Decimeter Ranging with Channel State Information

TL;DR

This paper develops a method for decimeter-level ranging using channel state information from commercial MIMO-OFDM WLAN devices, addressing phase errors through modeling and pre-processing, and validating with extensive measurements.

Contribution

It introduces a comprehensive understanding and modeling of CSI errors, along with pre-processing techniques, enabling accurate ToF-based ranging in multipath environments.

Findings

Median ranging accuracy of 0.6m at 5m distance

Median accuracy of 0.8m at 10m distance

Median accuracy of 0.9m at 15m distance

Abstract

This paper aims at the problem of time-of-flight (ToF) estimation using channel state information (CSI) obtainable from commercialized MIMO-OFDM WLAN receivers. It was often claimed that the CSI phase is contaminated with errors of known and unknown natures rendering ToF-based positioning difficult. To search for an answer, we take a bottom-up approach by first understanding CSI, its constituent building blocks, and the sources of error that contaminate it. We then model these effects mathematically. The correctness of these models is corroborated based on the CSI collected in extensive measurement campaign including radiated, conducted and chamber tests. Knowing the nature of contamination in CSI phase and amplitude, we proceed with introducing pre-processing methods to clean CSI from those errors and make it usable for range estimation. To check the validity of proposed algorithms, the MUSIC super-resolution algorithm is applied to post-processed CSI to perform range estimates. Results substantiate that median accuracy of 0.6m, 0.8m, and 0.9m is achievable in highly multipath line-of-sight environment where transmitter and receiver are 5m, 10m, and 15m apart.

Equations

$$\begin{array}{rl}{\mathbf{y}}^{(k)}=& {\left[{\mathbf{H}}^{(k)}\right]}_{N_{\mathrm{rx}}\times N_{\mathrm{tx}}}\cdot {\left[{{\mathbf{\Phi }}_{\mathbf{a}}}^{(k)}\right]}_{N_{\mathrm{tx}}\times N_{\mathrm{tx}}}\cdot \\ & {\left[{\mathbf{Q}}^{(k)}\right]}_{N_{\mathrm{tx}}\times N_{\mathrm{ss}}}\cdot {\left[{{\mathbf{\Phi }}_{\mathbf{b}}}^{(k)}\right]}_{N_{\mathrm{ss}}\times N_{\mathrm{ss}}}\cdot {\mathbf{x}}^{(k)}\end{array}$$

$$\begin{split}h^{(m)}=\sum_{j_{\rm mp}=1}^{N_{\rm mp}}{\Gamma_{j_{\rm mp}}\bigg{(}\frac{\sin\big{(}\frac{\pi(N_{\rm sc}+1)}{N_{\rm sc}}(\kappa_{j_{\rm mp}}-m)\big{)}}{\sin\big{(}\frac{\pi}{N_{\rm sc}}(\kappa_{j_{\rm mp}}-m)\big{)}}-1\bigg{)}}\end{split}$$

$$\begin{array}{r}{\Gamma }_{j_{\mathrm{mp}}}=\frac{1}{N_{\mathrm{sc}}}{\beta }_{j_{\mathrm{mp}}}{e}^{-2\pi i{f}_0{\tau }_{j_{\mathrm{mp}}}}{e}^{\frac{\pi i(N_{\mathrm{sc}}-1)}{N_{\mathrm{sc}}}m}\text{mbox}and{\kappa }_{j_{\mathrm{mp}}}=N_{\mathrm{sc}}\Delta f{\tau }_{j_{\mathrm{mp}}}\end{array}$$

$$\left[\begin{array}{ccc}{y}_{1,1}^{(k)}& \cdots & y_{1,N_{\mathrm{ltf}}}^{(k)}\\ ⋮& \ddots & ⋮\\ y_{N_{\mathrm{rx}},1}^{(k)}& \cdots & y_{N_{\mathrm{rx}},N_{\mathrm{ltf}}}^{(k)}\end{array}\right]=$$

$$\left[\begin{array}{ccc}{q}_{1,1}^{(k)}& \cdots & q_{1,N_{\mathrm{ss}}}^{(k)}\\ ⋮& \ddots & ⋮\\ q_{N_{\mathrm{tx}},1}^{(k)}& \cdots & q_{N_{\mathrm{tx}},N_{\mathrm{ss}}}^{(k)}\end{array}\right]\left[\begin{array}{ccc}{{\varphi }_b}_{1,1}^{(k)}& \cdots & 0\\ ⋮& \ddots & ⋮\\ 0& \cdots & {{\varphi }_b}_{N_{\mathrm{ss}},N_{\mathrm{ss}}}^{(k)}\end{array}\right]\left[\begin{array}{ccc}{x}_k{p}_{1,1}& \cdots & x_k{p}_{1,N_{\mathrm{ltf}}}\\ ⋮& \ddots & ⋮\\ x_k{p}_{N_{\mathrm{ss}},1}& \cdots & x_k{p}_{N_{\mathrm{ss}},N_{\mathrm{ltf}}}\end{array}\right]+{\mathbf{N}}_k$$

$$\begin{array}{r}{\mathrm{csi}}_{j_{\mathrm{rx}},j_{\mathrm{ss}}}^{(k)}=\sum _{j_{\mathrm{tx}}=1}^{N_{\mathrm{tx}}}{\mathfrak{h}}_{j_{\mathrm{rx}},j_{\mathrm{tx}}}^{(k)}{{\varphi }_a}_{j_{\mathrm{tx}},j_{\mathrm{tx}}}^{(k)}{q}_{j_{\mathrm{tx}},j_{\mathrm{ss}}}^{(k)}{{\varphi }_b}_{j_{\mathrm{ss}},j_{\mathrm{ss}}}^{(k)}+{\mathsf{n}}_k\end{array}$$

$$\begin{array}{r}{\mathfrak{h}}_{j_{\mathrm{rx}},j_{\mathrm{tx}}}^{(k)}=\sum _{j_{\mathrm{mp}}=1}^{N_{\mathrm{mp}}}{\beta }_{j_{\mathrm{mp}}}^{j_{\mathrm{rx}},j_{\mathrm{tx}}}{e}^{-2\pi i{f}_k{\tau }_{j_{\mathrm{mp}}}^{j_{\mathrm{rx}},j_{\mathrm{tx}}}}\end{array}$$

$${\mathrm{csi}}_{j_{\mathrm{rx}}}^{(k)}=$$

$$|{\tilde{W}}^{(k)}|e^{i\angle {\tilde{W}}^{(k)}}+n_k$$

$${\tilde{W}}^{(k)}=\mathcal{F}\left\{w^{(m)}\cdot {\mathrm{rect}}_{N_{\mathrm{t}}}(m/N_{\mathrm{sc}})\right\}⊛{\mathrm{rect}}_{N_{\mathrm{sc}}}(k/N_{\mathrm{nz}})$$

$${\mathbf{CSI}}^{(k)}(n)\leftarrow {\mathbf{CSI}}^{(k)}\underset{{\Psi }^{(k)}(n)}{\underbrace{\left[\begin{array}{ccc}f({\psi }_1(n),{\psi }_2(n))& \cdots & 0\\ ⋮& \ddots & ⋮\\ 0& \cdots & f({\psi }_1(n),{\psi }_2(n))\end{array}\right]}}$$

$${\widehat{\mathrm{csi}}}_{j_{\mathrm{rx}},j_{\mathrm{ss}}}^{(k)}(n)={\mathrm{csi}}_{j_{\mathrm{rx}},j_{\mathrm{ss}}}^{(k)}(n)e^{-2\pi i\left(\frac{{\zeta }_{\mathrm{CFO}}\cdot g_2(n)}{N_{\mathrm{sc}}}+{\varphi }_c\right)}+{\mathsf{n}}_k$$

$${\widehat{\mathrm{csi}}}_{j_{\mathrm{rx}},j_{\mathrm{ss}}}^{(k)}(n)={\mathrm{csi}}_{j_{\mathrm{rx}},j_{\mathrm{ss}}}^{(k)}(n)e^{-2\pi ik\left(\frac{{\zeta }_{\mathrm{SFO}}\cdot g_1(n)}{N_{\mathrm{sc}}}\right)}+{\mathsf{n}}_k$$

$${\widehat{\mathrm{csi}}}_{j_{\mathrm{rx}},j_{\mathrm{ss}}}^{(k)}(n)={\mathrm{csi}}_{j_{\mathrm{rx}},j_{\mathrm{ss}}}^{(k)}{e}^{-2\pi i\left(\frac{k{N}_{\mathrm{STO}}(n)}{N_{\mathrm{sc}}}\right)}+{\mathsf{n}}_k$$

$${\widehat{\mathrm{csi}}}_{j_{\mathrm{rx}},j_{\mathrm{ss}}}^{(k)}={\mathrm{csi}}_{j_{\mathrm{rx}},j_{\mathrm{ss}}}^{(k)}{e}^{-2\pi i\left(\frac{k{ϵ}^{\mathrm{pre}}}{N_{\mathrm{sc}}}\right)}+{\mathsf{n}}_k$$

$${\widehat{\mathrm{csi}}}_{j_{\mathrm{rx}},j_{\mathrm{ss}}}^{(k)}(n)=$$

$$\times \underset{\mathrm{SFO}}{\underbrace{\left(e^{-\frac{2\pi ik{\zeta }_{\mathrm{SFO}}{g}_1(n)}{N_{\mathrm{sc}}}}\right)}}\underset{\mathrm{STO}+\mathrm{pre}-\mathrm{advancement}}{\underbrace{\left(e^{-\frac{2\pi ik(N_{\mathrm{STO}}+{ϵ}^{\mathrm{pre}})}{N_{\mathrm{sc}}}}\right)}}+{\mathcal{J}}_k$$

$${\mathrm{csi}}_{j_{\mathrm{rx}},j_{\mathrm{ss}}}^{(k)}=\sum _{j_{\mathrm{tx}}=1}^{N_{\mathrm{tx}}}{\mathfrak{h}}_{j_{\mathrm{rx}},j_{\mathrm{tx}}}^{(k)}{{\varphi }_a}_{j_{\mathrm{tx}},j_{\mathrm{tx}}}^{(k)}{q}_{j_{\mathrm{tx}},j_{\mathrm{ss}}}^{(k)}{{\varphi }_b}_{j_{\mathrm{ss}},j_{\mathrm{ss}}}^{(k)}+{\mathsf{n}}_k$$

$$\underset{\Delta (\angle {\mathrm{csi}}^{(k)})(n_1,n_2)}{\underbrace{{\mathrm{uwrp}}_k\left[\angle {\mathrm{csi}}_{j_{\mathrm{rx}},j_{\mathrm{ss}}}^{(k)}(n_1)-\angle {\mathrm{csi}}_{j_{\mathrm{rx}},j_{\mathrm{ss}}}^{(k)}(n_2)\right]}}$$

$$={\mathrm{uwrp}}_k[\underset{\Delta {\psi }_1(n_1,n_2)}{\underbrace{({\psi }_1(n_1)-{\psi }_1(n_2))}}k+\underset{\Delta {\psi }_2(n_1,n_2)}{\underbrace{({\psi }_2(n_1)-{\psi }_2(n_2))}}(\mathrm{mod}2\pi )]$$

$$={\mathrm{uwrp}}_k[\Delta {\psi }_1(n_1,n_2)k(\mathrm{mod}2\pi )]+\Delta {\psi }_2(n_1,n_2)(\mathrm{mod}2\pi )$$

$${\hat{\psi }}_1(n)=-\angle \frac{1}{(N_{\mathrm{nz}}-1)}\sum _{k=-N_{\mathrm{nz}}/2+1}^{N_{\mathrm{nz}}/2}\left({\mathrm{csi}}_{j_{\mathrm{rx}},j_{\mathrm{ss}}}^{(k)}(n){{\mathrm{csi}}_{j_{\mathrm{rx}},j_{\mathrm{ss}}}^{(k-1)}}^{\ast }(n)\right)$$

$${\hat{\psi }}_1^{(\mathrm{I})}(n)=$$

$$\displaystyle\sum_{k=-N_{\rm nz}/2+1}^{N_{\rm nz}/2}\sum_{j_{\rm rx}=1}^{N_{\rm rx}}\sum_{j_{\rm ss}=1}^{N_{\rm ss}}{\rm csi}_{j_{\rm rx},j_{\rm ss}}^{(k)}(n){{\rm csi}_{j_{\rm rx},j_{\rm ss}}^{(k-1)}}^{*}(n)\bigg{)}$$

$${\widetilde{\mathbf{CSI}}}^{(k)}(n)=e^{i\left({\hat{\psi }}_1(n)\right)k}\cdot {\mathbf{CSI}}^{(k)}(n)$$

$$\breve{{\rm csi}}_{j_{\rm rx},j_{\rm ss}}^{(k)}=\sum_{j_{\rm tx}=1}^{N_{\rm tx}}e^{-\frac{2\pi ik\big{(}{{\delta_{a}}}_{j_{\rm tx}}+{{\delta_{b}}}_{j_{\rm ss}}\big{)}}{N_{\rm sc}}}\mathfrak{h}^{(k)}_{j_{\rm rx},j_{\rm tx}}q_{j_{\rm tx},j_{\rm ss}}^{(k)}+\mathsf{n}_{k}$$

$${\breve{\mathrm{csi}}}_{j_{\mathrm{rx}},j_{\mathrm{tx}}}^{(k)}={\mathfrak{h}}_{j_{\mathrm{rx}},j_{\mathrm{tx}}}^{(k)}=\sum _{j_{\mathrm{mp}}=1}^{N_{\mathrm{mp}}}{\beta }_{j_{\mathrm{mp}}}^{j_{\mathrm{rx}},j_{\mathrm{tx}}}\cdot e^{-2\pi i{f}_k{\tau }_{j_{\mathrm{mp}}}^{j_{\mathrm{rx}},j_{\mathrm{tx}}}}+{\mathsf{n}}_k$$

$$\breve{\mathbf{csi}}=\mathbf{A}\cdot \gamma +\mathbf{n}$$

$$\begin{array}{rl}\mathbf{A}=& \left[\mathbf{a}({\tau }_1)\cdots \mathbf{a}({\tau }_{N_{\mathrm{mp}}})\right]\\ & \text{mbox}where\mathbf{a}({\tau }_{j_{\mathrm{mp}}})={\left[1,e^{-2\pi i\Delta f{\tau }_{j_{\mathrm{mp}}}},\cdots ,e^{-2\pi i(N_{\mathrm{nz}}-1)\Delta f{\tau }_{j_{\mathrm{mp}}}}\right]}^{\mathrm{T}}\\ & \gamma ={\left[{\gamma }_1\cdots {\gamma }_{N_{\mathrm{mp}}}\right]}^{\mathrm{T}}\\ & {\gamma }_{j_{\mathrm{mp}}}={\beta }_{j_{\mathrm{mp}}}{e}^{-2\pi i{f}_0{\tau }_{j_{\mathrm{mp}}}}\text{mbox}and\mathbf{n}={\left[{\mathsf{n}}_1\cdots {\mathsf{n}}_{N_{\mathrm{nz}}}\right]}^{\mathrm{T}}\end{array}$$

$$\mathrm{PS}(\tau )=\frac{\mathbf{a}(\tau {)}^{\mathrm{H}}\mathbf{a}(\tau )}{\mathbf{a}(\tau {)}^{\mathrm{H}}{\mathbf{E}}_n{\mathbf{E}}_n^{\mathrm{H}}\mathbf{a}(\tau )}$$

$$\small\left[\begin{array}[]{c}\breve{{\bf csi}}_{1}\\ \breve{{\bf csi}_{2}}\end{array}\right]=\left[\begin{array}[]{c}{\bf A}_{1}\\ {\bf A}_{2}\end{array}\right]\cdot{\bf\gamma}+{\bf n}$$

$$\begin{array}{rl}{\mathbf{R}}_{\mathrm{ss}}=& \frac{1}{N_{\mathrm{b}}}\sum _{j_{\mathrm{b}}=1}^{N_{\mathrm{sc}}-N_{\mathrm{sc}}^{\prime }+1}{\mathbf{R}}_{{\breve{\mathbf{csi}}}_{j_{\mathrm{b}}}}^{(j_{\mathrm{b}}:j_{\mathrm{b}}+N_{\mathrm{sc}}^{\prime }-1,j_{\mathrm{b}}:j_{\mathrm{b}}+N_{\mathrm{sc}}^{\prime }-1)}\\ & \text{mbox}s.t.(j_{\mathrm{b}}+N_{\mathrm{sc}}^{\prime }-1\le N_{\mathrm{sc}}/2\text{mbox}\mathbf{or}{j}_{\mathrm{b}}\ge N_{\mathrm{sc}}/2+1)\end{array}$$

$${\mathbf{R}}_{\breve{\mathbf{csi}}}^{FW/BW}={\mathbf{R}}_{\breve{\mathbf{csi}}}^{\mathrm{FW}}+\underset{{\mathbf{R}}_{\breve{\mathbf{csi}}}^{\mathrm{BW}}}{\underbrace{\mathbf{J}{{\mathbf{R}}_{\breve{\mathbf{csi}}}^{\mathrm{FW}}}^{\ast }\mathbf{J}}}$$

Full text

I Introduction

One of the fundamental challenges of today’s networks is precise estimation of indoor users’ locations. The location of a user is a source of information that can be leveraged to unlock huge technological, social, and business potentials. This is in particular the case for indoor environment, where the signal of the global navigation satellite system (GNSS) is unavailable.

Due to its pervasive deployment and cost-effective nature, positioning using wireless local area networks (WLANs) signals has been at the focus of research for almost a decade. In fact, experimental works have proven that WiFi signals can be used to obtain excellent location accuracy even in harsh multipath environments [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11]. For a comprehensive survey on the success of WiFi in localizing indoor users refer to [12, 13]. This has been a significant advancement as, until recently, ultra-wide-band (UWB) radio was deemed as the only viable solution to get accurate location information [14].

Indoor positioning using WiFi began with power-based ranging using received signal strength (RSS) [8, 9, 10, 11, 15, 16]. Unfortunately, accurate range estimation with RSS is impossible because: (i) time-domain OFDM signals are highly fluctuating (ii) the amplitude of a signal is directly affected by small-scale fading (iii) signal amplification at the receiver is controlled by the automatic gain controller (AGC) whose behaviour dynamically varies with channel conditions.

This paper is motivated by the availability of channel-state information (CSI) from Intel [17] and Atheros [18] WiFi chipsets that have enabled CSI to be used for positioning. CSI is a more stable and informative representation of the wireless channel (compared to RSS) between two communicating end-points. Therefore, it can be used to perform range (time-based or power-based) and angle-of-arrival estimation. When it comes down to implementation, while CSI-based localization with AoA achieved promising outcomes [2, 3, 4, 19], using CSI to estimate time-of-flight (ToF) measurement has either not been pursued or led to inconsistent results [2]. To our knowledge, the studies that do consider phase-based ranging all use software-defined radio (SDR), an open-source and fine-tuned platform that is expensive to acquire and so is unscalable. On the other hand, our work is based on using commercial off-the-shelf MIMO-OFDM network interface cards (NIC), which are used in laptops and computers, to estimate the range from phase of the CSI. As ToF measurement is crucial to ranging, and subsequently positioning, this raises the question, “What makes ToF estimation using CSI a challenging task?” This paper aims to find an answer to this question. Our goal is multifaceted: First, we aim to discuss some of the often neglected practical issues about CSI and ToF estimation using the CSI. In that vein, we dissect CSI that is obtainable from WiFi chipsets to understand its constituent building blocks, different forms it takes, and the sources of error that contaminate it. We proceed with introducing pre-processing methods to clean CSI from those errors and make it usable for ToF estimation. We then apply the classic super-resolution spectral MUSIC algorithm to the post-processed CSI to obtain accurate and stable range estimates. To our knowledge, this is an achievement that has never been accomplished before.

The inherent appeal of MUSIC algorithm is due to the fact that estimator’s resolvability power is not only determined by the signal bandwidth but also the total signal-to-noise ratio (SNR). More importantly, MUSIC is an efficient and consistent estimator when certain criteria are met.

In doing so, different ideas are examined, including covariance hardening methods, such as spectral smoothing and forward-backward smoothing, and decision fusion algorithms. We demonstrate that decimetre ranging with only $20$MHz of spectrum is possible if CSI is properly post-processed and range estimates are intuitively combined.

**Problem Statement: ** A holistic view of the problem addressed in this paper is presented in Fig. 1a where the link between a transmitter and receiver is shown: Whereas coherent decoding of data symbols in communications systems requires the knowledge of end-to-end degradation imposed between a transmitter’s baseband (BB) and receiver’s BB (named transmission channel), location estimation hinges on the knowledge of the channel immediately between the two antennas (named propagation channel). Not only these two channels are not the same, but quantifying one from the other is a non-trivial task. The difference between transmission channel MX ${\bf CSI}$ and propagation channel ${\bf H}$ arises because of (i) lack of synchronization between transmitter/receiver in passband (PB) and (ii) deterministic signal processing operations in transmitter’s BB. In the latter case, cyclic delay diversity (CDD), spatial mapping matrix (SMM), and time-windowing, whose effects are generally incorporated into the CSI matrix, make the receiver believe that the transmitter is several tens of meters away and that the channel is more reflective than it really is.

**Contribution: ** In tackling the aforementioned problem, this paper’s contributions are as follows:

• •

To dissect different deterministic and random phenomena happening in the transmitter and receiver hardware causing ${\bf H}$ and ${\bf CSI}$ to be different.

• •

To establish the right model for CSI and its relation with the channel matrix.

• •

To develop pre-processing techniques to eliminate random phases introduced by the insufficiency of synchronization between the transmitter and the receiver.

• •

To obtain accurate range estimates by applying super-resolution algorithm to the calibrated CSI.

**Organization: ** This paper is organized as follows: In Section II, we go over the basics of multiple-input multiple-output orthogonal frequency division multiplexing (MIMO-OFDM) WLAN systems, including their transceiver architecture, channel-sounding, etc. In Section III we show why ToF estimation with CSI is a challenging task, and explain different random and deterministic sources of error contributing to this problem. With the knowledge gained, we tackle the problem of cleaning and calibrating CSI in Section IV. Finally, in Section V, we introduce ideas to obtain more accurate range estimates from the post-processed CSI.

**Notation: ** The following notation is adopted throughout this paper: $a$ (lowercase/regular)$\rightarrow$ a scalar, ${\bf a}$ (lowercase/boldface)$\rightarrow$ a vector, ${\bf A}$ (uppercase/boldface)$\rightarrow$ a matrix. For matrix ${\bf A}$, ${a}_{r,q}$ is its $(r,q)$th element, ${\bf A}^{\rm T}$ is its transpose, ${\bf A}^{\rm*}$ is its conjugate, and ${\bf A}^{\rm H}$ is its Hermitian.

II Background

II-A Channel State Information (CSI)

Without properly compensating for the propagation and asynchronization effects, the receiver has no way of detecting what was transmitted. To that end, and through a mechanism named channel sounding, the receiver obtains an estimate of wireless channel. This is accomplished by sending a training sequence that is known to both transmitter and receiver. For a wideband MIMO-OFDM system, the estimate of the channel is a collection of complex matrices one for each OFDM subcarrier. It is such information that is universally known as channel state information (CSI). Once CSI is known, it is used by the equalizer in order to cancel out any deterioration (e.g. phase shift, attenuation, etc.) that was imposed on the transmitted data. For packet-based MIMO-OFDM IEEE802.11(n) systems, training sequences, namely high throughput long training fields (HT-LTF), are sent in the preamble, which is instantly used by the receiver to derive CSI.

II-B WLAN Transceiver Architecture

Fig. 1b shows the general structure of the MIMO-OFDM WLAN transmitter. An encoded high-rate bit stream is fed to the stream parser to create $N_{\rm ss}$ spatial streams. These spatial streams are modulated using constellation mappers (e.g. QAM) to create stream of symbols. As explained before, the transmitter may only send $N_{\rm ss}\leq{\rm rank}({\bf H})$ parallel streams, where ${\bf H}$ is the true channel matrix, and violating this rule would result in loss of data. Note that ${\rm rank}({\bf H})\leq\min(N_{\rm tx},N_{\rm rx})$ (with the equality holding when the channel is rich scattering), where $N_{\rm tx}$, $N_{\rm rx}$ are the number of transmit and receive antennas, respectively.

Next, spatial streams are cyclically shifted through a mechanism named cyclic delay diversity (CDD) to create extra frequency diversity and make sure no unintended beamforming takes place when sending common information (e.g. headers) from all transmit antennas.

The spatial mapping maps fewer number of spatial streams to larger number of transmit antennas [20]. This is especially crucial in situations where lower number of streams is to be carried by larger number of transmit chains. The existence of CDD and spatial mapping matrix are among the main reasons to render one-way measurements of time-of-flight (ToF) for ranging difficult. Moving forward, a second CDD layer is applied to each transmit chain and frequency domain samples are fed to inverse fast Fourier transform (IFFT) to create time-domain samples. These samples are then simultaneously sent from all transmit chains.

Referring to Fig. 1, the receiver output ${\bf y}$ at point “B”, is related to transmitter input ${{\bf x}}$ at point “A” through the following matrix equation:

[TABLE]

where ${\bf H}^{(k)}$, ${\bf Q}^{(k)}$, ${\bf\Phi_{a}}^{(k)}$ and ${\bf\Phi_{b}}^{(k)}$ are, respectively, the channel matrix, the spatial mapping matrix, and the first, and the second CDD matrices at the $k$th subcarriers, $k=1,...,N_{\rm nz}$, where $N_{\rm nz}$ is the number of (non-zero) subcarriers within the band of interest out of the total of $N_{\rm sc}$ subcarriers (e.g. $N_{\rm nz}=56$ and $N_{\rm sc}=64$ for $B=20$MHz in IEEE 802.11n systems). More details on the composition of ${\bf Q}^{(k)}$,${\bf\Phi_{a}}^{(k)}$, and ${\bf\Phi_{b}}^{(k)}$ are provided in the next sub-section.

II-B1 Cyclic Delay Diversity (CDD)

Despite that the payload part of a packet is destined only to a given destination, the packet preamble is meant to be heard/decoded by everyone. To ensure that the header is received by all, and to avoid inadvertent beamforming across the antennas, CDD is used [21]. This is achieved by sending the same header OFDM symbols over different antennas while cyclically shifting them so that (i) all RF chains are utilized, thus, longer communication range is obtained (ii) no unintended beamforming is experienced. The effect of CDD on transmitting common header information changes the multipath nature of the channel as seen by the receiver. To simplify the transceiver architecture, CDD is always applied no matter which portion of packet is being sent, header or payload. The choice of CDD is implementation dependent. We observe that at times, even the same access point (AP) will use different CDD values for the same number of streams. Nonetheless, the standard [22] puts forth some recommendations. Ranging with the raw CSI obtained from the NIC (without accounting for CDDs) may give rise to an accuracy that is off by several tens of meters.111For example, for a 4x4 MIMO system, CDD values $0,-400,-200,-600$ns are suggested. For WLAN systems operating on sampling rate $T_{\rm s}=1/B=50$ns, where $B=20$MHz, these CDDs are equivalent to delays equivalent to $0,8,4,12$ samples.

II-B2 Spatial Mapping Matrix (SMM)

The spatial mapping operation is the most crucial component of MIMO-OFDM systems assuming tasks such as transmit beamforming, spatial multiplexing, spatial diversity, and so on. This is often implemented through linear matrix operation ${\bf Q}^{(k)}$ as shown in (1) and is an implementation-dependent matter. If $N_{\rm ss}=N_{\rm tx}$, often direct mapping takes place, i.e. ${\bf Q}^{(k)}=\bf I$, where $\bf I$ is the identity matrix. However, when $N_{\rm ss}<N_{\rm tx}$, indirect mapping may be adopted [20]. In the latter case, the effect of SMM is similar to having more echoes than those added by the propagation environment. For this reason, imposition of SMM has similar effect as having virtual echoes.

II-C Channel Sounding

Channel sounding is the mechanism of obtaining CSI at the receiver. This is done by transmitting known HT-LTF sequences. HT-LTF sent over $j_{\rm ss}$th stream is a unique sequence ${\bf x}_{j_{\rm ss}}=(x_{j_{\rm ss}}^{(k)},k=1\cdots N_{\rm sc})$ where $x_{j_{\rm ss}}^{(k)}\in\{-1,1\}$. To probe a single dimension of the multi-dimensional (MIMO) channel, one ${\bf x}_{j_{\rm ss}}$ is sent on each spatial stream, for the total of $N_{\rm ss}$ stream. That means that vector ${\bf x}^{(k)}=(x_{j_{\rm ss}}^{(k)},j_{\rm ss}=1\cdots N_{\rm ss})$ is fed to all the $N_{\rm ss}$ streams simultaneously to be transmitted over the $k$th subcarrier in order to estimate MIMO channel matrix on the $k$th subcarrier frequency. Let’s denote ${\bf\hat{x}}=({\bf x}_{j_{\rm ss}},{j_{\rm ss}}=1\cdots N_{\rm ss})$. To probe all the dimensions of the MIMO channel, not one but several ${\bf X}=({\bf\hat{x}}_{j_{\rm ltf}},{j_{\rm ltf}}=1\cdots N_{\rm ltf})$ are transmitted in the preamble (in sequence) where, $N_{\rm ltf}\geq N_{\rm ss}$. In other words, $N_{\rm ltf}\times N_{\rm ss}\times N_{\rm sc}$ two-state training symbols $x_{j_{\rm ss}}^{(k)}$ will have to be sent to learn $N_{\rm rx}\times N_{\rm ss}\times N_{\rm sc}$ complex coefficients of the MIMO channel [20]. Subsequently, a matrix ${\bf Y}^{(k)}$ is received for the $k$th HT-LTF symbol on $N_{\rm rx}$ received antennas.

III Challenges of Ranging with CSI

In general, ToF estimation based on CSI suffers from several deep-rooted issues some of which have not been discussed in the literature. These issues are pointed out next and dealt with in detail later on.

Bandwidth Limitation

Range estimation has been traditionally done through derivation of the channel impulse response (CIR) for each tx/rx pair and hunting CIR’s first and strongest peak. This simple approach has been effective in ranging with UWB radio and been lately pursued in the WiFi-based indoor localization literature [18, 23, 13]. Without delving into derivation details, CIR is obtained by taking the IFFT of the samples of the channel-frequency response (CFR), i.e. CSI metric, while accounting for the fact that no CSI is collected on $k=0$ (i.e. zero subcarrier)222Transmitting data on OFDM’s center frequency would result in loss of information due to strong DC current at BB. and is given by

[TABLE]

where $m$ is the time (delay) domain index and

[TABLE]

where $N_{\rm mp}$, $\tau_{j_{\rm mp}}$, $\beta_{j_{\rm mp}}$, $\Delta f$, $f_{0}$ are the number of multipath arrivals, delay and attenuation on $j_{\rm mp}$th path, subcarrier-spacing, and central frequency, respectively. This power-delay-profile (PDP) peaks at discrete samples $m=m_{\rm peak}=\lfloor\kappa_{j_{\rm mp}}\rceil$ only if (i) $j_{\rm mp}$th arrival has enough strength $|\Gamma_{j_{\rm mp}}|$ (ii) close-by arrivals are not within each other’s Rayleigh resolution limit, i.e. $|\tau_{j_{\rm mp}}-\tau_{j_{\rm mp}^{\prime}}|>1/(N_{\rm sc}\Delta f)$. For WiFi systems with sampling rate $20$Mega sample/s (Msps) (for a $B=20$MHz channel), the electromagnetic wave travels extra $15$m between two consecutive samples. Such low sampling rate makes resolving closely-spaced multipath reflections (as needed for indoor positioning) based on CIR theoretically impossible.

CSI Phase Contamination

The phase in the CSI matrix is contaminated with terms triggered by the imperfect synchronization between the transmitter and receiver in analog/digital domains. Dubbed by the names symbol timing offset (STO), sampling frequency offset (SFO), carrier frequency offset (CFO), and carrier phase offset (CPO), these frequency and time synchronization errors are extremely volatile in nature [24].

CSI Amplitude Contamination

The amplitude of the CSI is highly distorted by three phenomena: (a) unpredictable changes in AGC gain, (b) I/Q imbalance, and (c) the mixed effect of cyclic-prefix removal/guard-band insertion/windowing operation on time-domain CSI samples.

CDD Phase Shift

The CDD included in the CSI matrix appears as an additive phase in the CSI matrix. CDD can potentially degrade the ranging accuracy using CSI by several tens of meters. This is particularly the case when $N_{\rm ss}<N_{\rm tx}$ [20, 21].

Artificial Multipath

The multiplexing operation ${\bf Q}^{(k)}$ performed on input streams causes the received samples to look as if they were transmitted on a fading channel with many more reflections [22, 20].

III-A Impact of OFDM Baseband Operations

III-A1 SMM and CDD

Accounting for the SMM and CDD operations at the transmitter, the entire sounding mechanism can be described by (3), at the top of the page, where ${\bf P}$ (the rightmost matrix) is called the orthogonal mapping matrix.

The CSI matrix is calculated as ${\bf CSI}^{(k)}={\bf Y}^{(k)}{\bf P}^{-1}$, for each subcarrier. In (3), ${{\bf\Phi_{a}}}$ and ${{\bf\Phi_{b}}}$ are the cyclic shift (diagonal) matrices before and after spatial mapping, which is denoted by ${\bf Q}$, a linear matrix, as shown in the transceiver architecture of Fig. 1 and ${\bf N}_{k}$ is the noise matrix. Because ${\bf\Phi_{a}}$, ${\bf\Phi_{b}}$, ${\bf Q}$ are implementation-dependent quantities, estimating matrix ${\bf H}^{(k)}$ at the receiver from observations ${\bf CSI}^{(k)}$ is challenging. However, the receiver does not require to extract the channel matrix ${\bf H}^{(k)}$ to decode data points; so long as ${\bf\Phi_{a}},{\bf\Phi_{b}},{\bf Q}$ are applied to both training sequences and payload (which is indeed the case), the receiver can view $\hat{{\bf H}}^{(k)}={\bf H}^{(k)}{\bf\Phi_{a}}^{(k)}{\bf Q}^{(k)}{\bf\Phi_{b}}^{(k)}$ as an end-to-end channel. Elaborating on (3), and given that the receiver removes the orthogonal mapping matrix ${\bf P}$, the $(j_{\rm rx},j_{\rm ss})$ element of the CSI matrix is given by

[TABLE]

where $j_{\rm rx}$, $j_{\rm tx}$, $j_{\rm ss}$ represent receive antenna, transmit antennas, and spatial stream indices, respectively. From (4), the information on the ToF of the line-of-sight (LoS) path is concealed in $\mathfrak{h}_{j_{\rm rx},j_{\rm tx}}^{(k)}$ which is given by

[TABLE]

where $\beta_{j_{\rm mp}}^{j_{\rm rx},j_{\rm tx}}$ and $\tau_{j_{\rm mp}}^{j_{\rm rx},j_{\rm tx}}$ are the attenuation and time delay of the $j_{\rm mp}$th path between $j_{\rm rx}$th receive and $j_{\rm tx}$th transmit antennas, respectively. Also, $N_{\rm mp}$ is the number of multipath components and $f_{k}=f_{0}+k\Delta f$ is the $k$th subcarrier’s frequency with $\Delta f$ and $f_{0}$ being the subcarrier spacing and the center frequency, respectively.

To better understand the effect of CDD and SMM on range measurement, we performed experiments in an anechoic chamber (Fig. 7c) wherein $N_{\rm mp}\approx 1$ (no multipath). In cases when the CSI matrix is not full rank, i.e. $N_{\rm ss}\neq N_{\rm tx}$, we expect ${\bf Q}^{(k)}\neq\bf I$. In this situation, the PDP yields more than one peak $m_{\rm peak}=\lfloor N_{\rm sc}\Delta f\tau_{0}^{j_{\rm rx},j_{\rm tx}}+{{\delta_{a}}}_{j_{\rm tx}}+{{\delta_{b}}}_{j_{\rm rx}}\rceil$, $j_{\rm tx}=1\cdots N_{\rm tx}$, where ${{\delta_{a}}}_{j_{\rm tx}}$, ${{\delta_{b}}}_{j_{\rm rx}}$ are the cyclic shifts before and after spatial mapping on the $j_{\rm tx}$th transmit chain and the $j_{\rm rx}$ spatial stream. This is indeed the case as shown in Fig. 2. Fig. 2a uses data collected from a setup where transmitter and receiver arrays directly face each other whereas, in Fig. 2b, the receiver is rotated by 90 degrees. The latter experiment was performed to understand whether we can achieve a full channel matrix ($N_{\rm ss}=3$) in non-scattering anechoic chamber.

In Fig. 2a, PDP is plotted for those packets that encounter a channel with $N_{\rm ss}=2$. As expected, peaks of equal strength is observed (for all transmit-receive sub-channels) which cannot be justified by the echo-free nature of the propagation environment. This is not observed in Fig. 2b where $N_{\rm ss}=3$ and the SMM is often non-existent (explained later on). Nevertheless, in both figures, peaks are shifted to the right by 2 samples which could be caused by STO, pre-advancement, or CDD. 333Note that transmitter-receiver are 5.18m apart in anechoic chamber experiment which should produce a peak at sample index ”0”.

The conclusion here is that raw CSI is unusable. One has to derive channel-related terms from CSI metrics in order to do positioning, a fact that is often underappreciated in the field of CSI-based positioning.

III-A2 Time Domain Windowing

In examining the CSI obtained in a controlled conducted test (Fig. 7d), and in the anechoic chamber, non-linearities of regular shape were observed in both phase and amplitude of CSI as shown in Fig. 4a and Fig. 4b. The symmetric phase and amplitude non-linearity $W^{(k)}=\mathcal{F}\{w^{(m)}\}$ on CSI (after FFT operation at the receiver) advocates a real-time operation $w^{(m)}$ (after IFFT operation at the transmitter). Importantly, this phase distortion can degrade the ranging accuracy. We claim that this effect arises due to the combination of time-domain windowing, cyclic-prefix (CP) removal, and guard-band insertion at the transmitter as shown in Fig. 3 and the logic is as follows: Wireless communications systems follow a block-wise design methodology where hierarchies of subsystems444e.g. scrambling $\rightarrow$ FEC encoding $\rightarrow$ stream parsing $\rightarrow$ interleaving $\rightarrow$ mapper $\rightarrow$ channel $\rightarrow$ equalization $\rightarrow$ de-mapper $\rightarrow$ de-interleaving $\rightarrow$ de-parser $\rightarrow$ FEC decoder $\rightarrow$ de-scrambler are used at the transmitter and receiver. This approach works because of the linearity of the operation performed in each block, hence, an inner block (say channel-equalization) remains transparent to the outer block (say encoding-decoding). This reversibility is true for most operations along a wireless chain except a few, where CP insertion-removal is the most important one. When CP of the training sequence (from which CSI is calculated) is removed at the receiver, what passes through is a sequence that is windowed (in time domain) from tail but intact from head. That is because the rising head of the time-domain windows are often not long enough to get passed CP and split into the OFDM symbol, but the falling tail of that time-domain window will impact the tail of OFDM symbol. This effect causes the observed distortion.

To further investigate this hypothesis, we worked on measurements collected in the conducted test setup. In this setting, and based on the model in (4), $N_{\rm mp}=1$ and $N_{\rm ss}=N_{\rm tx}\rightarrow{\bf Q}=I$, hence CSI with linear phase (vs $k$) was expected, like ${\rm csi}_{j_{\rm rx},j_{\rm ss}}^{(k)}=\gamma\exp(-{2\pi ik}\zeta/{N_{\rm sc}})+n_{k}$ where $\zeta=N_{\rm sc}\Delta f\tau_{0}^{j_{\rm rx},j_{\rm tx}}+{{\delta_{a}}}_{j_{\rm tx}}+{{\delta_{b}}}_{j_{\rm ss}}$, the latter two terms are the cyclic shifts after and before spatial mapping, $\Delta f$ is the OFDM subcarrier spacing, and $\gamma=\beta_{0}\exp(-2\pi if_{0}\tau_{0}^{j_{\rm rx},j_{\rm ss}})$ is a complex coefficient. Since the non-linearity is completely constant regardless of the choice of attenuators, cable length, etc., it implies a systematic operation happening in hardware. In fact, taking FFT of CSI yields $\mathcal{F}_{k}^{-1}\{{\rm csi}_{j_{\rm rx},j_{\rm ss}}^{(k)}\}=\gamma\exp(\zeta_{f})w^{(m-\zeta_{I})}$ where $\zeta_{f}$ and $\zeta_{I}$ are the fractional and integer part of $\zeta$. This time-domain signal is plotted in Fig. 4c. This is a Tukey window as recommended in IEEE 802.11 standard [22].555One should note that the Tukey window is a flat function with smooth edge falloff. However, the window we observe through CSI has an FFT whose $N_{\rm g}/2$ upper (and $N_{\rm g}/2$ lower) values are zeroed as a result of guard subcarrier exertion, which gives rise to Fig. 4c. Whereas the results for Atheros 93xx chipset are presented here, the same observation were made for Intel 53xx chipset. In the general case, the CSI model in (4) is revised as

[TABLE]

where

[TABLE]

and $\mathrm{rect}_{N_{\rm t}}({m}/{N_{\rm sc}})$ is a time-domain rectangle function of length $N_{\rm t}=N_{\rm sc}+N_{\rm cp}$ to represent the CP removal operation on OFDM symbol, $\mathrm{rect}_{N_{\rm sc}}({k}/{N_{\rm nz}})$ is a frequency-domain rectangle of length $N_{\rm sc}=N_{\rm nz}+N_{\rm g}$ to represent guard band insertion operation in OFDM systems, and $w^{(m)}$ is the time-domain windowing function. $N_{\rm cp}$, $N_{\rm g}$, and $N_{\rm sc}$ are the length of OFDM cyclic prefix (CP), the number of guard subcarriers, and the total number of subcarriers in OFDM system, respectively. Also $\mathcal{F}(\cdot)$ and $\circledast$ are the FFT and circular convolution operators. Since this is a deterministic effect that stems from a systematic design choice, a one-time non-linear fitting to the phase curve in Fig. 4a and de-rotating CSI phase accordingly would be sufficient without any concern with respect to over-fitting.666Our fit is a 3rd-degree polynomial which resulted in $-7\cdot 10^{-5}k^{3}+3\cdot 10^{-5}k^{2}+0.05k$.

Discussion: The existence of phase non-linearity in Fig. 4 has led some researchers to associate this with the I/Q imbalance phenomenon [25]. In several different works, e.g. [13, 26, 23], the trigonometric-like shape of the CSI phase (as depicted in Fig. 4) has led to incorrect representation of CSI as $|{\rm csi}^{(k)}|\exp(i\sin(\angle{\rm csi}^{(k)}))$. The unrecognised, deleterious effects of these baseband operations have led to the belief that CSI is not usable for ToF estimation and made range-based indoor positioning a less fruitful area of investigation. Chronos [5] is able to measure ToF by only using the zero subcarriers (at different frequency bands), a workaround that dodges all the deteriorations explained earlier. However, this is not the case if one needs to use CSI on arbitrary set of subcarriers for ToF estimation. On the other hand, estimating AoA using CSI circumvents these problems, as differencing the phases of the CSI at receive antennas eliminates the effect of the aforementioned additive phases imposed at the baseband of the transmitter [2, 3, 4].

III-B Impact of Imperfect Signal Processing

The matrix equation in (3) assumes perfect synchronization between the transmitter and receiver. Such assumption is not realistic as communication always suffers from lack of perfect time/frequency synchronization. To account for this, the CSI model in (3) is revised as

[TABLE]

where ${\bf CSI}^{(k)}$ is given by (3), $\Psi^{(k)}(n)$ is an $N_{\rm rx}$ by $N_{\rm rx}$ matrix of complex and time-dependent elements $f(\psi_{1}(n),\psi_{2}(n))=\exp(-i(k\psi_{1}(n)+\psi_{2}(n)))$ to account for phenomena such as symbol timing offset (STO), carrier frequency offset (CFO), sampling frequency offset (SFO), and carrier phase offset (CPO). Since the chains (transmit and receive) in today’s MIMO systems are driven by one oscillator in an $N_{\rm rx}\times N_{\rm tx}$ MIMO system, every pair of transmit-receive ports $(n_{\rm rx},n_{\rm tx})$ observe similar synchronization error in (7). Please note the difference between the time index $n$ in (7) (to distinguish CSI for different packets) and delay index $m$ in (2) (to distinguish discrete multipath components of the channel).

In general, $\Psi^{(k)}(n)$ can be an arbitrary matrix with non-zero elements. However, when there is no coupling between receiver chains, this matrix will be diagonal. Also given that all RF chains in MIMO WLAN systems use a common oscillator/synthesizer, the complex diagonal elements of $\Psi^{(k)}(n)$ are the same. Our extensive experiments in the anechoic chamber (Fig. 7c) verifies the following two hypotheses regarding the phase of $f(\cdot,\cdot)$: (i) linear in subcarrier index (ii) highly variable even in purely static environment. These additive phase terms highly degrade the accuracy of the CSI-based ranging as reported in several localization studies [2, 3, 5] and are discussed next.

III-B1 Frequency Errors

In down-converting analog passband (PB) signal to baseband (BB), the following errors are introduced into the CSI:

• •

CFO/CPO: The generated carrier at the receiver can be represented by a complex exponential. CFO exists when the receiver’s carrier frequency $f_{0}^{\prime}$ drifts from the transmitted carrier frequency $f_{0}$ by $\Delta_{c}=f_{0}^{\prime}-f_{0}$ due to residual errors in receiver’s phase locked loop (PLL).777The CFO can also be due to Doppler effect. Nonetheless, contribution of the latter to $\Delta_{c}$ is considerably less compared to oscillator frequency mismatch.

On the other hand, CPO $\phi_{c}$ is imposed because receiver’s voltage controlled oscillator (VCO) starts from a random phase every time the synthesizer restarts and the phase locked loop (PLL) cannot completely compensate for the phase difference between generated carrier and received signal. Both of these effects are shown to affect CSI in the following manner

[TABLE]

where $\zeta_{\rm CFO}=(f_{0}^{\prime}-f_{0})/\Delta f$ is the CFO normalized with OFDM subcarrier spacing $\Delta f$. Equation (8) signifies an additive phase that is cumulative in time as denoted by $g_{2}(n)$. Due to its accumulative nature, CFO is regularly tracked by the receiver and compensated for. However, the residual leftover can be detrimental in precise ranging.

III-B2 Timing Errors

These errors happen when receiver (transmitter) samples (synthesizes) signals at mismatching rates. There is also the significant issue of symbol boundary detection as discussed next:

• •

SFO: In modern homodyne architectures, the same oscillator triggering the mixer drives the analog-to-digital converter (ADC). If the ADC samples the received signal with rate $T_{\rm s}^{\prime}$ different from transmitter’s synthesization rate $T_{\rm s}$, SFO is experienced. This is manifested as an additive phase shift proportional to the subcarrier index and cumulative in time [27, 24]. Mathematically,

[TABLE]

where $\zeta_{\rm SFO}=(T_{\rm s}^{\prime}-T_{\rm s})/T_{\rm s}$ is the SFO normalized with the sampling time and $g_{1}(n)$ denotes the SFO calibration interval.

• •

STO: STO is the most degrading effect arising due to the lack of knowledge about the beginning of the received OFDM symbol [24]. This uncertainty emerges as it is not a-priori known when to expect a packet. Since OFDM systems function on blocks of (time domain) samples, named symbols, it is crucial that the right block is fed to the FFT demodulator. To find out about the symbol boundary, header starts with known, periodic sequences (named short-training fields-STF) and auto-correlator/cross-correlator is utilized at the receiver to capture and detect the presence of WiFi signals. However, because of the length limitations of these sequences, error in determining symbol boundary cannot be fully eliminated leading to irreversible errors such as inter-carrier interference (ICI), inter-symbol interference (ISI), and phase rotation, as seen in Fig. 5.888ISI is experienced in case I of Fig. 5 because there is multipath leakage from $j$th symbol into the FFT window of the $j+1$th symbol. This is different from Case IV where not only leakage from the next symbol (i.e. j+2 which is not plotted) causes ISI, but there is ICI as well since the FFT window is missing the beginning of OFDM frame. To summarize, FFT window should neither advance too much into CP (to avoid ISI with the previous symbol) nor should it progress into main part of OFDM symbol (to avoid ICI and ISI with the next symbol). This phase rotation can be shown to impact CSI in the following manner:

[TABLE]

• •

OFDM Pre-advancement: Accounting for STO uncertainty, and to avoid irrevocable ICI/ISI, almost all NIC chipsets intentionally (upon estimating symbol boundary) borrow $\epsilon^{\rm pre}$ samples from current OFDM symbol’s CP. This operation, named pre-advancement, guarantees that FFR input samples are ISI/ICI free, and only (clockwise) cyclically shifted (Case II in Fig. 5) which creates phase rotation after FFT given by:999pre-advancement won’t impact decoding quality as both payload and channel estimation (HT-LTF) symbols undergo the same shift, hence equalization removes it.

[TABLE]

Discussion: Positioning based on the unprocessed CSI will be severely impacted as $N_{\rm STO}+\epsilon^{\rm pre}=1$ will cause $15$m ranging inaccuracy at best. This is evident from our experimental measurements in Fig. 2: Whereas in the chamber the transmitter and receiver were $5$m apart, calling for a PDPs that climax at the very first sample ($n=0$), the true peak actually happens at the third sample, an anomalous behaviour that is a testimony to the deliberate clockwise (left) cyclic shifting of OFDM symbol.

Accounting for non-idealities due to AGC, CFO, CPO, SFO, STO, and pre-advancement, the CSI model is revised as follows

[TABLE]

where, according to Eq. (4), ${\rm csi}_{j_{\rm rx},j_{\rm ss}}^{(k)}$ is given by

[TABLE]

The additive term $\mathcal{J}_{k}$ entails noise $\mathsf{n}_{k}$, ISI, and ICI. Despite its sophisticated look, the multiplicative error terms in (12) can be compactly represented by $\exp(-i(k\psi_{1}(n)+\psi_{2}(n)))$ as initially claimed in (7).

IV CSI Calibration

We have discussed so far that ranging based solely on CSI is a futile effort unless (i) the effect of deterministic SMM, CDD, and mixed windowing operations are cancelled out (ii) random phase errors due to the lack of synchronization are compensated for.

In the following, we investigate the statistical behaviour of the CSI random phase errors and introduce techniques to remove them. Our goal is to estimate synchronization errors in (12) in the aforementioned onerous problem where errors are changing from packet to packets, thus, rendering classic estimation (ML, MMSE, etc.) approaches that rely on availability of many samples unusable.

IV-A Statistical Error Characterization

Due to the highly volatile nature of phase errors, differencing across time keeps the volatility while eliminating stagnant channel terms.101010As a rough figure, the parameters of the indoor wireless channel change in the order of tens of ms. Doing so for consecutive CSI samples and performing phase unwrapping (w.r.t the subcarrier index $k$) yields111111One has to be wary of the fact that we do not get to observe $\Delta\psi_{1}k+\Delta\psi_{2}$ but its $2\pi$ modulus.

[TABLE]

where ${\rm uwrp}_{k}[\cdot]$ is phase unwrapping w.r.t to $k$ and $n_{1}$ and $n_{2}$ are arbitrary time indices with the constraint that $(|n_{2}-n_{1}|T_{\rm s}<T_{\rm c})$ with $T_{\rm c}$ being the coherence time of the channel. Also, $x~{}({\rm mod~{}}2\pi)$ is the modulo operation, which is denoted by $[x]_{2\pi}$, hereinafter. To gain insights into the statistical nature of $\psi_{1(2)}(n)$, we use the measurements collected in an anechoic chamber. Fig. 6b shows CSI phase difference vs. subcarrier index for two cases: (i) $N_{\rm p}=12$ (ii) $N_{\rm p}=8000$ CSI measurements. Fig. 6c displays the empirical PDF of $\Delta\psi_{r}$, $r=\{1,2\}$, for $N_{\rm p}=8000$. The following conclusions are drawn:

• •

Even for as low as $N_{\rm p}=12$, the randomness introduced by $\psi_{r}(n),r=\{1,2\}$ is so large that it drives the average phase difference (horizontal red line) to zero. This observation substantiates that both $[\Delta\psi_{1}(n_{1},n_{2})]_{2\pi}$ and $[\Delta\psi_{2}(n_{1},n_{2})]_{2\pi}$ are zero mean random processes.

• •

The obvious linearity in Fig. 6b conforms with the derivations in (12) as was reported in earlier works [18].

• •

The drastic changes of $\Delta(\angle{\rm csi}^{(k)})=[k\Delta\psi_{1}+\Delta\psi_{2}]_{2\pi}$ is because of two effects: (a) The high dynamicity of receiver’s synchronization algorithms (b) the $\angle(\cdot)$ operation which delivers not the true angle but the wrapped-around version of it.

• •

The Gaussianity of $\Delta\psi_{r}$, $r=\{1,2\}$ is proved as follows: Since $\Delta(\angle{\rm csi}^{(k)})$ is a Gaussian process (per our observation), $\Delta(\angle{\rm csi}^{(k=0)})=\Delta\psi_{2}$ is Gaussian random variable. Noting that $\Delta\psi_{1}\perp\Delta\psi_{2}$, then ${\varphi}_{k_{0}\Delta\psi_{1}}(t)\cdot{\varphi}_{\Delta\psi_{2}}(t)={\varphi}_{\Delta(\angle{\rm csi}^{(k_{0})})}(t)$, where $\varphi_{a}(t)$ is the characteristic function of random variable $a$. Subsequently, the PDF of $\Delta\psi_{1}$ is attained using the Fourier transform, that is, $f_{\Delta\psi_{1}}=1/k_{0}\mathcal{F}\{{\varphi}_{\Delta(\angle{\rm csi}^{(k_{0})})}(t)/{\varphi}_{\Delta\psi_{2}}(t)\}$ which can be shown to be a Gaussian. This is shown in Fig. 6c.

• •

Finally, the knowledge of $\Delta\psi_{r}=\mathcal{N}(0,\sigma_{r}^{2})$ implies $\psi_{r}=\mathcal{N}(\mu_{1(2)},\sigma_{r}^{2}/2)$, $r=\{1,2\}$. This is true since the process $\psi_{r}(n)$ has the same distribution for different $n$. Yet, so long as the cyclic-prefix (CP) pre-advancement is performed at the receiver, deeming $\psi_{r}(n)$ as a zero-mean random variable [18] yields completely biased range estimates.

Discussion: These findings contradict some views on the uniformity of distributions $\psi_{r}$ [28, 29], an assertion seemingly made due to equating the statistical behaviour of $[\psi_{r}]_{2\pi}$ with that of $\psi_{r}$.

IV-B Estimating STO and SFO

The unpredictability of phase errors $\psi_{1}(n)$ in (12) stems from the following reasons:

• •

Randomness in $g_{1}(n)$ due to the opportunistic nature of WLAN access protocol.

• •

Randomness in $g_{1}(n)$ due to receiver’s ability to initiate calibration using any packet header on the air regardless of whether it was destined to it or not.

• •

Errors in estimating the amount of drift $\zeta_{\rm SFO}$ which depends on how badly the calibrating header is influenced by small scale fading.

• •

Errors in estimating the symbol boundary and $N_{\rm STO}$ which, again, depends on the fading nature of the channel.

• •

OFDM pre-advancement [20].

For these reasons, $\psi_{1}(n)$ is decorrelated for different $n$. Therefore, only CSI across frequency and space can be used to estimate $\psi_{1}(n)$. With this knowledge and given the linearity of the additive phase (in $k$) in (12), several previous works [2, 30, 31] adopted a simple CSI phase de-trending to eliminate $\psi_{1}(n)$. This estimator can more generally be expressed as

[TABLE]

where ${\rm csi}_{j_{\rm rx},j_{\rm ss}}^{(k)}$ is the $(j_{\rm rx},j_{\rm ss})$th element of the CSI matrix, $N_{\rm nz}=N_{\rm sc}-N_{\rm g}$ is the number of non-zero subcarriers and $N_{\rm g}$ is the number of guard subcarriers at both ends of spectrum that are not used to modulate any symbol. This is an exact estimator, i.e. $\psi_{1}(n)=\hat{\psi}_{1}(n)$, only when (i) the channel does not change variably between two adjacent subcarriers, that is $\mathfrak{h}^{(k)}_{j_{\rm rx},j_{\rm tx}}{\mathfrak{h}^{(k-1)}_{j_{\rm rx},j_{\rm tx}}}^{*}\approx|\mathfrak{h}^{(k)}_{j_{\rm rx},j_{\rm ss}}|^{2}$ and (ii) $\mathbb{E}\{\psi_{1}(n)\}=0$.

None of these two conditions is satisfied in reality: As shown in Fig. 6a, the true channel phase normally has a first-order linearity, hence, (14) estimates $\psi_{1}$ plus the linear phase term in $\mathfrak{h}_{j_{\rm rx},j_{\rm tx}}$, which is denoted by $\epsilon^{\rm ch}_{j_{\rm rx},j_{\rm tx}}$ hereinafter. In this situation, (14) becomes (often negatively) a biased estimator and compensating CSI using it (as in (16)) gravely impacts ranging accuracy possibly worse than keeping STO and ranging with the original CSI. The performance of (14) is studied for thousands of channel realizations and for two different STO+SFO drift. The bias of the estimator, caused by eliminating the first-order channel linearity $k\cdot\epsilon^{\rm ch}_{j_{\rm rx},j_{\rm tx}}$ was observed.

IV-B1 Alternative Estimators

In obtaining $\hat{\psi}_{1}(n)$, the following estimator was proven more effective in reducing the estimation error in lieu of (14).

Spatial/spectral Averaging

Given that all transmit/receive sub-channels experience the same hardware error, averaging can be performed in those dimensions as follows:

[TABLE]

Having obtained $\hat{\psi}_{1}$, compensation is performed with simple post multiplication with the CSI matrix as follows,

[TABLE]

IV-B2 Recovering Channel Phase Linearity

The goal is to subtract the first-order channel linearity $\epsilon^{\rm ch}_{j_{\rm rx},j_{\rm tx}}$ that is removed (along with phase errors) in (14)-(15). However, unless the true attenuations $\bm{\beta}$, path delays $\bm{\tau}$, and $N_{\rm mp}$ are precisely known in advance (which is actually the ultimate goal of positioning), no deterministic approach can find $\epsilon^{\rm ch}_{j_{\rm rx},j_{\rm tx}}$. Yet, with the knowledge that the channel-related term remains constant over the course of several packets, and leveraging the randomness in $\psi_{1}$, Algorithm 1 is used to remove the volatility contributed by SFO and find $\tilde{\psi}_{1}(n)$. This is corroborated when observing that $\tilde{\psi}_{1}(n)$ is closely independent of $j_{\rm rx}$ and $j_{\rm tx}$ (which is expected as per (12)) whereas $\hat{\psi}_{1}(n)$ varies across antennas.

IV-B3 STO Removal

The previous procedure designed to recover the channel linearity is incapable of eliminating the STO phase. This is because $N_{\rm STO}$ varies in much longer time-scale, hence, is somewhat fused into the channel phase $\mathfrak{h}_{j_{\rm rx},j_{\rm tx}}$. STO manifests itself as jumps at the end of PDP due to cyclic-shifting of CIR. This is because any phase shift due to STO in frequency domain ($k$) causes circular rotation by the same amount in time domain ($n$). Since, in indoor environments, transmitter-receiver are only several meters away and that bandwidth is limited (20MHz in IEEE802.11n), the first expected peak of true channel CIR (due to LoS arrival) often happens at $n$=0 or 1 which means that any $N_{\rm STO}>1$ causes that peak to appear at the end of the PDP (due to circular shift property).

This observation forms the basis to estimate $N_{\rm STO}$ through the following logic: The discrete CIR in (2) is a linear combination of shifted discrete Dirichlet functions. This is a periodic function with fundamental period $N_{\rm sc}$ that varies smoothly from one sample to the next. Therefore, jumps that are observed at the far-end of the PDP due to STO, can be detected and compensated for using Algorithm 2.

IV-C Removing CFO and CPO

Removing the linear phase terms produced by STO/SFO leaves CFO/CPO errors in (12) intact. As explained earlier, and similar to SFO, CFO is an accumulative error that has to be tracked by the receiver and compensated for. However, this compensation is crude and leaves behind some residual phase $\psi_{2}(n)$ on CSI. Estimating the latter is not an easy task. That is because:

• •

Similar to $g_{1}(n)$, not much is known about the calibration intervals $g_{2}(n)$ within the receiver.

• •

Small-scale fading highly deteriorates CFO compensation performed at the receiver using high-throughput short-training field (HT-STF).

• •

There is no differentiating dimension (as was $k$ in previous case) to distinguish the latter from the channel term.

• •

Whereas it was shown earlier that $\psi_{2}(n)$ has Gaussian distribution, it is not this variable that we observe but its wraparound version $[\psi_{2}(n)]_{2\pi}=2\pi\phi_{c}+[{2\pi}g_{2}(n)\zeta_{\rm CFO}/{N_{\rm sc}}]_{2\pi}$.

Interestingly, $[\psi_{2}(n)]_{2\pi}$ is uniformly distributed $\mathcal{U}(-\pi,\pi)$ as observed through experiments and simulations.121212Heuristically, when a random variable $X$ has a relatively high variance, the wrapped random variable $Y=[X]_{2\pi}$ behaves uniformly. Provided that the wireless channel undergoes insignificant change during $N_{\rm p}$ CSI measurements, we leverage the weak law of large numbers in Algorithm 3 to average out $\psi_{2}(n)$ instead of estimating it.

This only leaves CPO (also known as PLL initial phase) term $\phi_{c}$. When estimating range by finding the peaks of the PDP $|h_{j_{\rm rx},j_{\rm ss}}^{(m)}|^{2}$, whereby $h_{j_{\rm rx},j_{\rm ss}}^{(m)}=\mathcal{F}_{k}^{-1}(\exp(-2\pi i\phi_{c})\mathfrak{h}_{j_{\rm rx},j_{\rm ss}}^{(k)})$ is the discrete channel impulse response (CIR) on $({j_{\rm rx},j_{\rm ss}})$th link, TOF estimation is immune to CPO since the latter gets eliminated in $|\cdot|$ operation. This is the case even when the MUSIC algorithm is used for ToF estimation [32] as all subspace-based methods rely on calculating the covariance matrix, which automatically eliminates phase stagnancy.

Finally, Algorithm 3 also removes those spatial streams $(j_{\rm rx},j_{\rm ss})$ that are too weak (in average power sense) as those are contaminated with more noise and can potentially deteriorate ranging accuracy.

IV-D Dealing with Pre-advancement

None of what was discussed so far is able to tackle pre-advancement $\epsilon^{\rm pre}$. The latter is neither a constant (relative to channel) to be eliminated by high-pass filtering the data, nor too variable to be averaged out. Surprisingly, our experiments show that, in both Atheros and Intel chipsets, $\epsilon^{\rm pre}$ changes quicker when the channel undergoes variations and it varies slowly when the channel becomes stable. With the lack of knowledge on the dynamics of channel and the receiver, removing $\epsilon^{\rm pre}$ seems almost like an impossible task.

The fact that $\epsilon^{\rm pre}\in\mathbb{Z}$ makes things much easier though. Let’s denote the estimated transmit-receive distance obtained using post-processed CSI after removing all contaminations by $\hat{d}$. Due to the presence of $\epsilon^{\rm pre}$, the true range $d^{\rm truth}$ is among the hypothesis set $\mathcal{D}=\{\hat{d},\hat{d}+15m,\hat{d}+30m,\cdots\}$. Since we also have access to the received power through RSSI metric and knowing that several dB of power loss is expected as distance increases by $15$m,131313The exact power reduction due to path-loss depends on many factors. Per our observation, doubling the distance results in $5-10$dB power reduction almost all of these hypotheses in $\mathcal{D}$ are rejected except one. This idea is better illustrated in Fig. 8. Briefly, all the hypotheses are formed and, then, examined based on the matching between the tabulated RSSI (collected in offline phase) and the observed RSSI (collected in online phase). In the example of Fig. 8, this approach chooses $\hat{d}+30=36$m as the range estimate instead of the initial $\hat{d}=6$m.141414Note that RSSI is a relative index. Each chipset manufacturer can define their own “RSSI-Max” value. Cisco, for example, Cisco uses a $0-100$ scale, while Atheros uses $0-60$. Nonetheless, the higher the RSSI value is, the better the signal is. In case of Atheros, RSSI=$95$+$E$(dbm), where $E$ is the received signal energy.

IV-E Removing Baseband Effects

Having eliminated the synchronization sources of error, the CSI output of Algorithm 3 is given by

[TABLE]

As discussed before, CDD affects ranging as if transmitter/receiver are farther away from each other.151515For instance, with sampling time $T_{\rm s}=50$ns (in case of IEEE802.11n WLANs), a $d=400$ns cyclic shift is equivalent to $\delta=d/T_{\rm s}=8$ On the other hand, SMM makes the receiver believe that there are more multipath arrivals than there really is. While it might appear that removing CDD/SMM is a trivial task, this is an implementation-dependent matter whereof details are not always available from the chipset manufacturers. As a matter of fact, the same chipset might use different CDDs at different times. Luckily, our experiments in a conducted test setup with both Intel and Atheros chipset shows that when the channel is full rank, direct mapping takes place, where ${\bf Q}^{(k)}=\bf I$, and CDD is always removed by the receiver. This has not been the case when $N_{\rm ss}<N_{\rm tx}$.

In conclusion, when $N_{\rm ss}=N_{\rm tx}$, the CSI matrix ${\bf CSI}^{(k)}$ is the closest to the channel matrix ${\bf H}^{(k)}$ whose elements are given by

[TABLE]

V CSI-based ToF Estimation

V-A Spectral-Domain MUSIC Algorithm

Having cleaned the CSI samples from random and deterministic errors, our goal in this section is to use them to obtain range estimates. As discussed before, estimating the ToF of the signal using PDP has limited resolution due to bandwidth limitations of WiFi signals. On the other hand, [32] discovered that the subspace-based MUSIC algorithm that was traditionally used to estimate the AoA of the signal can also be used to estimate the ToF of the signal. The inherent appeal of MUSIC algorithm for ranging lies in the fact that its resolution is not only determined by the signal bandwidth but also the total signal-to-noise ratio (SNR). For that reason, MUSIC is among super-resolution algorithms. For more comprehensive treatment of the topic, readers are referred to [33, 32, 34]. MUSIC leverages the structure of the received samples in (18) to form

[TABLE]

where $\breve{{\bf csi}}=[\breve{{\rm csi}}^{(1)}\cdots\breve{{\rm csi}}^{(N_{\rm nz})}]^{\rm T}$ is a vector of frequency domain post-processed CSI samples and $\hat{{\bf csi}}={\bf A}\cdot{\bf\gamma}$ is the noise-free CSI vector. Based on (18), the steering matrix $[{\bf A}]_{N_{\rm nz}\times N_{\rm mp}}$ , steering vector $[{\bf a}(\tau_{j_{\rm mp}})]_{N_{\rm nz}\times 1}$, source vector $[{\bf\gamma}]_{N_{\rm mp}\times 1}$, and noise vector $[{\bf n}]_{N_{\rm nz}\times 1}$ are given by

[TABLE]

Assuming independence of noise ${\bf n}$ from the signal ${\bf\gamma}$ in (19) and $N_{\rm nz}>N_{\rm mp}$, the covariance matrix of $\breve{{\bf csi}}$ is given by ${\bf R}_{\breve{{\bf csi}}}={\bf R}_{\hat{{\bf csi}}}+{\bf R}_{{\bf n}}$ where the noise-free CSI covariance matrix ${\bf R}_{\hat{{\bf csi}}}={\bf A}{\bf R}_{{\bf\gamma}}{\bf A}^{\rm H}$ is only of rank $N_{\rm mp}$ (rank deficient). Therefore, the largest $N_{\rm mp}$ eigenvalues in decomposition ${\bf R}_{\breve{{\bf csi}}}={\bf E}\Lambda{\bf E}^{\rm H}$ are due to signal (multipath arrivals) and the rest are due to noise. This observation is then used to separate the noise subspace from the signal subspace by forming the following pseudo-spectrum

[TABLE]

which ideally peaks at about $\tau=\tau_{1}\cdots\tau_{N_{\rm mp}}$ (if multipaths are sufficiently apart). In (21), ${\bf E}_{n}=[{\bf e}_{1},\cdots,{\bf e}_{N_{\rm nz}-N_{\rm mp}}]$ are the noise eigenvectors corresponding to $N_{\rm nz}-N_{\rm mp}$ smallest eigenvalues of ${\bf R}_{\breve{{\bf csi}}}$. For the MUSIC algorithm to work, the following conditions are to be met [34]:

1. (i)

$N_{\rm sc}>N_{\rm mp}$ and ${\bf a}(\tau_{j_{\rm mp}})\nparallel{\bf a}(\tau_{j_{\rm mp}^{\prime}}),\;\forall j_{\rm mp}\neq j_{\rm mp}^{\prime}$ 2. (ii)

$\mathbb{E}\{{\bf n}\}=0$, $\mathbb{E}\{{\bf n}{\bf n}^{*}\}=\sigma\bf I$, $\mathbb{E}\{{\bf n}{\bf n}^{\rm T}\}=0$ (spatial whiteness) 3. (iii)

${\bf R}_{{\bf\gamma}}$ is non-singular (positive definiteness)

It is violation of (iii) that causes the MUSIC algorithm to completely fail. The latter is indeed the case when ranging with CSI in indoor environment due to the complete coherence between source vectors ${\bf\gamma}$ obtained for each new snapshot. Note that different snapshots are needed to calculate the empirical covariance matrix $\hat{{\bf R}}_{\breve{{\bf csi}}}=1/N_{\rm p}\sum_{j_{\rm p}=1}^{N_{\rm p}}{\breve{{\bf csi}}(j_{\rm p})\breve{{\bf csi}}(j_{\rm p})^{\rm H}}$ as ${{\bf R}}_{\breve{{\bf csi}}}$ is never given in practice. Provided that time-domain averaging is ineffective, we perform averaging in other domains as discussed next.

V-B Spectral Smoothing

Since $N_{\rm sc}\gg N_{\rm mp}$ and CSI are obtained by uniform sampling of CFR in the frequency domain, they possess invariant structure. The latter property means that the CSI vector can be partitioned into $N_{\rm b}$ spectral partitions of length $N_{\rm sc}^{\prime}$($>N_{\rm mp}$) to perform averaging across those partitions by treating them as time samples. The idea behind spectral smoothing can be explained with an example; when $N_{\rm b}=2$, (19) is written as

[TABLE]

where, $\breve{{\bf csi}}_{1}=\breve{{\bf csi}}^{(1:N_{\rm sc}/2)}$, $\breve{{\bf csi}_{2}}=\breve{{\bf csi}}^{(N_{\rm sc}/2+1:N_{\rm sc})}$, ${\bf A}_{1}={{\bf A}}_{(1:N_{\rm sc}/2,1:N_{\rm mp})}$, and ${\bf A}_{2}={{\bf A}}_{(N_{\rm sc}/2+1:N_{\rm sc},1:N_{\rm mp})}$. Now, given the definition of ${\bf a}(\tau)$ in (20), ${\bf A}_{1}={\bf A}_{2}\cdot{\bf M}$ where ${\bf M}={\rm diag}(z_{1}^{N_{\rm sc}/2}\cdots z_{N_{\rm mp}}^{N_{\rm sc}/2}),\;\;z_{j_{\rm mp}}=\exp(-2\pi i\Delta f\tau_{j_{\rm mp}})$.

With this property, a hardened covariance matrix can be obtained by averaging individual sub-array’s covariance matrices as ${\bf R}_{\rm ss}=0.5({\bf R}_{\breve{{\bf csi}}_{1}}+{\bf R}_{\breve{{\bf csi}}_{2}})={\bf A}_{1}{\bf R}_{{\bf\gamma}}^{\prime}{\bf A}_{1}^{\rm H}$ where ${\bf R}_{{\bf\gamma}}^{\prime}=0.5({\bf\gamma}{\bf\gamma}^{\rm H}+{\bf M}{\bf\gamma}{\bf\gamma}^{\rm H}{\bf M}^{\rm H})$ has an improved rank, thus closer to the true source covariance matrix. In the general case, covariance hardening can be achieved if $N_{\rm b}\geq N_{\rm mp}$ [35] through:

[TABLE]

where the constraints above are to ascertain that no sub-array contains $k=0$ subcarrier. This is an important consideration as no information is sent on $k=0$ (due to large DC current) causing ${\rm csi}^{(k=-1)}$ and ${\rm csi}^{(k=1)}$ to be $2\Delta f$ apart instead of $\Delta f$ (as is the case for other neighbouring subcarriers). Not paying attention to this when performing spectral smoothing adds to the estimation error.

Since the averaged covariance matrix has the exact structure as the original covariance matrix, MUSIC can be applied to obtain ToF estimates. This advantage came at the cost of reducing the effective length of the CSI vector ($N_{\rm sc}\rightarrow N_{\rm sc}^{\prime}$) and results in a tradeoff between resolution and stability of MUSIC solution.

V-C Forward-Backward Smoothing

The invariant structure of the CSI signal model can be used not only to smooth over the forward covariance sub-matrices but also the backward ones [36]. Mathematically, this operation is equivalent to

[TABLE]

where $\bf J$ is an $N_{\rm sc}\times N_{\rm sc}$ exchange matrix with ones only on the anti-diagonal and ${\bf R}_{\breve{{\bf csi}}}^{\rm FW}$ is the forward covariance matrix which is given by (23). Using forward-backward smoothing, the empirical covariance matrix in (24) gets closer to the true CSI covariance matrix improving the accuracy of the MUSIC estimator that heavily relies on the knowledge of this matrix.

V-D Decision Fusion

As detailed before, CSI is a matrix characterizing the channels between each transmit antenna $j_{\rm tx}$ and receive antenna $j_{\rm rx}$. Provided that transmit antennas (and receive antennas) are spatially sufficiently separated, CSI provides us with $j_{\rm rx}\times j_{\rm tx}$ independent sub-channels which can be used to obtain independent estimates of range. By fusing these decisions at last, one expects a more accurate final range estimate. One should note that CSI over different sub-channels cannot be stacked up to form a single covariance matrix (named fusion over raw measurement), as the steering matrix ${\bf A}$ in (19) is different for different transmit-receive sub-channels. Fig. 9 illustrates pseudo-spectrums calculated from measurement in corridors of University of Toronto (UofT) where transmitter and receiver were 45m apart.

Different pseudo-spectrums peak at different ranges ($\hat{d}_{j_{\rm rx},j_{\rm tx}}$) for two reasons: (i) some $(j_{\rm rx},j_{\rm tx})$ sub-channels are weaker thus giving rise to larger random shifts in their corresponding pseudo-spectrums (ii) multipath fading impacts sub-channels differently.

How do we combine $\hat{d}_{j_{\rm rx},j_{\rm tx}}$s to get a more accurate range estimate? Simply averaging them yields inaccurate range estimates. The solution we propose is to obtain all sub-channel pseudo-spectrums for all post-processed CSI packets and:

identify those $\hat{d}_{j_{\rm rx},j_{\rm tx}}$ that fluctuate the most (in time). Apply any outlier rejection method to remove that sub-channel from decision-making process. For example, that peak is $\hat{d}_{1,3}$ in Fig. 9. 2. 2.

weight the remaining pseudo-spectrum peaks with their corresponding averaged (w.r.t $k$) CSI magnitudes, i.e. $w_{j_{\rm rx},j_{\rm tx}}=1/N_{\rm sc}\sum_{k}{|{\rm csi}^{(k)}_{j_{\rm rx},j_{\rm tx}}|}$. The logic is that a weaker sub-channel is more impacted by the noise components when CSI matrix is being estimated by the receiver through simple zero-forcing (ZF) or minimum-mean-square (MMSE) algorithms. Since the weakness/strength of a sub-channel is manifested in the total energy spread across frequency components, the above weighting put more emphasis on the stronger sub-channels that are less impacted by estimation noise.

VI Experimental Results

We performed extensive experiments using IEEE802.11n Atheros 93xx chipset in two environments: (i) Anechoic chambers (multipath-free) in Fig. 7c (ii) corridors (multipath) in Fig. 7a and Fig. 7b. We collected a few thousands CSI, post-processed them using the techniques introduced in Section IV, formed the spatially-smoothed covariance matrix, applied spectral MUSIC algorithm, fused final decisions, and obtained one final estimate. We repeated this experiment for all the collected CSI set. Fig. 9b plots the empirical cumulative distribution function (ECDF) of the estimation error: According to this plot, the median accuracy of 60, 80, 90, 115, 140, 350, and 500cm is achieved when transmitter-receiver are 5, 10, 15, 20, 25, 30, and 40m apart respectively. The 90th percentile accuracy is about 1m (at 5m) and 1.7m (at 20m). Note that at 40m distance, the received power is about -100dB which is only a few decibels higher than the noise floor. One should note that using raw CSI yields range estimates that are off by several tens of meters. Provided that the range estimation error is even larger than the maximum WiFi coverage, which is about 20m in current MIMO-OFDM systems, there is truly no value in comparing calibrated and uncalibrated range estimates. Moreover, since our work is the first to exploit the CSI phase to obtain range estimates, it was impossible to benchmark our results with the previous studies that are based on angle of arrival (AoA) estimation.

Contrary to the claims made in the literature [2, 5], our results suggest that sub-meter ranging accuracy is possible using CSI obtainable from commodity WiFi. There are several observations that were made in the course of the project which are worth mentioning:

• •

With $20$MHz of spectrum available for WiFi signals, one shall not expect to resolve multipath components with MUSIC or with any high-resolution estimation algorithm. This is evident from Fig. 9a for 9 sub-channels of a highly fading propagation environment.

• •

Due to the limited resolvability power achievable with $20$MHz CSI, spectral smoothing with only a handful of partitions is able to sufficiently harden the covariance matrix and recover the only expected peak.

• •

When SNR is low (which happens at longer distances), receiver chooses to advance more than one symbol to make sure any mistake in detecting the symbol boundary estimation (using cross-correlation of HT-LTF sequence with the received header) wouldn’t cause erroneous outcomes.

• •

In situations when $d^{\rm truth}<\epsilon^{\rm pre}$, the pseudo-spectrum has a (one-sided) peak at $d=0$ which signifies the existence of a hidden (two-sided) peak at negative distances. When that’s the case, the RSSI-assisted approach won’t work as the knowledge of the hypothesis set $\mathcal{D}=\{\hat{d},\hat{d}+15m,\hat{d}+30m,\cdots\}$, delineated in sub-section IV-D, hinges on the knowledge of the two-sided $\hat{d}$. To cope with this situation, after post-processing CSI, one will have to deliberately rotate (leftwise) the CSI phase (before forming the pseudo-spectrum) by a few samples to recover peaks at negative distances (due to the existence of pre-advancement error) and de-rotate those peaks for the same number of samples to cancel out what was artificially added. Then RSSI-based hypothesis testing is applied to find out the true range estimate.

• •

This work does not consider tracking of user’s range parameter through combining motion information (obtainable using prevalent inertial measurement units (IMU)) with instantaneously obtained range estimates. Therefore, it is believed that such fusion of information (e.g. using Kalman filter) would yield more stable and accurate results.

VII Conclusion

The availability of channel-state information (CSI) from WiFi chipsets has made indoor positioning a reality. Leveraging the CSI, several recent studies have achieved decimeter accuracy through angle-of-arrival (AoA) estimation or wideband ranging. When it comes down to implementation, the CSI-based localization with time-of-flight (ToF) measurement from only a single channel ($20$ MHz of spectrum) has either not been pursued or led to inconsistent results. With the knowledge of fundamental limits of ranging and its reliance on the availability of bandwidth, the critical question has always been “whether sub-meter ranging is possible with such limited bandwidth”. This paper aims to answer this question. We dissect different deterministic and random phenomena happening in the transmitter and receiver hardware and establish the right model for CSI. We propose techniques to eliminate random phases introduced by the insufficiency of synchronization between transmitter and receiver. Our range estimates using the MUSIC algorithm show that median accuracy of $0.6$m ($1.15$m) is achievable in highly multipath line-of-sight environment where transmitter and receiver are $5$m ($20$m) apart. Moreover, with $90$th percentile accuracy of $1.1$m ($2$m) in $5$m ($20$m), we can claim that the proposed system is robust.