Signal Processing - September 2017 - 119

representing sector ID and group ID of the eNodeB, respectively.
Once the PSS and SSS are detected, the UE can estimate the
frame start time, ts, and the eNodeB's cell ID.

CRS
The CRS is a pseudorandom sequence, which is uniquely
defined by the eNodeB's cell ID. It is spread across the entire
bandwidth and is transmitted mainly to estimate the channel
frequency response. The CRS subcarrier allocation depends
on the cell ID, and it is designed to keep the interference
with CRSs from other eNodeBs to a minimum. Since CRS
is transmitted throughout the bandwidth, it can accept up to
20 MHz bandwidth.

LTE SDR architecture
To obtain the pseudorange to each eNodeB, the UE must execute several steps: 1) acquisition, 2) system information extraction, 3) tracking, and 4) timing information extraction. These
steps are summarized in Figure 6 and are discussed next.

Acquisition
After receiving the LTE signal and downmixing to baseband
[Figure 6(a)], the first step in a receiver is to acquire an initial
estimate of frame start time and Doppler frequency. By correlating the locally generated PSS and SSS with the received
signal, the frame timing is obtained. Figure 6(b) shows the correlation results of PSS and SSS with a real LTE signal. Next,
the Doppler frequency is estimated using the received signal
and its CP [44]. The block diagram of the acquisition step is
presented in Figure 6(c).

System information extraction
Relevant parameters for navigation purposes including the
system bandwidth, number of transmitting antennas, and
neighboring cell IDs are provided to the UE in two blocks, a
master information block (MIB) and system information block
(SIB). The receiver must decode the data of several transmitted physical channels to be able to extract relevant navigation
information. These channels include 1) physical control format indicator channel (PCFICH), 2) physical downlink control
channel (PDCCH), and 3) physical downlink shared channel
(PDSCH). These steps are presented in Figure 6(d).

Tracking
After acquiring the LTE frame timing and extracting the relevant navigation information from the received signal, a UE
must continue tracking the frame timing for two reasons: 1)
to produce a pseudorange measurement and 2) continuously
reconstruct the frame. In the tracking architecture shown in
Figure 6(e), SSS is exploited for tracking the frame timing. The
components of the tracking loops are a frequency-locked loop
(FLL)-assisted PLL and a carrier-aided DLL.
The main components of an FLL-assisted PLL are a phase
discriminator, a phase loop filter, a frequency discriminator, a
frequency loop filter, and a numerically controlled oscillator
(NCO). The reference signal SSS is not modulated with other

data. Therefore, an atan2 discriminator, which remains linear
over the full input error range of ! r, could be used without the
risk of introducing phase ambiguities.
In the DLL, the prompt, early, and late correlations are calculated by correlating the received signal with a prompt, early, and
delayed versions of the SSS sequence, respectively. The objective
of the DLL is to track the null of the S-curve, which is the difference between the early and late correlations. Figure 6(f) shows
the tracking results.

Timing information extraction
The SSS code start time estimated in the tracking loop is
used to reconstruct the transmitted LTE frame. In LTE systems, PSS and SSS are transmitted with the lowest possible
bandwidth. Consequently, the timing resolution obtained from
these signals is low. To achieve higher localization precision,
CRS can be exploited. First, the channel impulse response is
estimated using CRS. Then, the TOA is estimated by using the
first peak of the estimated channel impulse response. This step
is presented in Figure 6(g), and the obtained pseudorange is
shown in Figure 6(h).

Navigation framework and experimental results
Different methods to extract LTE pseudorange have been
proposed. The estimation of signal parameters via rotational
invariance technique is used in [40] to extract the pseudorange,
which provides accurate results but is complex to implement.
An SDR that tracks CRS exclusively, which has lower complexity compared to the LTE SDR discussed in this article,
was proposed in [34]. However, it has lower precision, since it
tracks the maximum of the channel impulse response amplitude; therefore, the precision is limited to the bandwidth of
the CRS.
It is commonly assumed in the literature that the receiver
has knowledge of the eNodeB's clock error [34] or that the
receiver solves for the clock error and removes it by postprocessing [21], [36], [40]. In this article, an EKF is used to
estimate the UE's position and velocity states and the difference between the UE's clock bias and eNodeBs' and between
the UE's clock drift and the eNodeBs'. The UE's position and
velocity states were assumed to evolve according to velocity
random walk dynamics, and the clock bias and clock drift
dynamics were modeled as a double integrator, driven by noise
[33]. The eNodeBs' positions are assumed to be known to the
UE. Also, the UE had knowledge of its own initial position,
velocity, clock bias, and clock drift (from GPS) before it started
navigating with LTE signals.
To evaluate the performance of the LTE SDR, a field test
was conducted with real LTE signals in a suburban environment. For this purpose, a ground vehicle was equipped with
three antennas to acquire and track 1) GPS signals and
2) LTE signals in two different bands from nearby eNodeBs.
The LTE antennas were consumer-grade 800/1,900-MHz
cellular omnidirectional antennas, and the GPS antenna
was a surveyor-grade Leica antenna. The LTE signals were
simultaneously downmixed and synchronously sampled via

IEEE SIGNAL PROCESSING MAGAZINE

September 2017

119

Table of Contents for the Digital Edition of Signal Processing - September 2017