is used in both the Ekahau system and the LA200 systems from Trapeze networks (LaMarca, 2005). There are two separate stages in the fingerprinting process, the offline and online stages. The offline stage involves calibrating the area where positioning is to be conducted. This can be a time consuming process and involves manually walking around a building with a Wi-Fi enabled device which is constantly taking RSS snapshots of the signals that it can detect at each location from all the detectable APs. This must be done every few meters or so and at each location a full 360 degree rotation must be carried out as there can be a large variation in RSS values depending on orientation. This information is then stored in a database with the coordinates of each location corresponding to a different pattern of RSS values. Systems such as Ekahau display areas where calibration has been conducted with their RSS values denoted by the different colours graphically on a map. The online phase involves actually getting a position fix from a mobile Wi-Fi device at an unknown location in the test area. A number of approaches can be followed with either terminal, network or terminal assisted being used. The detected RSS values at a particular location are compared with those in the database. The closest matching pattern with its corresponding location coordinates are given as the previously unknown coordinates of the mobile device. A number of different methods may be used for find which of these patterns is the closest as there will very rarely be an exact match. Disadvantages of this method include a time consuming calibration/training process. In addition, if some of the APs are moved then partial calibration needs to be redone CELLULAR POSITIONING METHODS In a cellular system the position is given as that of the cell that the phone is currently in. This is known as cell_id based positioning. It can be network based or terminal based. Some towers broadcast their location intermittently. This beacon can be listened to and the location deduced from it. This approach has been used in a number of indoor systems. Olivetti Research developed the Active badge system that worked on this principle (LaMarca, 2005). Intel Research s PlaceLab system also contains a basic method that works in this manner known as Closest AP. Cellular accuracy with this method is often poor but improves in built up areas where the cell size is smaller. Suitability depends on the type of LBS and on the accuracy required RFID POSITIONING METHODS

11 Radio Frequency Identification (RFID) is a technology which is in widespread use in areas like asset management and stock control. Radio signals are transmitted between a reader and a tag. An RFID tag consists of an antenna, a transceiver and a small amount of memory. An RFID reader has more functionality than a tag and in addition to an antenna and a transceiver it also contains a power supply, a processor and an interface to connect to a network, usually Ethernet or serial (Jones, 2006). The tags may be either active or passive. The passive tags have no power supply and are activated by the signals scanning them. The active tags have a small power supply and this enables them to have a range of several meters when compared to less than 1 meter for most passive tags. RFID tags enable positioning by placing the readers at doorways or other such points of human movement. The network can then track people when the tag they are carrying, passes through a doorway. This information can be sent by the reader to a central server which can display the tag s location graphically. Aeroscout is an example of this type of positioning application INFRA-RED (IR) POSITIONING METHODS Infra-Red (IR) based systems usually operate in one room or an open area. This is because the short range of the IR signals does not travel through walls or doors. These systems usually need a direct Line of Sight (LOS) to the target device. Infrared (IR) systems operate by either the user taking some action to highlight their presence to a sensor or as in the case of the IntelliMotion system the light pulses worn by a user are detected by sensors and the location of the user is display on a computer 7. With IR technology and due to the fact that light cannot pass through walls, a sensor is required in every room, behind every blocking wall and in every corridor of a facility using this technology. These IR positioning systems work in a similar manner to RFID systems. Each user wears a tag that periodically emits a beacon containing some unique information about that tag and hence the person carrying the tag. IR sensors on the walls or ceilings detect the tags and give the location. This is usually a networkbased positioning system. Olivetti research developed one of the first indoor positioning systems (ActiveBadge) in the early 90 s using this technology (Want et al, 1992; Priyantha et al., 200; Curran & Furey, 2007) BLUETOOTH LOCATION DETERMINATION Bluetooth is a short range wireless technology that is used to connect a pc to a device like a Personal Digital Assistant (PDA) or it can be used to connect a mobile device to a Bluetooth enabled accessory like a hands free kit. There are a number of new technologies available that use both Bluetooth and IrDA to augment Local Positioning Systems especially Bluetooth as the range is more sensitive within 50 metres with a Bluetooth device (Forno et al., 2005). A Bluetooth system like the Tadly s Topaz 8 system is made up of three major components the positioning server, the access points and the tags. The tags can be either special Topaz system Bluetooth tags or any Bluetooth equipped device such as a mobile phone. The system can provide up to ninety five percent reliability accuracy to around two meters. It can detect a Bluetooth tag by several methods namely, using RSSI to triangulate the location, putting an access point in every room and using the nearest AP to the tag to indicate its location. 2.2 SUMMARY Accurate location determination systems have been a luxury for large scientific institutions and military installations for some time, but such systems are much too complex and expensive for use in smaller areas such as schools, clinics and even the common household. The ability to track the real-time location and movement of items or people offers a broad range of useful applications in areas such as safety, security and the supply chain

12 Many systems that track subjects in real time, such as GPS and mobile phone triangulation have severe limitations when tracking individuals in a smaller area, such as a room, building or garden. GPS devices require line of sight with satellites in order to be tracked correctly, meaning devices cannot be tracked indoors or in some areas surrounded by tall buildings. The degree of accuracy to which GPS provides location information is also inadequate for applications that monitor areas with specific boundaries between where an individual is allowed and where they are not. Mobile phone tracking is expensive and works only in more developed areas in the range of multiple cell towers. Position estimation, to within an average of fifty metres, is much too inaccurate to track subjects over a small area. Implementing a location determination system using received-signal-strength (RSS) has the advantage that the system can work indoors, however the cost of implementation is rather high and the complex network infrastructure may need constant maintenance. Radio Frequency Identification (RFID) is an automatic identification technology which has seen increasingly prominent use in tracking, however problems also exist here with regards accurate tag location determination. WLAN fingerprinting is arguably the most successfully used technique in systems on the market at the moment. It is used in both the Ekahau system and the LA200 discussed in more detail later. There are two separate stages in the fingerprinting process, the offline and online stages. The offline stage involves calibrating the area where positioning is to be conducted. This can be a time consuming process and involves walking around with a wireless enabled device which is constantly capturing signal snapshots that it can detect at each location from all the detectable APs. The following section discusses actual products on the market for detecting presence within buildings.

13 3 INDOOR POSITIONING SYSTEMS A Real-time location system (RTLS) is a combination of hardware and software that is used to continuously determine and provide the real time position of assets and resources equipped with devices designed to operate with the system. A location may be described through relative position data with indication of distances, or absolute position data, with some accuracy in any defined grid of coordinates. Ranging is the prerequisite for locating, hence delivering angles or distances between locations. Generally Location and Ranging are reported visually, mostly referring either to a map of a terrain, or to a plan of a building, or in a graph. Alternatively a change of location may be indicated with sound signals. Location determination systems show many resemblances to location based services of mobile phone networks. Typical applications of location determination systems may be Warehousing - Resource tracking with local distribution as Fork-lifts, pallets, cardboard-boxes, tools, machines; Access control - ability to read the identity of many people at the same time passing through doorways, tube station entrances, lift access and doorways; Identifying capital goods - Ability to read the identity of transponders mounted inside capital goods or packaging, when in the warehouse, transport system and even when passing through doorways for an asset tracking system; Airline baggage - identifying, sorting and routing; Laundry for hospitals - identity, sorting and routing after bulk washing; Library books - identifying, self service checkout/checkin, book location; Hospitals - tracking patients, preventing baby removal, patient location and identification and Penal systems - House arrest - verification of presence. Figure 2: Trilateration Differential travel time triangulation against reference points (TDOA Time Difference Of Arrivals) uses more than one frequency for metering. Travel time triangulation against reference points (AOA Angle Of Arrival) uses more than one receiver for metering. For instance in Figure 2, the person/object to locate is standing at point A, and the three closest RTLS nodes are located in P1, P2, P3. Received Signal Strength Indication (RSSI) is a procedure for utilizing the strength of a signal to determine a best estimate for current location. This procedure can either use the strength of a single signal arriving at multiple readers or the strength of multiple signals arriving at a single reader. Accuracy can be variable based on the environment and the number of RF reading devices. This method is common in systems based on the IEEE standard for wireless networks, and is most frequently used in tightly enclosed indoor areas. The approaches to determine the location can be categorized into two classes: switch-based and client-based. To realize switch-based location determination, the wireless switch system must include a positioning component, which measures the signal strength of the mobile devices within its range and estimates their locations using specific mathematical algorithms. All the work is done at the switch side. However, for client-based location determination, it is the mobile device that retrieves the signal strength from its wireless adapter and reports it to the location determination server, which then estimates the location of the mobile device using mathematical algorithms (Zhou, 2005). The following section gives an overview of a number of currently used indoor positioning systems. Knowledge of these is necessary to motivate why we chose certain systems to evaluate.

14 3.1 PLACELAB INTEL RESEARCH PlaceLab 9 was developed for research purposes and is open source. The PlaceLab architecture consists of three key elements as shown in Figure 3: (1) Radio beacons in the environment, (2) Databases holding beacon location information and (3) PlaceLab clients that estimate their location from this data. Unlike the LA200, PlaceLab can be used in ad-hoc mode and also works between buildings but the accuracy levels when used this way are at least 20m (LaMarca et al., 2005). Figure 3: PlaceLab Architecture Placelab provides location based on known positions of the access points which are provided by a database cached on the detecting device. Wi-Fi radio surveys seldom have enough data from one access point to calculate a position, so position must be calculated from information provided by a number of access points. 3.2 TRAPEZE NETWORKS LOCATION APPLIANCE LA200 The LA200 is a Wi-Fi network based system which uses the existing network hardware and devices already deployed. Trapeze claims that all the calibration can be done from a central point but this only gives RSS fingerprints at the access point locations. Like many commercial systems, much manual tweaking is necessary to get satisfactory levels of accuracy. The underlying methods of positioning are also based on fingerprinting. The LA200 contains an API for further development. Trapeze Networks list a number of benefits of the LA-200 system, which include 10 provision of user access control based on their location, this feature could also be used to prevent those with stolen Wi-Fi equipment such as laptop accessing the network; the ability to collect network access points RSSI data; Wi-Fi compliant and therefore does need not specialized hardware or software on the Wi-Fi devices and a Dashboard application which provides the ability to view the real time movement and track up to two thousand Wi-Fi enabled devices simultaneously

15 Figure 4: LA200 Fingerprinting showing signal strength of the APs it can hear The LA200 has a granularity of five minutes without additional network load and then stores all this data for each device for a maximum of thirty days at a ten meter precision level so it can attempt to locate all devices to a room level. Figure 4 shows the web configuration screenshot where signal strengths for a number of access points are visible. 3.3 UBISENSE Ubisense 11 is a real time location system (RTLS) built on Ultra Wide Band (UWB) radio technology. The system is composed of UWB active tags (ubitags), sensors and a software platform. Active battery powered Ubisense tags enable positioning by transmitting UWB pulses. Sensors receive these pulses from the tags which must be positioned around the test area in a way that gives complete directional coverage of the test area. A software platform carries out the positioning calculations on the data received from the sensors. This platform then analyses the results and presents them in a suitable format. Figure 5: Ubisense Tags Each area to be tested must have its own network of sensors, i.e. each room. These areas can be integrated to give continuous positioning information even when the target moves from one area to another. This works in a similar manner to mobile phone cells transferring control from one to the next. Each sensor determines the Angle of Arrival (AoA) of the signal from the tag (see Figure 5). If two or more sensors are connected in the test area it is possible to include Time Delay of Arrival (TDoA) along with AoA measurements. This gives a 3D location estimate 11

16 with accuracy levels of 15 cm (Steggles & Gschwind, 2005). The tags can respond to an event in less than 100 ms and the battery life is claimed to last up to 5 years. The Ubisense system also contains a.net 2.0 API for custom application development. 3.4 EKAHAU REAL TIME LOCATION SYSTEMS (RTLS) The current market leader in Wi-Fi positioning systems is the Finnish Company, Ekahau 12. Their proprietary Java based system contains of a number of main parts which include: (1) The Ekahau Positioning Engine (EPE), (2) the Ekahau Site Survey and (3) the Ekahau Client (see Figure 6). The Client communicates with the mobile device s Wi- Fi chip and retrieves the RSSI information and passes this along to the EPE. The EPE is a positioning server that provides the location coordinates (x, y, and floor) of the mobile terminal or Wi-Fi tag. The Ekahau manager merges information from the EPE and the Client and also provides applications for site calibration (Ekahau Site Survey) and live tracking. Figure 6: Ekahau Architecture A noteworthy element of the Ekahau systems is their proprietary Rails software which allows for tracking to be carried out in a way that replicates human movement and eliminates the jumping through walls effect that is common with other RTLS. This gives a unique competitive advantage to the Ekahau solution. The Rails are added by an administrator to teach the solution where devices are able to travel. The software views the area where the rails are as a higher probability of true location. Ekahau can use a network, terminal or terminal assisted approach. It also comes with an Application Programming Interface (API) to enable custom applications to be developed. The Ekahau RTLS system facilitates all tracking of devices as it does not rely on proprietary infrastructure or readers in order to track devices. The existing Wi-Fi network is used for all tracking with signal strengths being recorded. 3.5 RFID RADAR Radio frequency identification is an automatic tracking technology that is used to identify people or objects by automatically scanning a specific radio frequency and retrieving a serial number or some other type of information from the person or object (see figure 7). This serial number would be compared to a matching number on the system database and whatever process associated with its scanning would be carried out. Today, a significant thrust in RFID use is in enterprise supply chain management, improving the efficiency of inventory tracking and management. RFID is used for tracking livestock, pets, and payment at Toll systems, access control, asset tracking and many more. An RFID tag is an object that can be applied to a person or an object for the purpose of identification using radio waves. Some tags can be read from several meters away and beyond the line of sight of 12

17 the reader, but we had not tags of the latter type to test. Most RFID tags contain at least two parts. One is an integrated circuit for storing and processing information, modulating and demodulating a (RF) signal, and other specialized functions. The second is an antenna for receiving and transmitting signals. Figure 7: RFID system components The vast majority of these applications, however only use the data contained in tags within the reader s zone, rather than the location of the tag at any given time. Radio Frequency Identification tags can be easily added into most everyday objects. Trolley Scan s RFID-radar 13 system is a an example of an indoor RFID based location determination system that has the accuracy capability of less than fifty centimetres in an area up to one hundred meters deep, however this depends on the tags used and may be as little as ten meters. The system can track up to fifty tags and locate their position within a few seconds. The system has three main components, the reader, the antenna array and the tags. The reader measures the distance of the signals from the tags, the antenna array for energising the tags and finally the tags themselves. 3.6 AEROSCOUT Aeroscout 14 specialise in asset tracking and visibility through a combination of Wi-Fi & RFID enabled tags. Aeroscout tags & devices may be located within range and the Aeroscout tags contain an RFID chip which gives them extra functionality. The tags are activated when they pass by RFID exciters at choke points, e.g. doorways. This allows the system to be alerted when a tag enters or leaves a particular sector. In addition to using RSSI as a means of establishing position indoors, Aeroscout uses Time delay of Arrival (TDoA) for large indoor or outdoor areas. This gives it much greater range than is available with RSSI. Along with the tags and exciters, Aeroscout contains a number of key software components

18 Figure 8: Aeroscout visibility system The Aeroscout positioning server receives measurements from the tags/terminals and conducts positioning calculations based on these. Included is the Aeroscout system manager allowing setup, configuration and administration of the software environment. The core element is the positioning API for the development of Aeroscout based location services applications. Figure 8 illustrates the Aeroscout visibility system which organizations such as Boeing and DHL have deployed. AeroScout uses Wi-Fi RFID tags along with Aeroscout software that can be integrated into a standard network Infrastructure. The system also provides its own frontend software to monitor tags known as MobileView. A trial in Yokohama City, Japan, in 2005 using an AeroScout system tracked school children and monitored their safety as they went to school. Each child was given an AeroScout active RFID tag to wear and MobileView software was able to track each child based on the RSSI from the city s Cisco WLAN AP s. The active RFID tags could be read up to three hundred meters from the AP s and the location determination had an accuracy of around ten meters. Each tag also has an additional feature of a call-button that could be activated by the child if they needed help; on activating the tag an showing the childs location on a map was sent to the child s parents (Swedberg, 2005). 3.7 CISCO WIRELESS CONTROL SYSTEM (WCS) Cisco Wireless Control System (WCS) 15 is a platform for wireless LAN planning, configuration, management, and mobility services. It provides functionality for IT managers to design, control, and monitor their enterprise wireless. It seeks to provide this from a centralized location thus simplifying operations and reducing total cost of ownership. The feature of the Cisco Wireless Control system that we are Interested in here is the Cisco Wireless Location Appliance. This application allows effective tracking of any assets equipped with transceivers, this includes laptops, pda s, handsets, or equipment tagged with a wireless tag. Cisco also claims that with these advanced location tracking capabilities, the Cisco Unified Wireless Network is a platform for helping to enable key business applications that take advantage of wireless mobility, such as asset tracking, inventory management, and enhanced 911 (e911) services for voice (Mahmud, 2006). 15

19 Figure 9: Visualize RF Coverage. By incorporating indoor location tracking into the wireless LAN infrastructure itself, Cisco aims at reducing the complexities of wireless LAN deployment (Krzysztof & Hjelm, 2006). Figure 9 illustrates the CISCO Wireless control system application which shows the visual coverage of the access points. 3.8 SUMMARY Some location determination vendors say that they can achieve accuracy to within six inches. However these systems require a myriad of readers and cabling to achieve these accuracies. Others require the installation of choke-points to doors which may be feasible for counting people in shopping centres but it is hardly reasonable in large scale campuses with hundreds of doors needing monitoring. Thus we focus only on systems which have the necessary scalability and practicality in the real world for cost effective monitoring of devices and people. There are wireless cost effective systems on the market but the current batch of location determination technologies all have limitations that restrict how and where they can be implemented. There are also issues concerning the difficulties of obtaining independent information on variables such as cost, accuracy and ease of installation. Therefore, subsequent sections provide a more detailed summary of five leading location aware systems and the findings of implementing such systems in a university campus environment with a view to adding to the existing body of knowledge in this area.

20 4 SELECTED TEST BED DETERMINATION SYSTEMS The platforms we investigated in this study are (1) PlaceLab (2) Trapeze Networks LA-200 (3) Ubisense Precise RTLS (4) Ekahau RTLS and (5) Trolley Scan s RFID-radar. What follows is a more detailed description of the characteristics of each of these systems. 4.1 PLACELAB PlaceLab operates by listening for transmissions from wireless networking devices such as access points, GSM towers and fixed Bluetooth devices. These radio services are collectively referred to as beacons. Each of these use protocols that assign a unique or semi-unique ID to the beacons. Clients positions can be determined by detecting these ID s access points can be used to determine location. The only interaction between the AP and the PlaceLab enabled device is that the device must detect the unique ID and the signal strength. PlaceLab does not require the client to transmit any data nor is it required to listen to any other network user s transmission with This is done entirely passively by listening for the beacon frames that are broadcast periodically by the AP. These frames are sent without any form of encryption and do not employ MAC address authorisation or WEP. The current version of Place Lab is v and is a freely available Place Lab toolkit including the source-code for Place Lab, all pre-compiled jar files and platform-specific executables and scripts can be downloaded for Windows XP, Linux, Mac OS X, Windows CE/Pocket PC and Symbian Series 60 phones. PlaceLab database information is contained in a flat text file with tab separated columns Latitude, Longitude, SSID and BSSID. This file can be loaded into the PlaceLab database. The client must be able to see a number of these access points to determine location. A minimum of three are required. Merely detecting on AP does not give our client its location. The relevant location information for the AP must be stored in the database. The database plays an essential role in the architecture of PlaceLab. It serves the clients with the beacons location information. Figure 10: Spotter Hierarchy The PlaceLab clients determine their location from both the database of APs and from making live observations of the radio signals around them. For reasons of portability and extensibility, the client s functionality is divided into three separate elements: spotters, mappers and trackers. Spotters are the means by which the client observes the real physical world as shown in Figure 10. A sample output of the Wi-Fi Spotter is shown in Figure 11. Other spotters may be used if necessary for the different protocols supported, for example, GSM and Bluetooth. The purpose of the spotter is to monitor the radio signals detected and pass on the ID s of these beacons to other elements of the system. The mappers purpose is to provide the location of known radio beacons. Latitude and longitude are always provided but it is possible to include other relevant information such as altitude, power of the transmitter or the age of the current data. This data may come from a number of locations. Data for the location of 129 access points on campus was loaded into the maploader application from wigle.com as shown in Figure

21 Figure 11: WifiSpotterExample.bat showing APs Figure 12: maploadergui interface with wigle.net The tracker uses the information from the spotter and the mapper to estimate the client s position. System understanding of signal propagation and its relationship to distance, location and the physical environment are encapsulated in the tracker. A simple tracker is included in PlaceLab that computes Venn diagram-like intersections of the beacons observed. Also included is a Bayesian particle filter tracker that uses range information for specific beacons. Although this requires more computation, it can give a 25% improvement in accuracy and can also give extra information like speed of movement and direction. A number of applications have been developed that use PlaceLab such as UC Berkeley who developed a rapid prototyping tool known as Topiary for designing location enhanced applications (Li et al., 2004). This allows a prototype to be run on a mobile device while its interactions can be monitored by the designer on another device. The user s location can be changed by the designer by clicking on the map as shown in Figure 13. Figure 13: A screenshot of Topiary Topiary has been adapted to use live location estimates from the device using PlaceLab. As PlaceLab can be used indoors it allows Topiary to be used in a wide variety of settings. A2B 17 is an online catalogue of geocoded web pages (pages tagged with location metadata) where users can add new pages or query for nearby pages. A2B normally discovers its location by the application interacting with a GPS unit. The A2B interface supports HTTP requests from users who are running the PlaceLab web proxy. 17

22 4.2 TRAPEZE NETWORKS LA-200 The Trapeze Networks Location Appliance LA-200 is a rebranded Newbury Networks Location Appliance. Newbury Networks strategic business partners rebranded the unit under several different names namely the Meru Networks Meru RF Location Manager, the Nortel Networks Nortel WLE2340 and Trapeze Networks Trapeze LA-200 (See Figure 14). It will only be referred to as the LA-200 in this report. Figure 14: LA200 The LA200 uses server-side RSSI pattern matching techniques to locate devices or tags and claims the industry s highest performance for accuracy (i.e. claims to locate all devices to room level with accuracy at 99% with 10 meter precision in fewer than 30 seconds. It claims an ability to track up to 2,000 wireless devices without the need for specialized hardware or software on the tracked devices. Figure 15: Trapeze Dashboard for the LA-200 The LA200 is shipped with a dashboard application (see Figure 15) which allows the viewing of real-time movement of WiFi devices, people, and asset tags on each floor. It comes also with some scripting examples for the API which enables custom applications and business-process integration with location services. The system is also able to store location history for each tracked device for up to 30 days. The Trapeze Networks Location Appliance provides the ability in real time to quickly and accurately locate and track assets, people or practically anything that is attached to an existing Wi-Fi network. It provides the capability to run custom or enterprise applications that require the ability to provide location sensitive content or security and track assets. The LA-200 is Wi-Fi compliant which allows the system to use the active Wi-Fi tags from other companies such as, AeroScout, Ekahau, Newbury Networks and Pango. A summary of devices connected can be viewed through the Dashboard and options are available to view devices by server, locale or network as shown in Figure 16. An image file containing a scaled plan of a building can be imported into the system and different locales added by the user.

23 Figure 16: Trapeze Dashboard Device List Screen Appliance The light blue area in Figure 17 represents the MG122 locale. After the locales have been identified the actual physical fingerprinting is done. The points where fingerprints have been taken are represented by a green flag as shown in Figure 17. Figure 17: Trapeze Dashboard fingerprint locations The Dashboard application summary screen displays information on the system, network and devices visible to the network. By clicking on a particular device from the device list screen the system will display the recent activity of the tag. A MAC address and date range for a given time period of up to thirty days can be entered here and the system will display the location of that tag for the given date range. The system will also display the fingerprint information it holds for a particular fingerprint point. For example in Figure 18 fingerprint mp24 is shown. Figure 18: LA200 Web Configuration screenshot showing Fingerprints of MG lab Figure 18 shows a screenshot from the web based Dashboard fingerprint section which shows the detail of the mp24 fingerprint location in a graphical representation using green and purple bars.

24 4.3 UBISENSE Ubisense are a UK Company and one of the first to exploit Ultra-Wide Band for Real Time Location System (RTLS). Ultra wideband is precisely timed short bursts of RF energy to provide accurate triangulation of the position of the transmitting tag. Ultra-wideband (UWB) is a radio technology which can be used at very low power levels for shortrange high-bandwidth communications (>500 MHz) by using a large portion of the radio spectrum. UWB transmissions send information by generating radio energy at specific time instants and occupying large bandwidth thus enabling a pulse-position or time-modulation. The information can also be modulated on UWB pulses by encoding the polarity of the pulse, its amplitude, and/or by using orthogonal pulses. Unlike conventional RFID systems, which operate on single bands of the radio spectrum, UWB transmits a signal over multiple bands simultaneously, from 3.1 GHz to 10.6 GHz. In a UWB location system, small active tags are attached to the objects to be located, or are carried by personnel (Figure 20). The signals emitted by these tags are detected by a network of receivers surrounding the area. By detecting the signal at two or more receivers, the 3D position of the tag can be found. It is worth noting that two algorithms are employed. One calculates the time difference of arrival of a signal at two different readers and the other calculates the angle of arrival of the signal. The Ubisense RTLS solution utilizes battery-operated radio tags and a cellular locating system to detect the presence and location of the tags. Figure 19: Ubisense out of the box contents The Ubisense Series 7000 sensor is a precision measuring instrument containing an array of antennas and ultrawideband (UWB) radio receivers. The sensors calculate the location of the tags based on reception of the detected UWB signals transmitted from Ubitags. Each sensor independently determines both the azimuth and elevation Angle of Arrival (AOA) of the UWB signal, providing a bearing to each tag. The Time Difference of Arrival (TDOA) information is determined between pairs of sensors connected with a timing cable. Sensors are administered remotely using standard Ethernet protocols for their communication and configuration. They work in standard wired and wireless environments, using networking infrastructures, such as access points, Ethernet switches and CAT5 structured network cabling for communication between sensors and servers. The locating system is usually deployed as a matrix of sensors that are installed at a spacing of anywhere from 50 to 1000 feet depending on the site layout. These sensors determine the locations of the radio tags. Ubisense consists of Tags - designed to be mounted on assets or to be worn by a person; Location Engine software to install and tune a Ubisense sensor network and track tags in real time, through a series of configuration wizards and the Location Platform software which provides persistent storage and distribution of real-time location events for multiple clients in conjunction with real-time monitoring and notification of user-specified spatial interactions

25 between objects. Ubisense claim that their systems (see Figure 19) require fewer readers than other systems which implement only the time-difference algorithm. Readers receive data from the tags (max distance 160 m) and send location updates through the Ubisense Smart Space software platform. Ubisense creates sensor cells each requiring a minimum of four sensors. It claims to achieve scalability to 1000 s of sensors using low-cost offthe-shelf servers over Ethernet. The standard range covered by a cell is less than <160m and typically the range between a tag and a receiver is 10m-30m. Key limiting factors include the level of building obstruction between the two. Ubisense claim an achievable range accuracy of <15cm even within a complex indoor environment. Accuracy such as this would allow location aware applications to pinpoint particular devices being used in a room. Ultra wide band systems work well indoors as the short bursts of radio pulses emitted from UWB tags are easier to filter from multipath reflections than conventional RF signals, however metallic and liquid materials still cause some signal interference (Petzold et al., 2006). Ubisense however claim that this can be overcome through the strategic placement of sensors and UWB also possesses the ability to determine "time of flight" of the direct path of the radio transmission between the transmitter and receiver at various frequencies which helps overcome multipath propagation. UWB pulses are very short in space (less than 60 cm for a 500 MHz wide pulse and less than 23 cm for a 1.3 GHz bandwidth pulse) therefore most signal reflections do not overlap the original pulse, and thus the traditional multipath fading of narrow band signals does not exist. Figure 20: Slim & Compaq tags Ubisense uses active tags named Ubitags which are manufactured by C-MAC and designed to be easily mounted on the side of vehicles and assets or worn by a person (Figure 20). Their update Rate is 0.01Hz 20Hz. These tags have a unique 32-bit identifier and broadcast a beacon including their location as often as 10 times a second (essential for tracking people walking quickly through a monitored area) or as infrequently as once every few minutes. This rate can be changed dynamically over a wireless link while the system is running and in response to individual tag behaviour. If a tag is moving quickly, the update rate of its beacon can be programmed to increase, and if a tag is stationary, the update rate can programmed to decrease. This feature is an attempt to conserve battery life. Ubitags are designed to last for approximately five years in typical use. The Ubitags can store up to 200 bytes of data, four of which are used to store the ID. Tag data can be changed over the network and individual tags can be paged. The Compact Tag is a small, rugged dust & water resistant device specifically designed for use in harsh industrial environments.

26 4.4 EKAHAU The current market leader in Wi-Fi positioning systems is the Finnish Company, Ekahau 18. The Ekahau Real Time Location System is a software suite that uses an existing WLAN network without the need for additional special network hardware to determine the location of a Wi-Fi equipped device. The suite has three main components namely the Ekahau Site Survey (ESS), the Ekahau Positioning Engine (EPE) and the Ekahau API that utilises the EPE system to create custom applications (see Figure 21). The EPE uses software based algorithms to calculate the position of a tag. However before the EPE can determine the location work it needs the site survey calibration information from the ESS. The ESS collects the information on the coverage and RSSI of each AP in the network across the area to be covered. The ESS gathers the calibration information by a person carrying the system and walking around the area to be covered. Ekahau provides an open API with support to integrate XML thus full visibility across geographically-dispersed campuses is available out of the box without the need to install software or hardware at remote sites. Figure 21: Ekahau Components out of the box The Client communicates with the mobile device s Wi-Fi chip and retrieves the RSSI information and passes this along to the EPE. The EPE is a positioning server that provides the location coordinates (x, y, and floor) of the mobile terminal or Wi-Fi tag (See Wi-Fi tags in Figure 22). The Ekahau manager merges information from the EPE and the Client and also provides applications for site calibration (Ekahau Site Survey) and live tracking. Figure 22: Ekahau Tags A noteworthy element of the Ekahau systems is their proprietary Rails software which allows for tracking to be carried out in a way that replicates human movement and eliminates the jumping through walls effect that is common with other RTLS. This gives a unique competitive advantage to the Ekahau solution. The Rails are added 18

27 by an administrator to teach the solution where devices are able to travel. The software views the area where the rails are as a higher probability of true location. Ekahau can use a network, terminal or terminal assisted approach. It also comes with an Application Programming Interface (API) to enable custom applications to be developed. The Ekahau RTLS system facilitates all tracking of devices as it does not rely on proprietary infrastructure or readers in order to track devices. The existing Wi-Fi network is used for all tracking with signal strengths being recorded as they are. Figure 23: Ekahau Survey Inspector showing 30s fluctuations Ekahau Site survey records RSSI data of the test area with all observable aspects of the WLAN being considered. RF characteristics e.g. multipath, reflection, etc, are recorded and do not harm location accuracy or signal measurement. This survey data then facilitates building tracking models. The observed client data is recorded and each recorded location is assigned a probability based on this data (see Figure 23). Figure 24: Rails and free space Ekahau uses its own probabilistic location detection algorithms which are computationally efficient giving 1-3 metres accuracy in ~ 5 seconds. Different Wi-Fi devices hear the network at different levels (RSSI readings) even when they are located at the same distance from the Access Point (AP). A process of normalization is applied which allows for the use of hardware from different vendors. Figure 24 illustrates how the rails tools in Ekahau can be used to designate areas such as hallways between rooms.

28 4.5 RFID RADAR The RFID-radar 19 system from Trolley Scan is an RFID based location determination system that they claim can track up to fifty tags and locate their location within a few seconds. The system has three main components, the reader, the antenna array and the tags (See Figure 25). The reader measures the distance of the signals from the tags from the antenna array which also energises the tags (Collins, 2005). The RFID radar works by measuring the distance the signal travels to two of the antenna then calculating the angle from each and movement can be detected by repeating this process (rfid-radar.com, 2007). Trolley Scan determines the range of the transponder based on its received transmission. The reader has a location accuracy lower than 0.5 m, a pointing accuracy of 1 degree and can cover a maximum range of 100 m depending on the tag used with the reader. RFID-radar takes a relatively long time to determine the exact position therefore it is better suited to static situations where transponders are relatively stationary. A problem with RFID systems is that they need an external antenna which is 80 times bigger than the chip. Further, the present costs of manufacturing the inlays for tags have inhibited broader adoption, but as silicon prices are reduced and more economic methods for manufacturing inlays and tags are perfected in the industry, broader adoption and item level tagging may make RFID both innocuous and commonplace much like Barcodes are presently. Figure 25: RFID Radar out of the box contents The RFID-radar by Trolley Scan, makes two measurements on each signal received from each transponder in its receiving zone: a range measurement and an angle of arrival. The angle of arrival measurement is virtually instantaneous and used in conjunction with range gives a 2D positioning system from a single measuring location. It also measures range with narrow bandwidth (10 KHz as is shown in Table 1). RFID tags come in three general varieties: passive, active, or semi-passive (also known as battery-assisted). Passive RFID tags have no internal power supply. The minute electrical current induced in the antenna by the incoming radio frequency signal provides just enough power for the CMOS integrated circuit in the tag to power up and transmit a response. Most passive tags signal by backscattering the carrier wave from the reader. This means that the antenna has to be designed both to collect power from the incoming signal and also to transmit the outbound backscatter signal. The response of a passive RFID tag is not necessarily just an ID number and the tag chip can contain non-volatile, possibly writable EEPROM for storing data. Passive tags have practical read distances ranging from about 10 cm up 19

29 to a few meters, depending on the chosen radio frequency and antenna design/size. The lack of an onboard power supply means that the device can be quite small: commercially available products exist that can be embedded in a sticker, or under the skin in the case of low frequency RFID tags. Accuracy range 3 cm Max no of dimensions 3 Pointing accuracy 0.2 degree Maximum range of reader 100m (...dependant on transponder type- 40m for 5uW tags) Transponder technology Passive TTF (Tag talks first) protocol Multiple transponders Up to 50 in energising zone Interfacing to computer network RS232 Field of view 64 degrees- 80 degrees Operating frequency of reader 860 to 960 MHz (UHF) Operating bandwidth of reader 10kHz Interference zone with second reader 4 m Multipath discrepancies Range corrected for multipath Table 1: Specification of RFID-Radar A technology called chipless RFID allows for discrete identification of tags without an integrated circuit, thereby allowing tags to be printed directly onto assets at a lower cost than traditional tags. They receive energy from the constant energizing field. The transponders are low cost Tag-Talks-First type devices, capable of being produced cheaply. Trolley Scan also works with the TTF (Transponder-Talks-First) Protocol which is suitable for fast moving tags which send their ID as soon as they have enough energy. The interference area is smaller than using RTF (Reader-talks-first) Protocol because the tags are less powerful than the receiver. Due to very low operating power, Ecochip tags can be mounted on either side of objects as they will still be able to operate even when the large losses caused by the differences in dielectric constants of the objects in the path are taken into account (see Figure 26). The operating range is reduced dramatically from the 13m air situation to around 4 to 6m depending on the materials. Unlike passive RFID tags, active RFID tags have their own internal power source, which is used to power the integrated circuits and to broadcast the response signal to the reader. Communications from active tags to readers is typically much more reliable than from passive tags due to the ability of active tags to conduct a "session" with a reader. Active tags, due to their on board power supply, also may transmit at higher power levels than passive tags, allowing them to be more robust in "RF challenged" environments with humidity and spray or with dampening targets (including humans, which contain mostly water), reflective targets from metal (shipping containers, vehicles), or at longer distances: generating strong responses from weak reception is a sound approach to success. In turn, active tags are generally bigger, caused by battery volume, and more expensive to manufacture. Many active tags today have operational ranges of hundreds of meters, and a battery life of up to 10 years. Active tags may include larger memories than passive tags, and may include the ability to store additional information received from the reader. Semi-passive tags, also called semi-active tags, are similar to active tags in that they have their own power source, but the battery only powers the microchip and does not power the broadcasting of a signal. The response is usually powered by means of backscattering the RF energy from the reader, where energy is reflected back to the reader as with passive tags. An additional application for the battery is to power data storage. Semi-passive tags have greater sensitivity than passive tags, possess a longer battery powered life cycle than active tags and can perform active functions (such as temperature logging) under its own power, even when no reader is present for powering the circuitry. Whereas in passive tags the power level to power up the circuitry must be 100 times stronger than with active or semi-active tags, also the time consumption for collecting the energy is omitted and the response comes with shorter latency time. The battery-assisted reception circuitry of semi-passive tags leads to greater sensitivity than passive tags, typically 100 times more. They have the ability to extend the read range of standard passive technologies to well over 50 meters, to read

30 around challenging materials such as metal, to withstand outdoor environments, to store an on-tag database, to be able to capture sensor data, and to act as a communications mechanism for external devices. Figure 26: RFID Radar Supplied Ecotag claymore semi-passive RFID tag The CR2032 battery has a life of approximately five years. The power level is 0.6 μw and the minimum range is 5 m as transponders might overload and stop if they are too close to the energizing field. The maximum range is 40 m. The Claymore tags (Figure 26) have been developed to address the issue of sensitivity when attached to hard objects. The tag is mounted in a block of plastic which has a metal backing so that objects behind the tag do not influence the sensitivity. This means that the radiation pattern of the tag is more directional as it is intended to be attached to a hard object and does not need to radiate behind this tag. The long range stick Ecotag claims operating distances of at least 30m however when it is placed close to a hard surface, its performance degrades as the hard surface influences the sensitivity (the stick Ecotag has the radiation pattern of a conventional dipole). RFID readers that are in charge of the tags of an area may operate in autonomous mode (as opposed to interactive mode). When in this mode, a reader periodically locates all tags in its operating range, and maintains a presence list with a persist time and some control information. When an entry expires, it is removed from the list. Frequently, a distributed application requires both types of tags: passive tags are incapable of continuous monitoring and perform tasks on demand when accessed by readers. They are useful when activities are regular and well defined, and requirements for data storage and security are limited; when accesses are frequent, continuous or unpredictable, there are time constraints to meet or data processing (internal searches, for instance) to perform, active tags may be preferred. 4.6 SUMMARY Location awareness is becoming an important capability for mobile computing devices. However, affordable positioning systems that work well indoors have not been available up to now. Here in this section we highlighted five popular approaches to location determination in indoor environments. These systems were highlighted in some detail in order to provide a useful overview of their various features and applicability. The following section will provide an outline of the various experiments that were performed using these systems in order to evaluate the claims and features of these systems.

31 5 EVALUATION OF LOCATION DETERMINATION SYSTEMS RSSI is the most crucial parameter in the localization of WLAN devices. At the laptop, it shows the signal strength received from an access point, where the stronger signal received by the WLAN card, the closer the position of the card to the access point. This corroborates a natural observation that there is a dependence between RSSI and the distance from the source of the signal, though the actual relation is not needed in the non-parametric localization algorithm used in this project. For localization purposes, the RSSI parameter has to be measured between the device of interest and many APs. One of the most important factors in the measurement of RSSI is the power attenuation due to distance; however absorption gradient also affects the RSSI measurement. Sudden changes in signal absorption, due to walls for example, introduce discontinuities into the dependence between RSSI and distance which is normally considered a smooth function (Nafarieh & How, 2008). In addition to walls, the presence of humans, the direction of the antenna, and the types of WLAN cards have an effect on the absorption of the RF signal energy. Throughout our study, we attempted to recreate environments as close to the real world conditions as possible. The RSSI values can be reported by the device driver as a non-dimensional number or percentage and sometimes is converted to dbm through some nonlinear mapping process (Bardwell, 2005). However, the means of conversion are different from one WLAN card to the other. Although there is a formula for each specific card, some cards like Cisco cards follow a table for conversion with higher granularity, and some like Atheros cards use lower resolution (Bardwell, 2002). Since the RSSI measurements are dependent on different laptop / antenna positioning (e.g., height of the mobile card), antenna orientations were controlled. The average of all data in all directions was used to create the vector for the particular measurement point. We found that the antenna orientation could cause a variation in RSS level of up to 10 dbm. This effect cannot be ignored when considering the impact different orientations have on RSSI measurements reliability and eventually on the localization accuracy documented here (Li et al., 2005). Another source of error for localization is the presence of humans in the environment. The frequency used by b, g standards is 2.4 GHz and the resonance frequency of water is at the same frequency. Therefore, water and anything containing water can be problematic because it absorbs RF signal and attenuates it significantly. Since the human body consists of 70% water, the received signal strength is absorbed when the user obstructs the signal path and causes an extra attenuation (Ladd et al., The deployment of different wireless NICs during the training phase and the actual localization phase, can also cause discrepancies in measurements. Also, the collected RSSI data on laptops are percentage-based while at Access Points they are in dbm. Since the conversion methods and their accuracy depend on the type of WLAN cards, the actual RSSI readings in the localization algorithm may be interpreted in erroneous ways, resulting in different RSSI data for the exact same environment. The error caused by different types of WLAN cards can be around 20% which is a considerable error value. The platforms we investigate in this study are (1) PlaceLab (2) Trapeze Networks LA-200 (3) Ubisense Precise RTLS (4) Ekahau RTLS and (5) Trolley Scan RFID-radar 5.1 PLACELAB PlaceLab uses the existing wireless network as a means of finding the location of a mobile wireless computing device. The fact the no sensing hardware needs to be installed means that the system can be used anywhere that has an WLAN. The first task was to map the access points that exist on campus and create a database containing their location and the corresponding unique ID that each one broadcasts. Next, the PlaceLab software was configured to run on the PDAs and finally an application was created with a client side and server

32 side. Figure 27 provides an overview of the system. Each client communicates with the server only to upload its location and the server broadcasts the updated map. Figure 27: Placelab Client Location Test architecture The Campus consists of approximately ten separate buildings, each housing different faculties as shown in Figure 28. PlaceLab contains a utility for finding APs and working out their approximate locations based on signal strength and the position of the user at that moment. Some of the main buildings of interest contain 4-5 floors and each floor can contain as many as six AP s. Therefore if we positioned ourselves between buildings MF and MG and ran the utility, in theory over 40 AP s could be detected each giving its MAC address and signal strength. However, we would not know which AP s are on which side and therefore would not be able to pinpoint our location. Figure 28: Campus with each building code shown and red dots showing test locations We used Wigle.net which contains AP information for some of the university access points. This information should have allowed us to rapidly create a suitable AP database for the campus however, when this information was downloaded and analysed it proved to be too inaccurate for our purposes. We tried warwalking around the campus but the specific locations of the AP s were still unclear. In fact walking close to the edges of the building meant that the GPS unit often lost its signal due to the height of the buildings overshadowing one another. We used a Bluetooth GPS unit with the PDA for this stumbling process in order to map access points. Therefore we conclude that this method of stumbling for the locations of the Access points would only be effective when the actual number of AP s is low and are widely dispersed.

33 Figure 29: Netstumbler Log when encryption is not applied. Netstumbler was used finally for recording signal strengths of APs in our fingerprinting phase (see Figure 29). The AP s detected first had to be filtered so that only those that contained no encryption could be used. In one location, 36 AP s could be detected however while these all gave unique MAC address, there were in fact only 9 separate Access points as shown in Figure 29 when the encrypted APs were filtered. The reason for this was that the University operates 4 separate Virtual Local Area Networks (VLANs), namely uuwlan (unencrypted), uu-staff, eng-staff and eng-student. Each AP was broadcasting 4 different MAC addresses and when the encryption filter was applied, only 9 AP s were detected as could be worked out from 36 / 4 = 9. This filtering had to be applied throughout the campus and we decided that any AP that was not detected from one of the locations surveyed would not be included in the database. Figure 30: Top Floor of MG building with APs shown in green. From the list of campus AP s, the location of some of the detected AP s could be worked out. Photocopies of maps of all the floors of each building on campus, showing room number, were provided by the university s residential services and from these maps approximately half of the detected AP s could be located down to room number. The location of the rest could not be discovered from this list as not all of the AP s had a name that bore any relevance to any of the maps. AP names such as DAP29 and MP30_spare gave no clue as to their location. Figure 30 shows a map of the top floor of the MG building showing the locations of APs. For PlaceLab to function, the positions of AP in latitude/longitude had to be plotted on a map of the campus. Since the GPS has proved to be unusable in this case, another method was chosen to plot the locations. A map of the campus was saved from the college website. The dimensions of this map were approximately 33cm wide by 11.5cm high. Using Adobe Photoshop and setting the bottom left corner as (0,0) each of the AP s was plotted on the map and allocated an X and Y value. Using this method a number of AP s could end up with the same value, even if on different floors but the method was still more accurate than either the GPS stumbler or wigle.net and is

34 an acceptable method of plotting values for use with PlaceLab (Hightower et al, 2006). Note that the best accuracy possible with PlaceLab is less than 25m so the margin of error was acceptable. The location of each detected AP was then converted into a flat text file of the form latitude longitude SSID BSSID (in our case y, x, SSID, BSSID). Another file that had to be created for use with PlaceLab was the map.meta file. This was used to tell PlaceLab the values of the origin of the map (0, 0) and the position of the top-right hand corner of the map as shown below. Two versions of this file were created for testing purposes. One using the values plotted by hand and one using the values obtained from wigle.net as shown in Table 1. Plotted by hand Plotted by GPS from wigle.net origin_lat=0 origin_lat= origin_lon=0 origin_lon= upper_right_lat=33.34 upper_right_lat= upper_right_lon=16.83 upper_right_lon= image=images/mageecampus.jpg image=images/mageecampus.jpg Table 2: Creation of map.meta using values manually plotted and those gathered from wigle.net The access points held in mapper.db are plotted on the map. PlaceLab compares these access points to those it can detect in the area. The detected access points are used to give an estimation of the position of the user which is then displayed on the map as a red circle. Due to the many apparent limitations to the suitability of PlaceLab for use on the campus a very simple test was created. Using the same locations that had been used in the test for AP visibility, the system was run at these points. At each location comparisons were made to between the tester s current position and the position that the PlaceLab software indicated. See Table 3. Test Location Number Location Number of APs Visible Accuracy < 25m Manual Plot 1 MF N/A Yes 2 MG N/A No 3 Library Top-Back-Left 3 N/A No 4 LRC Library 4 N/A No 5 Canteen 10 N/A No 6 MF138 2(1 Rogue) N/A No 7 MF139 2(1 Rogue) N/A No 8 MG229 9 N/A No 9 Abberfoyle Lecture Theatre 1 N/A No 10 Sportshall 8 N/A No 11 MB Courtyard 0 N/A No 12 MC Corridor 2 N/A No Table 3: Campus Test Plan Accuracy < 25m wigle.net GPS Plot A limit was set of 25m. If the software indicated a position at greater than 25m from the true location then it was considered to fail. If a location was displayed at less than 25m from the true position then it was considered a success and could feasibly be argued to be useful in a widespread outdoor location determination appliance for the campus. Only two of the twelve locations initially tested for AP visibility proved to be able to give an estimate of location, MF and MG122. The map had to be rotated 180 degrees for the APs to be shown in their correct locations. Figure 31 shows a screenshot of the PlaceLab APViewer when it is operating correctly. For this to run the wigle.net database was first queried to receive AP information for the campus. Using this information PlaceLab

35 was able to estimate the user s position as is seen at the top of the screen in Figure 31. The next line gives the information for the 29 beacons detected, 26 are active and 21 are new. This means that PlaceLab has no information about 21 of the beacons but that it does have information about 8 of them. It is these 8 with their signal strength that it uses to calculate location. The APViewer notes these APs as false under the new column as shown in Figure 31. Figure 31: APViewer estimating position and showing detected APs and signal strength. The next 4 maps show the results of running the MageemapDemo.bat file. Figure 32 shows the AP locations as downloaded from wigle.net. It is clear from this that many of these APs are not in the correct location. Figure 33 illustrates the application without the APs overlaid and shows the users position as the red circle. Figure 32: AP locations provided by wigle.net Figure 33: Users position shown as red circle. Figure 34 shows all of the above information but also includes the APs that are being used for triangulation purposes in red. Figure 35 shows the estimate where the yellow dots indicate that beacons of the same domain are being detected. Unfortunately the accuracy at the point is greater than 40m.

36 Figure 34: APs used to estimate location in red Figure 35: Inaccurate Estimation of position Here it would seem that PlaceLab may be used as a means of establishing a user s location but, when applied in the real world, many limitations are evident. The simple mapping procedure turned out to be quite complicated and time consuming. PlaceLab s own AP Stumbler failed to build an AP map for the campus. Wigle.net could be used but with high levels of inaccuracy. Therefore a more accurate map had to be created by other means. The PlaceLab software is difficult to use and was not.."a means of incorporating location into an application without significant effort as described by the documentation. The process of component integration requires extensive knowledge of many different areas of computing. The high levels of inaccuracy which our tests revealed show that the system would not be suitable for an average user on campus. The documentation is very inadequate for a novice user of the software. The applications that have been developed using PlaceLab to date have all been developed by large teams. It must be concluded that PlaceLab could not be used as a means of establishing a users position on the Campus.

37 5.2 TRAPEZE NETWORKS LA-200 The Trapeze LA200 is a location appliance from Newbury Networks. Physically it is a rack server and was slotted into the central IT services server room. The reliance on central services IT department at the university was a noticeable difference from the other systems where each could be installed with little collaboration with central services IT. The LA200 is similar in many aspects to the Ekahau system. The notable difference is that the LA200 can sense any wifi device in the campus and these devices do not need to be associated with an access point. This allows a device with a weak signal which otherwise would not be allowed to connect to be tracked. It also allows devices to connect which do not need to be running client software. However the LA200 is also compatible with any compatible active tags from Newbury Networks, Pango, AeroScout or Ekahau. Figure 36: LA200 Locales visible in Dashboard application The setup proved to be complicated. Trapeze engineers spent a few days on site trying to sort out issues with software incompatibilities and mapping of access points. Once setup was complete, the fingerprinting began. This involves the uploading of maps for each floor to be mapped. Locales are defined so as to define regions for clarity (see Figure 36). For instance, a corridor may be irregularly shaped but the locale allows this type of region to be defined such as for instance second floor hallway. Figure 37: Fingerprints for each area

38 Fingerprinting was done holding a Newbury tag whilst selecting current locations on the map and defining locales. The usual practice of turning 360 o in each room and walking slowly was carried out at each location. Graphical bars in the dashboard application show the strength levels of the signal for each locale. Figure 37 shows the actual fingerprints as green flags. For instance, the room in the bottom right of Figure 37 shows that two fingerprints were performed. We did this due to the large size and the actual physical location of the room. Figure 38: Device view Devices can be tracked and viewed using the dashboard application. For instance, Figure 38 shows a laptop associated with an access point and located in an academic office. Views may be created which allow searching for particular devices, groups of devices, devices in particular locales and more. Historical movement of devices can also be viewed. A history is stored for 30 days. Snapshots can be downloaded however. The LA200 can also be queried through its API. Applications can be built on top and Trapeze supply a new application called Active Asset (See Figure 39) which allows the system to immediately respond with the location of a device on the map. Figure 39: Active asset showing all devices on MS first floor Figure 39 shows a number of devices on the first floor of the MS building. A neat feature is the ability to highlight a device in the interface and the application immediately displays a map such as in Figure 39 showing the actual location of the device in real-time.

39 Figure 40: Asset Tag History from Active Asset Application The active asset software also allows the querying of history from any device which has been tracked. Figure 40 shows the locations which a tag with mac address 00:18:8E:20:1A:85 has visited. It shows the start time and end time and duration in that locale. This system easily allows logging of time associated with individuals in various locales over a period. The LA200 also integrates with a smartpass system from Trapeze which allows location to be used to control network access. For instance, access to a WiFi hotspot could be confined to a boardroom therefore once the user is detected as being outside the boardroom location internet access becomes denied. This is a potentially useful feature for fine-grained network access and could be linked into various network access control mechanisms. The system was tested in two buildings over a 9 month period. Straightforward can you see me now trail runs were conducted and on average the system could detect devices to room level 70% of the time. The accuracy was measured at approximately 25 meters. Refresh time was <10 seconds but this would generally not be an issue as the vast majority of the time objects are static. The test runs were also mirrored on the Ekahau system and this proved useful for direct comparison when compiling the findings. A number of strange issues arose such as near identical third party tags being traced to 20 meters apart yet being held side by side. Overall, the system produced accurate traces provided the initial fingerprints were good. Like many systems, the results were only as good as the effort that went into the fingerprinting groundwork. There are a number of limitations. It can be argued that the LA200 is relatively expensive. Current price is 10,000 UK pounds. Specialist knowledge is required to integrate the LA200 into existing enterprise systems. This is not to be underestimated and can prove to be a showstopper if the relevant network administrators are unable to integrate the system for any reason. The system needed rebooting on average every eight weeks. There are also range limitations due to the penetration of Wi-Fi signals through solid objects such as building walls, but this is in no way peculiar to the LA200. There are also privacy issues, namely the ability to track individuals without their consent but all location determination systems can be accused of this.

40 5.3 UBISENSE The Ubisense RTLS solution utilizes battery-operated radio tags and a cellular locating system to detect the presence and location of the tags. The locating system is usually deployed as a matrix of sensors that are installed at a spacing of anywhere from 50 to 1000 feet depending on the site layout. These sensors determine the locations of the radio tags. Ubisense consists of Tags - designed to be mounted on assets or to be worn by a person; Location Engine software to install and tune a Ubisense sensor network and track tags in real time, through a series of configuration wizards and the Location Platform software which provides persistent storage and distribution of real-time location events for multiple clients in conjunction with real-time monitoring and notification of user-specified spatial interactions between objects. The Ubisense Series 7000 sensor is a precision measuring instrument containing an array of antennas and ultra-wideband (UWB) radio receivers. The sensors calculate the location of the tags based on reception of the detected UWB signals transmitted from Ubitags. Each sensor independently determines both the azimuth and elevation Angle of Arrival (AOA) of the UWB signal, providing a bearing to each tag. The Time Difference of Arrival (TDOA) information is determined between pairs of sensors connected with a timing cable. Sensors are administered remotely using standard Ethernet protocols for their communication and configuration. They work in standard wired and wireless environments, using networking infrastructures, such as access points, Ethernet switches and CAT5 structured network cabling for communication between sensors and servers. The tests were carried out in the same room used for the RFID-radar tests along with the same calibrated locations shown in Figure 41. Each of the four sensors were mounted high in the corners of the Lab and pointed towards the floor in the middle of the room. Sensors needed to be adjusted using a spirit level to have no roll as sensors with non-zero roll will exhibit poor performance tracking those tags which are near the edge of their visible field. Each sensor network cable was connected to an 8 port Ethernet switch. The sensor in the top-left of the map (near location (0,5)) was chosen as Master and we connected a timing cable (unshielded CAT5 Ethernet straight-through cable) from each slave to a timing socket on the back of the Master case. Ubisense recommend that the timing cables be shielded and rated as CAT5e or better and that preferably be factory made. Figure 41: Room MG281where locations for experiments are spotted in red A coordination system must be defined. We choose the origin (0,0,0) near the column in the centre of the room. We also used a right-handed co-ordinate system. Calibration was done with a slim-tag in five uniformly distributed points in the room. It is important to avoid those points that were not in LoS with the four sensors and in each

41 location we waited 10s before moving to the next one. In the actual testing, the tag was left for 30s at each location before we read the measurement. The slim tag was also placed one meter above the floor. Location Tag ID Ubisense location(m) (1,0) ,25 from B -0,62 from A (1,1) ,25 from B -2,17 from A (1,2) ,89 from A -3,69 from B (0,0) ,30 from B -0,56 from A Real location(m) -2,60 from B -0,10 from A -2,60 from B -2,00 from A -4,30 from A -2,60 from B -0,10 from B -0,10 from A Range accuracy(m) -0,65 from B -0,52 from A -0,65 from B -0,17 from A -0,44 from A -1,09 from B -1,20 from B -0,46 from A Table 4: Results of experiments with low range accuracy due to the presence of obstacles Table 1 reports the results for those locations where the range accuracy was low due to the presence of obstacles in the path. For instance, Figure 42 shows the Ubisense Location Engine results for position (1,0) where location reported is not accurate. Figure 42: Poor results obtained by Ubisense Location Engine for position (1.0) Location Tag ID Ubisense location(m) Real location(m) Range accuracy(m) (0,4) ,66 from B -4,02 from C -0,10 from B -2,60 from C -0,56 from B -1,42 from C (1,3) ,63 from B -3,69 from C -2,60 from B -4,30 from C -1,03 from B -0,61 from C (2,0) ,18 from D 0,66 from A -4,30 from D -0,10 from A -0,88 from D -0,76 from A (2,1) ,68 from D -2,57 from A -4,30 from D -2,00 from A -0,38 from D -0,57 from A (2,2) ,30 from D -4,30 from A -4,55 from A -3,63 from B -0,25 from A -0,97 from B (2,4) ,68 from D -4,30 from D -0,38 from D

42 -2,31 from C -2,60 from C 0,31 from C Table 5: Some selected locations with good accuracy measurements Table 5 illustrates some locations where the system reported good accuracy. Figure 43 and Figure 44 show the actual Ubisense Location Engine results for position (0,4) and position (2,0) where location reported is not accurate. Figure 43: A good result obtained by Ubisense Location Engine for position (0,4) Figure 44: A good result obtained by Ubisense Location Engine for position (2,0) The error distance for static tags was on average 0.89 meters. We also found that all our Ubitags which Ubisense claim are designed to last for approximately five years in typical use were dead after 9 months. The majority of that time, they were lying in a box between the two key periods of testing. The tags are supposed to power down to conserve energy when non movement is detected. These tags therefore should have been in power saving mode throughout this period. Ubisense support suggested that the tags may have been placed in monitoring mode which led to them being run down far quicker than expected. We were unable to verify this.

43 5.4 EKAHAU The Ekahau Real Time Location System is a software suite that uses an existing WLAN network without the need for additional special network hardware to determine the location of a Wi-Fi equipped device. The suite has three main components namely the Ekahau Site Survey (ESS), the Ekahau Positioning Engine (EPE) and the Ekahau API that utilises the EPE system to create custom applications. The EPE uses software based algorithms to calculate the position of a tag. However before the EPE can determine the location work it needs the site survey calibration information from the ESS. The ESS collects the information on the coverage and RSSI of each AP in the network across the area to be covered. The ESS gathers the calibration information by a person carrying the system and walking around the area to be covered. Ekahau have also developed Wi-Fi tags as shown in Figure 22. Figure 45: Ekahau Tags The Ekahau Positioning Engine allows the pinpointing of items such as Wi-Fi laptops, PDAs, tablet PCs, barcode scanners, hospital telemetry devices, wireless VOIP phones or people wearing tags or carrying these devices. The Ekahau client runs on a client device such as a PC laptop or PDA. The Ekahau Positioning Engine service runs on a desktop PC or (PC/Unix) server and calculates the client device x,y co-ordinates and area name. The Ekahau Manager is an application for recording the field data for a positioning model (Ekahau Site Calibration), tracking client devices on a map, and analyzing the positioning accuracy. Finally, the Ekahau Application Framework and SDK is a set of helpful tools and easy programming interface for authorized applications to quickly utilize EPE location information. Figure 46: Ekahau Survey Inspector showing 30s fluctuations Ekahau's positioning technology features impressive indoor location-tracking accuracy and when combined with multi-floor tracking support, enables a wide variety of next generation people and asset tracking applications both

44 indoors and outdoors - basically wherever there is Wi-Fi coverage. EPE supports both a zone based tracking, to report the device location by zone name, and also a continuous real-time positioning of precise (x, y, floor) location coordinates. The Ekahau client is fully IEEE a/b/g compliant and runs in the background while still leveraging the Wi-Fi data and voice capabilities for other applications Figure 47: Calibration Quality (Red = Low quality, Green = High quality) Ekahau Site survey records RSSI data of the test area with all observable aspects of the WLAN being considered (see Figure 46). RF characteristics e.g. multipath and reflection are recorded and do not harm location accuracy or signal measurement. This survey data then facilitates building tracking models. The observed client data is recorded and each recorded location is assigned a probability based on this data. Figure 47 illustrates the calibration quality for one floor. Red indicates locales of poor fingerprinting quality whilst areas of green indicate high quality calibration information. Ekahau Site Survey (ESS) is their software tool for Wi-Fi network planning and administration. ESS gives a groundlevel view of coverage and performance for creating, improving and troubleshooting Wi-Fi networks. ESS can provide tools for network deployment and troubleshooting that are not provided by the centrally managed Wi-FI systems. Network issues that are invisible to the wireless management systems may indeed by more easily identified and resolved with ESS. Figure 48: Rails and free space It is worth noting that Ekahau Site Survey Professional is their all-in-one solution for Wi-Fi planning, verification, troubleshooting and reporting while Ekahau Site Survey Standard only includes the site survey, troubleshooting and visualization capabilities, but does not support planning, reporting, or GPS enabled outdoor surveys. Before you can calibrate an area, you have to draw "rails" in the Ekahau Manager program. Rails are walking paths where it is assumed people will walk (see Figure 48).

45 Figure 49: Signal Strength Ekahau uses its own probabilistic location detection algorithms which are computationally efficient giving 1-3 metres accuracy in ~ 5 seconds. Different Wi-Fi devices hear the network at different levels (RSSI readings) even when they are located at the same distance from the Access Point (AP). A process of normalization is applied which allows for the use of hardware from different vendors. Figure 48 illustrates how each dot represents a fingerprint. RSSI fingerprinting facilitates creating radio maps and pin-pointing device locations (see Figure 49). Figure 50: Ekahau vision allows for the tracking and management of tags All tags in the systems may be monitored at all times and detailed information is given on each one as shown in Figure 50. Various rules may be set up and applied to control the movement of tags and devices for instance rules can be setup to trigger alarms when tags enter certain zones (e.g. Lab B, outer perimeter) and this information may also be output in report form.

46 5.5 RFID RFID has seen widespread use across many different applications. The vast majority of these applications, however only use the data contained in tags within the reader s zone, rather than the location of the tag at any given time. Radio Frequency Identification tags can be easily added into most everyday objects. Trolley Scan s RFID-radar (rfidradar.com, 2007) is an example of an indoor RFID based location determination system that has the accuracy capability of less than fifty centimetres in an area up to one hundred meters deep, however this depends on the tags used and may be as little as ten meters. The system can track up to fifty tags and locate their location within a few seconds. The system has three main components, the reader, the antenna array and the tags. The reader measures the distance of the signals from the tags, the antenna array for energising the tags and finally the tags themselves. Trolley Scan RFID-radar system claims that it can: Monitor a zone of up to 100m deep, to an accuracy of less than half a metre All tags in reading zone can be scanned within a matter of seconds The reader can map out the location of all transponders in the reading zone in one, two or three dimensions and many readers can work in close proximity with minimal interference due to the bandwidth being only 10kHz at UHF frequencies The reader connects to the computer via an RS232 port. It measures the distance of signals travelling from transponders and provides an energy field to power them. Two or three receiver channels in the reader allow the angle of the signal s arrival to be calculated. The reader s processor can make up to ten thousand range measurements per second and its operational frequency can be set anywhere in the range of 860MHz to 960MHz. The processing module can report the identity, position in 2D or 3D space, and movement at one-second intervals of any tags in the reader zone. Its location accuracy is within half a meter and its pointing accuracy is to within one degree. The tags are passive backscatter Ecotag UHF transponders. The credit-card-sized 200uW EcochipTags have a range of ten meters, while the 5uW stick tags have a maximum operating range of forty meters. The antenna array contains one transmit antenna for energising the passive transponders and one antenna for each receiver, giving a total of three antennas in the array. The system works by measuring the distance the signal travels from each transponder within the reading zone on two receivers. By comparing the ranges on both receivers, the angle of arrival can be calculated, allowing the system to show the range and direction of a tag at the time of reading. By measuring the range many times per seconds, the system can plot the path of moving transponders. Tag location data is streamed to a computer connected to the equipment using an RS-232 port. An example stream, showing data for multiple tags, is shown in Figure :45:08 BCBBB :45:08 BCBBB :45:08 BCBBB :45:09 BCBBB :45:09 BCBBB :45:09 BBBBB :45:09 BCBBB :45:09 BCBBB :45:09 BCBBB :45:09 BCBBB :45:09 BCBBB :45:09 BCBBB

47 Figure 51: RFID Radar Screen Output The columns, from left to right in Figure 51, indicate the time of the tag report, the tag ID, the range of the tag in meters and the angle of the tag from the reader s centre-line. The P at the end indicates that the radar has temporarily lost contact with the tag since the last report cycle. Figure 52 shows a graphical representation of the location of the tags in the above data stream, in the demo program supplied with the unit. Figure 52 - Trolley Scan RFID-Radar Software GUI We evaluated the base performance of the RFID-radar by comparing the estimated location with the true location of tags in an indoor scenario. Tag Reading range however is affected by goods placed in the path between antenna and tag. The RFID-radar comes with two types of speed tags. The single speed tag they claim can work at up to 51 Kmh and the dual speed tag works at up to 12 Kmh. The RFID reader utilizes an array of adjacent antennas. One transmits an RF constant field to energize the passive transponders, while others depending on the spatial tracking, receive RF signals from transponders. A receiving antenna determines a tag location in one dimension, and two are needed for 2D with three for 3D. RFID-radar has two receiving antennas and it determines location in 2D. Dipoles couple to radiation polarized along their axes, so the visibility of a tag with a simple dipole-like antenna is orientation-dependent. Tags with two orthogonal or nearly-orthogonal antennas, often known as dual-dipole tags, are much less dependent on orientation and polarization of the reader antenna, but are larger and more expensive than single-dipole tags. We tested just single-dipole tags, so the measurements were strictly dependent on their polarization. The antenna was horizontal to the ground and also the tags had to be horizontal to the ground. As the manual refers, when one of the antennas has the wrong polarisation, especially the energiser antenna and the transponder, then no energy is transferred to the transponder and as a result it does not work. The RFID-radar includes three patch antennas in total, which are used to provide a service in close proximity to metal surfaces, but the structure is 2 cm thick, and the need to provide a ground layer and ground connection increases the cost relative to simpler single-layer structures. The radio frequency environment is a hostile environment for signal strength-based location systems. This is because signal propagation is characterised by reflections, diffractions, and scattering of radio waves caused by structures within the building. Multipath (distortion of a signal due to many different paths to get to the receiver) is an enemy of narrow-band radio. It causes fading where wave interference is destructive. Some UWB systems use "rake" receiver techniques to recover multipath generated copies of the original pulse to improve performance on receiver. Other UWB systems use channel equalization techniques to achieve the same purpose. Narrow band receivers as in RFID-radar can use similar techniques, but are limited due to the poorer resolution capabilities of the narrow band systems. Multipath within buildings is strongly influenced by the layout of the building, the

48 construction material used, and the number of people in the building. As the number of people in the building varies, the propagation characteristics of RF signals change as well. This is because the human body is made up of water and water absorbs RF signals. At different times of the day, a different number of humans may be present in the building causing the signal strength at the various locations in the building to vary considerably. As a consequence, a Radio Map created at any one particular time may not accurately reflect the environment at a different time. This can reduce the accuracy of the RADAR system considerably. For this reason an appropriate indoor test scenario was chosen to test the systems accuracy and we also verified the performance of the system through the following characteristics. With regards to the actual location estimates, we looked for sufficient precision so that the reported position should be within the range accuracy stated by the maker and systems operation should not interfere with other systems nor crash in active environments. With regard to tracking performance the tracking system should not make jumps that the tracked object would never perform and the trace of the target on screen (or in database) should resemble the actual motion of the target. Additionally, the tracking should show a delay that remains steady and systems operation should not be limited to just a handful of moving nodes and should allow additional nodes to migrate in and fade out. To respect all these constraints, the experiments were carried out in the first floor of MG building in the Magee Campus of the University of Ulster, in a room without humans but containing office furniture (desks, chairs, bookcases and similar). All experiments for the RFID radar were carried out in the same lab as the system could not penetrate walls. Dots on the map in Figure 53 are the calibrated locations. (0,0) (0,1) (0,2) Obstacle4 (0,3) (0,4) (0,5) Obstacle3 (1,0) (1,1) (1,2) (1,3) (1,4) (1,5) (2,0) (2,1) Obstacle5 (2,2) (2,3) (2,4) (2,5) Obstacle2 RADAR ANTENNA (3,0) (3,1) (3,2) (3,3) (3,4) (3,5) Obstacle1 READER (4,0) (4,1) (4,2) (4,3) (4,4) (4,5) Figure 53: Room MG281 with all calibrated locations One design consideration for the evaluation was how the system would translate positional data from the RFID- Radar system to a graphical representation shown on our prototype map. The system was calibrated for the area to be monitored, by placing a transponder at the far edge of the area and storing its range information. This total range, shown in Figure 54 was then used in calculations to depict the relative position of transponders to the equipment on the on-screen map. Figure 54 shows the layout of a simple room to be monitored using the RFID- Radar system. A transponder is placed on the far wall, giving the relative location data of the far edge of the monitored area. The location data is stored in the program and is assigned to the corresponding edge of the map

49 in the GUI. The transponder used in the calibration process is no longer needed and can be reassigned to an individual to be tracked by the system. Monitored Area Original Transponder position for calibration Total Range / Centre Line Range Reading Angle RFID Radar Antenna Transponder Real-World On-Screen Map John Smith Tracker Figure 54: Tracking a Transponder after Calibration Figure 55 shows how we translated location data from a transponder onto the map in the GUI. It can be seen that a transponder s range and angle reading, together with the centre line, creates an imaginary right-angled triangle. With trigonometric calculations, and the known total range, the triangle could be scaled down so that the icon depicting the tag will appear on the map in the location corresponding to the real tag s location. Centre-Line 15 Person with Tag 6m (Range of Tag) Tag Tracked On Screen Radar System Antenna On-Screen Map. Figure 55: Overview of System Each object (person) to be tracked in the tests was assigned an RFID tag containing a unique ID. The reader in the RFID-Radar system retrieves this ID and calculates the location of the tag. Both the tag s ID and location data were sent to the master computer via an RS232 connection. The monitoring software shows the location of the tag on the map screen using the tag s location data. Figure 56 shows the imaginary right-angled triangle created by the tag s range and angle reading.

50 30 (Hypotenuse) Test Tag (Tag Range) (Adjacent) (Opposite) Figure 56: Right-Angled Triangle Created By Test Tag Data The ratio of the X-axis of the tag to the total range is / 50, which is Therefore, if the on-screen map is 1000 pixels across, the icon representing the tag would appear 556 pixels (0.556 x 1000) across from the left side of the map where Tan ( Angle ) = Opposite / Adjacent and Opposite = Tan ( Angle ) * Adjacent therefore the opposite side is equal to: Tan ( 22 ) * 556 = = 225 The icon representing the tag should appear 225 pixels above the centerline of the map screen. The calibration distance was set to four meters, and the demo software supplied with the equipment was used to calibrate the system with a stick tag placed four meters in front of the antenna. The demo software then began to stream location data for the tag. Any tag, when it first entered the reading field of the equipment, was initially reported with a range of around 60m and an angle of 0, which was simply not accurate. Each location report for the tag had the same incorrect data for around 45 seconds after the tag entered the field. After around a minute, the reported ranges decreased to a value close to the correct 4m. The associated data is shown in Figure 57. BCBBB4677^ BCBBB4677^ BCBBB4677^ BCBBB4677^ BCBBB4677^ BCBBB4677^ BCBBB4677^ BCBBB4677^ BCBBB4677^ BCBBB4677^ BCBBB4677^ BCBBB4677^ BCBBB4677^ BCBBB4677^ BCBBB4677^ BCBBB4677^ BCBBB4677^ BCBBB4677^ BCBBB4677^ BCBBB4677^ BCBBB4677^ BCBBB4677^ BCBBB4677^ RED = End portion of Data streamed initially. GREEN = Range decreases to a more accurate value. Figure 57: Associated data from radar The angle reports were sometimes erratic, with values fluctuating in a range of 0-6. This was not a major problem at the small test range of 4m as a change of angle that small would not make a very noticeable difference in its mapped location. However, at large ranges, e.g. 30m, even a small fluctuation in the angle value could significantly affect its position on the map. Once the tag s range reports settled on a value near 4m, moving the tag further from or closer to the antenna did not increase or decrease the range. Once the tag was moved, the RANGE command had to be submitted to the equipment to recalculate the new range, which took an average of 30 seconds. Sometimes the newly-calculated range was inaccurate, e.g. increasing from 4m to 9m when moving the tag closer to the antenna.

51 The main problem unearthed was that the reader was not able to report a correct range or a Tag ID for those locations which were not in line of sight (LoS) with the antennas. LoS is a requirement too restrictive since in a typical indoor environment there are lots of obstacles between the tags and the Antennas. In the room there are some metal obstacles drawn in grey in Figure 53. For static measurements (i.e. objects were not moving), the average error distance of RFID-radar was found to be 4.19m. ( 0,0) ( 0,1) ( 0,2) ( 0,3) ( 0,4) ( 0,5) O bst acl e4 O bst a cl e3 (1,0) ( 1,1) ( 1,2) ( 1,3) ( 1,4) ( 1,5) O bst acl e5 O bst a cl e2 ( 2,0) ( 2,1) ( 2,2) ( 2,3) ( 2,4) ( 2,5) A N TE N N A ( 3,0) ( 3,1) ( 3,2) ( 3,3) ( 3,4) ( 3,5) O bst a cl e1 R E A D ER ( 4,0) ( 4,1) ( 4,2) ( 4,3) ( 4,4) ( 4,5) Figure 58: Locations where RFID-radar failed to locate tags in red (Good spots are in bold green) Problems for the failure of the reader reporting the range came from Obstacle1 and Obstacle2 (the first one is Lab furniture and the second one a structural vertical building column). Of course in a normal office, there will often be obstacles (objects sizeable compared to the wavelength of the operating frequency, from a couple of centimetres upwards) made of wood or metal. Figure 58 shows the locations in red where the radar failed to log the tag. The bold lines in green highlight locations (2,0), (2,1), (2,2), (2,4) and (2,5) where the Radar had good measurements from the tags. Table 6 shows a sample of locations and measurements. Location Tag ID Range (m) (0,2) BCBBB (0,3) BCBBB Angle (grad) Real Range(m) AvgRange accuracy(m) (18.17) (13.95) 2.78 (0,4) BCBBB (14.25)

52 (4,5) BCBBB (12.26) 5.79 Table 6: Locations with poor measurements Finally, we tested the ability to track relatively fast moving objects. When the distance of the Tags to the antenna is small, the Accuracy should be high, however when the read range starts increasing uncertainty is introduced into the system. Here we used the single speed Claymore tag. The path navigated for tests shown in Figure 59 was traversed at a very slow walking pace. The average length of each walk was 2 minutes and the sampling rate was 30s. Obstacles caused the reader to lose the tag thus the accuracy of measurements was poor. We found the radar to require~10-20s to determine the exact position of tags. We found this seriously limiting and would only recommend for static situations where transponders are relatively stationary. However, in reality devices to be tracked are not fixed to a location 21. Here we found the average error distance for slowly moving devices was 10m. Figure 59: Room MG281 with the test navigation path We noticed an initial delay in reporting a tag s location. These observations may be an indicator that the accuracy of the RFID-Radar equipment is adversely affected in smaller environments where obstacles and interference from other technology may hinder measurement. Range and angle readings often failed to be updated correctly when the tag was moved around. Furthermore, because of frequent fluctuations in the range and angle data supplied by the RFID-Radar equipment, the icons on the map, representing the real-world tags, appeared to jump around the point on the map, even if the tag itself was stationary, especially at large ranges. We found the equipment yielded too many inaccurate readings to use the prototype in any practical way. Trolley Scan s RFID-radar transponders were relatively cheap however and the reader can map out the location of all transponders in the reading zone in one, two or three dimensions. Drawbacks were that signals from transponders can be interfered with or may not be read correctly through certain RF-lucent materials. For instance, while the claimed reading range of the