A CFO-Assisted Algorithm for Wireless Time-Difference-of-Arrival Localization Networks: Analytical Study and Experimental Results

Abstract

Localization of wireless transmitters is traditionally done using Radio Frequency (RF) sensors that measure the propagation delays between the transmitter and a set of anchor receivers. One of the major challenges of wireless localization systems is the need for anchor nodes to be time-synchronized to achieve accurate localization of a target node. Using a reference transmitter is an efficient way to synchronize the anchor nodes Over-The-Air (OTA), but such algorithms require multiple periodic messages to achieve tight synchronization. In this paper, we propose a new synchronization method that only requires a single message from a reference transmitter. The main idea is to use the Carrier Frequency Offset (CFO) from the reference node, alongside the Time of Arrival (ToA) of the reference node messages, to achieve tight synchronization. The ToA allows the anchor nodes to compensate for their absolute time offset, and the CFO allows the anchor nodes to compensate for their local oscillator drift. Additionally, using the CFO of the messages sent by the reference nodes and the target nodes also allow us to estimate the speed of the targets. The error of the proposed algorithm is derived analytically and is validated through controlled laboratory experiments. Finally, the algorithm is validated by realistic outdoor vehicular measurements with a software-defined radio testbed.

1. Introduction

Accurate localization of Radio Frequency (RF) transmitters is an important feature of future wireless networks, with applications in smart cities, industry 4.0 and vehicular technology [1]. Localization through wireless networks is especially important when Global Navigation Satellite Systems (GNSSs) are unavailable or unreliable, for instance, in urban or suburban environments due to severe multipath conditions or blockage of satellite signals [1,2,3,4,5].

Different features of RF signals can be used for localization, among which are Received Signal Strenght (RSS), Angle of Arrival (AoA), Time of Arrival (ToA) or Time Difference of Arrival (TDoA) [6]. In a TDoA-based localization system, several anchor nodes (with known locations) estimate the difference in ToA of a signal transmitted by a target node. The TDoA between a pair of anchor nodes defines a hyperbola of possible target node locations, and the intersection of multiple such hyperbola indicates the target location. TDoA-based localization has multiple advantages: it does not require costly multi-antenna arrays, the target node does not need to be synchronized with the anchor nodes and the target node need not be cooperative with the anchor nodes [3]. However, one important prerequisite of TDoA-based localization is that the anchor nodes need to be accurately time-synchronized to achieve precise localization. Each anchor node has its own Local Oscillator (LO), and clock parameters (commonly referred to as clock offset and drift) differ randomly at each node. Without synchronization, each receiver would utilize a different time reference when measuring the ToA of the target message, resulting in a substantial amount of error when estimating the TDoA. As a result, the synchronization of receivers is essential in TDoA estimation [1].

Synchronization methods for anchor nodes can generally be divided into two categories: wired and wireless synchronization. In a wired synchronization network, a reference signal is transmitted over cables that can be used for synchronizing the anchor nodes. Advanced LO tracking algorithms have been implemented that can synchronize oscillators down to the nanosecond over coaxial cables or over fiber optics (such as the White Rabbit project protocol [7]). However, wired synchronization requires expensive deployments, which may not be feasible in practical situations. Wireless synchronization can be subdivided into Global Navigation Satellite Systems (GNSS) and Over-The-Air (OTA) synchronization methods. GNSS synchronization requires equipping each anchor node with a GNSS receiver module, which can use the Universal Time Coordinate (UTC) as a reference time and yield accuracies from a few nanoseconds to several tens of nanoseconds [8]. However, the synchronization accuracy will severely be degraded in indoor environments, urban environments or tunnels due to limited GNSS visibility. In such environments, the accuracy goes to hundreds of nanoseconds or more, making GNSS synchronization unbearable. OTA synchronization methods are usually based on a broadcaster node, which is used to distribute reference signals [9,10]. The drawback of OTA synchronization is that some bandwidth capacity is used to distribute the synchronization information, and the resulting accuracy is highly dependent on the rate of the synchronization messages from the broadcaster node [9].

In our preliminary work [11], we introduced a new OTA one-way synchronization algorithm for a TDoA system with a broadcaster. It is based on the realization that the time skew and the Carrier Frequency Offset (CFO) between a transmitter and a receiver are related. By using CFO estimations, we are able to achieve better time synchronization over time from a single message from the broadcaster, allowing a lower synchronization message rate. In this paper, we extend our previous work to include an error analysis of the proposed algorithm, extensive outdoor measurements in a vehicular scenario and speed estimation.

Contributions: The contributions are listed as follows:

• We propose a CFO-assisted TDoA localization algorithm, which is able to synchronize the anchor nodes with only a single message from a broadcaster node;
• On top of localization information, our proposed method is also able to provide information about the movement of the target, even with a single message from the target node;
• The error of the proposed algorithms is investigated analytically and a closed-form solution is proposed;
• A set of controlled lab experiments is realized to validate our previous findings;
• An extensive outdoor vehicular measurement campaign is conducted to validate and quantify the performances of the proposed algorithms.

The significance of the proposed algorithms lies in the fact that we are able to perform TDoA-based localization with only a single message with no time metadata from the broadcaster, as opposed to other synchronization algorithms that require multiple messages from a broadcaster node to achieve accurate synchronization.

The paper is organized as follows: Section 2 introduces the algorithms proposed in this paper, while Section 3 presents and analyzes experimental results. In particular, Section 2 is structured as follows: Section 2.1 introduces the TDoA system, its need for synchronization and the clock model. Section 2.2 and Section 2.3 present some conventional synchronization methods for TDoA estimation. In Section 2.4, the proposed CFO-assisted synchronization algorithm is presented and its accuracy is analytically evaluated. The estimation is then extended to include a velocity estimator.

The following notations are used in this paper: ${ }^T$, ‖ ‖ are defined as the matrix transpose and the Euclidean norm, respectively. Moreover, vectors and matrices are bold.

2. Materials and Methods

2.1. System Model

2.1.1. TDoA Architecture

The TDoA system consists of N-receivers with known positions ${\mathbf{p}}_{\mathbf{i}}={[x_i,y_i]}^T$ ($i=0,\dots ,N-1$), and a target at an unknown position ${\mathbf{p}}_{\mathbf{T}}={[x_T,y_T]}^T$, as depicted in Figure 1 (the broadcaster node will be introduced later).The target transmits RF packets at a known carrier frequency. The receivers record their ToAs:

$$t_i=\underset{{\tau }_i}{\underbrace{∥{\mathbf{p}}_{\mathbf{i}}-{\mathbf{p}}_{\mathbf{T}}∥/c}}+t_T$$

(1)

where ${\tau }_i$ is the propagation delay between the target and the receiver i, c the speed of transmission through the medium and $t_T$ the unknown transmission time. From these ToAs, a TDoA system of equations to recover the target location is constructed, where the TDoA ${\tau }_{ij}$ between receivers i and j is defined as:

$$\begin{array}{cc}\hfill t_j-t_i& =(∥{\mathbf{p}}_{\mathbf{j}}-{\mathbf{p}}_{\mathbf{T}}∥-∥{\mathbf{p}}_{\mathbf{i}}-{\mathbf{p}}_{\mathbf{T}}∥)/c\hfill \\ \hfill & ={\tau }_j-{\tau }_i\equiv {\tau }_{ij}.\hfill \end{array}$$

(2)

In this paper, only additive measurement noise on the estimation of $t_i$ is considered, neglecting effects due to the environment, such as multipath components or loss of line-of-sight. A TDoA localization method robust to such impairments might be required, as they will degrade the TDoA estimation. For clarity purposes, the additive noise is not shown hereafter.

2.1.2. LO Model

To compute timing information, as in (1), devices use LOs. These LOs are non ideal, hence locally distorting the notion of time. A common model for these imperfections is [9,12,13]:

$${\mathcal{T}}_i\left(t\right)={\alpha }_i+{\beta }_{i}t,$$

(3)

where ${\mathcal{T}}_i\left(t\right)$ is the time recorded by the LO of node i at the absolute time reference t, and depends on an initial shift parameter ${\alpha }_i$ and a drift parameter ${\beta }_i$. These clock parameters are usually slowly varying in time. However, they are varying much slower than the regular period (<1 s) between two synchronization updates. These clock parameters are hence assumed constant.

On many devices, the ADC and the down-converter are driven by the same LO, as shown in Figure 2. Since the LO is not perfect, it will lock within an offset of the nominal frequency. In such cases, the frequencies of the clocks driving the ADC $f_{s_i}$ and the down-converter $f_{c_i}$ can be written as follows:

$$\begin{array}{cc}\hfill f_{c_i}& =f_c(1+{ϵ}_i),\hfill \\ \hfill f_{s_i}& =f_s(1+{ϵ}_i),\hfill \end{array}$$

(4)

and the drift parameter ${\beta }_i$ can be rewritten as:

$${\beta }_i=1+{ϵ}_i.$$

(5)

Hence, the ToA (1) measured by anchor i of a message sent by the target at absolute time $t_T$ becomes:

$$\begin{array}{cc}\hfill {\mathcal{T}}_i(t_T+{\tau }_i)& ={\alpha }_i+(1+{ϵ}_i)(t_T+{\tau }_i)\hfill \\ \hfill & \approx {\alpha }_i+(1+{ϵ}_i)t_T+{\tau }_i.\hfill \end{array}$$

(6)

In the final equation, the second-order term ${ϵ}_i{\tau }_i$ is an order of magnitude smaller than the others and can therefore be neglected (${ϵ}_i$ is typically in the order of parts-per-million, i.e., 1 × 10⁻⁶, and ${\tau }_i$ is typically in the order of tens to hundreds of nanoseconds).

2.2. TDoA without Synchronization

Using this model, without any prior synchronization, the estimated TDoA between two receivers is given by:

$${\tau }_{ij}^{NS}={\mathcal{T}}_j(t_T+{\tau }_j)-{\mathcal{T}}_i(t_T+{\tau }_i)=({\alpha }_j-{\alpha }_i)+({ϵ}_j-{ϵ}_i)t_T+{\tau }_{ij}.$$

(7)

In this case, the TDoA ${\tau }_{ij}$ is tainted by a constant offset $({\alpha }_j-{\alpha }_i)$ and drifts over time with a factor $({ϵ}_j-{ϵ}_i)$.

2.3. Broadcaster-Assisted TDoA

To compensate for the constant offset and time drift, one can use other node broadcasting messages (denoted the broadcaster, depicted in Figure 1), and use these messages as an absolute time reference. Without loss of generality, we will assume that the propagation delay between the broadcaster and anchor i ${\tau }_{B_i}=0$. In practice, this means that the propagation delay between the broadcaster and the anchors needs to be estimated and compensated for. The broadcaster-assisted ToA can then be defined as:

$$\begin{array}{cc}\hfill t_i^{BS}\equiv {\mathcal{T}}_i(t_T+{\tau }_i)-{\mathcal{T}}_i\left(t_B\right)& =(1+{ϵ}_i)(t_T-t_B)+{\tau }_i\hfill \\ \hfill & =(1+{ϵ}_i)\Delta t+{\tau }_i,\hfill \end{array}$$

(8)

where $t_B$ is the ToA of the last message received from the broadcaster and $\Delta t=t_T-t_B$. The TDoA is then given by:

$${\tau }_{ij}^{BS}\equiv t_j^{BS}-t_i^{BS}=({ϵ}_j-{ϵ}_i)\Delta t+{\tau }_{ij}.$$

(9)

It can be seen that the constant offset is removed, and the drift is reset each time a new broadcasting message arrives. Hereafter, this method will be referred to as the broadcaster-assisted synchronization method. In the remainder of this paper, and without loss of generalization, we will define the absolute time to be the time that is estimated locally at the broadcast node, such that ${\alpha }_B=0$, ${ϵ}_B=0$ and ${\beta }_B=1$.

2.4. CFO-Assisted TDoA and Velocity Estimation

2.4.1. CFO-Assisted TDoA Estimate

In Equation (9), the estimated TDoA is tainted by an error $({ϵ}_j-{ϵ}_i)\Delta t$, which drifts when the time between two broadcast messages increases. In this paper, we propose to enhance the broadcaster-assisted synchronization method by using the CFO of the target message to compensate for the existing drift between two broadcast messages. Knowing the model (4), the CFO between the target and the receiver is:

$${\Delta f_c}_i=({ϵ}_T-{ϵ}_i)f_c.$$

(10)

The proposed enhanced ToA estimate $t_i^{CS}$ is the following:

$$\begin{array}{cc}\hfill t_i^{CS}\equiv t_i^{BS}(1+\frac{{\Delta f_c}_i}{f_c})& =((1+{ϵ}_i)\Delta t+{\tau }_i)(1+{ϵ}_T-{ϵ}_i)\hfill \\ \hfill & =(1+{ϵ}_T+{ϵ}_i{ϵ}_T-{ϵ}_i^2)\Delta t+(1+{ϵ}_T-{ϵ}_i){\tau }_i\hfill \\ \hfill & \approx (1+{ϵ}_T)\Delta t+{\tau }_i.\hfill \end{array}$$

(11)

In the last equation, the second-order terms are an order of magnitude smaller than the others and can therefore be neglected (values for $ϵ$ are typically in the order of parts-per-million, i.e., 1 × 10⁻⁶, and values for propagation delays ${\tau }_i$ are typically in the tens or hundreds of nanoseconds). When using these “compensated” ToA, the corresponding TDoA becomes:

$${\tau }_{ij}^{CS}\equiv t_j^{CS}-t_i^{CS}={\tau }_{ij}.$$

(12)

It can be seen that both the offset and the drift have been compensated from the estimated TDoA.

Note that it is also possible to use the CFO of the broadcaster message to compensate for the ToA and TDoA values. The CFO is:

$${\Delta f_{c_B}}_i=-{ϵ}_i{f}_c,$$

(13)

while the compensated ToA $t_i^{C_{B}S}$ is:

$$\begin{array}{cc}\hfill t_i^{C_{B}S}\equiv t_i^{BS}(1+\frac{{\Delta f_{c_B}}_i}{f_c})& =((1+{ϵ}_i)\Delta t+{\tau }_i)(1-{ϵ}_i)\hfill \\ \hfill & \approx \Delta t+{\tau }_i.\hfill \end{array}$$

(14)

The corresponding TDoA is then:

$${\tau }_{ij}^{C_{B}S}\equiv t_j^{C_{B}S}-t_i^{C_{B}S}={\tau }_{ij}.$$

(15)

In the remainder of the paper, unless stated otherwise, the CFO from the target will be used for estimating the CFO-assisted TDoA.

An example of TDoA error with the different synchronization methods is shown in Figure 3. Using the broadcaster-assisted method, the TDoA error increases at the same rate as without any synchronization. The accumulated error of the broadcaster-assisted method is compensated for each time a new broadcast packet is received (every second). The slope of that drift depends on the difference of the normalized frequency shifts ${ϵ}_{Rx}$ between receivers. Using the CFO-assisted method, the error is reduced between broadcast messages. In this case, the drift depends on the accuracy of the CFO estimation. The synchronization using the CFO from the target seems more noisy than the one using the CFO from the broadcaster because of the higher number of realizations of the former. Over two broadcaster messages, several CFOs from the target are estimated, but only one from the broadcaster.

2.4.2. Variance of TDoA Error

The variance of the CFO-assisted estimator ${\sigma }_{{\tau }_{ij}^{CS}}^2$ based on (11) and (12) is derived in Appendix A. It is given by:

$${\sigma }_{{\tau }_{ij}^{CS}}^2=2\left(\frac{{\sigma }_{{\Delta f_c}_i}^2}{f_c^2}{\overline{t_i^{BS}}}^2+\frac{{\sigma }_{t_i^{BS}}^2{\sigma }_{{\Delta f_c}_i}^2}{f_c^2}+{\sigma }_{t_i^{BS}}^2{\left(1+\frac{\overline{{\Delta f_c}_i}}{f_c}\right)}^2\right)-2\frac{{\overline{t_i^{BS}}}^2}{f_c^2}Cov\left[{\Delta f_c}_i,{\Delta f_c}_j\right].$$

(16)

where ${\sigma }_{{\Delta f_c}_i}^2$ is the variance of the CFO estimation at anchor i, ${\sigma }_{t_i^{BS}}^2$ is the variance of the ToA estimation at anchor i, $\overline{{\Delta f_c}_i}$ is the estimated CFO and $\overline{t_i^{BS}}$ is the estimated, broadcaster-compensated, ToA. It also includes the covariance between the CFO estimated at both receivers. Since that covariance can be challenging to estimate, and since it is always positive (see Appendix B), an upper bound estimate is used instead:

$${\sigma }_{{\tau }_{ij}^{CS}}^2\le 2\left(\frac{{\sigma }_{{\Delta f_c}_i}^2}{f_c^2}{\overline{t_i^{BS}}}^2+\frac{{\sigma }_{t_i^{BS}}^2{\sigma }_{{\Delta f_c}_i}^2}{f_c^2}+{\sigma }_{t_i^{BS}}^2{\left(1+\frac{\overline{{\Delta f_c}_i}}{f_c}\right)}^2\right).$$

(17)

The upper bound (17) is composed of three terms. The second and third terms are constant and depend mainly on the estimators used in the localization system. The first term increases with $\overline{t_i^{BS}}$, i.e., the delay between the target and broadcast messages. This implies that when the time between a target and broadcast message becomes larger, a larger error will be incurred, even with the CFO-assisted TDoA estimation.

Simulation results and experimental results in a controlled experiment show that this upper bound is especially tight at lower Signal to Noise Ratios (SNRs), as will be shown in Section 3.

2.4.3. Localization

The main goal of the TDoA system is the extraction of the target location. The estimation of the target location is based on the resolution of (2), which consists of a set of hyperbolas intersecting at the target location. Several algorithms have been proposed to solve these types of problems, such as [14,15,16,17]. In this paper, the localization performance is evaluated on outdoor measurements (see Section 2.5.3 for details). Since these measurements are tainted by outliers, the algorithm described in [18] is used. This algorithm was developed based on these measurements.

2.4.4. Velocity Estimation

In the previous equations, velocity was not considered. If the target is moving, it induces a Doppler frequency, adding up to the CFO estimate. In such cases, the CFO estimate contains the contribution due to imperfect LOs ${\Delta f_c}_i$, and the contribution due to the movement of the target with regard to the receiver ${F_D}_i$:

$$\begin{array}{c}\hfill \mathrm{C}\mathrm{F}{\mathrm{O}}_i={\Delta f_c}_i-{F_D}_i,\\ \hfill {F_D}_i=\frac{{({\mathbf{p}}_{\mathbf{T}}-{\mathbf{p}}_{\mathbf{i}})}^T{\mathbf{v}}_{\mathbf{T}}}{\lambda ∥{\mathbf{p}}_{\mathbf{T}}-{\mathbf{p}}_{\mathbf{i}}∥},\end{array}$$

(18)

where ${\mathbf{v}}_{\mathbf{T}}={[{v_T}_x,{v_T}_y]}^T$ is the velocity of the target and $\lambda$ is the wavelength of the RF wave.

Knowing the location of the target ${\mathbf{p}}_{\mathbf{T}}$ is not sufficient to estimate its velocity from the system of equations generated from (18). Indeed, for a TDoA system with N anchors, (18) spawns N equations, but there are $N+2$ unknowns (${v_T}_x$, ${v_T}_y$ and ${\Delta f_c}_i,i=1,\dots ,N$). Nonetheless, the CFO between the receiver and the broadcaster can be used to remove the dependency on the unknowns ${\Delta f_c}_i$. Since there is no Doppler frequency between the receiver and the broadcaster, the measured CFO is

$${\mathrm{C}\mathrm{F}{\mathrm{O}}_B}_i={{\Delta f_c}_B}_i$$

(19)

and knowing that

$${\Delta f_c}_i-{{\Delta f_c}_B}_i={ϵ}_T{f}_c={\Delta f_c}_T,$$

(20)

then another system of equations can be constructed:

$${\Delta \mathrm{CFO}}_i\equiv \mathrm{C}\mathrm{F}{\mathrm{O}}_i-{\mathrm{C}\mathrm{F}{\mathrm{O}}_B}_i={\Delta f_c}_T-{F_D}_i,$$

(21)

which reduces the unknowns to ${v_T}_x,{v_T}_y$ and ${\Delta f_c}_T$ while preserving the number of equations. Equation (21) can also be rewritten as a linear matrix equation:

$$\left[\begin{array}{cc}& ⋮\\ 1& \frac{x_T-x_i}{-\lambda ∥{\mathbf{p}}_{\mathbf{T}}-{\mathbf{p}}_{\mathbf{i}}∥}& \frac{y_T-y_i}{-\lambda ∥{\mathbf{p}}_{\mathbf{T}}-{\mathbf{p}}_{\mathbf{i}}∥}\\ & ⋮\end{array}\right]\left[\begin{array}{c}{\Delta f_c}_T\\ {v_T}_x\\ {v_T}_y\end{array}\right]=\left[\begin{array}{c}⋮\\ {\Delta \mathrm{CFO}}_i\\ ⋮\end{array}\right].$$

(22)

which is solvable if there is at least three anchors. The proposed algorithm is summarized in Algorithm 1.

Algorithm 1: Velocity estimation
	Data: N anchors, $N\ge 3$
	Result: position ${\mathbf{p}}_{\mathbf{T}}$ and velocity ${\mathbf{v}}_{\mathbf{T}}$ of a moving target
1	foreach anchor i do
2		measure the ToA (${\mathcal{T}}_i\left(t_B\right)$) and CFO (${\mathrm{C}\mathrm{F}{\mathrm{O}}_B}_i$) of the last broadcaster packet;
3		measure the ToA (${\mathcal{T}}_i(t_T+{\tau }_i)$) and CFO ($\mathrm{C}\mathrm{F}{\mathrm{O}}_i$) of the current target packet;
4		compute ${\Delta \mathrm{CFO}}_i=\mathrm{C}\mathrm{F}{\mathrm{O}}_i-{\mathrm{C}\mathrm{F}{\mathrm{O}}_B}_i$ (21)
5		compute $t_i^{C_{B}S}=({\mathcal{T}}_i(t_T+{\tau }_i)-{\mathcal{T}}_i\left(t_B\right))(1+\frac{{\mathrm{C}\mathrm{F}{\mathrm{O}}_B}_i}{f_c}))$ (14);
6	end$\phantom{(}$
7	Solve the TDoAs system generated from (15) using [18] to determine the target location ${\mathbf{p}}_{\mathbf{T}}$
8	Solve (22) to estimate the target velocity ${\mathbf{v}}_{\mathbf{T}}$

2.5. Simulation and Experimental Setup

In this section, several setups are described to evaluate the CFO-assisted algorithm. They consist of a TDoA system, as modeled in Section 2.1. Targets and broadcasters send the OFDM legacy preamble (L-STF and L-LTF) of the 802.11 standard [19]. ToAs and CFOs are extracted using the Schmidl and Cox algorithm [20,21]. ToA estimates are further refined by fitting a parabola on the correlation function, as described in [22].

2.5.1. Simulation Setup

The simulations setup is used to perform large-scale simulations with controlled system parameters, as to provide conclusions that can be generalized to any hardware system. This setup aims at simulating the system depicted in Figure 1 and Figure 2 with two receivers. The LO model is the following [23,24]:

$$\left[\begin{array}{c}\varphi (t+T)\\ \omega (t+T)\end{array}\right]=\left[\begin{array}{cc}1& T\\ 0& 1\end{array}\right]\left[\begin{array}{c}\varphi \left(t\right)\\ \omega \left(t\right)\end{array}\right]+\mathbf{n}\left(T\right),$$

(23)

where $\varphi ,\omega$ are the phase and angular frequency offset of the LO. $\mathbf{n}$ is the process noise vector and follows $\mathbf{n}\sim \mathcal{N}(0,\mathbf{Q}(T\left)\right)$:

$$\mathbf{Q}\left(T\right)={\omega }_c^2{q}_1^2\left[\begin{array}{cc}T& 0\\ 0& 0\end{array}\right]+{\omega }^2{q}_2^2\left[\begin{array}{cc}{T}^3/3& T^2/2\\ T^2/2& T\end{array}\right],$$

(24)

where ${\omega }_c$ is the angular carrier frequency, $q_1^2$ and $q_2^2$ are process noise parameters accounting for white and random walk frequency noises. The parameters of the simulation are summarized in

Table 1. Summary of setup parameters.

	sim	lab	exp
${ϵ}_{Tx,Rx}$	2 $\mu$$\mathrm{s}$/$\mathrm{s}$	2.5 $\mu$$\mathrm{s}$/$\mathrm{s}$	2.5 $\mu$$\mathrm{s}$/$\mathrm{s}$
$q_1^2$	4.235 × 10−20 $\mathrm{s}$	-	-
$q_2^2$	2.755 × 10−16 $\mathrm{Hz}$	-	-
T	2 $\mathrm{m}$$\mathrm{s}$	-	-
$T_{\mathrm{target}}$	2 $\mathrm{m}$$\mathrm{s}$	10 $\mathrm{m}$$\mathrm{s}$	10 $\mathrm{m}$$\mathrm{s}$
$T_{\mathrm{broadcaster}}$	1 $\mathrm{s}$	10 $\mathrm{m}$$\mathrm{s}$	10 $\mathrm{m}$$\mathrm{s}$
$T_{\mathrm{run}}$	20 $\mathrm{s}$	40 $\mathrm{s}$	40 $\mathrm{s}$
$N_{\mathrm{run}}$	500	24	100
$f_{c_{\mathrm{target}}}$	2.35 $\mathrm{G}$$\mathrm{Hz}$	2.35 $\mathrm{G}$$\mathrm{Hz}$	2.35 $\mathrm{G}$$\mathrm{Hz}$
$f_{c_{\mathrm{broadcaster}}}$			2.55 $\mathrm{G}$$\mathrm{Hz}$
$f_{s_{Tx}}$	20 $\mathrm{M}$$\mathrm{Hz}$	20 $\mathrm{M}$$\mathrm{Hz}$	20 $\mathrm{M}$$\mathrm{Hz}$
$f_{s_{Rx}}$		100 $\mathrm{M}$$\mathrm{Hz}$	100 $\mathrm{M}$$\mathrm{Hz}$
SNR	40 dB	-	-

.

2.5.2. Lab Setup

The lab setup aims at providing hardware validation in a controlled environment without suffering from real-world effects, such as multipath, limited SNR, etc. The setup consists of two receivers, one target and one broadcaster, using four USRP-X310 Software Defined Radios (SDRs), as depicted in Figure 4. The SDRs are interfaced using the USRP Hardware Driver (UHD) version 3.9 from Ettus Research, Austin, TX, USA. Signals are sent through cables, and RF splitters are used to broadcast a signal to the two separate receivers. There are 24 measurements, with about 40 s of recording each. The device’s roles as broadcaster, target and anchors are permuted throughout the experiments. The baseband signals are processed to extract ToA and CFO. Then, packets from one receiver are associated with their corresponding packets at the other receiver. The parameter values are summarized in Table 1.

2.5.3. Roadside Setup

Finally, the roadside setup aims to validate the proposed methods and algorithms in a realistic, vehicular environment. The experimental setup is the following: six receivers (USRP-X310 SDR) for TDoA acquisition, one broadcaster (USRP-X310 SDR), and up to four targets (USRP-E310 SDR). Signals are sent Over-The-Air. The RF characteristics are similar to the lab, except the broadcaster transmitting at 2.55 $\mathrm{G}$$\mathrm{Hz}$ carrier (see Table 1). Target Global Positioning System (GPS) positions are used as ground-truth. The experimental environment is shown in Figure 5. During the experiment, no other vehicle than the targets is present.

There are 30 to 40 measurements, 40 s recordings each, for each of the three road scenarios depicted in Figure 6: Major Road (MR), Road Junction (RJ), Roundabout (RA). Target paths are changed every 10 measurements. The processing of the baseband signals is similar to the lab. The extracted features (ToAs with unknown transmission time, CFOs and GPS positions) are further processed according to the availability of the ground-truth, amounting to almost 2 million snapshots. More details regarding the experiment and how the dataset is preprocessed can be found in [18].

3. Results

3.1. TDoA Estimation

3.1.1. Errors

The proposed synchronization method (11) is tested on simulation and lab setups. Packets from the broadcaster are dropped at regular intervals to evaluate the estimator across several $\Delta t$, i.e., when the time between the target message and the last broadcaster message becomes larger. Each $\Delta t$ category is a 20 $\mathrm{m}$$\mathrm{s}$-wide bin. The resulting empiral Cumulative Distribution Function (eCDF) of TDoA errors are shown for simulations and lab experiments in Figure 7a,b, respectively.

The increase in $\Delta t$ induces a degradation of the TDoA estimates. Furthermore, the CFO-assisted method performs better than the broadcaster-assisted method in every case. While Figure 7a,b show similar behavior, differences in absolute values are expected for several reasons, such as:

• Imperfect clock model and different time resolutions, explaining the significant difference at $\Delta t=100 \mathrm{m}\mathrm{s}$.
• Lack of clock diversity in the lab setup, containing only six LOs in an identical environment. This explains the plateau in broadcaster-assisted results.

3.1.2. Variance

For each lab measurement, the mean and variance of the CFOs at each receiver are estimated from the measured ones. The variance of $\Delta t$ is estimated from the time resolution at the receiver, while the mean is estimated by computing the histogram, and then taking the means of each resulting bin.

The upper bound is computed by feeding the parameters described above into (17). The experimental ${\sigma }_{{\tau }_{ij}}$ is estimated by taking the root-mean-square error (RMSE) of every bin. The result is shown in Figure 8b. As expected, the standard deviation linearly increases as the time difference between the target and the broadcaster messages increases. If one can estimate the covariance between CFOs, then a better estimate can be achieved.

Figure 8a shows the effect of CFO covariance in simulation. The more significant the covariance is compared to the measurement noise, the more (17) overestimates the CFO-assisted TDoA estimator variance.

3.2. Localization

The effect of synchronization on location accuracy is evaluated on all roadside measurements. Figure 9 shows eCDFs of the location error for each scenario. For the broadcaster-assisted method, the location accuracy at $\Delta t=100 \mathrm{m}\mathrm{s}$ drops to accuracies similar to the CFO-assisted method at $\Delta t=1 \mathrm{s}$, while the location accuracy is similar at $\Delta t=10 \mathrm{m}\mathrm{s}$ and $\Delta t=100 \mathrm{m}\mathrm{s}$ for the CFO-assisted method.

3.3. Velocity

The performance of the velocity estimator (22) is evaluated on all roadside measurements. To lower the noise on the CFO estimation, a moving average is applied on the right side of (22). Their estimated standard deviations are summarized in

Table 2. Estimated value of ${\sigma }_{\Delta \mathrm{CFO}}$.

	MR	RJ	RA
No averaging	560 $\mathrm{Hz}$	440 $\mathrm{Hz}$	610 $\mathrm{Hz}$
51-sample average	90 $\mathrm{Hz}$	80 $\mathrm{Hz}$	110 $\mathrm{Hz}$
301-sample average	50 $\mathrm{Hz}$	40 $\mathrm{Hz}$	60 $\mathrm{Hz}$

. The size of the window is constrained by the constancy of the Doppler frequency (18) over time. Hence, only window sizes below 500 (5 $\mathrm{s}$) are presented. Figure 10 shows the eCDFs of the speed error for each scenario. One of the six anchors, in MR and RJ scenarios, has been excluded for the velocity estimation due to analog saturation with the broadcaster.

Lowering ${\sigma }_{\Delta \mathrm{CFO}}$ increases the accuracy of the speed estimation. However, targets where not moving faster than 55 $\mathrm{k}$$\mathrm{m}$/$\mathrm{h}$ and, 95% of the time, they do not reach 30 $\mathrm{k}$$\mathrm{m}$/$\mathrm{h}$. Hence, getting accurate speed estimations—relative to the target’s low speed—is challenging.

However, the direction of the target can be extracted, as shown in Figure 11. It performs worse in roundabout scenarios. Apart from the higher ${\sigma }_{\Delta \mathrm{CFO}}$, averaging over several measurements is less effective since it averages measurements with different directions.

4. Discussion

The results of Section 3 show that CFO-assisted estimation allows for localization of unsynchronized targets, even when the anchor nodes are not synchronized explicitly. The main advantage of the proposed method is that, unlike existing algorithms, it requires only a single message from the target node. The main drawback of the proposed method is the increased error that occurs when the time difference between the target and broadcaster message becomes large. In the vehicular scenarios investigated in the experiments of this paper, delays higher than $\Delta t=100 \mathrm{m}\mathrm{s}$ make the errors too large in practice.

The theoretical upper bound on the error variance of the proposed algorithm allows system designers to choose the parameters of the localization system, based on the TDoA error that can be tolerated from a design perspective.

The proposed method also allows us to estimate the speed of the target, despite the large CFOs that may occur between target and anchor nodes. In practice, however, the speed estimation errors are too large to be usable in practice with one-message estimation. Reducing the CFO estimation error might lead to lower speed errors, but even lower CFO estimation errors still result in large speed estimation errors (as shown in Figure 10). While the actual speed might not be reliably estimated, the direction of the vehicle can still be estimated with reasonable reliability (as shown in Figure 11), especially if the CFO estimation error can be reduced. This is interesting for vehicular scenarios, where the direction of a vehicle along a road axis might already provide valuable contextual information.

5. Conclusions

This paper proposes a CFO-assisted TDoA estimation algorithm, that allows for unsynchronized targets and anchors. The algorithm relies on the fact that CFO and time drift in wireless transceivers have the same physical origin, i.e., the LO offset, and an additional broadcaster.

The proposed method performs well, both in controlled environments and in practical situations, with TDoA errors below a few tens of nanoseconds. The estimator is extended to include speed estimation, but the accuracy is too low to be used for anything more than direction estimation.

Using the CFO to compensate for time drift is a promising method for node synchronization. An extension of this work could be in the context of distributed multi-antenna systems, where time, frequency and phase synchronization are required [24]. Extending the proposed algorithm to distributed systems could also provide interesting developments, especially in Internet-of-Things networks where messages from target nodes are only sent sparsely.