Radio Localization with GSM

(1)

Master of Science Thesis in Communication Systems

Department of Electrical Engineering, Linköping University, 2016

Radio Localization with

GSM

(2)

Master of Science Thesis in Communication Systems

Radio Localization with GSM

Simon Pålstam LiTH-ISY-EX–16/5006–SE Supervisor: Bram Dil

ISY, Linköpings universitet

Examiner: Fredrik Gustafsson

isy_{, Linköpings universitet}

Division of Automatic Control Department of Electrical Engineering

(3)

Abstract

This thesis presents a feasibility study on unobtrusive localization of GSM en-abled cellphones using a Fake Base Station (FBS). An FBS is a radio transceiver that emulates the behaviour of a legitimate GSM Base Station (BS) to fool unal-tered cellphones to connect with it. This feasibility study investigates how an FBS can be utilized to estimate positions of connected cellphones in an area of interest. We present a proof of concept system that consists of a mobile FBS that measures the Time Of Arrival (TOA) and Received Signal Strength (RSS) to a cell-phone. The positions of the mobile FBS are determined with GPS. We employ calibration-free localization algorithms as we assume unknown environments and unknown hardware. Our experiments in an outdoor 180x100 m2 Line-Of-Sight (LOS) environment show that our calibration-free localization algorithms provide an average localization error less than 10 meters, which is sufficient for most applications of interest. In addition, our experiments show that RSS-based localization outperforms TOA-based localization when the average distance be-tween the FBS and cellphone is roughly 50 meters. Our experiments show that TOA-based localization outperforms RSS-based localization when the average dis-tance increases to roughly 75 meters.

This research is part of the Smart Savannah project in which a wide range of different surveillance systems are developed to protect rhinos from poachers. We envision that our localization system can be used to detect and localize these poachers in an unobtrusive way. In addition, we envision that our localization sys-tem can be used in Search And Rescue (SAR) operations to estimate the positions of cellphones of missing persons.

(4)

(5)

Sammanfattning

Detta examensarbete undersöker möjligheten att lokalisera mobiltelefoner med GSM teknologi genom att använda en Falsk Basstation (FBS). En FBS är en radio transceiver som emulerar beteendet hos en legitim GSM basstation för att lura omodifierade mobiltelefoner att ansluta till den. Undersökningen tar reda på hur en FBS kan användas för att estimera positionerna av anslutna mobiltelefoner inom ett målområde. För att undersöka detta har ett Proof-Of-Concept-system ta-gits fram. Systemet består av en mobil FBS som som mäter propageringstid (TOA) och mottagen signalstyrka (RSS). FBS:ens positioner bestäms med GPS. Systemet använder kalibreringsfria algoritmer för lokalisering, då vi antar att miljön och mobiltelefonernas hårdvara är okänd. Tester av systemet har utförts utomhus i ett 180x100 m2Line-Of-Sight-område. Dessa tester visar att lokaliseringsalgorit-merna ger ett genomsnittligt fel på mindre än 10 meter. Detta anses vara till-räckligt för de flesta tillämpningar av intresse. Utöver detta visar även testerna att RSS-baserad lokalisering ger bättre resultat än TOA-baserad lokalisering när medelavståndet mellan FBS och mobiltelefon är omkring 50 meter. TOA-baserad lokalisering ger däremot ett bättre resultat än RSS-baserad lokalisering när me-delavståndet ökar till omkring 75 meter.

Denna undersökning är en del av Smart Savannah projektet som innefattar flera olika övervakningssystem, utvecklade för att skydda noshörningar från tjuv-skyttar. Målet med vårt lokaliseringssystem är att det ska kunna användas för att upptäcka och lokalisera tjuvskyttar utan deras vetskap. Vi tror även att lokalise-ringssystemet kan användas vid eftersökning- och räddnings-operationer för att lokalisera försvunna personers mobiltelefoner.

(6)

(7)

Acknowledgments

I would like to thank my supervisor Bram Dil for all the help and support. It has been crucial for this master thesis to succeed. I would also like to thank Fredrik Gustafsson and Gustaf Hendeby for comming up with the scope for this master thesis.

Linköping, October 2016 Simon Pålstam

(8)

(9)

Notation

List of Abbreviations Abbreviation Meaning

FBS Fake Base Station

GSM Global System for Mobile communications MS Mobile Station

RSS Received Signal Strength SDR Software Defined Radio AOA Angle Of Arrival TOA Time Of Arrival

TDOA Time Difference Of Arrival SAR Search And Rescue

BS Base Station

PLMN Public Land Mobile Network HPLMN Home Public Land Mobile Network

MCC Mobile Country Code MNC Mobile Network Code

GPS Global Positioning System SNR Signal to Noise Ratio NLS Non-linear Least Squares LAD Least Absolute Deviation LNSM Log-Normal Shadowing Model

BiS Bias and Scaling Saw Sawtooth Model

(12)

(13)

1

Introduction

This document is a report for a master thesis performed at the Department of Electrical Engineering at Linköping Universisy by Simon Pålstam. The thesis was performed during the spring semester 2016. The thesis contains a feasibility study on tracking cellphones using a Fake Base Station (FBS) for Global System for Mobile communications (GSM), also known as 2-G.

1.1 Background

The world is in the midst of a wildlife crisis. In recent years, over 100,000 ele-phants, rhinos and other endangered species were killed by poachers. One way to reduce this mass slaughter of endangered animals is to develop new technologies for surveillance of wildlife sanctuaries and national parks. Linköping University started a large research initiative on this matter. The initiative includes research in a wide range of different surveillance systems that will be part of what they call the Smart Savannahs. To demonstrate the utility of the Smart Savannahs, the system will first be deployed in Ngulia Rhino Sanctuary. A future part of the Smart Savannah is a surveillance system that detects and localizes poachers. This thesis contains a feasibility study on such a system.

In an earlier study Jacob Sundqvist and Jonas Ekskog [5] developed a radio localization system using Wi-Fi. Their system localizes a cellphone, also referred to as a Mobile Station MS, by circulating the area of interest and performing Re-ceived Signal Strength (RSS) measurements to the MS. The RSS is measured on Wi-Fi signals transmitted from the MS. For this system to work the MS must be in Wi-Fi hot spot mode to make sure that the MS transmits Wi-Fi signals contin-uously. Our system is similar to this but uses GSM instead of Wi-Fi.

(14)

2 1 Introduction

1.2 Problem Description

This thesis contains a feasibility study on unobtrusive localization of GSM en-abled cellphones using one or more FBSs. Unobtrusive means that no extra hard-ware or softhard-ware is needed in the cellphone. The setup for this problem consists of two different entities:

1. A target with unknown position, consisting of a GSM enabled cellphone. 2. Localization system consisting of an FBS with known position.

We distinguish two different localization setups, which are shown in Figure 1.1a and Figure 1.1b. Figure 1.1a shows the first setup where a mobile FBS with known positions performs range measurements to the cell phone. This setup is also referred to as Search And Rescue (SAR) setup. Figure shows the second setup where fixed FBSs perform range measurements to the cellphone. Setup two is a typical wildlife protection setup. It consists of several static FBSs that perform range measurements to the cellphone. This setup is presented in Figure 1.1b.

(a)Mobile localization setup (b)Static localization setup

Figure 1.1:Two different localization setups.

1.3 Requirements of the Localization System

This section presents the requirements of the localization system in Ngulia. • The localization system uses GSM signals to estimate the position of MSs. • The localization system is calibration-free. This means that the

localiza-tion system does not require calibralocaliza-tion for unknown environments and unknown hardware.

(15)

1.4 Goals for the feasibility study 3

1.4 Goals for the feasibility study

This section lists the goals of the feasibility study.

• Implement a simple proof-of-concept GSM-based localization system. • Investigate the noise properties of the available radio measurements. • Investigate the localization accuracy of the different radio measurements. • Give a proposal for how a system of one or several FBSs can be used to

localize poachers.

1.5 Related Work

We consider and compare our work to existing work on GSM localization that uses Software Defined Radio (SDR). We differentiate between different GSM-based localization systems by the type of measurements it employs. The types of mea-surements include RSS, Angle Of Arrival (AOA), Time Of Arrival (TOA) and Time Difference Of Arrival (TDOA).

We distinguish between two types of RSS-based GSM localization systems, namely calibration-intensive and calibration-free localization systems. Calibration-intensive systems require Calibration-intensive calibration before deployment. A common example of such a system is a fingerprinting-based localization system [3]. This thesis focuses on calibration-free and range-based localization systems using RSS and TOA measurements. The term radio measurements are sometimes used to refer to both RSS and TOA. We analyze these signal properties of the radio mea-surements in Chapter 3.

We have found four other localization systems that are comparable to ours. The system most similar to ours is a localization system developed by Rögg Cor-poration. It is a GSM-based localization system for Search-And-Rescue (SAR) operations. The localization system consists of an FBS implemented with an SDR and is carried by a helicopter. The FBS performs TOA measurements to local-ize the MS of the person that requires help. The localization system provides a localization accuracy of 60 meters at a range of 35 km [19].

A research team from University of Vigo in Spain developed a GSM-based lo-calization system for SAR operations [18]. This lolo-calization system uses AOA to localize MSs. The AOA measurements have an accuracy of 15◦

at a range of 200 to 2000 meters, when deployed in Formigal ski resort and Guadarrama Moun-tains (Madrid). To be able to collect AOA measurements this system requires a specialized SDR equipment with an arrray of antennas.

At Tsinghua University in China a research team developed GSM-based local-ization system [17], where three SDRs perform TDOA measurements to estimate the positions of MSs. The system has an average accuracy of about 2.2 meters at a maximum range of 122 meters in a LOS environment. This system requires that the FBSs are well synchronised in time, in order to get accurate TDOA measure-ments. This is obtained by synchronising the FBSs to a GPS signal.

(16)

4 1 Introduction

A team at Florida International University developed a GSM-based system for indoor localization [22]. The system consists of five SDRs collecting RSS-measurements. To test the system they placed out the SDRs in a an indoor en-vironment of about 2400 m2. The localization system provides a localization accuracy of roughly 5 meters in an indoor NLOS environment of 2400 m2.

(17)

2

Fake Base Station: hardware and

software

An FBS is a radio transceiver that emulates the behaviour of a legitimate mobile base station (BS). The purpose of an FBS is to fool ordinary MSs to switch from the legitimate base station to the fake one. This process is sometimes referred to as spoofing. The feasibility study in this thesis investigates how an FBS can be utilized to localize MSs. The following section describes in more detail what an FBS actually is. The last section describes the localization system used in this feasibility study.

2.1 Spoofing a GSM network

It is relatively easy to spoof a GSM network, because a base station does not need to authenticate itself to an MS. The lack of authentication for the BS means that an MS considers any BS (including FBS) that follows the GSM protocol as a legit-imate BS. A mobile network provided by a telecommunication operator is called a Public Land Mobile Network (PLMN). A PLMN is a system of several BSs nected into one network. According to the GSM standard 05.08 [6], an MS con-nects to the BS with the strongest signal. However the MS will always prioritize BSs belonging to its Home PLMN (HPLMN) over any other BSs. The HPLMN is the PLMN provided by the telecommunication operator to which the MS SIM-card is subscribed. The MS identifies the PLMN by the Mobile Country Code (MCC) and the Mobile Network Code (MNC). Note that it is possible to disguise an FBS as the HPLMN, by setting the MNC and MCC correctly. By doing this it is possible to make the MS switch to the FBS, if the FBS provides a stronger signal than the true HPLMN BSs.

(18)

6 2 Fake Base Station: hardware and software

2.2 System overview

Our localization system consists of an FBS that collects RSS and TOA measure-ments and some surrounding components that are used for the localization. The system is divided into four different main components.

• An SDR that receives and transmits radio signals. • A computer that controls the FBS.

• A computer used for localization. • An MS that collects GPS coordinates.

Figure 2.1 displays a simple block scheme of the hardware and software com-ponents used by the system. RSS measurements are collected both from the up-link and the downup-link signals. Upup-link signals are transmitted from the MS to the FBS. Downlink signals are transmitted from the FBS to the MS.

Figure 2.1:Overview block scheme of the FBS

In Figure 2.1 the boxes with sharp corners represent hardware components, the boxes with round corners represent software components, and the cylinders rep-resent collected data. The arrows with solid lines reprep-resent online data transfers. The arrows with dashed lines represent offline file transfers. It should be noted

(19)

2.3 Hardware 7

that this implementation is setup to be used in the field tests presented in Chap-ter 5. For a working prototype, the FBS would have to acquire the GPS positions by itself.

2.3 Hardware

As mentioned in the previous section, the localization system consists of two com-puters, one MS and one SDR. These components are represented by boxes with sharp corners in Figure 2.1. A few extra components are required for the FBS to work. These components include two antennas for radio signals in the 900 MHz band, one GPS Disciplined Oscillator (GPSDO) and a GPS antenna. The reason for adding the GPSDO and the GPS antenna is to get better Frequency precision for the FBS. Complete descriptions of the hardware components are listed below

• FBS Computer - DELL Latitude E6410 • SDR - USRP B210 from Ettus Research [12]

• GPSDO - Board Mounted GPSDO (TCXO) Recommended for USRP B200/B210 from Ettus Research [11]

• Radio Antenna - Two VERT900 Antennas from Ettus Research. [13]

• GPS Antenna - 5-Volt Active GPS Antenna for USRP X300/X310 and B200/B210 from Ettus Research. [10]

• Localization computer - MacBook Pro by Apple • MS - Nexus 5 by Google

2.4 Software

The following subsections contain short descriptions of each software compo-nent in the localization system. These compocompo-nents are represented by boxes with round corners in Figure 2.1.

2.4.1 OpenBTS

OpenBTS is an open source software implementation of the GSM protocol pro-vided by Range Networks. It implements the GSM protocol from level 1 up to level 3. The version of OpenBTS used for the FBS is OpenBTS 5.0. Documenta-tion for OpenBTS is available in OpenBTS-4.0 Manual [20]. Note that the manual is written for OpenBTS 4.0 and not 5.0. An introduction on how to use OpenBTS is available in the book Getting started with OpenBTS [16].

(20)

8 2 Fake Base Station: hardware and software

2.4.2 OpenBTS CLI

OpenBTS CLI is a text-based user interface for OpenBTS. The CLI is used to set parameters and get real-time information from the FBS. Examples of parameters that can be modified with the CLI include transmit power, MCC and MNC. Ex-amples of real-time information include noise level and a list of MSs connected to the FBS. The OpenBTS CLI is provided by Range Networks and is installed together with OpenBTS. Documentation and an introductory guide for OpenBTS CLI is available in OpenBTS-4.0 manual [20] and Getting started with openBTS [16].

2.4.3 UHD

UHD is an abbreviation for USRP Hardware Driver. It is an API developed by Ettus Research to enable easy development on USRP SDRs. In the FBS it works as a hardware abstraction layer between OpenBTS and the SDR hardware.¨¨

2.4.4 Measurement Extraction

The Measurement Extraction software extracts radio measurements and other information from OpenBTS. The information arrives as packages made up of json formatted strings. The packages are obtained from a streaming API implemented in OpenBTS named¨PhysicalStatus API¨. The program prints the information in real-time in the terminal and saves it to a text file. The text file can then be transferred offline to the Localization computer for further use. There is a lot of different information available in the packages, but only a portion of it is used for localization. The list below presents the information that is used for localization. • Uplink RSSI - Named ¨RSSI¨ in OpenBTS, used to calculate the uplink RSS. RSSI is an abbreviation for Reseived Signal Strength Indication. It is the raw RSS value, for further explanation see Chapter 3.

• MS transmit power - Named¨actualMSPower¨ in OpenBTS, used to calcu-late the uplink RSS.

• Downlink RSSI - Named ¨RXLEVEL_FULL_dBm¨ in OpenBTS, used to calculate the downlink RSS.

• Timing advance - Named¨actualTimingAdvance¨ in OpenBTs, used to cal-culate the TOA.

• Timing offset - Named ¨timingError¨ in OpenBTs, used to calculate the TOA.

In addition to the information obtained from the API, the Measurement extrac-tion program also marks each packet with a timestamp. The timestamp is the current Unix time for when the packet was received. The reason for adding the timestamp is to make it possible to synchronise the radio measurements with GPS coordinates. The PhysicalStatus API is documented in OpenBTS-4.0 manual [20] and Getting started with openBTS [16].

(21)

2.4 Software 9

2.4.5 Sensor fusion app

The sensor fusion app is an Android app developed by Linköping University in collaboration with HiQ [1, 2]. The application can be used to log sensor data from an MS. The available data includes GPS coordinates, downlink RSS, accelerome-ter, and more. We use the sensor fusion app to obtain GPS coordinates. The GPS coordinates are collected with a frequency of 1 Hz. Each set of GPS coordinates is associated with a unix time timestamp. This timestamp is used to synchronise the GPS coordinates with the radio measurements. The application stores all logged data in a text file.

2.4.6 Localization program

The localization is implemented in Matlab. The program uses the radio measure-ments and the GPS coordinates to localize a target offline. The following steps are performed by the program:

1. Parsing - Parse the text files containing the radio measurements and the GPS coordinates.

2. Synchronising - Synchronise the GPS coordinates with the radio measure-ments so that each radio measurement is associated with a specific position. This is done by pairing the timestamps from the radio measurements to the closest timestamp from the GPS measurements.

3. Coordinate transformation - Transform the GPS coordinates to East- and North-coordinates in Universal Transverse Mercator coordinate system. The standard used for the transformation is World Geodetic System 1984. 4. Localization - Uses the radio measurements and the GPS coordinates to

localize the target. The measurement types used for the localization are TOA, uplink RSS and downlink RSS. Chapter 4 presents the methods used for localization.

5. Presentation - Presents the results of localization both graphically and sta-tistically.

(22)

(23)

3

Measurement types

This chapter presents the different measurement types that are used by the lo-calization system. Four different types of measurements for lolo-calization in GSM-based systems are mentioned in this thesis:

• AOA - Points out the direction in which the MS is located. • TOA - Measures the propagation time between an MS and a BS.

• TDOA - Measures the difference in propagation time between an MS and several different BSs.

• RSS - Measures the received power of a GSM signals.

AOA and TDOA require extra hardware and software to work [18] [17]. RSS and TOA are standard available in the GSM protocol. Therefore, we focus on RSS-and TOA-based localization.

3.1 RSS in GSM

In ETSI TS 125 215 Section 5.1.6 [9], RSSI is defined as the time-averaged power over one time slot. We employ a path loss model, which assumes that decay in power only depends on distance. The path loss is the difference between received power and transmitted power. In this thesis, the term RSS refers to the path loss, while the term RSSI refers to the actual raw measured value.

The FBS transmits with constant power level. This means that there is a con-stant relation between the RSS and RSSI in the downlink. The relation between downlink RSS and downlink RSSI is

RSSd(t) = RSSId(t) − PBS, (3.1)

(24)

12 3 Measurement types

where PBSis the constant BS transmit power.

The MS transmit power varies to keep the received power at the BS constant. This means that the relation between uplink RSS and uplink RSSI varies over time. Due to this variation it is important to keep track of the MS transmit power for each measurement to calculate the uplink RSS correctly. The relation between uplink RSS and RSSI is thus

RSSu(t) = RSSIu(t) − PMS(t), (3.2)

where PMS(t) is the time varying MS power. Figure 3.1 displays the downlink

and uplink RSS measured during 300 seconds. The MS and the FBS positions are completely static during the measurements. The figure shows that the downlink RSS is more stable than the uplink RSS. This is partly due to the fact that there are larger quantization steps in the downlink RSS.

(a)RSS_d (b)RSSu

Figure 3.1:Downlink and uplink RSS while standing still.

3.1.1 Power control loop

The algorithm for controlling the MS transmit power is called the power control loop. This algorithm is explained in detail in GSM 05.08 Section 10.2.1 [8]. The power control loop makes sure that the received power at the BS always is close to a certain value. This value is called RSSI target or GSM.Radio.RSSITarget in the OpenBTS CLI. In our system this value is set to -65 dBm. Figure 3.2 illustrates how the MS power control loop works when an MS connects to a BS and then moves back and forth to the FBS.

(25)

3.1 RSS in GSM 13

(a)MS transmit power (b)Uplink RSSI

Figure 3.2:MS transmit power and uplink RSSI while moving back and forth to the BS.

Figure 3.2a displays the MS transmit power. The figure shows that the MS transmit power starts at 33 dBm. The power control loop then starts to decrease the transmit power as the RSSI in Figure 3.2b is very high. After a while, the MS transmit power and the RSSI stabilize. This is because the RSSI reached the desired level of -65 dBm. The MS then starts to move back and forth to the BS. Figure 3.2a shows how the power control loop varies the MS transmit power to compensate for the changing distance. Figure 3.2b shows that the uplink RSSI is kept stable at -65 dBm. Figure 3.3 displays the resulting uplink RSS after the transmitted power has been removed.

Figure 3.3:Uplink path loss while moving away from and back towards the base station

(26)

One important property of Figure 3.3 is the erroneous measurements in the be-ginning. These are due to the fact that the MS is not synchronised with the power control loop until the connection is established, which takes a few seconds.

3.2 TOA in GSM

It is possible to get TOA measurements in GSM by using the GSM features for time alignment defined in GSM 05.10 [7]. The total time between transmitting and receiving a packet at the BS is referred to as the round trip time. Figure 3.4 visualises the path of a round trip. It takes the time T1for a packet to travel from

the BS to the MS. The MS then waits the time Td before it retransmits a package.

The retransmitted package arrives back at the base station after time T2.

Figure 3.4:Visualization of a round trip between a BS and an MS We assume that T1= T2= T . The total round trip time Ttotis then

Ttot= T1+ Td+ T2= 2T + Td. (3.3)

The delay Tdis specified in the GSM standard [7] to be in the range

467.75 − T A < Td< 469.75 − T A (3.4)

bit periods. The expected value of Td is assumed to be 468.75 − T A bit periods.

A bit period equals 48/13 µs and TA is an abbreviation for Timing Advance. Tim-ing Advance is an integer sent from the base station that informs the MS how much earlier it has to transmit to compensate for the propagation time. The TA is quantized down to an integer number of bit periods. The base station calculates the TA by measuring the so-called Timing Offset (TO). TO equals the difference between the true round trip time and the expected round trip time for T = 0. TO can thus be expressed as

T O = (2T + 468.75 − T A) − 468.75 = 2T − T A (3.5) This relation is used to define the TOA measurement as

T OA = T A+T O₂ . (3.6)

The GSM standard [7] states that the TO has an accuracy of at least 1 bit period, which corresponds to about ±553 meters. However our FBS provides a

(27)

3.2 TOA in GSM 15

TO accuracy of at least 1/20 bit periods, which corresponds to about 27 meters [20].

Our TOA measurements follow two distinctly different probability distribu-tions. In the first probability distribution, the TOA measurements periodically drift in a sawtooth shape. Even though the distance between the FBS and the MS is constant. Figure 3.5a shows an illustrative sample of this probability distribu-tion. The graph shows that the minimum value and maximum value of the TOA differs 0.5µs. This corresponds to a distance of about 150 meters.

The other probability distribution appears to be random with no trace of any periodic properties. This distribution is displayed in Figure 3.5b. For this dis-tribution, the difference between min and max is 0.3µs. This corresponds to a distance of about 90 meters.

(a)Sawtooth distributed TOA (b)Random distributed TOA

Figure 3.5:MS transmit power and uplink RSSI while moving back and forth to the BS.

The occurrence of these two behaviours seemed somewhat arbitrary and in many cases it was possible to detect combinations of both. In these cases, there was of-ten one probability distribution that seemed more distinguishable than the other. Figure 3.6 contains TOA measurements were both probability distributions are distinguishable. Section 5.2.4 and 5.2.5 presents the probability distributions obtained from the final field tests.

(28)

Figure 3.6:TOA measurements with a combination of sawtooth and random distribution

(29)

4

Sensor fusion algorithms for

localization

This chapter presents the algorithms and the signal models that we use for local-ization. We base our localization on trilateration. Trilateration is the process of determining absolute or relative locations of points by measurement of distances, using the geometry of circles, spheres or triangles [23]. Figure 4.1 shows an illus-trative example of trilateration in 2-D.

Figure 4.1:A target (in the center) is located through trilateration with mea-surements from three different positions

(30)

18 4 Sensor fusion algorithms for localization

4.1 Localization methods

We model the trilateration problem as a non-linear optimization problem. The goal of the optimization is to determine the parameters ˆX that minimize the loss

function V (X). We express the optimization problem as ˆ

X = argmin

X

V (X). (4.1)

X is a vector containing all unknown parameters that require estimation. In our

implementation, these parameters include the target position, along with other parameters belonging to the signal models defined in Section 4.2 and 4.3. All signal models are defined according to the following notation:

yk = hk(X) + ek. (4.2)

Here, yk denotes measurement k, hk is the signal model for measurement k, and

ekis the measurement noise of measurement k. The measurements are either RSS

or TOA.

The loss function V (X) represents an overall difference between the measure-ment yk and the signal model hk(X). These differences k(X) = yk−hk(X) are

re-ferred to as residuals. The loss function, i.e. the overall difference can be defined in several different ways. We use two different criteria on the loss function to find the optimum for the optimization problem. The first criterion is the Non-linear Least Squares (NLS) criterion. NLS minimizes the sum of squared differences be-tween the estimated values and measured values. NLS is optimal if the additive noise in (4.2) is Gaussian i.i.d. We define the NLS loss function as

VN LS(X) = 1 2 N X k=1 (yk−hk(X))2. (4.3)

The second criterion we use is the Least Absolute Deviation (LAD). It mini-mizes the sum of absolute differences between estimated and measured values. We define the LAD loss function as

VLAD(X) = 1 2 N X k=1 |_y_k−_h_k_(X))|. _(4.4) Minimizing the loss function is in the general case a non-linear optimization problem. To solve this optimization problem we use Matlab’s implementation of the Levenberg–Marquardt algorithm [21].

4.2 Signal model for RSS

The RSS measurements are modelled as a non linear function hRSS,kwith additive

noise ek that is assumed to be Gaussian and i.i.d.,

(31)

4.2 Signal model for RSS 19

RSSk is the kth RSS measurement, measured in dBm. The function hRSS,kis the

signal model for RSS measurement k.

The signal model that has been used is based on the the so called log distance path loss model. It is a widely used model, used by for instance [15], [4], and many more.

We adopt the Log-Normal Shadowing Model (LNSM) for modeling the signal strength over distance decay. This empirical model is widely used by RSS-based localization estimators [15] and has shown to be a reasonable representation of reality [4]. LNSM assumes that RSS follows a log-normal distribution.

Pk = Pd0−10n log10

dk

d0

!

+ ek. (4.6)

Here, Pk is the power received at the distance dk, Pd0 is the power received at

reference distance d0 = 1. Parameter n denotes the path loss exponent, which

represents the rate at which the path loss increases with distance. ek follows a

zero-mean Gaussian distribution e ∼ N (0, σ_dB2 ). We assume that Pd0 and n are

unknown parameters. Moreover the distance dk denotes the distance between

the known measurement position pk = [pk,1, pk,2]

>

for measurement k, and the unknown target position x = [x1, x2]

>

. These assumptions imply that Pd0 and n

need to be estimated along with the target position x. To follow the notation of the NLS, we define X as X = [x1, x2, Pd0, n] > , (4.7) and hRSS,kis defined as hRSS,k= hRSS(X, pk) = Pd0−10n log10 q (x1−pk,1)2+ (x2−pk,2)2 . (4.8) By substituting (4.8) into (4.3) and (4.1) we get

ˆ X = argmin X 1 2 N X k=1 yk−Pd0+ 10n log10 q (x1−pk,1)2+ (x2−pk,2)2 2 . (4.9)

The known parameters are: yk, pk,1and pk,2. The unknown parameters are: x1, x2,

Pd0 and n. Figure 4.2 shows how the LNSM fits to true RSS measurements at

dif-ferent distances. Figure 4.3 shows how the LNSM fits to true RSS measurements for a set of measurements collected over time.

(32)

Figure 4.2: Comparison between LNSM and true RSS measurements at dif-ferent distances.

Figure 4.3: Comparison between RSS measurements and the fitted LNSM over time.

4.3 Signal models for TOA

The signal model of TOA measurements equals [14]

(33)

4.3 Signal models for TOA 21

Here, hT OA,k is the signal model and ek is the measurement noise for

measure-ment k. We assume ek to be Gaussian and i.i.d.. We employed two different

signal models for modelling the TOA measurements. The first one is the Bias and Scaling (BiS) model. The second model is the Sawtooth Model (Saw). These two models are described in the following subsections.

4.3.1 Bias and scaling model

The TOA measurements are subject to unknown bias and scaling. To account for this, we introduce the parameters α and β. With these parameters we define the Bias and Scaling (BiS) model as

Tk = α

dk

C + β + ek. (4.11)

Here Tk is the propagation time at the distance dk, C equals the speed of light,

α accounts for unknown scaling and β accounts for unknown bias. From this

model we define hBiSas

hBiS(X, pk) = α

q

(x1−pk,1)2+ (x2−pk,2)2+ β. (4.12)

Here, x1 and x2 denotes the target position, and pk = [pk,1, pk,2]

>

denotes the measurement position of measurement k. The unknown parameters are x1, x2, α

and β. This gives

X = [x1, x2, α, β] >

. (4.13)

The LAD criterion is used to solve the optimization problem with TOA. By sub-stituting (4.12) into (4.4) and (4.1) we get

ˆ X = argmin X 1 2 N X k=1 yk−α q (x1−pk,1)2+ (x2−pk,2)2−β . (4.14)

Figure 4.4 shows how the BiS model fits to true TOA measurements at different distances. Figure 4.5 shows how the BiS model fits to true TOA measurements for a set of measurements collected over time.

(34)

Figure 4.4: Comparison between LNSM and true RSS measurements at dif-ferent distances.

Figure 4.5: Comparison between TOA measurements and fitted BIS model over time.

4.3.2 Sawtooth model

The purpose of the Saw model is to compensate for the sawtooth like behaviour presented in Figure 3.5a. The Saw model is based on the BiS model (4.12) but is modified by adding one extra term. The extra term represents a sawtooth func-tion with unknown period, amplitude and time shift. We define the Saw model

(35)

as

hSaw(X, pk, t) = hBiS(X, pk) + β + A mod (t−dT , 1)

= α q

(x1−pk,1)2+ (x2−pk,2)2+ β + A mod (t−dT , 1).

(4.15)

Here, x1, x2, α, β, and pk = [pk,1, pk,2]>are the same as in (4.12). Parameter A

denotes the amplitude of the sawtooth, T denotes the period of the sawtooth, d denotes the time shift of the sawtooth, and mod() denotes the modulo operation. Parameter t denotes the time instant of the measurement, thus making this signal model time dependent. For this model the unknowns are

X = [x1, x2, α, β, A, ∆f , d] >

. (4.16)

By substituting (4.15) into (4.4) and (4.1) we get

ˆ X = argmin X 1 2 N X k=1 yk−α q (x1−pk,1)2+ (x2−pk,2)2−β − A mod (t−dT , 1) . (4.17) Solving this optimization problem is hard. The loss function seems to have many different local minimum and thus the resulting fit depends on the starting point of the optimization. Hence, the results using the sawtooth model varies significantly. It is possible to identify three distinctly different ways in which the model fits to data. The first way is that the contribution from the sawtooth part is relatively small. Hence, it provides similar results as the BiS model. Figure 4.6 shows an example of this behavior. The second way is that the sawtooth part mimics additive noise. This does not add any information compared to the BiS model. Figure 4.7 shows an example of this behavior. The third way is that the sawtooth part mimics large ramps in the signal. Figure 4.8 shows an example of this behavior.

(36)

Figure 4.6:Sawtooth model fitted to TOA measurements by minimizing the effect of the sawtooth part

Figure 4.7:Sawtooth model fitted to TOA measurements by letting the saw-tooth part mimic additive noise

(37)

Figure 4.8:Sawtooth model fitted to TOA measurements by letting the saw-tooth part mimic the noisy ramps in the beginning of the TOA measurements

We use the BiS model for evaluating the TOA localization accuracy of our localization system due to inconsistent results from the sawtooth model.

(38)

(39)

5

Field Tests and Results

This chapter presents the results from the field tests that are performed as a basis for this feasibility study. The purpose of these tests is to evaluate the perfor-mance of the GSM-based localization system. The field tests are performed in the form of SAR operations. This means that the target MS position is assumed to be static and the localization system moves around the area in which the target is known to be. While moving along the perimeter the FBS collects RSS and TOA measurements continuously from the target MS. After collecting measurements it is possible estimate the targets position. We employ the methods described in Chapter 4. The signal models we use are the LNSM for RSS and the BiS model for TOA. The optimum for the NLS problem is found with the Levenberg–Marquardt algorithm. We use the LS loss function for RSS and LAD loss function for TOA.

5.1 Field Test Implementation

We simplified the measurement process by using a mobile MS with known po-sition and a fixed FBS with unknown popo-sition. This way it is possible to move around with the MS while the FBS collects radio measurements and use these measurements to localize the FBS. This method is equivalent to a SAR operation since the FBS still collects the required measurements. The MS positions are ob-tained by collecting GPS measurements with the Sensor Fusion app, described in Section 2.4.5. The radio measurements are collected by making a call from the MS to the FBS. The FBS is then able to collect measurements with a frequency of 2 Hz as long as the call is active. The radio measurements and the GPS measure-ments are synchronised as in Section 2.4.6.

Figure 5.1 displays an example of a SAR test. In the figure the FBS is located in the center. The MS moves in a rectangular shape along a line around the FBS. The asterisks along the line marks the measurement positions of the MS.

(40)

28 5 Field Tests and Results

Figure 5.1:Overview of a field test setup

The SAR scenario is similar to finding poachers in Ngulia national park. The major difference is that the poachers can not be assumed to have a static position, since they do not want to be found.

5.2 Field Test at Campusvallen

The first field test is performed at the athletics stadium next to Campus Valla in Linköping. The test is performed with three different SAR setups. In the first setup, the FBS is placed in the center of the field and the MS moves along the edge of the grass field. In the second setup the FBS is also placed in the middle, but the MS moves along the edge of the running track instead. In the final setup the base station still moves along the edge of the running track, but the FBS is placed in the lower left corner instead of the center. All these setups are displayed in Figures 5.2 - 5.4. In these figures the positions are superimposed onto an air photo of the area. The SAR test is performed 3-5 times for each setup. The measurement positions and the true FBS position are represented the same way as in Figure 5.1. The figures also show the positions estimated by the localization system.

(41)

5.2 Field Test at Campusvallen 29

Figure 5.2:Measurement setup 1

(42)

Figure 5.4:Measurement setup 3

5.2.1 Localization Accuracy

This section presents the achievable localization accuracy for our localization sys-tem. In the three measurements setups performed at Campusvallen the position of the FBS is estimated several times using TOA and both uplink and downlink RSS. The NLS optimization is based on all measurements from each setup to achieve maximum accuracy. The statistical results from each of the three setups are presented in tables 5.1-5.3. Five different statistics are presented. Absolute er-ror is the absolute distance between the estimated and the true FBS position. Av-erage error refers to the avAv-erage absolute error. Standard deviation refers to the standard deviation of the absolute error. Average distance refers to the average distance between the MS and the FBS. Maximum distance refers to the maximum distance between the MS and the FBS. Relative error is the average error relative to the average distance.

(43)

Table 5.1:Localization statistics Measurement setup 1 Measurement

type

Average error [m]

Relative error [%] Standard deviation [m] Uplink RSS 5.98 12.5 2.56 Downlink RSS 5.54 11.6 2.52 TOA 8.60 18.0 3.18 Average distance: 47.7m Maximum distance: 66.0 m

type

Average error [m]

Relative error [%] Standard deviation [m] Uplink RSS 18.1 25.2 6.03 Downlink RSS 22.9 32.0 7.89 TOA 9.58 13.4 5.91 Average distance: 71.7 m Maximum distance: 97.5 m

type

Average error [m]

Relative error [%] Standard deviation [m] Uplink RSS 21.1 27.4 8.43 Downlink RSS 12.6 16.4 1.94 TOA 10.5 13.7 1.26 Average distance: 76.7 m Maximum distance: 126 m

The statistics in Table 5.1-5.3 point to some interesting results. It seems like the uplink and the downlink RSS measurements give about the same localization accuracy. The LNSM implies that the accuracy of the RSS decreases with distance. This is confirmed by the fact the relative error increases by more than 100% when the average distance is increased from 48 to about 74 meter. This is not the case for the TOA measurements since the relative error actually decreases when the av-erage distance was increased. This leads to the result that the avav-erage error for the TOA measurements are roughly constant when the distance increases. According to these results we can conclude that for our localization system RSS-based local-ization provides better results than TOA-based locallocal-ization when distances are relatively short.

(44)

5.2.2 Accuracy Gain from Adding more Measurements

The results in the previous section shows the maximum achievable accuracy for the FBS. Since the the signal models only contain 4 variables it is theoretically possible to get an estimate from 4 measurements. In general, the localization performance decreases with the number of range measurements over space. Fig-ure 5.5 shows the mean error as a function of the number of measFig-urements over space. We decrease the number of used measurements uniformly, so that the calculations always is based on measurements from all around the perimeter. It should be noted that Figure 5.5b is a zoomed in version of 5.5a.

(a) (b)

Figure 5.5:Accuracy depending on the number of measurements, based on Measurement setup 1

Both figures clearly show that there is a large gain in adding more measurements. From Figure 5.5b we observe that not much is gained for more than 11 measure-ments for RSS, whereas TOA needs 25 measuremeasure-ments before it attains maximum accuracy. This is due to correlation between the measurements which means that after a certain point there is no more gain in collecting more measurements. In measurement setup 1, 25 measurements correspond to an average distance of 13 meters between each measurement.

5.2.3 Comparison between Least Squares and Least Deviation

Optimization for TOA

All earlier results for TOA are achieved by employing LAD optimization. The reason for this is that the LAD proves better results than LS. Figure 5.6 shows that the accuracy levels out much earlier for LS than for LAD. Figure 5.6b is a zoomed in version of Figure 5.6a.

(45)

(a) (b)

Figure 5.6:Accuracy comparison between TOA with LS and LAD

5.2.4 Noise estimation for RSS

The log distance path loss model (4.5) for the RSS measurements is defined in Section 4.2 as

RSSk= hRSS,k+ ek.

In this model the noise ek is assumed to be Gaussian i.i.d. with mean µ = 0

and some unknown standard deviation σ . By using all measurements collected from the field tests at Campusvallen we can validate this assumption and also calculate the variance of the measurements. Figure 5.7 displays histograms of the residuals for both the uplink and the downlink RSS measurements. In the figure it is possible to compare the distribution of the residuals with a true Gaussian distributions (in red) with the same µ and σ .

(46)

(a)Distribution of the residuals for down-link RSS measurements.

(b)The distribution of the residuals for up-link RSS measurements.

Figure 5.7: Comparison between distribution of the measured noise and a Gaussian distribution with mean value µ and variance σ . The statistics is based on 9900 measurements.

The distributions of the residuals seem to follow a Gaussian distribution. In both cases, the standard deviation is about 5 meters. We analyze the measured distri-butions by its skewness and kurtosis. Skewness is a way to measure how asym-metric a distribution is. A value of 0 means that the distribution is completely symmetric, a negative value means that the distribution has a longer negative tail and a positive value means that the distribution has a longer positive tail. This means that a perfect Gaussion distribution has a skewness of 0 since it is completely symmetric. Kurtosis is a measurement for how much outliers a dis-tribution has, higher values correspond to more outliers. A perfect Gaussian distribution has a kurtosis of 3. For the uplink RSS, the measured residuals have a skewness of -0.34 and a kurtosis of 2.83. For the downlink RSS, the measured residuals have a skewness of -0.23 and a kurtosis of 2.67. These values means that the residuals for both uplink and downlink have a slightly longer negative tail and a bit less outliers than in a perfect Gaussian distribution. Looking back at Figure 5.7 it is possible to see these aspects in the histograms. The parame-ters for hRSS,k are estimated for each SAR test using the known true distances

between the true FBS position and the measurement positions. This means that the error in the model itself is minimized. We can thus assume that the residuals only depend on measurement noise.

5.2.5 Noise Estimation for TOA

The noise for the BiS model is assumed to be Gaussian i.i.d. just like the noise for the LNSM. Figure 5.8 shows that the assumption of Gaussian noise compares the distribution of the residuals with a perfect Gaussian distribution. The skewness for the TOA residuals is -0.80. This means that the TOA residuals have more outliers than what is expected from a Gaussian distribution. The kurtosis of the

(47)

5.3 Field Test at Kolmården 35

TOA residuals equals 6.28. This means that the distribution of the residuals has a longer negative tail than a perfect Gaussian distribution. In Figure 4.3 it is actually possible to see the large negative outliers that causes these results. It should be noted that the standard deviation σ = 29.1 is much higher than for the RSS measurements. The signal model hT OA,kis estimated the same way as hRSS,k

in the previous section to minimize the model error.

Figure 5.8:Probability density function for the noise on TOA measurements, based on 9900 measurements.

5.3 Field Test at Kolmården

Another field test was performed on the savannah at Kolmården Wildlife Park. The purpose of this field test was to test out the system in an environment more similar to Ngulia Wildlife Sanctuary. Once again a search and rescue test was performed. Figure 5.9 displays the localization result superimposed onto an air photo of the area.

(48)

Figure 5.9:Localization field test at the Kolmården Wildlife Park

As Figure 5.9 implies the accuracy of the localization is much worse at Kolmår-den than it is at Campusvallen. The average distance during this field test is 78 m and the maximum distance is 115 m. This means that the distance conditions are about the same as for Measurement setup 3 at Campusvallen. Since the dis-tance conditions are the same, it can be assumed that the inferior result is due to some other factor. The source may be the trees placed around the area and the uneven terrain in the center. Or it may be due to interruptions of the line of sight at several points of the field test. The results are clearly worse than on campusvallen. Despite this, the test shows that the system works in a savannah like environment.

(49)

6

Conclusions

This chapter discusses the results in the thesis and connects it to the thesis prob-lem stated in Chapter 1. The chapter also mentions some future research that can be performed on the subject.

6.1 Discussion

In the thesis we present a proof of concept system that consists of a mobile GSM-based FBS that collects RSS and TOA measurements to a cellphone. The FBS is implemented with SDR hardware and OpennBTS software. The results are col-lected in field tests implemented according to a SAR setup, similar to Figure 1.1a. The differences in our field tests are that the FBSs position is fixed and unknown, while the cellphone position is mobile and known. Thus the roles in Figure 1.1a are exchanged. The localization is performed by solving non linear optimisation problems. The optimization problems are solved using signal models for RSS and TOA measurements along with the Levenberg–Marquard algorithm. The op-timization is done either with the Non-linear Least Squares (NLS) criterion or with the Least Absolute Deviation (LAD) criterion. For RSS measurements we employ the Log-Normal Shadowing Model. For TOA measurements we investi-gate two different models. The first model is called the Bias and Scaling (Bis) model. It compensates for any bias or scaling in the measurements. The second model is called the Sawtooth model and will, in addition to bias and scaling, also compensate for cyclic drift in the measurements.

RSS localization provides promising results in close range with an average error of less than 6 meters. It proves less useful at longer ranges as the error increases with a factor of 2 up to 4. This can however be due to the fact that the distance during the tests are close to the maximum range of the system. This results in a low SNR and thus the measurements get inaccurate. It might be

(50)

38 6 Conclusions

possible to solve this by using a signal amplifier and better antennas.

For the TOA measurements the simple Bias and Scaling (BiS) model proves to be the superior option. It provides good localization results, especially consider-ing that the accuracy is almost the same for all three setups. Another interestconsider-ing property of the TOA is that the relative accuracy actually increases with longer distance. The best loss function for TOA is LAD. This is because the TOA mea-surement contains a lot of outliers, which influences NLS more than LAD . By using the LAD and the BiS model it is possible to obtain an accuracy of 8-10 me-ters. Despite the fact that the residuals have a standard deviation of 54 meme-ters. We consider the localization performance sufficient for finding poachers in an open savannah.

It is hard to do a fair comparison between our results and the related work mentioned in Section 1.5. This is mainly due to differences in the system imple-mentation and the environment in which the systems are deployed. Although the results from [19] implies that our system could achieve a sufficient accuracy at distances up 35 km as long as the FBS is provided with enough signal power. This assumption is supported by the fact that the accuracy of the TOA measure-ment does not decrease substantially when the distance increases. Moreover we see that [17] achieves an average error of 2.2 meters with TDOA. This accuracy is almost five time better than the average error of 10.5 m that our system achieves with TOA. The large difference in accuracy implies that the attainable accuracy is much higher with TDOA than with TOA.

6.2 Evaluation of the stated problem

The results show that our FBS-based localization system meets the requirements for tracking poachers in a savannah. However, this thesis presents a feasibility study of using an FBS for localization purposes along with a proof of concept system, not a working prototype.

6.3 Future Research

Our system has some limitations and thus there are still a few things that can be investigated further. There is no thorough investigation on how much the distance between the target and the FBS actually affects the localization accuracy. The reason for this is that the FBS only has a range of about 120 meters. With this range, it is hard to make any significant conclusions concerning the change in accuracy over distance. Another thing that can be investigated in the future is tracking of moving targets. We have not tested this since we have been limited to only one FBS. Tracking of a moving target would require several FBSs working together as a sensor network, or that the FBS moves around much faster than the target.

(51)

Bibliography

[1] Sensor Fusion app: download. https://play.google.com/store/ apps/details?id=com.hiq.sensor&hl=en, 2014. Cited on page 9. [2] Sensor Fusion app: support site. http://www.sensorfusion.se/

sfapp/, 2014. Cited on page 9.

[3] B.D.S.Lakmali and D. Dias. Database Correlation for GSM Location in Out-door InOut-door Environments. 2008. Cited on page 3.

[4] B. J. Dil and P. J. M. Havinga. RSS-Based Localization with Different An-tenna Orientations. November 2010. Cited on page 19.

[5] J. Ekskog and J. Sundqvist. Victim Localization using RF-signals and Multi-ple Agents in Search Rescue. http://liu.diva-portal.org/smash/ get/diva2:847134/FULLTEXT01.pdf, 2015. Cited on page 1.

[6] ETSI. Digital cellular telecommunications system (Phase 2+); Radio subsys-tem link control (GSM 05.08). http://www.etsi.org/deliver/etsi_ gts/05/0508/05.01.00_60/gsmts_0508v050100p.pdf, 1996. Cited on page 5.

[7] ETSI. Digital cellular telecommunications system (phase 2+) radio subsys-tem synchronisation (GSM 05.10). http://www.etsi.org/deliver/ etsi_gts/05/0510/05.00.00_60/gsmts_0510v050000p.pdf, jun 1999. Cited on page 14.

[8] ETSI. Digital cellular telecommunications system (Phase 2+) Ra-dio subsystem link control (GSM 05.08 version 8.5.0 Release 1999). http://www.etsi.org/deliver/etsi_ts/100900_100999/

100911/08.05.00_60/ts_100911v080500p.pdf, 2000. Cited on page 12.

[9] ETSI. Universal Mobile Telecommunications System (UMTS); Physi-cal layer – Measurements (FDD) (3G TS 25.215 version 3.1.1 Release 1999). http://www.etsi.org/deliver/etsi_ts/125200_125299/ 125215/03.01.01_60/ts_125215v030101p.pdf, 2000. Cited on page 11.

(52)

40 Bibliography

[10] Ettus Research. 5-Volt Active GPS Antenna for USRP X300/X310 and B200/B210. https://www.ettus.com/product/details/ GPS-ANT-5V, 2016. Cited on page 7.

[11] Ettus Research. Board Mounted GPSDO (TCXO) Recommended for USRP B200/B210. https://www.ettus.com/product/details/ GPSDO-TCXO-MODULE, 2016. Cited on page 7.

[12] Ettus Research. USRP B210. https://www.ettus.com/product/ details/UB210-KIT, 2016. Cited on page 7.

[13] Ettus Research. VERT900 Antenna. https://www.ettus.com/ product/details/VERT900, 2016. Cited on page 7.

[14] F. Gustafsson. Statistical Sensor Fusion. Studentlitteratur, second edition, 2012. Cited on page 20.

[15] F. Gustafsson and F. Gunnarsson. Localization based on observations linear in log range. IFAC Proceedings, Volume 41, Issue 2, 2008. Cited on page 19. [16] M. Iedema. Getting Started with OpenBTS. O’Reilly Media, Inc, first edition,

2015. Cited on pages 7 and 8.

[17] X. Ma, Q.-Y. Huang, X.-M. Shu, and S.-H. Yang. Design and implementation of instantly deployable localization system in remote areas. November, 2012. Cited on pages 3, 11, and 38.

[18] J. Munoz-Castaner, P. C. Soto, F. Gil-Castineira, F. J. Gonzalez-Castano, I. Ballesteros, A. di Giovanni, and P. C. Villar. Your Phone as a Personal Emergency Beacon: A Portable GSM Base Station to Locate Lost Persons. IEEE Industrial Electronics Magazine, 9, 2015. Cited on pages 3 and 11. [19] T. Parker. Range Networks’ OpenBTS enables helicopter-based GSM

network. http://www.fiercewireless.com/tech/story/ range-networks-openbts-enables-helicopter-based-gsm-network/ 2014-04-23, 2014. Cited on pages 3 and 38.

[20] Range Network. Openbts application suite release 4.0 user man-ual. http://openbts.org/site/wp-content/uploads/2014/07/ OpenBTS-4.0-Manual.pdf, 2014. Cited on pages 7, 8, and 15.

[21] The MathWorks Inc. Least-Squares (Model Fitting) Algo-rithms. http://se.mathworks.com/help/optim/ug/ least-squares-model-fitting-algorithms.html?refresh= true. Cited on page 18.

[22] K. Vasudeva, B. S. Ciftler, A. Altamar, and I. Guvenc. An Experimental Study on RSS-Based Wireless Localization with Software Defined Radio. June, 2014. Cited on page 4.

[23] Wikipedia. Trilateration. https://en.wikipedia.org/wiki/ Trilateration, 2016. Cited on page 17.

Radio Localization with GSM

Master of Science Thesis in Communication Systems

Department of Electrical Engineering, Linköping University, 2016