This review paper presents within a common framework the mobile station positioning methods applied in 2G, 3G, and 4G cellular networks, as well as the structure of the related 3GPP technical specifications. The evolution path through the generations is explored in three steps at each level: first, the new network elements supporting localization features are introduced; then, the standard localization methods are described; finally, the protocols providing specific support to mobile station positioning are studied. To allow a better understanding, this paper also brings a brief review of the cellular networks evolution paths.
At first, the main drive behind the development of positioning techniques to support location services (LCS) in cellular networks was the need to locate any mobile station (MS) originating emergency calls. The Federal Communications Commission (FCC) issued the first regulation concerning the availability and accuracy of the localization of such calls in the USA, as far back as
This paper starts explaining the intrinsic positioning capabilities available in any cellular system and then describes the functions that have been added by the Third-Generation Partnership Program (3GPP) in the RAN and core networks through the generations—from the second generation (2G) to the fourth generation (4G)—to support enhanced LCS applications. To allow a better comparison, the same structure is used for all generations: we describe, first, the new network elements, then the standard localization methods, and finally the most important protocols supporting enhanced LCS functions.
There were several 2G cellular systems, but the most important ones—as they were the starting points of two families of digital technologies, as shown in Figure
Evolution path of the two cellular technologies families: GSM (above) and CDMA (below). This timeline is greatly simplified; many intermediary standards have been ruled out. Only the evolution cornerstones are represented. The figure also brings some key features introduced by each standard, such as maximum achievable data rates, multiple access, and modulation techniques.
Along the years, data traffic on cellular networks kept increasing and new technologies supporting higher rates were demanded. Obviously, something beyond CS data was required. The General Packet Radio Service (GPRS) technology introduced the packet-switched (PS) domain in the GSM core network. GPRS uses the same modulation scheme of GSM in the RAN—Gaussian Minimum-Shift Keying (GMSK)—but, by assigning multiple time slots per user and using more efficient coding schemes, reaches higher data rates: up to
Enhanced Data Rates for GSM Evolution (EDGE), Universal Mobile Telecommunications System (UMTS), and cdma2000 1xRTT (1x Radio Transmission Technology) were the first third-generation (3G) systems. While EDGE and UMTS belong to the GSM evolution path, 1xRTT is part of the cdmaOne family.
EDGE improved GPRS rates by using a modulation scheme of higher spectral efficiency,
UMTS shares essentially the same core network of GSM/GPRS/EDGE systems. However, the UMTS RAN is completely different from the GSM/GPRS/EDGE RAN (GERAN). While the GERAN uses
On the cdmaOne evolution path, cdma2000 1xRTT, defined by IS-2000, reached downlink rates of up to
The next step on the evolution path of the cdmaOne family was 1xEVDO (1x Evolution Data Optimized), defined by IS-856. 1xEVDO uses adaptive modulation and coding (AMC), assigning forward error correction (FEC) codes with lower redundancy—that is, with higher code rates—and modulation schemes of higher spectral efficiency (e.g., QAM (Quadrature Amplitude Modulation) with
On the GSM family, High-Speed Downlink Packet Access (HSDPA) significantly improved UMTS downlink data rates, using fast physical layer retransmission and other techniques similar to those already adopted in 1xEVDO, such as AMC and improved scheduling algorithms to increase cell throughput [
Originally, the 3GPP 4G system was referred to as System Architecture Evolution (SAE), with a core network known as Evolved Packet Core (EPC) and RAN called Long-Term Evolution (LTE). However, the LTE acronym ended up being used to designate the whole system. LTE has RAN and a core network that are completely different from previous UMTS systems. LTE core network—the EPC—has only the PS domain, so CS voice service is not supported, as shown in Figure
Schematic representation of the GSM/GPRS/EDGE, UMTS, and LTE networks. The figure shows that GSM and UMTS share the same core network. In GSM network, the BTS is connected to the core network through the Base Station Controller (BSC). In the UMTS network, Node B is connected to the core network through the Radio Network Controller (RNC). The evolved Node B (eNB) in the LTE network has both Node B and RNC functions and is directly connected to the EPC. GSM and UMTS core network CS domain connects to other Public Switched Telephone Networks (PSTNs), while the PS domain connects to other Packet Data Networks (PDNs). The EPC in LTE has only the PS domain. In both UMTS and LTE, the MS is referred to as User Equipment (UE).
The 3GPP is an ensemble of six standardization groups: ARIB (Association of Radio Industries and Businesses), ATIS (Alliance for Telecommunications Industry Solutions), CCSA (China Communications Standards Association), ETSI (European Telecommunications Standard Institute), TTA (Telecommunications Technology Association), and TTC (Telecommunication Technology Committee). Those groups are referred to as 3GPP Organizational Partners, and they work together to issue technical specifications (TSs) and technical reports (TRs) regarding the radio access network, the core network, and services of GSM/GPRS/EDGE, UMTS, and LTE mobile telephony cellular systems.
The 3GPP specifications are grouped into releases, series, and stages, as follows:
Frozen 3GPP releases from 1997 to 2013.
Release | Spec. version number | Freeze date |
---|---|---|
Rel-11 | 11.w.u | June 2013 |
Rel-10 (LTE-Advanced) | 10.w.u | June 2011 |
Rel-9 | 9.w.u | December 2009 |
Rel-8 | 8.w.u | December 2008 |
Rel-7 | 7.w.u | December 2007 |
Rel-6 | 6.w.w | March 2005 |
Rel-5 | 5.w.u | June 2002 |
Rel-4 | 4.w.u | March 2001 |
R99 | 8.w.u (GERAN) | March 2000 |
R98 | 7.w.u | Early 1999 |
R97 | 6.w.u | Early 1998 |
R96 | 5.w.u | Early 1997 |
The title of each TS shows the series, release, and version. The general format of a 3GPP specification title is TS xx.yyy Vzz.w.u, for series
Different levels of location awareness are inherent to any metropolitan area network (MAN) with wireless radio access, to allow call forwarding and packet routing to any MS and call and session continuity when the MS moves from one base station transceiver (BTS) coverage area to another [
Figure
Location resolution hierarchy within a GSM cellular network.
The cellular networks intrinsic positioning capabilities can be enhanced with specific measurements and signals that are used as support data for the position calculation. The following sections show how it is achieved in 2G, 3G, and 4G cellular networks.
In the GERAN LCS architecture two network elements have been added to provide specific support to LCS [
MS-assisted EOTD position fix: the SMLC uses RTD and OTD measurements sent by the LMU and the target MS, respectively. This scenario represents a mobile terminated location request (MT-LR) [
Simplified scenario of an MS-assisted A-GPS position fix. The message flow shown here is a higher layer abstraction. Some specific position related protocols and messages are described in Sections
The SMLC is part of the GSM Base Station Subsystem (BSS) and can be either a standalone element or integrated into the BSC. The SMLC manages the position fix process. It receives and relays position location requests to (in the case of network initiated location requests) and from (in the case of MS initiated location requests) the MS. It also receives measurements made by the target MS and by LMUs, as well as Global Navigation Satellite Systems (GNSS) signals, which might assist the target MS positioning. The SMLC selects the localization technique to be used, based on the availability of LMUs and cells and on the specific positioning service requirements, like accuracy and position fix delay, as defined by the LCS client [
3GPP technical specifications define two types of LMUs [
LMUs time measurement accuracy for positioning methods supported in GSM networks, under different channel conditions, is specified in [
The GMLC allows communication of the SMLC with LCS clients external to the PLMN. The GMLC implements functions like charging and billing data for LCS, coordinate system transformation (between the coordinate system adopted at the SMLC and the one used by the external LCS client), and verification and authorization (i.e., it verifies if the LCS client is allowed to locate the client) [
GSM/GPRS/EDGE LCS architecture has four standard positioning methods [
TA positioning is also called E-CID (Enhanced Cell Identity) [
EOTD is a hyperbolic multilateration positioning method. Hyperbolic methods rely on time difference of arrival (TDOA) measurements to estimate the target MS position. There is a TDOA measurement for each pair of reference nodes, yielding a hyperbolic line-of-position (LOP) (a LOP is the loci of all points (coordinates) where the MS can be located; i.e., the LOP is the set of all candidate solutions for the MS positioning problem), with the two reference stations as focuses. As two hyperbolas might intercept at two points, at least three hyperbolic LOPs—and therefore four reference nodes—are required to yield an unambiguous position fix. If available, more than four reference nodes might be involved in an EOTD position fix, to improve accuracy. Two types of EOTD localization are supported in the GERAN [ MS-assisted type: the MS sends measurements to the SMLC, which then calculates the MS position. MS-based type: the MS calculates its position using assistance data broadcasted by the network.
Unlike the cdmaOne RAN, whose BTSs transmissions are kept tightly synchronized using Global Positioning System (GPS) signals as a time reference, the GERAN is asynchronous. So, time corrections are required before using TDOA measurements. These time corrections are provided by the LMUs and are called Real-Time Differences (RTDs). Consider that bursts sent from BTS1 and BTS2 are received at a nearby LMU at instants
Let us consider an example of an MS-assisted EOTD position fix, as shown in Figure
To support MS-based EOTD position fixes, the SMLC broadcasts through the CBC assistance data to allow the MS to calculate its position. Some of the contents of the broadcast EOTD assistance message include neighbor cells RTD values; RTD drift factor values; and serving cell and neighbor cells geographic coordinates [
Like EOTD, UTDOA is also a hyperbolic multilateration positioning technique [
In UTDOA, LMUs measure the time of arrival (TOA) of bursts ordinarily generated by the MS while in dedicated mode (circular multilateration [
The most widespread GNSS currently in use is GPS. The GPS system comprises three segments [ The space segment, composed of a constellation of up to The control segment, comprising all the nine ground stations involved in the system monitoring. The user segment, composed of all military and civilian GPS receivers.
The satellites are equipped with highly precise atomic clocks and transmit at two carrier frequencies,
GPS enabled MSs might operate in autonomous or assisted mode [
In autonomous mode, the MS is equipped with a fully functional GPS receiver and is capable of calculating its position without any communication with the cellular network. However, this mode has some disadvantages. Without assistance data from the PLMN, the MS has to scan the entire code phase (from
In assisted mode, or A-GPS positioning, the MS receives assistance data from the cellular network. The GPS Assistance Data Message includes the list of satellites that are visible at the target MS current location; the network is capable of starting with a coarse estimate of the MS location, as explained in Section
The operation of A-GPS requires the establishment of a GPS reference network, also known as a wide-area reference network (WARN)—whose receivers are placed at fixed known locations and with clear view of the sky, so that they can operate continuously [
Figure
RRLP is the specific LCS protocol in GSM/GPRS/EDGE networks. RRLP is part of Layer Measure Position Request: used by the SMLC to request location measurements (in MS-assisted positioning) or location estimates (in MS-based positioning) from the MS. Measure Position Response: used by the MS in response to a Measure Position Request; it contains location measurements, location estimates, or an error indicator. Assistance Data: used by the SMLC to send EOTD or A-GPS assistance data to the MS. Assistance Data Acknowledgment: used by the MS to acknowledge the correct reception of a complete Assistance Data component. Protocol Error: used by the receiving entity to notify the sender entity that there is a problem that prevents the completion of a requested procedure.
The Assistance Data Delivery Procedure allows the SMLC to send assistance data to the MS for location measurements (in MS-assisted mode) or location calculation (in MS-based mode). The message flow between the two entities (SMLC and MS) in this procedure is shown in Figure
RRLP Assistance Data Delivery Procedure.
The Position Measurement Procedure allows the SMLC to request and receive location measurements and location estimates from the MS (according to the 3GPP definition of this procedure [
RRLP Position Measurement Procedure.
When a receiving entity—either the SMLC or the MS—detects that some data is missing or receives erroneous data, a Protocol Error message is sent with an error code indicating the error type, as listed in Table
RRLP error codes.
Error code | Description |
---|---|
| Undefined |
| Not enough BTSs |
| Not enough satellites |
| EOTD Location Assistance Data missing |
| EOTD Assistance Data missing |
| A-GPS Location Assistance Data missing |
| A-GPS Assistance Data missing |
| Method not supported |
| Not processed |
| Ref. BTS for GPS not serving BTS |
| Ref. BTS for EOTD not serving BTS |
In MS-based positioning, upon reception of a Measure Position Request, the MS replies with a Measure Position Response message containing its location. However, no authentication is used. As a result, a third party might act as the SMLC, send a Measure Position Request message, and obtain the target MS coordinates. It is not an identity privacy violation in itself, because, to send the RRLP messages to the MS, the eavesdropper already has the target MS unique identifier (the IMSI—International Mobile Subscriber Identity). However, this is a violation of location privacy. It is even more serious as the subscribers may not even be aware that an RRLP session is taking place. The RRLP location privacy weaknesses were exposed during a large GSM field test carried at the
GSM/GPRS/EDGE and UMTS networks have completely different RANs but share most core network elements. As a result, the same elements defined for 2G networks remain in the 3G LCS implementation: the LMUs, the GMLC, and the SMLC—which in 3G networks is incorporated into the RNC [
UMTS LCS architecture has four standard positioning methods [
Cell ID (CID) positioning, also known as cell of origin (COO), is a proximity-based method, as it returns as the MS location estimates the geographic coordinates associated with the serving cell (which is assumed to be the closest to the target MS) [
One of the E-CID alternatives, CID + RTT, achieves a much higher precision in UMTS than in GSM networks, due to the much higher bandwidth in WCDMA. This improves the spatial resolution of RTT values: from
CDMA and WCDMA might suffer from a condition referred to as the “near-far” problem: the reception at the User Equipment (UE) of strong signals from a nearby BTS might make it impossible to detect and demodulate the signals from more distant BTS. This happens because, as all cells share the same downlink frequency, in the reception of the signals of a given cell the energy sum of signals from all other cells acts as noise. If one cell—the near one—is received with a very high energy, the SNR of a distant cell—the far one—will be very low.
In downlink hyperbolic multilateration methods, such as EOTD, the UE must detect the TOA of signals from at least four geographically dispersed cells. The near-far problem might prevent the UE from achieving this minimum number of measurements required to obtain an unambiguous position fix. In fact, EOTD would be usable only at the border of each cell coverage area [
To prevent this problem in UMTS, 3GPP has proposed OTDOA-IPDL, which is an adaptation of EOTD positioning to WCDMA networks [
Even though OTDOA-IPDL improves OTDOA availability, it is still hard to obtain measurements from at least four cells in a UMTS network. In fact, this is caused by one of the most fundamental aspects of WCDMA networks planning—that each cell must have a dominant area, where its signal overcomes the signals from neighbor cells. Simulations indicate that OTDOA-IPDL improves OTDOA availability from
UTDOA positioning in 3G networks is done the same way as in 2G networks. Please refer to Section
GNSS based positioning in 3G networks is done the same way as in 2G networks. Please refer to Section
AoA positioning is also known as multiangulation. Its deployment in cellular networks requires the installation of antenna arrays at Nodes B [
A further improvement to OTDOA was proposed by 3GPP, which is the introduction of positioning elements (PEs) that transmit short three-symbol identifier codes during Node B idle periods. OTDOA-PE is therefore OTDOA-IPDL with the use of PEs. PEs are handheld-sized elements accessible only through the air interface. They are registered in the network just like other UE and some operators reserve IMSI ranges to be assigned to them. PEs coordinates must be accurately known. They must be placed at reference points other than Nodes B locations. Each PE is attached to a Node B—from now on referred to as its serving Node B—and is synchronized with it. PEs transmit in the downlink channel and their signals, upon reception at the UE, provide TOA measurements to be used in the hyperbolic multilateration [
The greater advantage of OTDOA-PE upon EOTD is that as the PEs are synchronized with the serving Node B, there is no need to measure RTD values with LMUs. As previously mentioned in Section
(a) EOTD positioning scenario, with four single-cell geographically dispersed BTSs and LMU, all placed at known coordinates. Note that
(a) OTDOA-PE positioning scenario, with one single-cell Node B and three geographically dispersed PEs, all placed at known coordinates. Note that
Figure
Figure
As already mentioned in Sections
RRC is a UMTS Layer
Support to LCS in LTE networks was introduced only from Release
The standard LCS methods in LTE are E-CID, Assisted GNSS (A-GNSS), OTDOA (also referred to in LTE as downlink positioning), and UTDOA (also referred to in LTE as uplink positioning). LTE also supports A-GNSS + OTDOA hybrid positioning [
As already stated in Sections
LTE A-GNSS effectively is not just A-GPS: it also supports the Russian GLONASS [
LTE OTDOA uses position reference signals (PRS) transmitted on antenna port (an antenna port is a logical mapping of OFDMA channels, rather than a physical antenna)
Hybrid positioning combines the TDOA measurements obtained from the LTE network with GNSS pseudorange measurements. Thereby, the hybrid method is expected to improve positioning availability and accuracy, particularly in environments where GNSS signal reception might be impaired, such as inside building or in urban “canyons” (i.e., streets in dense urban areas which are sided by skyscrapers) [
LPP is the positioning protocol in LTE networks. It is designed to be forward-compatible with future access networks to prevent piling up several positioning protocols through the generations to come. It supports E-CID, A-GNSS, and OTDOA, as well as hybrid localization to improve accuracy. And, unlike previous protocols, such as RRLP and RRC—which support only control plane positioning—LPP also can be used in user plane positioning [
LPP is a point-to-point protocol between the UE and the E-SMLC. However, it has an extension, the LPP Annex (LPPa), which is specified only for control plane procedures between the evolved Node B (eNB) and the SMLC [
As shown in Figure Procedures related to capabilities exchange: Capabilities Transfer and Capabilities Indication Procedures. Procedures related to assistance data exchange: Assistance Data Transfer and Assistance Data Delivery Procedures. Procedures related to location information exchange: Location Information Transfer and Location Information Delivery Procedures.
LPP is also capable of detecting and reporting several specific error conditions, mostly in the positioning assistance data.
LPP conveying location related information between the UE and E-SMLC (or between the SET and the SLP, in user plane positioning). In the case of UE-based positioning, the UE sends its location estimate to the E-SMLC; in the case of UE-assisted positioning, the UE sends measurements (from GNSS constellations, from the LTE network, or form both, in the case of A-GNSS + OTDOA hybrid positioning).
An example of a full LPP session is shown in Figure
Example of a NI-LR LPP session: (a) Capabilities Transfer Procedure; (b) Assistance Data Transfer Procedure; and (c) Location Information Transfer Procedure.
In the case of a UE initiated LR (the UE wants to locate itself), the UE starts the LPP session with a Capabilities Indication Procedure, sending a Provide Capabilities Message. Note that, unlike in the previous NI-LR example, the Provide Capabilities Message is sent autonomously by the target device and not as a response to a Request Capabilities Message sent by the E-SMLC. The same applies to the Location Information Delivery Procedure, when the UE sends unsolicited location information to the server. On the other hand, in the Assistance Data Delivery Procedure, the server sends unsolicited Provide Assistance Data to the UE.
LPPa is an extension of LPP design to provide specific support to E-CID and OTDOA positioning in LTE networks. LPPa has the following functions:
Each of these functions comprises one or more elementary procedures, which in turn encompass a set of messages that define the information exchange. Table
LPPa functions and elementary procedures.
Function | Elementary procedure |
---|---|
E-CID Location Information Transfer | E-CID Measurement Initiation |
E-CID Measurement Failure Indication | |
E-CID Measurement Report | |
E-CID Measurement Termination | |
OTDOA Information Transfer | OTDOA Information Exchange |
Report of General Error Situations | Error Indication |
This review paper has presented the positioning capabilities in cellular networks, starting with the intrinsic localization support, inherent to any cellular system, and then passing through the specific features added by 3GPP—network elements (supported functions and interconnection with other elements of the architecture), supported positioning methods (position calculation details, related air interface parameters, autonomous and assisted operation modes, and assistance data provided by the network), and protocols (functions, elementary procedures and more relevant message exchanges)—from the second until the fourth generation. It has also brought a section explaining the organization of 3GPP Technical Specifications and provided a quick review on the cellular networks evolution path.
The author declares no competing interests.