Ferkans — Interactive Telecom Tutor

Why Positioning Belongs in a MIMO Book

For decades, communication and positioning were treated as independent problems: cellular networks carried bits, while GPS (and later Galileo, BeiDou, GLONASS) provided location. The separation made sense when indoor and urban-canyon coverage was unimportant and when wireless infrastructure was too sparse to triangulate reliably. That era is over. Cell-free massive MIMO deploys hundreds of cooperating APs per square kilometer — a dense grid of precisely calibrated anchors that is already in place for data delivery. The same pilots used for channel estimation carry timing and angle information about the user. The same fronthaul that collects baseband samples for joint decoding can collect them for joint localization. It would be wasteful not to exploit this.

This chapter builds the theory needed to turn the cell-free infrastructure into a high-precision positioning system. We start with classical ranging primitives (TOA, TDOA, AOA, RSSI), derive their Fisher information content, and then merge them with the communication rate analysis from TUatF Bound for Uplink Spectral Efficiency.

,

Definition:
The Four Ranging Observables

Consider a user at unknown position $\mathbf{p} \in \mathbb{R}^2$ transmitting a waveform $s(t)$ that is received by an anchor (AP) at known position $\mathbf{q}_l$ . Four scalar observables can be extracted from the received signal:

Time-of-arrival (TOA). The absolute propagation delay $\tau_l = d_l/c$ where $d_l = \|\mathbf{p} - \mathbf{q}_l\|$ and $c$ is the speed of light. Requires synchronized clocks between user and anchor.

Time-difference-of-arrival (TDOA). The difference $\Delta\tau_{l,1} = \tau_l - \tau_1$ between anchor $l$ and a reference anchor $1$ . Removes the unknown transmit time and hence the need for user-to-anchor synchronization — only inter-anchor synchronization is required.

Angle-of-arrival (AOA). The bearing $\phi_l$ under which the user is seen from anchor $l$ 's antenna array. Requires multiple antennas at the anchor.

Received signal strength (RSSI). The power $P_l = P_t \beta(d_l)$ , which is a monotone function of distance through the path-loss exponent. Does not require synchronization but is the least informative of the four.

In a cell-free deployment, TOA and TDOA come from the time-domain correlation of uplink pilots at each AP; AOA comes from the spatial covariance of the array response; RSSI comes from the squared norm of the received signal.

A practical positioning system rarely uses only one observable. Cell-free 5G NR positioning (Release 17) specifies multi-RTT (which combines two TOAs into a round-trip distance), UL-TDOA, and DL-AOA as complementary techniques. The chapter will show why combining observables improves the bound.

,

Time-of-Arrival (TOA)

The absolute propagation delay between a transmitter at position $\mathbf{p}$ and a receiver at position $\mathbf{q}_l$ , given by $\tau_l = \|\mathbf{p} - \mathbf{q}_l\|/c$ . Converting $\tau_l$ to distance requires knowledge of the transmit time, which in turn requires synchronized clocks.

Time-Difference-of-Arrival (TDOA)

The difference between two times-of-arrival measured at two different anchors from the same transmission. TDOA eliminates the unknown transmit time and leads to hyperbolic position loci. The classical solution is due to Chan and Ho (1994).

Angle-of-Arrival (AOA)

The direction from which a signal arrives at a receive antenna array, typically parameterized by azimuth $\phi$ and elevation $\theta$ . Estimation is performed via MUSIC, ESPRIT, or direct ML on the array covariance matrix.

Related: Aoa Estimation, Music

Round-Trip Time (RTT)

The total time for a probe signal to travel from node A to node B and back. In 5G NR, the gNB measures the round-trip time of positioning reference signals (PRS in DL, SRS in UL) to each UE. RTT/2 directly yields range without requiring clock synchronization between the UE and the gNB, making it the preferred positioning primitive in unsynchronized cellular deployments.

Position Error Bound (PEB)

The square-root trace of the inverse Fisher information matrix restricted to the position components: $\text{PEB} = \sqrt{\text{tr}(\mathbf{J}_{\mathbf{p}}^{-1})}$ . Any unbiased position estimator has root-mean-square error at least equal to the PEB. It is the positioning counterpart of the communication rate as a fundamental performance bound.

Theorem: CRB on TOA Estimation from a Bandlimited Pulse

Let the user transmit a baseband pulse $s(t)$ of duration $T$ and energy $E_s = \int |s(t)|^2 dt$ . Let anchor $l$ observe $y_l(t) = s(t - \tau_l) + w(t)$ with $w(t) \sim \mathcal{CN}(0, N_0)$ (white Gaussian noise, one-sided PSD $N_0$ ). The Cramer-Rao bound on any unbiased estimator $\hat{\tau}_l$ is

$\text{Var}(\hat{\tau}_l) \geq \frac{1}{8 \pi^2 \beta_{\text{rms}}^2 \cdot \text{SNR}_{l}}$

where $\text{SNR}_{l} = E_s/N_0$ is the integrated receive SNR and

$\beta_{\text{rms}}^2 \triangleq \frac{\int f^2 |S(f)|^2 df}{\int |S(f)|^2 df}$

is the squared root-mean-square bandwidth of $s(t)$ . Consequently, the CRB on the corresponding distance $\hat{d}_l = c \hat{\tau}_l$ is

$\text{Var}(\hat{d}_l) \geq \frac{c^2}{8 \pi^2 \beta_{\text{rms}}^2 \text{SNR}_{l}}$

The RMS bandwidth $\beta_{\text{rms}}$ is the natural measure of a waveform's time resolution. A wideband signal — with energy spread over a large frequency range — has a sharp autocorrelation peak, so small time shifts are easy to detect. A narrowband signal blurs the peak and makes timing ambiguous. This is why ultra-wideband (UWB) systems achieve centimeter-level ranging, while narrowband IoT positioning is stuck at tens of meters. The 5G NR positioning reference signal (PRS) uses up to 272 resource blocks (about 100 MHz) precisely to push $\beta_{\text{rms}}$ high.

Show Hint

Write $y_l(t) = s(t - \tau_l) + w(t)$ and compute $\partial \log p(y_l|\tau_l)/\partial \tau_l$ .

The Fisher information for a shift parameter is $J(\tau) = \int |\dot{s}(t-\tau)|^2 dt / (N_0/2)$ .

Parseval: $\int |\dot{s}(t)|^2 dt = \int (2\pi f)^2 |S(f)|^2 df = (2\pi)^2 E_s \beta_{\text{rms}}^2$ .

Proof

Log-likelihood for the shift parameter

Under the additive white Gaussian noise model, the log-likelihood is $\mathcal{L}(\tau_l) = -\frac{1}{N_0}\int |y_l(t) - s(t - \tau_l)|^2 dt + \text{const}$ . Differentiating, $\partial \mathcal{L}/\partial \tau_l = \frac{2}{N_0} \text{Re}\!\int (y_l(t) - s(t-\tau_l)) \dot{s}^*(t - \tau_l) dt$ .

Compute the Fisher information

Taking the negative expectation of the second derivative at the true $\tau_l$ and using $\mathbb{E}[y_l(t)] = s(t-\tau_l)$ , $J(\tau_l) = \frac{2}{N_0} \int |\dot{s}(t - \tau_l)|^2 dt = \frac{2}{N_0} \int |\dot{s}(t)|^2 dt$ , where the integral is shift-invariant.

Apply Parseval

By Parseval's theorem, $\int |\dot{s}(t)|^2 dt = \int (2\pi f)^2 |S(f)|^2 df = (2\pi)^2 E_s \beta_{\text{rms}}^2$ . Hence $J(\tau_l) = 8\pi^2 \beta_{\text{rms}}^2 (E_s/N_0) = 8\pi^2 \beta_{\text{rms}}^2 \text{SNR}_{l}$ .

Invert for the CRB

The CRB is $J(\tau_l)^{-1}$ . Multiplying by $c^2$ gives the distance CRB. $\blacksquare$

,

Key Takeaway

Time resolution = RMS bandwidth. The TOA variance scales as $1/(\beta_{\text{rms}}^2 \text{SNR})$ . Doubling the bandwidth cuts the ranging error in half, while doubling the SNR only cuts it by $\sqrt{2}$ . Wide bandwidth is the cheapest way to buy positioning accuracy — which is why 5G NR Release 17 expanded the positioning reference signal to up to 400 MHz in FR2.

Definition:
Fisher Information Matrix for Multi-Anchor Positioning

Let $\mathbf{p} = (p_x, p_y)$ be the unknown user position and assume anchors $l = 1, \ldots, L$ each provide a scalar observable $r_l$ with additive Gaussian noise of variance $\sigma_l^2$ :

$r_l = h_l(\mathbf{p}) + n_l, \quad n_l \sim \mathcal{N}(0, \sigma_l^2)$

The Fisher information matrix on $\mathbf{p}$ is

$\mathbf{J}(\mathbf{p}) = \sum_{l=1}^{L} \frac{1}{\sigma_l^2} \, \nabla h_l(\mathbf{p}) \, \nabla h_l(\mathbf{p})^T$

where $\nabla h_l(\mathbf{p}) = \partial h_l/\partial \mathbf{p}$ is the gradient of the observable with respect to position. The inverse $\mathbf{J}^{-1}$ is the covariance lower bound of any unbiased estimator.

The sum structure is the hallmark of independent measurements: each anchor contributes its own rank-1 information, and the total information is the sum. This is what makes the cell-free infrastructure so attractive for positioning — every AP adds independent rank-1 information, so doubling the number of APs doubles the Fisher information (if the new APs are in different directions).

,

Example: FIM with Two TOA Anchors in a Line

Compute the Fisher information matrix for a user at $\mathbf{p} = (p_x, 0)$ with two TOA-capable anchors at $\mathbf{q}_1 = (-a, 0)$ and $\mathbf{q}_2 = (a, 0)$ . Assume equal TOA variance $\sigma_\tau^2 = 1/(8\pi^2 \beta_{\text{rms}}^2 \text{SNR})$ at each anchor and $p_x \in (-a, a)$ (user between the anchors). What is the resulting position covariance, and why is $p_y$ unobservable?

Solution

Identify the observables

With $h_l(\mathbf{p}) = \|\mathbf{p} - \mathbf{q}_l\|/c$ , the noise variance on the range is $\sigma_l^2 = c^2 \sigma_\tau^2$ . Define $\sigma_r^2 = c^2 \sigma_\tau^2$ for brevity.

Compute the gradients

At $\mathbf{p} = (p_x, 0)$ , $\nabla h_1 = (p_x - (-a), 0)/\|\mathbf{p} - \mathbf{q}_1\|/c = (1, 0)/c$ if the user is to the right of anchor 1 ( $p_x > -a$ ). Similarly $\nabla h_2 = (-1, 0)/c$ for $p_x < a$ .

Assemble the FIM

$\mathbf{J}(\mathbf{p}) = \frac{1}{\sigma_r^2}\begin{pmatrix}1/c^2 & 0 \\ 0 & 0\end{pmatrix} + \frac{1}{\sigma_r^2}\begin{pmatrix}1/c^2 & 0 \\ 0 & 0\end{pmatrix} = \frac{2}{c^2 \sigma_r^2} \begin{pmatrix}1 & 0 \\ 0 & 0\end{pmatrix}$ . The FIM is rank-one (singular): we can estimate $p_x$ but have zero information about $p_y$ .

Interpret the geometric dilution

Collinear anchors cannot resolve the perpendicular coordinate. A third anchor off the axis, or switching to TDOA which has hyperbolic loci rather than collinear gradients, is required. This is the essence of the Geometric Dilution of Precision (GDOP) — anchor geometry, not just SNR, determines positioning accuracy.

Common Mistake: High SNR Does Not Imply Low Position Error

Mistake:

A common assumption, imported from communication engineering, is that increasing the SNR linearly improves positioning accuracy. One concludes that a well-designed cell-free network at 20 dB SNR automatically delivers centimeter-level localization.

Correction:

The Position Error Bound scales as $\text{PEB} \propto \text{GDOP}/(\beta_{\text{rms}} \sqrt{\text{SNR}})$ , where GDOP is a purely geometric factor determined by anchor placement. If all anchors lie on a line, GDOP along the perpendicular is infinite regardless of SNR. Even well-distributed anchors have GDOP that varies by a factor of 5-10 across the coverage area. Plotting the PEB over a 2D region (as we do in 📊Position Error Bound Heatmap over a Cell-Free Deployment) is the only reliable way to confirm that a deployment meets its accuracy targets — SNR numbers alone are misleading.

TOA Cramer-Rao Bound vs Bandwidth and SNR

Visualize how the TOA standard deviation $\sigma_\tau = 1/\sqrt{J(\tau)}$ depends on the RMS bandwidth $\beta_{\text{rms}}$ and receive SNR. Converts to distance error in meters using the speed of light. The plot makes concrete why UWB and wideband 5G NR positioning achieve centimeter accuracy while narrowband cellular positioning is limited to meters.

Parameters

Min bandwidth (MHz)5

Max bandwidth (MHz)500

Receive SNR (dB)10

Pulse shape

Historical Note: From LORAN to GPS to 5G NR Positioning

1942--2022

Time-difference-of-arrival positioning was deployed operationally long before GPS. The LORAN (LOng-RAnge Navigation) system began in 1942 as a wartime project at the MIT Radiation Laboratory, using synchronized master-secondary transmitter pairs to generate hyperbolic position lines. LORAN-C, the civilian version, remained active in North America until 2010 — a remarkable 68-year lifespan.

The Global Positioning System turned the geometry on its head: instead of terrestrial anchors at known positions, it placed 24 synchronized transmitters in medium Earth orbit. Each receiver solves a TDOA problem against four or more satellites, with atomic clocks onboard the satellites providing the reference. GPS achieved initial operational capability in 1993.

Cellular positioning languished until 3GPP Release 9 (2009), which introduced OTDOA (Observed TDOA) for LTE emergency services. The real leap was Release 17 (2022), which brought UL-TDOA, multi-RTT, and DL/UL-AOA into 5G NR with a centimeter-target accuracy for industrial IoT. The cell-free architecture discussed in this chapter is the natural next step: every AP becomes a LORAN master-secondary, but with 100 MHz of bandwidth instead of 100 kHz.

,

Quick Check

A positioning system uses a pulse with signal bandwidth $W = 100$ MHz but a triangular frequency response that weights the band edges heavily. If a flat (rectangular) spectrum of the same occupied bandwidth has $\beta_{\text{rms}} = W/\sqrt{3}$ , which statement is correct about the triangular pulse?

The triangular pulse has the same $\beta_{\text{rms}}$ because occupied bandwidth is identical.

The triangular pulse has higher $\beta_{\text{rms}}$ and hence a tighter TOA CRB.

The triangular pulse has lower $\beta_{\text{rms}}$ because it is less 'concentrated'.

RMS bandwidth is only defined for baseband pulses.