0 1 2 3 4 5 6 Time (s) 7 8 9 10 × 10-3 " ts Bandwidth BBD Convert Data Sampling to Frame F 5 10 Time (s) 15 20 2 0 -2 -4 0 5 10 Time (s) 15 20 Cell ID Spk BBD ts (0) Sek Correlator Slk fD (0) 15 20 × 104 In-Phase Quadrature 1 0 -1 0 5 Frequency Discrim. FLL Filter Carrier Phase Discrim. PLL Filter Carrier Phase Discrim. DLL Filter SSS Generator Timing Information Extraction CRS 10 Time (s) 10 Time (s) 15 20 1 1-z −1 2πfDk " (c) F 2 5 " Cell ID Calculation z −1 " (1) NID " (2) SSS Detection Tracking Acquisition PSS Detection NID -0.2 0 (f) (a) BBD 0 Prompt Correlation (Sp) 0 -60 0 0.1 -0.1 -40 SSS Carrier Phase Error (m) 20 -20 (b) fc Carrier Phase Error (°) PSS Doppler Frequency (fD) (Hz) Correlation Amplitude × 103 " 5 4 3 2 1 0 5 4 3 2 1 0 ts 1 ωc NCO NCO Channel Estimation (e) F MIB Decoding Number of Antennas (g) Frame No. System Information Extraction PCFICH CFI Decoding PDCCH Decoding DCI ASN.1 Decoding SIB4 PDSCH SIB4 Extraction SIB1 Decoding 0 Pseudorange (m) Cell ID -10 -20 -30 Neighboring Cell ID Bandwidth Number of Antennas 0 5 (d) 10 Time (s) 15 20 (h) FIGURE 6. The LTE SDR architecture and results. (a) The LTE signal is 1) received by the receiver, 2) downmixed to baseband, and 3) converted to the frame structure by knowing the frame start time. (b) Correlation of the real LTE signal with PSS and SSS. (c) LTE signal acquisition. (d) Extracting relevant timing and positioning information. (e) Tracking architecture. (f) Tracking results: code and phase errors, Doppler frequency and in-phase and quadrature components of the prompt correlation. (g) Extracting high-precision frame timing by CRS. (h) Pseudorange obtained from LTE signal. F: Frame, BBD: base-band data (initial bias is removed in this figure). a dual-channel USRP. The GPS signals were collected on a separate single-channel USRP. Over the course of the experiment, the receiver had access to LTE signals transmitted from two eNodeBs and eight GPS SVs. Due to the environment layout, the GPS signals were unobstructed; however, 120 signals from the LTE eNodeBs experienced multipath. The LTE transmission bandwidth was measured to be 20 MHz, and the CRS signals were utilized to estimate the channel impulse response, and subsequently alleviate the multipath [41]. Samples of the received signals were stored for offline IEEE SIGNAL PROCESSING MAGAZINE | September 2017 |