White Paper

An Overview of LTE Positioning

Introduction

Demand for mobile services is exploding and one of the fastest growing segments is Location-Based Services (LBS), primarily driven by two major requirements: emergency services and commercial applications. For emergency services, the most significant driver is the FCC’s E911 mandate in the US, which requires location (with certain accuracy limits) of emergency callers to be provided. A wide variety of commercial applications, such as maps and location-based advertising, also need fast and accurate positioning performance. In response to these needs, second and third generation networks (WCDMA, GSM, CDMA) have added support for several positioning technologies, which vary in their accuracy and Time to First Fix (TTFF) performance. They range from simple network-based schemes to complex trilateration and satellite-based solutions.

With the rollout of LTE comes a new focus on enabling E911 and LBS on these 4G networks, while providing a seamless transition between LTE and 2G/3G positioning services. Current LTE standards support three independent handset based positioning techniques: Assisted Global Navigation Satellite Systems (A-GNSS), Observed Time Difference of Arrival (OTDOA), and Enhanced Cell ID (ECID). There is new protocol for LTE called LPP (LTE Positioning Protocol), although SUPL 2.0 (Secure User Plane Location) remains a key User Plane protocol for enabling LBS and E911 on some networks, with its support for techniques such as Wi-Fi positioning. Taken together, these latest positioning techniques promise effective and efficient positioning performance in LTE networks, although at the cost of increased complexity.

www.spirent.com

An Overview of LTE Positioning

LTE Positioning Technologies

3GPP Release 9 for LTE defines support for three handset based positioning technologies: ECID, A-GNSS, OTDOA and LPP, a new positioning protocol. The following sections describe each of these technologies in detail.

Cell ID and Enhanced Cell ID

Cell ID (CID) positioning is a network based technique that can be used to estimate the position of the UE quickly, but with very low accuracy. In the simplest case, the position of the UE is estimated to be the position of the base station it is camped on. Cell ID positioning performance can be improved by measuring certain network attributes, a technique called Enhanced Cell ID (ECID). In ECID, the Round Trip Time (RTT) between the base station and the UE is used to estimate the distance to the UE. In addition, the network can use the Angle of Arrival (AoA) of signals from the UE to provide directional information. See Figure 1.

The RTT is determined by analyzing Timing Advance (TA) measurements, either from the eNodeB or by directly querying the UE. The eNodeB tracks two types of TA measurements—Type 1 and Type 2. Type 1 is measured by summing the eNodeB and the UE receive-transmit time differences. Type 2 is measured by the eNodeB during a UE Random Access procedure.

AoA is measured based on uplink transmissions from the UE and the known configuration of the eNodeB antenna array. The received UE signal between successive antenna elements is typically phase-shifted by a measurable value. The degree of this phase shift depends on the AoA, the antenna element spacing, and the carrier frequency. By measuring the phase shift and using known eNodeB characteristics, the AoA can be determined. Typical uplink signals used in this measurement are Sounding Reference Signals (SRS) or Demodulation Reference Signals (DM-RS).

This white paper provides an overview of positioning techniques, protocols and architecture supported in LTE networks (as of LTE release 9).

FCC E911 Requirement

2D error for a given set of measurements:

67% < 50m

95% <150m

LTE POSITIONING

A-GNSS, OTDOA, ECID

LPP SUPL 2.0

RTT, AoA

Figure 1: ECID positioning.

3

As stated earlier, CID positioning has very low accuracy, typically equating to the size of the cell the UE is camped on (which may be in the order of kilometres). ECID is able to provide better accuracy in comparison to CID; the main sources of error in ECID are receive timing uncertainty (which affects the RTT calculation) and multipath reflections.

ECID is able to provide better accuracy in comparison to CID; the main sources

of error in ECID are receive timing uncertainty (which affects the RTT

calculation) and multipath reflections.

SUMMARY OF CID/ECID POSITIONING

PRINCIPLE

Use knowledge of the serving cell, Round Trip Time and Angle of Arrival of the uplink signal to position the UE

KEY USE CASES

Quick, coarse fix as an input to other, more accurate positioning technologies Fall back methods in case A-GNSS/OTDOA are unavailable

ACCURACY

Typically 150m or coarser

www.spirent.com

An Overview of LTE Positioning

Assisted Global Navigation Satellite Systems (A-GNSS)

GNSS refers collectively to multiple satellite systems, such as GPS and GLONASS. With conventional standalone GNSS, the GNSS receiver in the mobile device is solely responsible for receiving satellite signals and computing its location. The receiver needs to acquire satellite signals through a search process; it must lock onto at least four satellites in order to compute a 3-D position. The acquisition process can be demanding in terms of battery and processing power, and TTFF can be long.

The performance of standalone GNSS can be significantly improved by a technique called Assisted GNSS. See Figure 2. In a typical A-GNSS implementation, the standalone GNSS facilities of the phone are augmented by data provided by the network, termed “Assistance Data”, which includes information the mobile GNSS receiver can use to accelerate the process of satellite signal acquisition. The final position can be calculated by either the UE or the network and shared with third parties (such as emergency PSAPs1). A-GNSS speeds up positioning performance, improves receiver sensitivity and helps to conserve battery power. A-GNSS works well outdoors and in scenarios where a reasonably good view of the sky is available. Performance is generally poor in environments with high obscuration and multipath, such as indoors and in dense urban settings.

Currently, two global systems are fully operational—GPS and GLONASS. Although mobile receivers have traditionally supported positioning using A-GPS alone, it is possible to use both satellite systems simultaneously to acquire a position. The advantage of this technique is to effectively increase the number of satellites available for signal acquisition, and it can improve performance in high-obscuration environments like cities. Assistance data can be provided by the LTE network for both GPS and GLONASS satellites (as well as Galileo and QZSS when these systems are fully operational).

SUMMARY OF A-GNSS POSITIONING

PRINCIPLE

Use standalone GNSS with help from the LTE network to speed up the position calculation process

KEY USE CASES

Highly accurate, technology of choice for positioning

ACCURACY

Typically 10—50m

NETWORK

Figure 2: A-GNSS positioning.1. PSAP - Public Safety Answering Point.

5

Observed Time Difference of Arrival (OTDOA)

OTDOA techniques are similar in principle to the GNSS position calculation methodology. The UE measures time differences in downlink signals from two or more base stations. Using the known position of the base stations and these time differences, it is then possible to calculate the position of the UE. Generally, the signals used for OTDOA are cell Reference Signals (RS). See Figure 3.

In LTE, the measured time difference between the RS from the serving cell and one or more neighboring cells is known as Reference Signal Time Difference (RSTD). In order to calculate the position of the UE, the network needs the positions of the eNodeB transmit antennas and the transmission timing of each cell (which can be challenging if the eNodeBs are asynchronous).

One of the biggest challenges faced by LTE OTDOA is the requirement to measure neighboring cell RS accurately enough for positioning. To overcome this problem, special positioning sub frames have been defined in Release 9 called Positioning Reference Signals (PRS). See Figure 4. These special reference signals can assist in the measurement of neighboring cell signals by increasing RS energy.

Figure 3: OTDOA positioning.

One of the biggest challenges faced by LTE

OTDOA is the requirement to measure neighboring cell RS accurately enough

for positioning. To overcome this problem, special positioning sub frames

have been defined in Release 9 called Positioning Reference Signals.

www.spirent.com

An Overview of LTE Positioning

The PRS is periodically transmitted along with the cell specific RS in groups of consecutive downlink sub frames. In a fully synchronized network, these positioning sub frames overlap, allowing for reduced inter-cell interference. In the case that the PRS patterns in two neighboring cells overlap, the network may mute the transmissions to improve signal acquisition. The network can also provide Assistance Data to the UE to aid its acquisition of the PRS. This data usually consists of relative eNodeB transmit timing differences (in the case of a synchronous networks), search window length, and expected PRS patterns of surrounding cells.

In LTE, OTDOA and A-GNSS may be used together in a “hybrid” mode. Since the fundamental positioning calculation approach is the same, a combination of satellites and base station locations can be used in the position calculation function. In this technique, the UE measures the RSTD for at least one pair of cells and satellite signals, and returns the measurements to the network, which is responsible for analyzing the measurements and calculating a position. This hybrid mode can be expected to provide better accuracy than OTDOA positioning alone, and is a key enabler for improving positioning accuracy in challenging environments.

Rs

Rs

Rs

Rs

Rs

Rs

Rs

Rs

Rs

Rs

Rs

Rs

Rs

Rs

symbols (time)

sub

carr

iers

(f)

Figure 4: Structure of the PRS.

SUMMARY OF OTDOA POSITIONING

PRINCIPLE

Use time difference of arrival of special Positioning Reference Signals (PRS) from 2 or more LTE base stations

KEY USE CASES

Fallback technology when GNSS is not available Positioning indoors and environments without clear sky visibility

ACCURACY

50—200m (based on simulation)

7

Positioning Architecture in LTE Networks

Positioning information exchange between the UE and the LTE network is enabled by the LTE positioning protocol. LPP is similar to protocols such as RRC, RRLP, and IS-801 already deployed in 2G and 3G networks². LPP is used both in Control Plane and User Plane (enabled by SUPL 2.0). The key entity in the core network that handles positioning is the Evolved Serving Mobile Location Center (E-SMLC). The E-SMLC is responsible for provision of accurate assistance data and calculation of position.

SUPL 2.0 can be deployed across 2G, 3G and 4G networks to provide one common user plane protocol. In initial LTE deployments, it is possible to use SUPL 2.0 with RRLP over LTE, which helps in enabling user plane positioning before implementing LPP. So in summary, positioning in LTE networks can be accomplished in one of three ways.

2. Note that RRLP only supports A-GNSS; delivery of LTE ECID and OTDOA information is not supported. However,

SUPL 2.0 has native support for sending information about the serving LTE and neighboring cells.

TIME DIFFERENCE OF ARRIVAL TECHNOLOGIES IN 2G/3G SERVICES—AN OVERVIEW

CDMA AFLT

In AFLT, CDMA pilot signals are used for measuring the time difference of arrival. CDMA base stations are synchronized with GPS time, which eliminates timing offsets between base stations and optimizes hybrid AFLT + A-GNSS positioning.

GSM E-OTD

In E-OTD, the UE measures the time difference of arrival at its receiver of burst signals from different BTS’s. A Location Measurement Unit (LMU) is used to synchronize BTS timing.

WCDMA OTDOA-IPDL

OTDOA in WCDMA is characterized by Idle Periods in Down Link (IPDL) to allow the UE to listen to neighboring cell signals which otherwise are subject to interference from the stronger serving cell signal.

DISADVANTAGES OF OTDOA IN GSM/WCDMA

Clock errors, lack of Base Station synchronization, cost of deploying LMUs and heavy signaling overhead discouraged use of these technologies for commercial purposes.

LTE POSITIONING METHODS

CONTROL PLANE

with LPP

SUPL 2.0 with RRLP

SUPL 2.0 with LPP

www.spirent.com

An Overview of LTE Positioning

LTE Positioning Protocol

Positioning over LTE is enabled by LPP, which is designed to support the positioning methods covered previously. LPP call flows are procedure based, where each procedure has a single objective (for example, delivery of Assistance Data). The main functions of LPP are:

• to provision the E-SMLC with the positioning capabilities of the UE

• to transport Assistance Data from the E-SMLC to the UE

• to provide the E-SMLC with co-ordinate position information or UE measured signals

• to report errors during the positioning session

LPP can also be used to support “hybrid” positioning such as OTDOA + A-GNSS.

In the case of network based positioning techniques, the E-SMLC may require information from the eNodeB (such as receive-transmit time difference measurements for supporting ECID). A protocol called the LPP-Annex (LPPa) is used to transport this information.

LPP

ECIDOTDOAA-GNSS

EXTENSIONS TO LPP (LPPE)

LPP was designed to enable the key positioning methods (with enhancements) available on 2G and 3G networks, and provide the minimum set of data necessary for positioning. The OMA has proposed extensions to LPP (LPPe) which can be used to carry more data to improve existing positioning techniques as well enable new methods (such as WLAN positioning). LPPe is primarily considered a User Plane positioning enabler.

9

Control Plane Positioning

With Control Plane implementations, most commonly used in emergency services, positioning messages are exchanged between the network and the UE over the signaling connection. In LTE, control plane positioning is enabled by the Mobility Management Entity (MME), which routes LPP messages from the E-SMLC to the UE using NAS Downlink Transfer Messages. See Figure 5. Control Plane positioning is quick, reliable and secure.

MME

E-SMLC

Figure 5: Control Plane Positioning.

CONTROL PLANE CALL FLOWS

Network Initiated Location Request (NILR)—Primarily used for emergency positioning. The network instructs the UE to provide a position, and may send unsolicited Assistance Data

Mobile Terminated Location Request (MTLR)—Initiated by the network, this differs from NILR with the addition of privacy features—the user can reject the location request.

Mobile Originated Location Request (MOLR)—The positioning session is initiated by the UE, which contacts the MME with the request. The remainder of the call flow is similar to NILR.

www.spirent.com

An Overview of LTE Positioning

User Plane Positioning

User Plane Positioning over LTE uses the data link to transmit positioning information, and is enabled by the SUPL protocol. SUPL 2.0 supports positioning over LTE as well as 2G and 3G networks, and provides a common user plane platform for all air interfaces³. SUPL does not introduce a new method to package and transport Assistance Data, instead it uses existing control plane protocols (such as RRLP, IS-801 and LPP). See Figure 6. SUPL uses the data link to transmit positioning information, and is enabled by an entity called the SUPL Location Platform (SLP). The SLP handles SUPL messaging, and is typically able to interface with the E-SMLC for obtaining Assistance Data. SUPL messages are routed over the data link via the LTE P-GW and the S-GW entities. See Figure 7.

SUPL 2.0 enables a complex feature set that is pertinent to mobile applications, including area based triggering, periodic reporting and batch reporting. SUPL 2.0 also features support for emergency positioning over the data link, and support for major positioning technologies (including multi-location technologies such as Wi-Fi positioning).

The primary positioning enabler in SUPL 2.0 is an underlying control plane protocol (such as RRLP or LPP). This implies that SUPL 2.0 can be used over any network, as long as the SLP and SMLC are able to interface and agree upon a common positioning protocol. This flexibility is very useful in initial LTE rollouts, as it allows operators to enable SUPL 2.0 positioning over an existing control plane protocol such as RRLP.

IP data connection over any air interface

IS-801

RRLP

RRC

LPP

SUPL 2.0

Figure 6: SUPL 2.0 supports multiple control plane protocols.

Figure 7: SUPL 2.0 network architecture.

3. For more information, please see the following reference guide “Secure User Plane Location 2.0

Reference Guide” and the two webinars “Unleash the Business Potential of LBS Over LTE Using

SUPL 2.0” and “SUPL 2.0 Conformance Requirements for LTE” on www.spirent.com.

P-GWS-GW

E-SMLC

SLPSUPL

11

Area Event Triggering

SUPL 2.0 features the use of geographical ‘triggers’, which enable the UE to report its position if it enters, leaves, or is within a particular area. Triggering may be enabled either by the network or by the SET, with the two entities agreeing on trigger criteria. Area Event triggers enable key mobile applications such as Check-in services, shopping deals and offers, location based advertising, and child location. The key factor determining the effectiveness of triggers is how accurate the obtained position is.

Emergency Positioning

Emergency Positioning in 2G and 3G networks has been processed over control plane, as user plane protocols did not have the necessary network elements to support such a requirement. SUPL 2.0 introduces an entity known as the Emergency SLP (E-SLP) which can co-ordinate with the IP Multimedia Subsystem (IMS) in LTE networks to enable positioning over an emergency call. The E-SLP functionality can be added to an existing SLP used by the network. When an emergency call is in process, the IMS coordinates the call with a Network Initiated Location Request from the E-SLP. Emergency positioning may override user notification and privacy settings, and receive priority over all non-emergency SUPL sessions. Emergency sessions are typically initiated by a Session Initiation Protocol (SIP) Push.

KEY TRIGGER CRITERIAType of trigger

List of target areas

Start and stop time

Measurement reporting criteria

Number of times to re-use the trigger

First report

Third report

SET starts here

No more reportsuntil SET leaves andre-enters area again

Second report

Targetarea

About Spirent Communications

Spirent Communications (LSE: SPT) is a global leader with deep expertise and decades of experience in testing, assurance, analytics and security, serving developers, service providers, and enterprise networks.

We help bring clarity to increasingly complex technological and business challenges.

Spirent’s customers have made a promise to their customers to deliver superior performance. Spirent assures that those promises are fulfilled.

For more information, visit: www.spirent.com

Contact Us

For more information, call your Spirent sales representative or visit us on the web at www.spirent.com/ContactSpirent.

www.spirent.com

© 2018 Spirent Communications, Inc. All of the company names and/or brand names and/or product names and/or logos referred to in this document, in particular the name “Spirent” and its logo device, are either registered trademarks or trademarks pending registration in accordance with relevant national laws. All rights reserved. Specifications subject to change without notice.

Americas 1-800-SPIRENT +1-800-774-7368 | sales@spirent.com

US Government & Defense info@spirentfederal.com | spirentfederal.com

Europe and the Middle East +44 (0) 1293 767979 | emeainfo@spirent.com

Asia and the Pacific +86-10-8518-2539 | salesasia@spirent.com

Rev B | 08/18

An Overview of LTE Positioning

Support for Multi-Location Technologies

One of the goals of SUPL 2.0 is to serve as a single, unifying user plane protocol independent of air interface. SUPL 2.0 can be used over 2G, 3G and LTE, with full support for the key positioning techniques and positioning protocols used in these networks. A key feature of SUPL 2.0 is flexibility in protocol use—for example, RRLP can be used to transfer assistance data over an LTE air interface.

SUPL 2.0 supports reporting of cell information for all major cellular wireless technologies as well as wireless LAN access point info. This feature, termed multi location ID, allows a location server to process many different types of measurements in order to calculate a more accurate position.

In future, SUPL 3.0 will support extensions to the LPP protocol (LPPe). These extensions serve to include additional information to enhance existing positioning techniques as well as to provide a bearer for new positioning methods (such as sensor positioning and Short Range Node positioning).

Summary

Since the LBS market is growing rapidly in size and scope, enabling high accuracy positioning both indoors and outdoors, is essential to validate the commercial promise of the enabling technology, as well as to meet the FCC’s emergency mandate in the US. 2G and 3G networks have used a variety of positioning techniques, such as A-GNSS, Cell ID and AFLT to satisfy positioning requirements. LTE introduces pivotal technologies that are not only able to provide adequate positioning performance for emergency and commercial purposes, but also to seamlessly transition from existing technologies. The deployment of LPP and SUPL 2.0 enables a diverse set of features, such as geofencing, emergency positioning over user plane, and multi-location technologies such Wi-Fi Positioning. However, this advanced feature set comes at the cost of increased complexity, requiring comprehensive conformance and performance testing to fully validate the technologies.

LTE introduces new positioning technologies that are complex and will require extensive verification to provide adequate positioning performance for emergency and commercial purposes.