A Survey on IoT Positioning Leveraging LPWAN, GNSS, and LEO-PNT

Location data is an important piece of information in many Internet of Things (IoT) applications. Global navigation satellite systems (GNSSs) have been established as the standard for large-scale localization. However, the rapidly increasing need to locate IoT devices in recent years has exposed several shortcomings of traditional GNSS approaches. These limitations include the weak signal propagation in indoor and dense environments, the inability to calculate or obtain a location remotely, and a high energy consumption. Therefore, several industries have shown an increasing demand for alternative and innovative positioning solutions that are more suited in an IoT context. Hence, we conduct a survey on state-of-the-art, large-scale, and energy-efficient positioning techniques for IoT applications. More specifically, we analyze the performance of terrestrial-based low power wide area network (LPWAN) techniques, novel GNSS solutions, and innovative positioning techniques leveraging low Earth orbit (LEO) satellite constellations. A comparison is made in terms of 16 dimensions, including energy consumption, positioning accuracy, coverage, and scalability. The analysis shows that interoperability between technologies is key to enable energy-efficient communication and positioning applications in the emerging market of satellite IoT.


I. INTRODUCTION
T HE LOCATION of a device on Earth has become an essential requirement in a myriad of Internet of Things (IoT) applications. Example use cases include smart agriculture, wildlife tracking, container tracking, and search-andrescue systems [1], [2], [3]. Moreover, the majority of IoT use cases may benefit from location awareness. Meanwhile, mobile IoT devices are often equipped with small batteries which need to last for several years. The balance between positioning accuracy and energy consumption is only one of the numerous tradeoffs use case designers have to consider.
Today, four major global navigation satellite systems (GNSSs) are fully operational. meter-level accuracies under open sky conditions. This has made GNSS the de-facto standard for many positioning applications. However, the GNSS technology has several weaknesses. Because GNSS satellites move in medium Earth orbit (MEO) and given their low transmission power, GNSS signals often cannot reach indoor or dense urban environments. Multipath errors degrade the accuracy drastically. Furthermore, GNSSs were not designed with low energy consumption in mind. In contrast, energy consumption is of utmost importance in mobile IoT applications. Therefore, more energy-efficient positioning alternatives are gaining increasing popularity. In this context, the question arises whether the high GNSS availability and accuracy are required by the application or if the requirements could be fulfilled by one of these alternatives. A final limitation of traditional GNSS approaches is the local location processing, requiring an additional connectivity link to communicate the computed location to a remote user. With such a link however, remote location processing techniques are also gaining more attention. For example, novel GNSS techniques enable cloud processing by sending raw observables via a terrestrial network to the cloud [4].
As an alternative to GNSS, terrestrial low power wide area networks (LPWANs), such as LoRaWAN and narrowband IoT (NB-IoT) are used to estimate the location of a mobile transmitter [1]. Advantages of these technologies are the optimized energy consumption profiles for IoT use cases and the ability to provide location updates in both indoor and outdoor environments. On the other side of the coin, the positioning accuracy is rather limited when compared to GNSS and the coverage is bound to the range of the often nationwide terrestrial networks.
Recently, a myriad of companies started deploying low Earth orbit (LEO) satellite constellations in the race toward the constant global coverage on Earth for the emerging market of satellite IoT [5], [6]. On the one hand, big tech companies like SpaceX, OneWeb, and Amazon are deploying hundreds and even thousands of satellites to provide worldwide broadband Internet. On the other hand, smaller companies, such as Kineis, Lacuna Space, and Hiber focus on very low-energy satellite communication and positioning of mobile end devices, which are especially of our interest. As illustrated in Fig. 1, LEO satellites are around 20 times closer to Earth compared to GNSS satellites. Therefore, the much stronger LEO satellite signals enable positioning, navigation, and timing (PNT) applications in GNSS-denied environments.
In perform when compared to each other. We tackle this by making the following contributions. 1) We provide an overview of state-of-the-art, energyefficient and large-scale positioning techniques using LPWAN, LEO, and GNSS technologies. We are the first to combine these in a single comprehensive survey. 2) We compare the performance of each positioning technique in terms of 16 dimensions and visualize them in a performance matrix. 3) For each positioning technique, we evaluate the interoperability and the possibility to integrate multiple techniques in a single satellite IoT device. 4) Through example IoT positioning use cases, we discuss a set of important tradeoffs to consider during the design. The survey is structured in the following way. We first introduce state-of-the-art positioning techniques leveraging LPWAN, GNSS, and LEO systems in Section II. Their performance is evaluated in Section III. Using a defined set of dimensions, we are able to compare these techniques and create a performance matrix. Section IV discusses the tradeoffs to be made when designing a location-enabled IoT use case. Finally, we summarize the main conclusions and discuss remaining challenges in Section V.

II. STATE-OF-THE-ART POSITIONING TECHNIQUES
When discussing positioning systems, it is important to distinguish between positioning technologies and techniques. Within the scope of this work, we define a positioning technology as the set of scientific principles that enables positioning, while a positioning technique refers to a certain method or algorithm to implement these principles. Therefore, multiple positioning techniques can be applied using the same technology. LPWAN, GNSS, and LEO technologies constitute three large-scale categories of positioning technologies, as illustrated in Fig. 1. A high-level overview of state-of-the-art positioning technologies and techniques in each of these categories discussed in this work is shown in Fig. 2. Their core concepts are briefly described in the following sections.
Alternative surveys exists, although they specifically target LPWAN [1], GNSS [7], or LEO [5], [8], [9] technologies. Besides, many works focus on communication rather than localization. To the best of our knowledge, no other work in the literature has investigated and compared this wide range of IoT positioning solutions, taking into account their energy efficiency.

A. LPWAN
Terrestrial LPWANs are designed for long-range and lowpower communication of small messages [10]. In more recent years, the networks of IoT transceivers and ground stations are also used as a means to provide a localization solution. LoRaWAN and NB-IoT are by far the most prominent LPWAN technologies available on the market [11], [12]. Where LoRaWAN provides operational flexibility and the choice for a private or public network, NB-IoT can be easily deployed on top of existing cellular infrastructure. Other LPWAN technologies include Sigfox and LTE-M, which offer battery lifetimes of several years as well.
Received signal strength (RSS)-based positioning technique determines the location of a mobile IoT device through uplink communication. When a user equipment (UE) transmits a message, the RSS is measured at nearby gateways. This information is sent as metadata along with the payload to the cloud, where the data processing and location estimation steps are performed [13]. An RSS ranging technique uses a path loss model to translate the signal strength into a distance to a certain gateway. The position estimate can subsequently be calculated using various algorithms, such as least squares (LSs) or min-max [14]. Another RSS-based technique is fingerprinting, in which training RSS data with groundtruth information is collected in the area of interest, and a new fingerprint is matched to this training database to locate the mobile transmitter. While this technique incorporates multipath effects and environmental influences, it requires a lot of effort, cost, and time to create a large fingerprinting database. The accuracy of these positioning techniques highly depends on the number of receiving gateways, as well as the accuracy of the path loss model in a given environment [15].
Another popular technique to estimate the location of an LPWAN-enabled device is time-based ranging. In traditional Time of Arrival (ToA) approaches, the absolute time for a signal to travel from transmitter to receiver is measured. Multiplying by the speed of light yields the distance between the UE and the gateway. If enough gateways received the signal of a mobile transmitter, a multilateration algorithm is used to estimate the location of the transmitter. However, to avoid the need for synchronization between the UE and gateways, Time Difference of Arrival (TDoA) has become more popular. In this technique, the distance between the target and reference points is calculated based on the difference of arrival times at these reference points [16]. Geometrically, this leads to a hyperbola. With at least four gateways, the final location estimate can then be calculated as the intersection of the hyperbolas. It should be noted that when discussing TDoA, one mostly refers to uplink TDoA approaches. However for NB-IoT, the Third Generation Partnership Project (3GPP) has defined Observed Time Difference of Arrival (OTDoA) in Release 14. Despite the limited number of networks currently supporting this feature, the first OTDoA experiments show promising positioning improvements [17].
In combination with RSS-or time-based techniques, the Angle of Arrival (AoA) of an LPWAN signal can be determined using an antenna array at the gateway side and a triangulation algorithm [18]. Finally, it was demonstrated that an increased positioning accuracy can be achieved using a combination of TDoA and AoA via sensor fusion in a particle filter [19].

B. LEO
While there are hundreds of LEO satellite constellations in orbit or to be launched, they are designed with different objectives in mind. For example, Iridium and Globalstar provide a voice service, while SpaceX, Amazon, and OneWeb aim to deliver global broadband Internet [20]. Similarly, Telesat aims to deliver secure broadband connectivity. The Argos system is designed for Earth observation purposes [21]. Omnispace focuses on the integration of their satellite network with a terrestrial NB-IoT network, while Hiber, Wyld, and Lacuna Space aim to achieve this using a network of LoRa gateways and LEO satellites [5]. Although all of these examples may not be primarily designed for positioning purposes, the satellite IoT market has made a myriad of companies to shift focus toward the monitoring and locating of remote IoT devices leveraging LEO satellites. For instance, Satelles is developing a service which provides a true ranging signal similar to GNSS, leveraging Iridium satellites. Two companies are currently testing a system targeting the autonomous driving market. Xona Space Systems is developing a standalone LEO-PNT system using a dedicated constellation of 300 cubesats [22]. The company aims to deliver a reliable and resilient PNT service that is ten times more accurate compared to GNSS [23]. Similarly, Geespace is developing a 240-satellite constellation that will feature combined precise point positioning (PPP) and real-time kinematics (RTK) services, aiming to provide centimeter-accurate precise positioning and connectivity for automaker Geely [24]. While many of the positioning solutions are still in a research or testing phase, some industry leaders already provide early access to a commercial localization service. The interesting part of this type of positioning approach is the fact that most LEO satellites support twoway communication via ground stations, enabling to transmit a location estimate from the UE to the cloud.
In order to provide a positioning service leveraging LEO satellite signals, most currently available solutions exploit the Doppler effect. For instance, the Argos system operated by CLS and Kinéis provides satellite telemetry services for scientific and environmental applications. Through precise Doppler measurements with the Argos constellation, end users are provided with a location estimate, along with an indication of the estimation accuracy [21], [25]. By sending multiple uplink messages, a single receiving satellite performs a Doppler measurement. The time and frequency observation of the received signal is forwarded via a ground station to a solver, which estimates the user position using either an LS algorithm, or a more advanced extended kalman filter (EKF) [26]. Several improvements to Doppler positioning are being investigated, such as only transmitting during a satellite pass using forecasting software.
Due to the increasing number of LEO constellations provided by different operators, it has become a challenging task to provide a universal positioning technique. However, the Doppler positioning technique can also be performed by the UE, rather than by the satellites. Exploiting Signals of Opportunity (SoOP) from LEO satellite constellations is one of the most recent developments and is referred to as instantaneous Doppler positioning. This approach has the potential to leverage mega-constellations for zero-cost worldwide access to space signals using software-defined radios (SDRs), removing the need for specific indoor infrastructure [27]. Farhangian and Landry [28] designed an LEO satellite receiver to perform local Doppler measurements using downlink signals from multiple LEO constellations in an opportunistic way. The feasibility of this approach was demonstrated using Iridium NEXT, GlobalStar, and Orbcomm satellites in both simulations and experimental setups [29], [30], [31]. Moreover, the fusion of mixed SoOP has been proven beneficial in weak signal environments as well [32]. Finally, the Doppler measurements can be used as assistance data in assisted GNSS (A-GNSS) (see Section II-C), as well as in inertial navigation systems (INSs) [33].

C. GNSS
When it comes to GNSS-based localization solutions, the trend in the last decade was to manufacture multiconstellation GNSS receivers, e.g., combining the American GPS, European Galileo, Russian GLONASS, and Chinese BeiDou satellite constellations in a single chipset. In this way, both global coverage and availability are extended. However, innovations to increase the energy efficiency lie in the used GNSS technique. In general, there are three GNSS techniques relevant to IoT use cases: 1) conventional observable-based GNSS; 2) A-GNSS; and 3) snapshot GNSS techniques.
Conventional GNSS receivers attempt a continuous signal tracking, which yields pseudorange, Doppler, and phase observations. The tracking stage is preceded by an acquisition stage, in which the satellite signals are detected and the tracking loops are initialized. GNSS positioning is based on ToA, as the time to travel from the satellite to the receiver is used to calculate the distance, i.e., pseudorange, between them. Provided that satellite orbit and clock information is known, and at least four satellites are in view, the receiver can determine its position based on the pseudoranges. While Doppler-only positioning could be performed with similar principles as for LEO positioning, it is rarely applied due to the low accuracy of several kilometers. The reason for this is that GNSS satellites orbit the Earth at significant lower velocities than LEO satellites. A common way to cope with the high energy consumption of conventional receivers is duty cycling, i.e., periodically waking up to receive GNSS signals and going back to lowpower sleep modes. However, this technique does not meet the energy requirements of IoT use cases. Therefore, a significant amount of research is devoted to novel energy-efficient GNSS techniques.
Obtaining a first GNSS fix on the UE can consume a considerable amount of time and energy. Therefore, several techniques exist to reduce the time to first fix (TTFF), and consequently, the energy consumption. In order to compute a first fix, the satellite signals have to be acquired and the ephemeris data containing information on the satellite orbits and clock needs to be decoded from the satellite navigation message. The acquisition requires multiple correlations for different time (i.e., delay of the ranging code modulated on the carrier) and frequency (i.e., carrier Doppler) offsets. The more a-priori information is available, the narrower the search space and the more efficient the acquisition processing becomes. The principle of A-GNSS has been developed in order to provide such assistance data from an external source to the GNSS receiver, with the aim to reduce the TTFF [34]. The assistance data can be a rough location and time estimate of a terrestrial network, as well as ephemeris data, which can be valid for up to a few weeks. Providing ephemeris data makes decoding it from the GNSS signal obsolete. For example, LPWAN can provide this information in an energy-efficient way. Moreover, this connection with a terrestrial network rises the opportunity to communicate the GNSS location to the cloud. Furthermore, if there is no possibility to connect to a terrestrial network, a GNSS receiver can reduce the TTFF by predicting the ephemeris data, based on previously calculated location, time, and orbital parameters.
Snapshot processing techniques constitute the most recent set of energy-saving GNSS techniques. The main idea of these cloud processing techniques is to only sample a short portion of the received satellite signal (referred to as a snapshot), digitize the samples, and transmit them via a connectivity link to the cloud, where the data is processed and the location is calculated [4]. By performing the most power-hungry functions in the cloud, the overall energy consumption is drastically reduced. The connectivity link can be provided though ground stations or LEO satellites. Depending on the length of the snapshot and the limitations of this link, a tradeoff needs to be made between how many processing is performed on the device and how many data is sent to the cloud [35]. Furthermore, a snapshot GNSS receiver requires some adaptations from standard GNSS processing to derive a position, velocity and time (PVT) solution. A basic block diagram for snapshot processing is shown in Fig. 3. Even with small snapshot lengths, the frequency and code phase can be detected. To calculate the pseudoranges and solve some ambiguities, a rough estimate of the current location and time is often required. This information can be sent to the receiver via an LPWAN connection, together with the ephemeris data. Using the latter, the current position and time can be calculated. Finally, it has been proven that even without a rough position and time estimate, meter-level accuracy can be achieved [36].

D. Additional Sensors
The aforementioned technologies and techniques can be complemented with sensors providing more accurate or contextual information of the device location. Inertial measurement units (IMUs), e.g., a combination of accelerometer, gyroscope, and magnetometer can be used for dead reckoning in GNSS-denied environments, or to save energy if the transmitter has not moved since its last position update. Barometers are often used to estimate heights, e.g., to determine the floor level in an indoor positioning use case. Finally, Wi-Fi scanning, near field communication (NFC) tags, and Bluetooth low energy (BLE) ranging can yield better positioning performance in indoor or urban environments. As the goal of this survey is to assess the performance of large-scale positioning techniques, i.e., tens of squared kilometers, these additional sensors fall outside of the scope of this work.

III. POSITIONING PERFORMANCE EVALUATION
In this section, we compare the aforementioned positioning techniques using LPWAN, GNSS, and LEO technologies.
The matrix in Table I shows an overview of the performance comparison in terms of 16 dimensions, of which the top 6 deserve the highest attention. This qualitative matrix enables the relative comparison between localization approaches. More  context and a more detailed discussion on the performance of each positioning technique with respect to the dimensions are provided in the following sections.

A. Hardware Availability
The first dimension indicates how accessible the hardware of a technology is, and if there are commercial off-the-shelf (COTS) chipsets available.
1) LPWAN: Since the rise of the IoT, LPWAN devices are becoming highly available to both industrial and commercial users. End devices are so commonly integrated in our society that they have become ubiquitous. A few examples include smart meters, temperature, and humidity sensors. LoRaWAN and NB-IoT, two of the most popular LPWAN, each provide several UEs in a different way. While Semtech is the major manufacturer of LoRa chips, some manufacturers have a license to produce them (e.g., Microchip) or collaborate with Semtech (e.g., ST Microelectronics). Alternatively, manufacturers may develop a LoRa module based on a chip from Semtech. In contrast, any manufacturer is allowed to produce NB-IoT-enabled chipsets and modules, provided that the corresponding 3GPP standard is followed.
The first rows of Table II provide an overview of commonly used LPWAN chipsets and modules. Common NB-IoT manufacturers include U-blox, Nordic Semiconductors, Qualcomm, and Quectel. Among the LoRa chips, the LR1110 chip from Semtech integrates LoRa with GNSS and Wi-Fi, providing a geolocation service through the "LoRa Edge" platform. Finally, the company behind Sigfox provides LPWAN modules that work together with GNSS and accelerometers to provide a low-power localization service.
In general, we can conclude that LPWAN chipsets and modules are highly available. As RSS-and timing-based localization techniques generally do not depend on the manufacturer or type of UE, they are given a score of 5 in Table I. Note however that UEs must support advanced localization techniques. For example, OTDoA requires accurate timestamps. Furthermore, besides a transmitter, AoA-based techniques require an antenna array at the receiver side to determine the angle of the incoming signal. Although antenna arrays are widespread, most LPWAN gateways are only equipped with a single antenna. Therefore, it is often not possible to deploy AoA in a public LPWAN network.
2) GNSS: Conventional GNSS and A-GNSS features are implemented in nearly all recent GNSS receivers and smartphones. Industry-leading companies such as u-blox provide an assistance service along with their multiconstellation GNSS chipsets. In contrast, snapshot GNSS receivers can be less complex and expensive as some traditional building blocks are not required. On the one hand, the building blocks of snapshot GNSS receivers are widely available and consist of an radio frequency (RF) frontend and a storage element, in order to digitize and store an incoming signal for processing at a convenient time in the cloud. An example is the Maxim MAX2769 GNSS-specific frontend. On the other hand, only

3) LEO:
The category of LEO-based positioning techniques is the most recent category, and therefore, chipsets and modules of these techniques are not as ubiquitous as LPWAN or GNSS devices. For example, both Jackson Labs and Orolia do provide Iridium-enabled devices but these do not support actual location estimation yet. In contrast, commercial positioning hardware is available for the Argos system. The ARTIC R2 chipset, for example, is compatible with the Argos-2, Argos-3, and Argos-4 system. An open-source reference design is provided, along with all technical details of the chip. Moreover, an Arduino library and multiple development kits are widely available. Furthermore, the KIM1 module provided by CLS and certified by Kinéis and CNES offers a more finished product, requiring less development. A shield board is also available to ease integration. Other companies providing LEO hardware include Orbcomm and Lacuna Space, as listed in Table II. Finally, the feasibility of instantaneous Doppler-based positioning using LEO signals has mostly been demonstrated based on SDR implementations, rather than tailored end products [37].
Recent hardware modules support the combination of LEO with LPWAN and GNSS. Kinéis partnering with Bouygues Telecom to integrate the Argos system with the LoRaWAN standard. Hiber, Lacuna Space and Wyld are competing companies, also combining an LEO constellation and an LoRa network. Orbcomm has designed a "dual-mode" platform, in which they combine their LEO constellation with a cellular network. Similarly, Intellian is manufacturing the user terminals for OneWeb, aiming to deliver commercial communications services to remote regions and industrial sectors. Globalstar provides devices combining LEO and GPS satellites to provide near real-time positioning in areas without terrestrial networks. While some of these companies are still developing and evaluating their solutions, some of them already offer commercially available hardware, as listed in Table II.

B. Network Accessibility
A second dimension indicates how accessible a network of gateways or satellites is, i.e., for commercial, personal, or industrial use. Table III lists currently available networks which are used for positioning. Additionally, we discuss any restrictions or limitations on the usage of these networks.
1) LPWAN: Since the emergence of the IoT, the number of low-power long-range networks worldwide has been growing rapidly. LPWAN technologies are deployed in various ways. Currently, 148 public and private LoRaWAN network operators are active in 162 countries [38]. Similarly, as of September 2022, 167 operators are actively investing in the NB-IoT technology, of which 124 have commercially launched NB-IoT networks in 80 countries [39]. Sigfox networks are operated nationwide, either by Sigfox or a partnering telecom provider. All of these networks are accessible for commercial, industrial, and personal use. Roaming between these networks has been a hurdle, but recent initiatives aim to tackle the problem and accelerate LPWAN roaming worldwide. For instance, full LoRaWAN roaming is available in 27 countries around the world as well as via the satellite network of Lacuna Space.
2) GNSS: GNSS networks are highly accessible. While there are signals dedicated to certain user groups (e.g., military or public authorities), everybody can use most signals from the different constellations free of charge. The system providers publish all required information to exploit the open services. The plethora of multiconstellation GNSS receivers allows the end user to use satellites from multiple constellations simultaneously.
3) LEO: In general, LEO satellite networks are not as accessible as when compared to GNSS constellations. First, most LEO positioning providers, such as Argos and Lacuna Space, require a paid subscription to use their Doppler positioning service. Second, many LEO constellations are not finished yet and only a small number of often region-bound beta testers can participate in the program (e.g., Starlink). When passively performing Doppler measurements on the UE using SoOP from multiple constellations, however, the network accessibility increases.

C. Energy Consumption Profile
As this survey aims to provide energy-efficient positioning techniques for the IoT, the energy consumption profile is one of the most critical dimensions. This section covers various energy-related parameters, ranging from overall UE energy consumption, over battery lifetime, to the availability of different energy profiles (e.g., sleep modes, idle mode, and cold/warm/hot start). It is important to highlight that, even though we provide numerical results originating from data sheets, simulations, and experiments, the overall energy consumption highly depends on a plethora of parameters, which may significantly differ based on the used hardware, the use case, and the environment. Examples of such parameters are the location update rate, transmission power, payload size, and sleep mechanisms.
1) LPWAN: Most LPWAN localization systems work through the "localization by communication" concept, i.e., by sending an uplink message. Therefore, the energy consumption of positioning techniques, such as RSS, TDoA, and AoA equals the energy consumption of this uplink communication using a certain LPWAN technology. Several recent studies have analyzed, simulated, and demonstrated the ultralow power consumption of LPWAN technologies. Singh et al. [40] provided an analysis of the actual energy consumption profiles of Sigfox, NB-IoT, and LoRaWAN. The analysis shows that an LoRa transmitter consumes 37.05 mJ to transmit a 5-byte uplink message and has an average sleep current of 81 μA at 3.7 V, while NB-IoT transmission consumes 63.48 mJ, with a deep sleep current of 0.10 μA at 3.7 V. However, the overall energy consumption can vary significantly depending on the  configuration parameters, such as payload size, spreading factor (SF), update rate, and sleep modes. For different update rates, the resulting estimated battery lifetimes are shown in Fig. 4.
The energy consumption profiles of LPWAN technologies show a peak in current consumption during message transmission and in the idle period, which highlights the need for sleep modes. Examples are the extended Discontinuous Reception (eDRX) and power saving mode (PSM) of NB-IoT, as shown in Fig. 5. While a Quectel BG96 NB-IoT module consumes 623.7 mW during transmission at 23 dBm, these modes consume only 3.63 mW and 10 μW, respectively [41]. Furthermore, the SF or LoRa provides the flexibility to tune the balance between energy consumption, data rate, and communication range, depending on the application requirements [42].
2) GNSS: In high contrast to LPWAN, GNSSs originally were not designed with low energy consumption in mind. According to the GNSS technology report of 2020, a typical receiver in the IoT market consumes 17 mA during signal acquisition and 0.5-8 mA during tracking, using a power supply of 1.4-4.3 V [43]. The feasibility of adding a GNSS receiver to an LoRaWAN tracking device in terms of location accuracy, battery lifetime, and location update rate is analyzed in [44]. The study shows that a GNSS receiver should only be omitted if a location error of more than 100 m is acceptable and the energy budget is extremely constrained, provided that the LoRa SF is configured correctly. Furthermore, the battery lifetime of LoRaWAN trackers is estimated, depending on different application requirements. When tracking an animal with 48 location updates per day, an SF equal to 9 and a minimum battery lifetime of three years, the battery of the IoT device would last 4688 days without GNSS receiver and 2446 days with GNSS receiver. However, when tracking an animal using the same location update rate but with a desired ten-year battery lifetime, a GNSS receiver can no longer be used.
An empirical study on energy consumption of GNSS chipsets in smartphones, which also have energy constraints, demonstrates that a smartphone with a dual-frequency GNSS chipset consumes on average 28% and 37% more power compared to a single frequency GNSS smartphone, in indoor and outdoor environments, respectively [45]. Using a location update rate of 1 s, the mean energy consumption of the singleand dual-frequency receivers equals 232 and 318 mJ, respectively. Due to this difference, the battery of the smartphone with single-frequency GNSS receiver lasts 10-h longer.
During initial signal acquisition, a GNSS receiver consumes more energy than the subsequent tracking mode. Hence, the TTFF has a significant impact on the overall energy consumption. This is especially true for IoT applications with low update rates. In this case, virtually every localization attempt can be regarded as a first fix. Therefore, several energy-saving GNSS techniques are focusing on TTFF reduction, as discussed in Section II-C. While the TTFF evaluation is discussed in more detail in Section III-G, the focus here is on the energy consumption profiles of these novel techniques.
The first and most widely adopted energy-saving technique in GNSS receivers is duty cycling. By putting the receiver in sleep mode between location updates, the total energy consumption can be reduced significantly, especially in IoT use cases where a location update is only required every few hours, days, weeks, or even months.
The widely adopted A-GNSS approach ensures all data needed to compute a location is present in the UE, successfully omitting power-hungry satellite communication to retrieve, e.g., coarse location, time, or ephemeris data. Several GNSS manufacturers provide a platform or service to download this data and send it to a UE, e.g., the AssistNow platform of u-blox. Furthermore, the integration of an assistance network and a GNSS receiver in an all-in-one System on Chip (SoC) leads to a lower overall power consumption. An SoC integrating GNSS and NB-IoT consumes 50 mW for receiving and 1610 mW for transmitting, while the always-on-block consumes 15 μW and the sleep current is smaller than 10 μA at 3.8 V [46]. When using a 300-mAh battery, this results in a lifetime of 306 days for a daily uplink message, while the lifetime significantly decreases to only 15 days when an hourly location update is required.
Snapshot processing and cloud computing are two emerging techniques to reduce the energy consumption of a GNSS receiver. They are especially of interest in case the GNSS receiver is connected to an LPWAN transceiver, as the latter is able to transmit snapshot data to a processing center for subsequent outsourced position calculation. Taking a snapshot of up to 25 ms with a cloud GNSS receiver is an order of magnitude more energy efficient than a conventional A-GNSS receiver [35]. The snapshot receiver of Baseband Technologies lasts for 18 days to 1 year depending on the snapshot length, while a conventional receiver would only last for 2 h on the same 10-mAh battery [47]. Finally, u-blox recently introduced their "CloudLocate" service, offering a snapshot GNSS approach in which the receiver acquires a snapshot of a few seconds, performs some preprocessing steps, such as the extraction of code phases, sends this information to the cloud, and turns itself off. Designed for use cases with batteryoperated devices with large power autonomy and Internet connectivity, this approach performs well in terms of energy consumption, successfully filling the gap between traditional (A-)GNSS and GNSS-less positioning, as shown in Fig. 6. According to u-blox, the additional power demand constitutes only 10% of the total UE power consumption.
A white paper of the European GNSS agency (GSA) describes the relative amount of energy saved with the aforementioned techniques, compared to a standard singlefrequency GNSS receiver [49]. A-GNSS can be up to ten times more energy efficient, while snapshot processing and cloud computing can be 2-25 times more energy efficient. For the latter category, higher energy efficiency is achieved when more location processing functionality is outsourced to the cloud. Finally, Fig. 7 shows the relationship between the energy efficiency of each technique and the connectivity requirements of the terrestrial network.
3) LEO: While constellations such as Starlink are designed for broadband mobile Internet access, other LEO constellations are designed for low-power communication with terrestrial IoT devices. Despite many studies evaluating and improving the accuracy of LEO-based positioning systems, little attention has been paid to their energy consumption profile. Therefore, we now provide energy characteristics as specified in data sheets. Thus, it is important to keep in mind that the actual energy consumption of these systems is not widely evaluated yet.
The Argos system is introduced to serve environmental applications, including wildlife tracking and oceanography. The UEs are designed to have an autonomy of multiple years. An Argos transceiver has a typical transmission power of 500 mW, but this setting can be configured in a range from 250 mW to 2 W, which is equivalent to 24-33 dBm. A popular chipset is the ARTIC R2, which supports bidirectional   [52] communication and is compatible with the Argos-2, Argos-3, and the future Argos-4 system. On average, the chipset consumes 15-20 mA when receiving, 350 mA when transmitting, and has an extremely low sleep current of less than 1 μA, at a supply voltage of 1.8 or 3.3 V [50]. Arribada provides an Argos module integrating an ARTIC R2 transmitter and a GPS receiver and claims to achieve a 20-μA sleep current and five years of autonomy. The module also provides support for hybridization with a cellular or LoRaWAN daughter board [51].
Lacuna Space uses the LR1110 "all-in-one" chip from Semtech to perform Doppler positioning using LEO satellites. Even though no details about the actual power consumption of this localization technique are public, the energy consumption profile of the LR1110 for different modes is shown in Table IV, using an operating voltage around 3.3 V. Obviously, the power consumption depends on the bandwidth, SF, and transmit power. The GNSS scanner typically needs to scan for 1-2 s, depending on the assistance data, and leads to a power consumption of 8.5 μWh for GPS. For the on-board passive Wi-Fi scanner, it takes 65-75 ms to scan three Wi-Fi channels and capture six MAC addresses, consuming 0.5-0.7 μWh.

D. Positioning Accuracy
In this section, we discuss the average, 3-D root mean square (RMS) and 95th percentile of the difference between the estimated location and the ground-truth location. The lower this location estimation error, the higher the positioning accuracy of a technique.
1) LPWAN: Leveraging LPWAN communication to locate a device has been a popular research topic in recent years. While some approaches only aim to provide location awareness, i.e., a rough location estimate, other approaches try to improve the localization accuracy in order to attract more IoT use cases.
In general, RSS-based localization algorithms perform the worst in terms of positioning accuracy. Reasons for this are the high number of multipath effects (shadowing, reflections, etc.) and signal interference. Moreover, the environment plays a significant role when judging the accuracy of RSS-based LPWAN localization. Although some studies categorize different environments into urban, suburban, and rural areas, these terms are not clearly defined and ambiguous. This consequently leads to inaccuracies when applying signal propagation models in RSS ranging algorithms. Other popular algorithms range from simple proximity estimation to advanced machine learning and neural network-based fingerprinting. While the former has a typical localization error of several hundreds of meters to a few kilometers, the latter is able to locate a transmitter with a mean location error below 500 m. A benchmark of RSSbased ranging and fingerprinting algorithms using LoRaWAN is detailed in [14]. The k nearest neighbors (kNN) and Random Forest algorithms yield the most accurate fingerprint-based results, while it was found that changing the path loss model in range-based approaches does not significantly impact the final location accuracy. Timing-based approaches generally are more accurate as when compared to RSS-based algorithms. TDoA experiments in a public LoRa network resulted in a median and maximal location error of 150 and 350 m, respectively [53]. However, TDoA requires accurate synchronization between gateways and is therefore not feasible in some LPWAN technologies. Moreover, applying TDoA in the ultra narrow band (UNB) technology of Sigfox is not feasible as the accuracy is directly proportional to the bandwidth (see Section III-H). Furthermore, at least four nearby gateways need to receive an uplink message in order to estimate the location of the transmitter. For these reasons, it is not always possible to provide a TDoA location estimate. Finally, the first OTDoA experiments in a laboratory environment report RMS positioning accuracy of 48.5 and 65.5 m in normal and extended coverage, respectively [17].
AoA systems using LPWAN signals are proven to accurately estimate the angle of arrival, with an error below 5 degrees, 80% of the time [18]. The combination of AoA and RSS in NB-IoT is very welcome, as a lot of NB-IoT modules and networks only report the currently serving cell, instead of all nearby base stations [13]. Furthermore, the combination of AoA and TDoA (also referred to as TDAoA) yields more accurate results, with a mean localization error of 159 m in a Nonline-of-Sight (NLoS) environment [19].
With the aim to compare localization algorithms and LPWAN technologies in a fair way, researchers have investigated the accuracy of several LPWAN localization algorithms in the same urban environment in the city of Antwerp, Belgium [13], [14], [15], [19]. The results are summarized in Fig. 8. Positioning accuracy of LPWAN localization algorithms [13], [14], [15], [19]. Fig. 8. It is important to mention the difference in base station number and density. For example, while only a single NB-IoT base station is reported per measurement, some Sigfox messages were received by more than 40 gateways. However, the high density of the cellular NB-IoT network compensates for this fact, resulting in mean location estimation errors between 204 and 340 m when applying fingerprinting and proximity algorithms, respectively. Despite several outlier detection algorithms, the outliers of LPWAN localization algorithms remain significant. Finally, the accuracy can be further improved by combining different techniques. Examples include applying artificial intelligence (AI) for optimized fingerprinting, estimating heights based on altimeters, and implementing road mapping filters.
2) GNSS: In high contrast to LPWAN localization techniques, GNSS techniques achieve much higher accuracies, up to several orders of magnitude. Important to note is that we evaluate the accuracy of single point position (SPP) GNSS receivers, as these are most common in IoT tracking devices. Hence, advanced positioning techniques, such as RTK and PPP fall outside the scope of this discussion.
The GNSS technology report of 2020 lists a horizontal positioning accuracy of 5-10 m with a dual-frequency GNSS receiver, and a typical accuracy of 15-30 m for a singlefrequency receiver [43]. These are typical accuracies however, and thus cannot always be guaranteed, i.e., in complex propagation environments, such as high-speed moving trains, dense urban scenarios, tunnels, and multistory car parks [54]. Furthermore, pseudorange measurements are affected by various effects, such as errors in the satellite clock and orbit information, errors in the ionospheric or tropospheric models and multipath effects. The Dilution of Precision (DOP) accounts for the error propagation and provides an indication for the accuracy of a location estimate. Time free pseudorange positioning results for various snapshot lengths, using GPS, Galileo, and BeiDou signals [56].
The accuracy of consumer-grade GPS and assisted GPS (A-GPS) receivers has been evaluated in [55]. No remarkable differences were observed two minutes after the first fix. Nonetheless, in both approaches, the accuracy of the first fix is generally lower, due to the fact that a receiver initially has a fix on only 3-5 satellites. It was shown that with 95% probability, the first fix was accurate within 28-77 m, depending on manufacturer and type of the GNSS receiver.
When no terrestrial communication link is available, a GNSS receiver can autonomously predict ephemeris data. However, due to satellite orbit perturbation and environmental factors, ephemeris data is subject to change. This leads to a decrease in orbit prediction accuracy over time, which in turn leads to a reduced positioning accuracy.
Snapshot GNSS and cloud processing techniques enable low energy positioning in return for a reduced sensitivity and accuracy [49]. Given the low energy consumption requirement, most snapshot GNSS receivers are using a single frequency, resulting in less accurate positioning, as mentioned before. Nonetheless, modern coarse-time navigation algorithms achieve an accuracy of a few meters from a oneshot position solution, depending on the length of the acquired signal and the accuracy of the code phase measurements. It was demonstrated that taking a 2-ms snapshot yields an accuracy below ±1 m in north and east directions despite a reduced precision, as shown in Fig. 9 for various snapshot lengths [56]. With a snapshot length of 1 s, the CloudLocate GNSS solution from u-blox achieves a median accuracy within 6 m [48]. Finally, it was demonstrated that a cloud GNSS sensor in an outdoor environment may offer the same horizontal accuracy as a conventional GNSS receiver, while consuming less energy. This relationship is visualized for different carrier-to-noise densities (C/N 0 ) in Fig. 10 [35].
3) LEO: The accuracy of positioning techniques using LEO satellites is studied to some extent in state-of-the-art literature. More specifically, the accuracy of Doppler positioning systems is being evaluated in a limited amount of test scenarios. Therefore, accuracy numbers may vary significantly.  Tan et al. [31] proposed an instantaneous Doppler positioning solution using SoOP of Iridium NEXT satellites. The inputs of the positioning system are the observed Doppler shifts and a precise orbit model. The SGP4 simplified perturbations model uses periodically updated two line element (TLE) data obtained from the North American Aerospace Defense Command (NORAD). The proposed solution requires at least four LEO satellites in view and at least six Doppler measurements at different moments in time. The location of a static receiver was estimated in an open sky with a total of seven satellites in view for 30 min. Using 25 different Doppler measurements in an LS algorithm, the mean error in the east direction is significantly higher than the mean error in the north direction, as shown in Fig. 11. The Doppler positioning was further improved by height aiding, resulting in a largest mean error of 46 and 24 m in the east-and north-direction, respectively (also shown in Fig. 11). Kalman filtering improves the accuracy even further, achieving a 2-D position error of 22 m (1σ ) for a static receiver in an open sky. This algorithm was also tested in a dense forest, which lead to a location estimation error of 108 m. Finally, it was concluded that satellites with high elevations and equally spaced velocity directions are more suitable for improving the horizontal positioning accuracy, while the subtracks of satellites at lower elevations should be used to restrict the vertical positioning errors.
Operating the Argos constellation, Kinéis [51] claimed to provide a native Doppler positioning accuracy of 150 m with the latest Argos satellites. Optionally, users can combine this service with GNSS, in order to increase the accuracy if desired. More recently, the system can determine the position of a mobile transmitter using a single satellite. However, the resulting accuracy can vary from several hundreds of meters to several kilometers, depending on the number of transmissions during a single satellite pass. A complete and open manual of the Argos positioning algorithms is available online [57]. Before 2011, a nonlinear LS algorithm was used, which required at least four messages to get information about the accuracy of the position estimation. Since 2011, a new algorithm using EKF was introduced, which was proven more accurate and reliable [26]. Moreover, an error estimate can be provided through seven so-called location classes, even with a single message per satellite pass. A location class is defined by the estimated positioning error of a measurement, as well as the number of messages sent during a satellite pass. A comparison of both LS and EKF algorithms in terms of location error and number of messages is shown in Fig. 12. The reason for the biggest outliers is the incorrect choice between nominal and mirror locations. Moreover, both algorithms underestimate the positioning error due to nonnormally distributed errors and changing frequency measurement noise, e.g., due to temperature changes. Furthermore, Lopez et al. developed the EKF algorithm that is able to switch between multiple motion models based on behavior (e.g., winter sleep versus hunt in animal tracking use cases), achieving higher accuracy.
Although Orbcomm does not provide an actual positioning service, the satellites of the company's constellation can be used to perform Doppler-based positioning. Due to the lack of accurate LEO products and incomplete constellations, researchers found a significant gap between expected accuracy through simulations, and measured accuracy in real-life experiments: while simulation results show an 11 m accuracy with 25 LEO satellites over a period of 4 min, only two Orbcomm satellites are visible to the UE in reality, resulting in an accuracy of 360 m over a period of one minute [37]. When using the Starlink mega-constellation, the authors obtained an accuracy of 33.5 m and improved it to 7.7 m by adding an altimeter [58]. Thus, the accuracy of LEO positioning systems will increase as more constellations will be completed in the future.
Reid et al. [59] observed that by investing in new infrastructure, the positioning accuracy improves by an order of magnitude every 30 years. Following this trend implies that decimeter-level performance will be achieved by the mid-2020 s. The authors also predict that LEO-based positioning could provide more than ten times better accuracy and 100 times better interference mitigation compared to legacy GNSS. This enables applications such as autonomous driving, which require < 30-cm accuracy and very high reliability. Therefore, Xona Space Systems aims to provide Pulsar, a navigation system based on 300 dedicated LEO-PNT satellites, by 2026. The system will employ GNSS-like signal ranging [22]. However, very few of the design parameters are made publicly available. Similarly, the Geely Technology Group is developing the GeeSpace system targeting the automotive industry. While the group aims to offer centimeter-level positioning accuracy leveraging enhanced GNSS-based technology, the exact design parameters are also not yet available in the open literature [24]. Other players on the market include DDK Positioning and Trustpoint. They are in the process of designing PNT systems independent of GNSS, aiming to provide accurate, reliable, and secure LEO-PNT services.

4) Combined Approaches:
It is common to combine or integrate the aforementioned standalone solutions, often resulting in an increased accuracy.
A first example is the solution provided by Lacuna Space, which comes in many flavors depending on customer demands. When accurate positioning is required, GNSS satellites are used to locate the UE and LEO satellites are only used to communicate the estimated position to the customer, if no LoRaWAN network is available. If an LoRaWAN network is available, the UE can also be located using the aforementioned LoRa Edge geolocation solution, which is less accurate but saves more energy. In addition, if no terrestrial network is available and battery lifetime is important, Lacuna Space recently offers a Doppler-based positioning service, along with their LEO satellite communication. Thus, the tradeoff between accuracy and energy consumption becomes clear. For the native Doppler positioning system, Lacuna Space itself currently reports an initial accuracy of a few kilometers, which will be improved with more satellite passes. To overcome this issue, Wi-Fi and GNSS scanning are integrated. Wi-Fi scanning is used for indoor positioning where satellite signals do not reach and has a typical accuracy of 30 m. Experiments from Irnas show that the passive GNSS scanner of the Semtech LR1110 leads to an average accuracy of around 30 m after 4.5 s, despite some outliers of around 100 m [60].
Aiming to track whales in oceans for a long time, LEO Doppler measurements and FastLoc GPS experiments were carried out in [21]. While the former is used to communicate the observables and provide a rough location estimate, the latter is used to determine a more accurate GPS location. Hence, the feasibility of combining LEO and MEO satellites was demonstrated.
Finally, it was shown that LEO constellations can be used as a backup positioning system for GNSS. It was experimentally demonstrated that LEO Doppler measurements can reduce the position error of INS from 31.7 to 8.8 m, 30 s after GNSS signals became unavailable [30]. The authors elaborated on this by evaluating different satellite propagation models and comparing three navigation frameworks. The combination of an LEO-aided INS simultaneous tracking and navigation

E. Ubiquity of Coverage
The ubiquity of coverage indicates the availability of a positioning system on Earth and is measured in a quantitative (e.g., 86% worldwide) or qualitative (e.g., deep indoor) way.
1) LPWAN: The coverage of LPWAN technologies has been studied extensively, both in simulation and real-life environments. With the aim to evaluate which technology provides the best coverage for IoT devices, a simulation study for Sigfox, LoRa, and NB-IoT was carried out in a 7800-km 2 area [61]. The results show that NB-IoT provides the best coverage, even in deep indoor environments, with a maximum coupling loss (MCL) of 164 dB. Moreover, the cellular technology was proven to have the smallest outage probability when the intersite distance is equal, followed by Sigfox and LoRa, respectively. A similar study revealed that NB-IoT outperforms LoRa in terms of coverage, in both urban and rural environments. The main reason for this is the directivity of NB-IoT antennas, which provide a better coverage for devices farther away from the eNodeB but near the main beam [11]. Besides the excellent performance in outdoor environments, extensive measurement campaigns confirm the deep indoor coverage of NB-IoT provided through existing long-term evolution (LTE) infrastructure [62].
In general, LPWAN technologies are able to provide excellent coverage in environments where terrestrial-based infrastructure is installed. Due to the presence of the communication signal, localization of the transmitter becomes possible within the same range. Despite the rapidly increasing number of mobile IoT networks, in some countries and especially in the continent of Africa, there is no cellular LPWAN connectivity yet, as shown in Fig. 13. Furthermore, positioning algorithms such as TDoA require a minimum number of receiving gateways. Therefore, not all LPWAN positioning techniques can be applied in any environment with coverage.
2) GNSS: In opposition to LPWAN transmitters, GNSS receivers usually benefit from global coverage, due to the Evolution of number and distribution of operational GNSS satellites [43]. combination of multiple (both global and regional) constellations. Fig. 14 shows the evolution of the total number and distribution of satellites across each global GNSS constellation [43].
Despite their ubiquitous worldwide coverage, GNSSs have two main limitations in terms of coverage: 1) signal blockage and 2) multipath effects. First, GNSS signals do not penetrate well through walls, reducing the number of satellites in view, making positioning difficult or even impossible in indoor and underground environments. Second, NLoS propagation causes multipath effects, which impact the observation quality and thus the positioning performance, especially in dense urban environments.
Aside from faster position fixes, A-GNSS improves the performance in difficult indoor and urban environments thanks to the increased receiver sensitivity [49]. However, A-GNSS and snapshot GNSS techniques can only be applied in areas where a communication network is available.
3) LEO: In comparison to GNSS satellites, satellites in lower Earth orbits provide a smaller coverage, as the smaller distance to Earth decreases the size of the satellite footprint. More specifically, LEO satellites are generally placed at altitudes below 1000 km, which is around 20 times smaller than the altitude of GNSS satellites, leading to a significantly smaller footprint. For example, Fig. 15 shows the Iridium NEXT constellation which consists of satellites at an altitude of 780 km, resulting in a satellite footprint with diameter equal to 3000 km [20]. Thus, many more satellites are required to cover the Earth in LEO than in MEO. In order to provide global coverage with only a few LEO satellites, most satellites follow a polar orbit, i.e., flying over the North and South poles. As the Earth rotates in the meantime, a single satellite will eventually map out the entire globe without blind spots. Therefore, there is a higher satellite coverage at the poles than at the equator. Although a single revolution around the Earth only takes about 100 min, there is no permanent coverage everywhere on Earth. To solve this problem, several companies, such as Argos, OneWeb, and Starlink are developing constellations of tens, hundreds, and even thousands of satellites. With more satellites in view, more accurate positions can be computed. Additionally, a higher location update rate can be achieved, as discussed in Section III-O.
Due to the closer distance to Earth, LEO satellite signals are experiencing less path loss and delivering more robust signals than GNSS signals, making them more suitable in difficult to reach environments. A perfect example of the use of LEO satellites can be found in the automatic identification system (AIS) for the tracking and monitoring of vessels. It was found that when using LEO satellites instead of GNSS satellites, a stronger signal was obtained at the AIS receiver and coverage was extended [65]. Moreover, LEO satellite signals are able to penetrate better in indoor environments. Tan et al. [31] claimed that LEO satellite SoOP can work in severe environments, such as when rushing to deal with an emergency, fire control inside deep buildings, and in combat. In contrast, companies providing LEO services experience limited or precluded coverage in indoor environments. To solve this coverage issue, Lacuna Space is experimenting with the integration of Wi-Fi scanning for indoor positioning. Once an indoor position is determined, it can be sent to an LEO satellite via an outdoor gateway. A final strategy is to wait for certain coverage conditions, such as the delayed transmission of Argos messages when a whale equipped with a UE surfaces after a dive [21].

4) Combined Approaches:
Aiming to track batteryconstrained IoT devices, LEO satellites can successfully extend the coverage of a terrestrial NB-IoT network [66]. The integration of LEO and LPWAN becomes more popular, as this combination of technologies provides truly global and deep indoor coverage. Companies integrating LEO and LPWAN solutions include Lacuna Space (LoRa + LEO), Hiber (LoRa + LEO), OmniSpace (NB-IoT + LEO), and Orbcomm (cellular + LEO). It should be noted that a roaming agreement needs to be in place with a public or private network where the device operates, unless it concerns an open public network such as the things network (TTN).
Finally, the combination of GNSS and LEO constellations leverages augmentation of GNSS for navigation. Moreover, LEO satellites can serve as a full standalone backup. Globalstar, for instance, provides UEs which are able to communicate with LEO and locate with GPS satellites, in order to enable near real-time tracking in, e.g., mountainous areas where no terrestrial network is available.

F. Scalability
In 2020, more than 25 billion devices were connected to the Internet, ranging from machine-to-machine (M2M) devices and consumer electronics to mobile phones, tablets, and laptops [12]. With this exponentially increasing number in mind, modern communication, and localization infrastructure requires a scalable design. In this section, we focus on the scalability of state-of-the-art positioning solutions toward billions of devices.
1) LPWAN: The scalability of the LPWAN localization technique depends on the technology and required network infrastructure. A capacity study of the Sigfox, LoRa, and NB-IoT technologies is conducted in [67]. Capacity experiments were carried out in a 8000-km 2 dense urban environment in Denmark, with a varying number of IoT devices per person. The results show that NB-IoT outperforms Sigfox and LoRa, with an uplink failure probability below 4% in the 95th percentile, with ten devices per person. Reasons for this are the superior coverage of NB-IoT, the use of link adaptations, and a licensed band, which in turn leads to less duty cycle violations and interference. Moreover, NB-IoT benefits from the scalability of existing LTE infrastructure, currently supporting up to 200k devices per cell with respect to Quality of Service (QoS) [68]. This number will only increase with upcoming 5th generation (5G) networks. In contrast, the scalability of LoRa networks has been questioned in literature, with main drawbacks being the higher chance of collisions due to the use of unlicensed bands and the longer airtime at higher SFs [69]. Moreover, the use of different carrier frequencies in different regions (e.g., 868 MHz in EU versus 915 MHz in U.S.) makes it a challenging task to track an asset worldwide. Nonetheless, LoRa gateways are able to serve up to 50k LoRa end devices [10].
Aside from the underlying technologies, the hardware in both end devices and gateways impacts the scalability of a certain positioning technique. While any LoRa network can be used for RSS-based ranging or fingerprinting localization, implementing TDoA-based ranging requires accurate clocks in the surrounding gateways, as well as synchronization between them. Similarly, AoA-based approaches require gateways equipped with a more complex antenna array. Deploying such features in a large-scale network is a costly and timeconsuming task for network operators. Therefore, TDoA and AoA are considered less scalable than RSS in Table I.
2) GNSS: GNSS in general is considered highly scalable, as it is a broadcast system which can be used by an infinite number of users. In the past decades, GNSS systems have been scaled already, which is why no recent literature is questioning the scalability of the positioning system anymore. Hardware is inexpensive, widely available, and produced in large numbers. The system is used by millions of users on a daily basis. Moreover, the integration of A-GNSS in our smartphones has become indispensable. Obviously, the scalability of A-GNSS and cloud processing techniques also depends on the scalability of the used communication network.
3) LEO: Due to relatively inexpensive nanosatellites or cubesats and decades of satellite technology advancements, a plethora of companies is currently deploying LEO constellations on a very large scale. In fact, one of the main reasons for the high interest in large-scale deployments is the capacity of LEO constellations. The more satellites in a constellation, the more satellites are in view and the higher the capacity of the system [20]. However, the high number of satellites requires a scalable constellation design. A framework to identify an optimal design for a constellation of cubesats and for different use cases is developed in [5].
With only eight operational LEO satellites, the Argos system is currently serving 22 000 active transmitters per month, spread over 100 countries. In addition, more than 60 ground stations worldwide and two data processing centers ensure the scalable delivery of a location estimate. The upcoming Kinéis constellation of 25 nanosatellites will further increase the system capacity [70]. Finally, Lacuna Space aims to provide a near real-time service with 240 satellites in orbit. The first step is to launch 24 cubesats by 2023, half of them launched in 2022. From the launch of their commercial service around September 2021, the constellation will be continuously expanded. In addition, better revisit times and more capacity will be provided as per market demand.

G. TTFF
The TTFF is of high priority in GNSS, as it significantly impacts the duration for which the components need to be powered and thus energy consumption. For other systems and use cases, this dimension might be of lower priority. Even though TTFF is mostly used in GNSS terminology, we use the term here in a broader context to indicate the time it takes to obtain a first position estimate. This parameter is not only highly related to the energy consumption profile (see Section III-C), but also important in low-latency and near real-time tracking applications. 1) LPWAN: In LPWAN positioning techniques, the TTFF can be seen as the sum of the time it takes to send an uplink message with observables, the Time of Flight (ToF), the time for nearby gateways to receive the messages and add metadata (e.g., timestamps for TDoA), and the time to send the message from the gateways via the operator's network and a localization server to the end user. In this summation, the wireless transmission obviously is the most time consuming, introducing latency in the communication and hence also in location updates. In the LoRa technology, the SF determines the transmission speed. For instance, sending an LoRaWAN packet using SF8 takes twice as long as when using SF7. Duty cycle regulations however limit the amount of airtime in unlicensed bands. For example, using the EU 868-MHz band limitations, the maximum payload size and 250-kHz bandwidth, the maximum airtime equals 3608.6 ms [71]. While NB-IoT transmitters do not have to cope with these limitations, the time it takes to get location information depends on various parameters and sources of latency, including the time to wake up the UE from PSM and synchronize with the network, payload size, subcarrier spacing, multitone capability, the chosen resource unit, the number of repetitions, and the efficiency of the location estimation algorithm. This results in an absolute minimum transmission time of 1 ms, and a worst-case latency of 40 960 ms [72]. In general, empirical experiments teach us that LPWAN location estimates can be produced within a few seconds after transmission.
2) GNSS: There are three requirements for a first fix in GNSS positioning: 1) signal acquisition; 2) availability of ephemeris; and 3) availability of a precise time of week. The TTFF of a conventional GNSS receiver can be split into the receiver warm-up time, the acquisition time, the settling time for code and carrier tracking, the navigation ephemeris read time, the time to retrieve the system time reference, and the time to compute the navigation solution [73]. Information available to the receiver at the start-up will influence the time spent at these different stages, especially acquisition and navigation ephemeris read time. The need to update this information depends on how good the information can be maintained, i.e., the validity of the ephemeris or almanac, and accuracy of the real-time clock. When there is no information available (cold start) the receiver has to go through all the stages mentioned before and has to search the full frequencycode delay search space during acquisition. This can take up to several minutes. When there is coarse information on the position, the time, the frequency, and the satellite positions (e.g., based on the almanac), the search space can be constrained leading to a decreased TTFF of around 30 s (warm start). In case of accurate knowledge of all the factors, the TTFF can be reduced to 1 s (hot start). The TTFF will also be influenced by environment, especially during a cold start. Weak signals or signal blockage lead to a longer TTFF because of possible data bit errors, which extends the navigation data read time considerably [34]. The usual estimations from chipset manufacturers for the TTFF are 30 s for a cold start and 1 s for a hot start.
Several techniques have been developed to reduce the TTFF. Through an external communication link, an A-GNSS receiver retrieves aiding information, such as ephemeris, almanac, satellites status, precise network timing, and a coarse approximate position based on, e.g., network cell ID. Several chip manufacturers, commercial service providers, and scientific organizations have implemented A-GNSS services and platforms to ease the provision of aiding information.
Alternatively, a receiver can implement self-assistance. This technique is similar to conventional A-GNSS services, but aiding information is computed at the UE based on information received in the past. A UE can compute ephemeris with a validity interval up to several weeks which is much more accurate than conventional almanacs. In order to compute orbits predictions, the UE has to integrate satellite motions by modeling all forces acting on GNSS satellites [74]. Although this process can be power consuming, self-assistance can reduce the TTFF by a factor of up to five times [75]. More recent studies show how neural networks are able to more accurately predict orbits with less computational effort [76].
Coarse-time positioning circumvents the need for decoding the time of week, maintaining the time by an accurate receiver clock or receiving time assistance from A-GNSS (better than 1 ms) and thus reduces the time by the waiting time for decoding the time of week in case of coarse (seconds to minutes) time knowledge [34]. Using A-GNSS or selfassistance together with coarse-time positioning, the TTFF can be reduced by constraining the search space during acquisition, which reduces the time and improves the sensitivity, by eliminating the need to decode satellite ephemeris and the need to wait for decoding the satellite time of week.
Finally, cloud-based snapshot GNSS techniques do not require any of the aforementioned information at the receiver side. Observables are sent to the cloud, where the latest aiding information is widely available.
3) LEO: In satellite IoT positioning applications, the TTFF can be defined as the sum of the following terms.
1) The difference in time between the request of a position update and the passing of a satellite above the UE. 2) The time for a UE to reach a satellite (transmission time). 3) The time to relay the message from the satellite to a ground station. 4) The time to calculate a position in a processing center. While the latter term is negligible when using enough processing power, the other three terms can have a significant impact on the total TTFF.
For the first term, the availability of LEO satellites plays an important role to assess the overall latency of the positioning system. Because of the relatively small footprint of LEO satellites (see Section III-E), a UE often has to wait to transmit an uplink message until a satellite passes. Therefore, a first Doppler location estimate can only be produced when a satellite is in view. For the Iridium constellation of 66 satellites, each satellite orbits the Earth about every 100 min. This subsequently results in an average satellite revisit time of around 9 min, provided that the UE did not move. Thus, in the worstcase scenario, the satellite revisit time of an Iridium transmitter can increase up to 9 min [77]. Obviously, the satellite revisit time reduces by adding more LEO satellites to the constellation, which is an ongoing task in many constellations. For more information about the satellite revisit time, we refer to Section III-O.
The second term refers to the total transmission time through space. LEO satellites are closer to Earth and therefore introduce a lower round trip time (RTT) as when compared to GNSS satellites. Even for the more upper-most LEO satellites at 2000 km, the RTT is only 13.3 ms [77]. According to Samsung, an LEO constellation below 1580 km has the potential to be faster than Earth-bound fiber optic networks [20].
The third term accounts for the time needed by the satellite to pass over a ground station and forward data such as Doppler measurements to it. In the case of Lacuna Space, this typically takes a few minutes, with a maximum delay of 12 h. A latency of a few minutes will be guaranteed by 2022 when more ground stations are deployed around the world.
In summary, the TTFF of LEO positioning systems can vary significantly, depending on the number of satellites and ground stations worldwide. In the near future, we expect these number to rise in a rapid fashion, achieving a latency of a few minutes. Table V lists the bandwidth and data rates for each technology considered in this work. In this section, we discuss how these parameters influence the positioning performance. However, a lower or higher bandwidth and data rate are not necessarily beneficial or disadvantageous for the overall positioning performance or power efficiency, hence the gray colored (meaning not applicable) row in Table I. 1) LPWAN: Out of all LPWAN technologies, the UNB technology of Sigfox has the smallest bandwidth of only 100-Hz uplink and 600-Hz downlink. Such narrow-band signals are not feasible to perform TDoA positioning. Together with a data rate of 100 bit/s, only 12 bytes can be sent in a single Sigfox uplink message. Note that this is just enough to communicate a traditional GNSS position.

H. Data Rate and Bandwidth
While the bandwidth and data rate are fixed in many LPWAN technologies, they can be configured in LoRa. By increasing the SF from 7 to 12, the data rate decreases and a longer airtime is required. On the upside, the signal becomes more robust against interference, leading to an extended communication range. Several tools exist to calculate the airtime depending on the number of input bytes and chosen configuration (i.e., SF, bandwidth, and region) [71]. The SF can be configured statically on the UE with the aim to optimize data rate, airtime, and energy consumption. Alternatively, the SF can be chosen dynamically by the network through an adaptive data rate (ADR) mechanism, which takes into account the signal-to-noise ratio (SNR) and the number of gateways that received the most recent uplinks.
As specified in 3GPP Release 13, NB-IoT occupies a frequency bandwidth of 200 kHz, which corresponds to a single LTE resource block. Within a licensed frequency band, NB-IoT can be deployed "in-band," in the guard band or as a standalone operation. In high contrast to Sigfox and LoRa, the maximum data rate of NB-IoT is 200 kbit/s and an unlimited number of messages can be sent, with a maximum payload length of 1600 bytes per message [10]. This subsequently enables the faster and unlimited communication of observables of, e.g., snapshot GNSS receivers to the cloud.
2) GNSS: Depending on the chosen GNSS technique, there are different requirements for data download to the IoT device and upload to the cloud. Data to be downloaded include.
1) GNSS almanac (i.e., coarse satellite orbit and clock information), used to improve the acquisition performance by constraining the frequency search space. The almanac is decoded from the GNSS navigation messages or received via external means. 2) GNSS ephemeris (i.e., precise satellite orbit, bias, and clock information), required to compute a position. Ephemeris can be directly obtained via the signal in space or via external means as well. 3) Coarse position and fine time, either derived from a terrestrial network or obtained via an assistance service in the cloud. There exist a variety of assistance data services, which differ in the volume of the data set and its validity period, which in turn determines the frequency at which updates have to be sent to the UE. Most services providing ephemeris data reach a validity period of several days with a few kB of assistance data [52], [78].
In the opposite direction, data to be transferred from the receiver to the cloud can include a time-stamped position, a full set of pseudorange and Doppler observations or a GNSS signal snapshot. For transmitting a time-stamped position, a minimum payload size of 20 B is required and can be extended with information on DOP and velocity. As an example for the size of an observation set, the Semtech LR1110 receiver transmits pseudorange and Doppler observations using 34 bits per satellite and a small header. For 20 satellites this would be equivalent to around 85 B.
The size of a GNSS snapshot should be based on a tradeoff between the snapshot length, the sampling frequency, and the number of quantization levels. The higher the sampling frequency the better the resolution of the code phase and thus the better the resulting positioning accuracy. However, a complete code length of the replica is favorable in order to ease the reconstruction of the full pseudorange. The snapshot length L as well as the sampling frequency f s define the data size S. For a complex signal, the size of the data expressed in bit is defined by Fig. 16. Relationship between snapshot length, sampling frequency, and snapshot size for an 8-bit quantization [56].
where Q represents the quantization. For example, a 20 ms snapshot using a sampling frequency of 20 MHz and 8-bit quantization results in a complex signal (I and Q) of 800 kB. If the sampling frequency is reduced to 4 MHz, only 160 kB needs to be communicated. The relationship between snapshot length, sampling frequency, and snapshot size is illustrated by Fig. 16 for an 8-bit quantization.

3) LEO:
Depending on the duration of an LEO satellite pass over a UE, a minimum data rate should be achieved, otherwise both uplink and downlink data can be lost. For example, in the cases of Lacuna Space and Argos, a passing satellite can only be reached for a duration of around two and ten minutes, respectively.
Argos uplink messages are sent at a data rate of 4.8 kbit/s. Each message contains a preliminary synchronization sequence, the total message length, transmitter identification number, user data, and a checksum. Since the 3rd generation of the Argos system, two-way communication is supported. Downlinks sent at 400 bit/s are used for acknowledgement (ACK) of uplink messages, as well as for sending data, such as timing information and satellite ephemeris data, in case the UE wants to locate itself or assist a GNSS receiver. Due to the introduction of ACK messages, redundant messages are no longer required. Moreover, the two-way communication enables customers to send commands to the UE. Such downlink messages may contain up to 128 bits by 8-bit increments. As an example, a command can be sent to the UE to increase the transmission frequency for a certain amount of time if more location updates are desired.
Apart from the aforementioned data rates, Argos has also developed a very low data rate standard for the Argos-4 system (VLD-A4). This uplink standard has been designed for very low-power transmitters (e.g., wildlife trackers) that transmit very small uplink messages. VLD-A4 has a modulated bit rate of 200 bit/s, which corresponds to a user bit rate of 124 bit/s. The message structure is shown in Fig. 17. For a very short message containing only the 28-bit ID, the total transmission time equals 515 ms. A maximum of 56 bits of user data can be appended to this message, resulting in a transmission time of 965 ms. The message repetition period is minimum 30 s and can be configured by CLS according to the application and the geographical position of the UE. The VLD-A4 standard is also integrated in the ARTIC-R2 chipset. Finally, while the  current bandwidth of Argos-3 equals 110 kHz, this number will be multiplied with a factor 8 in the future Argos-4 system of Kinéis [70].
Due to the way transmission works over an LEO satellite network, rather than throughput or data rate, it can be more useful to discuss message size and the number of messages per satellite pass. In the case of Lacuna Space, the maximum message payload size, i.e., excluding header data, varies between 45 and 125 bytes. In theory, a UE can transmit 20 messages of 50 bytes (or equivalent longer messages) during a single satellite pass of 2 min. However, as in terrestrial LoRa networks, local operating conditions apply, limiting the airtime in several regions. This means that in Europe, for example, only 2 messages of 50 bytes or at most one 125-byte message can be sent per satellite pass.

I. Interoperability
The degree to which technologies can co-exist or even cooperate on the same UE without interfering with each other is referred to as the interoperability. In this section, we elaborate on the opportunities of combining LPWAN, GNSS, and LEO technologies into a single solution, aiming to achieve a better overall positioning performance. A summary is shown in Fig. 18.
1) LPWAN: A multiple radio access technology (multi-RAT) UE can communicate with multiple low-power terrestrial networks. By implementing such a multimodal communication architecture, a UE is able to switch to an optimal localization method, depending on the context, and constraints of the active wireless technology, as demonstrated in [79]. For example, a UE is accurately located on a construction site using TDoA in a private LoRa network, while during transport, RSS-based localization in a public Sigfox network is used to save energy.
2) GNSS: Augmenting GNSS positioning with LPWAN or LEO communication technologies creates a myriad of opportunities for energy-efficient positioning in an IoT context. A UE becomes capable to communicate a location estimate to the end user. Moreover, raw observables of snapshot GNSS receivers can be communicated to the cloud in order to save energy. In the opposite communication direction, assistance data can be provided to the GNSS receiver through a terrestrial communication link or via an LEO satellite network, successfully reducing the TTFF. Due to its effectiveness and efficiency, many LPWAN chip manufacturers provide builtin A-GNSS support. The combination of GNSS and LEO satellite communication is demonstrated by GlobalStar, which integrates LEO and GPS satellites for near real-time tracking in mountainous areas where no terrestrial network is available.
3) LEO: Terrestrial LPWANs can aid LEO-based positioning systems by communicating assistance data, such as a rough location estimate and orbital parameters of LEO satellites, as well as to exchange data from pseudorange and Doppler measurements. The integration of LPWANs for satellite IoT is being investigated by Lacuna Space, Fleet Space, OmniSpace, Hiber, and many more companies. By doing so, the coverage of terrestrial LPWANs is extended by leveraging constellations of LEO satellites, resulting in a myriad of opportunities in the satellite IoT market. Potential use cases include global energyefficient asset tracking and monitoring. Finally, LEO Doppler positioning can serve as a fallback solution for GNSS positioning in case the UE is located in a harsh environment where GNSS signals do not reach.

J. Communication of Observables
A next dimension indicates whether there is a possibility to communicate the estimated position to the end user, or the need to communicate observables to a remote location processing system.

1) LPWAN:
The approach in almost all LPWAN positioning techniques is to communicate one or more observables over the operator's network to a certain backend server. Observables in these uplink communications typically include RSS measurements, accurate timestamps, sensor readings, etc. These features are either collected as nearby gateway metadata or message payload data and are forwarded over the Internet to a server acting as a localization engine, where the actual position of the UE is calculated. Finally, the location estimate is often visualized on a map in the end-user application.
2) GNSS: In essence, observable-based GNSS techniques do not provide a means to communicate observables or a position estimate to an end-user. Due to this self-localization, a GNSS tracker is often equipped with additional LPWAN or LEO communication hardware, as discussed in Section III-I. Prominent examples of commercial services combining local and cloud processing while optimizing the amount of data to be exchanged are u-blox CloudLocate [48] and Semtech "LoRa Cloud" [80]. In the future, we expect to see an increasing trend toward cloud processing and the integration of LPWAN and LEO in GNSS.
3) LEO: In contrast to GNSS, native positioning using LEO satellites leverages the communication link between the satellites and the ground stations to forward the location estimate to an end-user application. For example in the Argos system, the Doppler measurement data is obtained through the uplink connection to the satellite, relayed to receiving stations on Earth and forwarded to global processing centers (GPCs), where the location is calculated and distributed to enduser applications. Alternatively, this data can be stored in the memory of Argos chipsets for later retrieval, successfully saving energy, and increasing battery lifetime. Similarly, satellites from Lacuna Space send frequency and timing information to a solver at the Lacuna Space backend, where the geolocalization is performed.

K. Index of Technology Readiness and Maturity
Both academic and industrial research introduce novel positioning technologies and improve existing algorithms to push the state-of-the-art forward. However, every technology or algorithm faces challenges in terms of design, implementation, production, and large-scale adoption. These challenges are included in the index of technology readiness and maturity, also referred to as the technology readiness level (TRL).
1) LPWAN: Communication through LPWAN has been widely adopted, with many studies evaluating the performance and applications demonstrating the possibilities [81], [82]. Among the first major long-range energy-efficient networks, Sigfox and LoRa(WAN) have proven their excellent communication performance for more than a decade. Since 3GPP Release 13 in 2016, the NB-IoT standard has contributed significantly in the cellular IoT market. However, localization with LPWAN is not as mature as LPWAN communication.
In the early years after the release of the first LPWAN technologies, mostly academic research was devoted to RSS-based and timing-based positioning algorithms with these novel technologies, in order to remove the need for a GNSS receiver in low-power IoT applications. Nowadays, several industry leaders provide a cloud positioning solution, e.g., the LoRa geolocation service of Semtech. While the standardization of e-Cell-ID and OTDoA in NB-IoT is ongoing, the OTDoA feature is not widely available yet, as it requires an upgrade of the NB-IoT base station network, which is a challenging and costly task for network operators.
2) GNSS: Since the development of GPS by the U.S. Department of Defense in 1967, GNSS technologies have evolved significantly. GNSS receivers nowadays are highly available and inexpensive, and the satellite constellations are publicly accessible at no charge. As duty cycling and A-GNSS are highly integrated in modern GNSS chipsets, these GNSS techniques are considered highly mature. Snapshot and cloud processing algorithms, contrarily, are currently gaining popularity and completing the breakthrough in the IoT market. The fusion of these GNSS techniques with LPWAN technologies results in ubiquitous, energy-efficient, and accurate positioning applications. As the transformation to cloud processing is currently ongoing, these positioning techniques are not considered highly mature yet, but it is expected that they will be widely adopted in the near future.
3) LEO: Similar to LPWAN, communication using LEO satellites can be considered mature, while satellite IoT localization is still in its infancy. A myriad of companies already provide satellite communication for decades. For instance, mobile communication via Iridium satellites is provided since 1998. Furthermore, newer LEO constellations such as Starlink aim to provide global high-speed Internet communication. Only a handful of companies have the primary objective to provide native positioning and navigation for the satellite IoT market. The Argos system can be considered as the most mature among the currently existing LEO positioning solutions. Several Argos chipsets and development kits are commercially available, and the Doppler positioning algorithm has been evaluated and optimized a few times. Nevertheless, as in many cases, the LEO constellation is not completed yet. Therefore, there is no 24/7 coverage anywhere on Earth yet. However, this will change rapidly as thousands of LEO satellite launches are planned in the coming years.

L. Standardized or Proprietary
This section briefly specifies whether a protocol or technology has been standardized or made proprietary. This dimension does not influence the positioning performance, hence the corresponding gray row (meaning not applicable) in Table I. 1) LPWAN: In the category of LPWAN technologies, there is a clear distinction between standardized and proprietary technologies. On the one hand, cellular technologies, such as NB-IoT and LTE-M are based on 3GPP standards. The specification of these licensed technologies was frozen in Release 13 and is continuously updated in the next releases, adding new features, such as e-Cell-ID and OTDoA positioning in Release 14 [83]. On the other hand, several proprietary LPWAN technologies have arisen. Sigfox creates its own devices which are basically a "black box" for end users. In the case of LoRa, only the signal modulation has been made proprietary, while LoRa end devices are licensed by Semtech and can be developed by other manufacturers. Moreover, LoRa standards are created and improved by the LoRa Alliance.
2) GNSS: As a mature positioning technique, GNSSs have been standardized in different specifications such as the GPS standard positioning service (SPS) performance standard. In order to cope with messages originating from multiple constellations on a single UE, the international GNSS service (IGS) introduced a receiver independent exchange format (RINEX) for raw satellite navigation data [84]. While A-GNSS is a wellestablished technique described in several standards [85], the concept of snapshot GNSS has not been fully standardized yet. Ad-hoc methods of digitized data formats do not encourage interoperability and therefore need standardization. To this end, the Institute of Navigation (ION) aims to develop a specification for standardized metadata and formats. Adoption of this standard both by the data collection hardware and the SDR receiver would enable an SDR to process data from multiple sources seamlessly [86].

M. UE Cost
We define the UE cost as the total cost to use a certain positioning technique, including the cost for hardware, network access, and positioning services. This section is highly related to Section III-F, as the overall cost evolves when scaling up to billions of devices.
1) LPWAN: In 2020, the average terminal cost for Sigfox, LoRa, and NB-IoT was $2-3 [12]. These ultralow device costs are due to the massive number of IoT devices worldwide and the rapidly increasing interest to connect nearly everything to the Internet. Additionally, in the case of cellular IoT, a subscriber identity module (SIM) or e-SIM is required in order to register to the network. The subscription cost varies per region and operator. As an example, the average cost of a data SIM card from a Belgian NB-IoT network operator equals A C3 and the message transmission fee is in the order of A C1/MB per SIM. Similarly, LoRaWAN end users need to pay a subscription cost, which is determined by the network operator and may include services such as the LoRa Geolocation API. The subscription allows the end user to send a limited number of messages over the LoRa network each month. If this number is exceeded, an additional cost will be charged, depending on the policies of the operator. Alternatively, some LoRa operators such as TTN offer a connectivity service with a fair-use policy free of charge. Finally, AoA-based positioning does not impact the overall UE cost, as the antenna arrays are placed at the gateway side, which can be low-cost units as well [87].
2) GNSS: The price of a state-of-the-art GNSS receiver varies significantly depending on its capabilities. As an example, the u-blox MAX-M10S is a single-frequency multiconstellation GNSS module designed for low-power IoT applications and costs $21 when buying less than ten units. Support for A-GNSS is often provided at almost no extra cost, as it is commonly integrated in nearly all modern GNSS chipsets. Moreover, it was shown that by integrating a GNSS receiver with cellular IoT connectivity on a single chip, the cost of the bill of materials (BOM) can be reduced significantly [46]. Although GNSS hardware is more expensive than LPWAN hardware, no additional service cost needs to be paid in order to use the satellite broadcast systems. Furthermore, GSA and Ubiscale aim to deliver a Galileo service that integrates NB-IoT in the "Galileo-of-Things" project, enabling lower chipset cost [43], [88].
Snapshot processing GNSS receivers can be less expensive than an ordinary GNSS receiver, as the acquisition of GNSS signals only requires an RF frontend [36]. Therefore, an RTL-SDR dongle of a few euros can be sufficient, while more optimized GNSS-specific frontends and SDRs can be rather expensive [89]. Finally, it is worth mentioning that the actual position computation in the cloud also comes at a cost. In an analysis of cloud GNSS approaches, the economic cost of the required cloud resources was studied. For a cloud GNSS sensor sending raw snapshot samples of a 15-ms duration every hour to a reserved server, the annual cost per sensor was estimated to be $1.46 [35].
3) LEO: Similar to the cost of LPWAN usage, the cost of satellite IoT solutions is the sum of the hardware cost, a subscription cost, and a message cost. The hardware cost varies depending on and the level of optimization. For example, a multipurpose low-cost very high frequency (VHF) dipole antenna and an inexpensive RTL-SDR dongle can be used to sample LEO signals in a receiver-sided Doppler positioning approach [37]. However, if a more robust device or reliable positioning service is required, an off-the-shelf solution is recommended. For example, the argos receiver transmitter with integrated control (ARTIC) R2 chipset costs A C47, while the "plug-n-play" KIM-1 module costs A C50. Due to the allin-one design, the Semtech LR1110 chip only costs A C8.84. Furthermore, the subscription and message costs depend on the operator's business model. For example, Orbcomm charges a monthly message fee of $7 to get access to the OG2-M network on top of the $1.35 per kB sent. Lacuna Space only charges $5 per month per UE, but this excludes the LoRa geolocation service. Being a non-for-profit system, Argos offers unlimited usage of the satellite network for A C63 per month. Finally, it is important to note that these subscription costs are quite expensive when compared to LPWAN subscription costs. Therefore, it is more cost-effective to exchange data over a terrestrial link, if available.

N. UE Complexity
In order to determine a position, a set of hardware components, such as chipsets, sensors, and antennas are required. All of these increase the computational complexity of the UE, which we cover in this section.
1) LPWAN: LPWAN end devices are designed with low complexity in mind. First, this can be observed in the network architecture. LoRa networks, for instance, use a simple star topology, instead of more complex meshing topologies. In NB-IoT, a UE only communicates with a single serving cell, eliminating the need to scan for multiple nearby cells if a good connection is established. Second, RSS, TDoA, and AoA positioning approaches do not increase the complexity of the UE, as they only require more complexity at the gateway side. Hence, zero location processing is performed on the device itself. Finally, a multimodal LPWAN localization approach does increase the overall UE complexity as intelligent radio switching mechanisms need to be implemented and executed by the device [90].
2) GNSS: When comparing single-to dual-frequency GNSS receivers, the complexity of the latter more than doubles. This is due to the fact that the UE antenna must support both frequencies, a second saw filter needs to be implemented and the signal needs to be recombined again to send down the coax to the receiver [91].
When adding LPWAN or LEO connectivity to GNSSenabled UEs, the complexity changes depending on the used technique. For instance, adding A-GNSS features requires incorporating information into the GNSS tracking loops. In contrast, snapshot GNSS receiver designs are usually simpler due to the absence of signal processing blocks. In this case, the reduction in complexity due to the remote processing capability is more significant. However, increasing the sampling frequency of a snapshot GNSS receiver increases the pseudorange accuracy after the acquisition in exchange for more computational burden. The tradeoff between computational complexity and collaborative GNSS hybridization is further described in [92].
Several techniques are being investigated to further decrease GNSS complexity. The accurate GNSS positioning for lowpower and low-cost objects (APOLLO) project aims to provide a Galileo-based location solution using a 100% software GNSS receiver. By getting rid of chipset constraints, the goal is to reduce device complexity by a factor 10 [43]. Furthermore, a compressed sensing (CS) technique requires a smaller number of samples, reducing the amount of memory needed [93].
3) LEO: Similar to LPWAN, position calculation in LEO satellite systems often occurs in the cloud, successfully reducing the UE complexity. Many Doppler positioning systems use an uplink communication approach, where the final UE position is estimated in ground processing centers. For example, Lacuna Space uses standard LoRa devices such as the Semtech LR1110 with a slightly different antenna to communicate with their satellites. Moreover, a GNSS receiver in LEO systems could be used to steer the LEO clock, reducing the onboard clock requirement and complexity [20]. In high contrast, capturing SoOP from multiple LEO constellations with an SDR at the UE side requires local signal processing, adding computational complexity.

O. Location Update Rate
Where some positioning applications need real-time and fast location updates (e.g., in vehicle-to-vehicle communication), others only require a location update once a day. Independent of the application, we here discuss the maximum achievable location update rate for every technology.
1) LPWAN: In unlicensed frequency bands, the amount of airtime is regulated in order to reduce interference from nearby communications and to maintain a fair use policy. For example, Sigfox and LoRa transmitters should respect the 1% duty cycle limitation in the EU 868-MHz band. In the case of Sigfox, this results in the transmission of maximum 140 uplink messages per day. LoRa operators (e.g., TTN) can implement even stricter limitations. In opposition to unlicensed LPWAN technologies, cellular IoT technologies such as NB-IoT do not face these duty cycle limitations, enabling the possibility to produce fast location updates, e.g., every second if needed.
2) GNSS: One major benefit of traditional GNSS receivers is their ability to produce fast location updates locally. Once a receiver has acquired a first fix and goes into tracking mode, it can usually produce a position estimation at an update rate of 1 Hz or higher. However, in order to communicate the position update to a remote user, the system depends on the location update rate of the LPWAN or LEO communication channel. Therefore, the delay between the production of the GNSS coordinates and the reception of the location update by the remote user should be taken into account in (near) real-time tracking applications. Similarly, the raw observables sent to the cloud in a snapshot GNSS approach are only valid for a limited amount of time.
3) LEO: The location update rate of LEO positioning systems is determined by the number of satellite passes per day, and thus by the number of satellites in orbit. The satellite revisit time is defined as the period during which a UE at a given location has to wait until the next satellite passes to transmit a message. Due to the near-polar orbit of many LEO satellites, the satellite revisit time shortens with latitude. For example, an Argos satellite is able to receive messages from a UE at the poles 14 times per day, while this number decreases when the UE moves toward the equator. In the future constellation of 25 nanosatellites, Kinéis expects the average satellite revisit time to drop below 15 min [70]. A similar simulation carried out by Lacuna Space shows that 240 LEO satellites are sufficient to provide connectivity every five minutes. When using SoOP from multiple LEO constellations, more frequent location updates can be calculated locally. Finally, it should be noted that combining LEO and LPWAN communication enables a higher overall location update rate.

P. Local or Remote Processing
A final dimension of this survey indicates whether the localization algorithm or other processing steps are performed locally on the UE or remotely in the cloud. 1) LPWAN: When applying localization algorithms, such as RSS ranging or TDoA in terrestrial networks, oftentimes the UE is only required to send uplink messages with network statistics or sensor data. All further processing is performed on a localization server in the cloud, which in turn forwards a location estimate to the end-user application. The involved processing steps may include determining the range to each gateway leveraging path loss models, RSS data or accurate timestamps, combining this data with AoA and sensor data in a sensor fusion algorithm, and applying a multilateration algorithm to determine a final coordinate.
2) GNSS: In high contrast, traditional GNSS receivers perform all processing steps locally, ranging from full signal acquisition to pseudorange generation and coordinate production. However, given the communication and low-energy requirements of IoT as, there is an increasing interest toward remote processing of GNSS signals. Recent GNSS receivers do not only integrate LPWAN or LEO communication, but also enable cloud processing. As described in Section II-C, snapshot GNSS receivers capture small portions of a signal, digitize them and send them over a communication channel to the cloud for further processing. As an early adopter of this technique, Ubiscale provides a solution which shifts power-draining GPS (and Wi-Fi) processings to the cloud to minimize size, power consumption, and cost of trackers [88].
3) LEO: Location processing in LEO systems can be performed either locally or remotely, depending on the architecture of the positioning approach. When the satellites perform Doppler measurements based on uplink transmissions from the UE, the data is forwarded via a ground station to a processing station on Earth, where the location of the UE is calculated. On the other side, when a UE scans for all available LEO satellite signals, an algorithm on the UE determines the position of the UE itself. While the former approach requires less on-device processing and thus lower UE complexity, the latter does not require uplink communication to the satellites. In practice, most systems such as the one of Argos and Lacuna Space work using the first approach (i.e., by sending precise frequency and timing information from Doppler measurements at the side of the satellites to a geolocation solver on Earth), as this approach eases the communication of the estimated location to a remote end user.

IV. ANALYSIS
The performance matrix as shown in Table I and discussed in the previous sections can serve as a methodology to identify an optimal positioning solution when designing an IoT positioning application. This section analyzes the advantages and disadvantages of the discussed localization technologies and techniques, applied to example use cases.
Most prominent is the tradeoff between positioning accuracy and energy consumption. The vast majority of other tradeoffs directly or indirectly impacts this tradeoff. Hence, an application designer should choose a certain positioning technique primarily based on the position accuracy and energy requirements. Consider a construction company aiming to monitor valuable equipment, such as heavy machinery and cranes across several sites. Because the battery lifetime of the trackers on the equipment is of utmost importance, LPWAN positioning may be the best choice in this case. As the sites are far away from each other, the positioning accuracy of several hundreds of meters is acceptable. However, if a higher accuracy is required, other techniques should be used. Similarly, a wildlife tracker may perform LEO Doppler positioning or snapshot GNSS rather than traditional GNSS to save energy. In high contrast, the battery of a pet tracker can be replaced more frequently, allowing for meter-level GNSS accuracy. Furthermore, snapshot GNSS techniques provide great flexibility. If a higher positioning accuracy is desired, the snapshot size is increased and more observables are communicated to the cloud, at the expense of additional energy consumption.
In a myriad of positioning use cases, it is beneficial in terms of UE cost, computational complexity, and energy consumption to process the location remotely. Moreover, the final location estimate often needs to be available to remote end users. Therefore, the cloud processing paradigm has been established in the LPWAN and LEO markets and is gaining popularity in mass-market GNSS receivers. Notwithstanding the foregoing, there also is a growing interest toward local processing of LEO satellite SoOP, as this approach does not require communication, and signals from multiple LEO constellations can be used, improving the coverage in time and space, as well as the location update rate. In the wildlife tracking use case, for example, location and sensor data can be processed and stored locally. Afterwards, the logs can be retrieved manually or requested occasionally to save on communication energy.
The choice for a certain communication technology comes along with its data constraints, such as data volume, bandwidth, and data rate. Unlicensed terrestrial networks need to comply with regional duty cycle regulations and need to deal with limited payload sizes, data rates, and location update rates. Therefore, when many observables (e.g., GNSS snapshots) need to be communicated to a cloud solver, a cellular technology such as NB-IoT is preferred. However, if smaller amounts of data need to be transmitted sporadically (e.g., weekly ephemeris data in A-GNSS), a more flexible LoRa network can be used, possibly in combination with an LEO constellation to extend the application coverage.
The high interoperability of LPWAN, GNSS, and LEO solutions enables interesting novel use cases, such as energyefficient global tracking, managing natural resources, improving food production, and optimizing global infrastructure. In particular, the compelling multimodal aspect facilitates to intelligently change positioning strategies. For example, when the previously mentioned construction company is transporting equipment across cities or even countries, a network of terrestrial base stations or LEO satellites is used in order to save energy. However, when an asset reaches its destination site, the accuracy becomes more important. Based on a proximity detection algorithm, the UE might now switch to a more accurate A-GNSS approach, with the last known location and time provided by the communication network. Finally, switching between technologies also depends on their availability. For instance, the wildlife tracker may switch from LPWAN to LEO communication if no terrestrial network is available. Fig. 19 summarizes the key dimensions of every positioning technique discussed in this study. The figure clearly shows that the traditional observable-based GNSS technique has one main limitation: the system was not designed with low energy consumption in mind. Hence, techniques, such as A-GNSS and snapshot GNSS aim to solve this issue, leveraging LPWAN or LEO satellite communication networks. As a more energyefficient alternative, these networks can be used for positioning purposes as well, in exchange for positioning accuracy.
While LPWAN hardware is widely available and networks are easily accessible, LEO satellite networks for both communication and localization have not reached this point yet. Currently, there is no LEO constellation available which covers each place on Earth permanently (i.e., 24/7). As more and more LEO satellites will be launched into orbit in the coming years, satellite revisit times will reduce, increasing the location update rate, as well as the overall coverage. The most promising feature of LEO satellite networks is the ability to communicate a location estimate in areas where no terrestrial networks are available, such as remote mountainous, desert, or forest regions. Hence, we believe LEO constellations have

V. CONCLUSION AND FUTURE WORK
In this survey, we have provided a performance analysis of state-of-the-art, large-scale and energy-efficient positioning techniques for the IoT. Based on 16 dimensions, we composed a performance matrix, which can be used by application designers to determine the most optimal positioning solution. In most cases, this solution will consist of a combination of positioning techniques and communication technologies, which emphasizes the high interoperability between LPWAN, GNSS, and LEO systems. Through example use cases, we discussed important design tradeoffs, in which the location accuracy and energy requirements play a decisive role.
While techniques, such as LPWAN positioning and A-GNSS are widely adopted, others have remaining challenges to be investigated in the future. First, dedicated snapshot GNSS receivers are not widely available, as well as opportunistic LEO positioning hardware. As LEO constellations continue to expand, commercial positioning services will become available for the general public after the commercialization of this hardware. Second, based on the technology matrix in this survey, some practical guidelines could help manufacturers with the integration of LPWAN, GNSS, and LEO technologies, e.g., how to combine systems, which configurations (sleep modes, snapshot lengths, etc.) to use. Related research challenges involve the optimization of intelligent switching between positioning and communication technologies, potentially based on energy and accuracy requirements. Third, more accurate orbit products can improve LEO positioning, as the current accuracy makes up a large part of the localization error budget. Moreover, the propagation of LEO signals in indoor environments to enable indoor Doppler positioning should be further investigated. Finally, advanced yet low-complex compression algorithms could lower the data constraints of communication networks for efficient data transfer to the cloud. These efforts along with this state-of-the-art survey should deliver a better understanding of current challenges to enable ubiquitous, energy-efficient, and large-scale positioning solutions in the emerging market of satellite IoT.

ACKNOWLEDGMENT
The activities related to this article are carried out under a programme of, and funded by, the European Space Agency (ESA). The views expressed in this publication can in no way be taken to reflect the official opinion of ESA. The project industry partners are OHB Digital Solutions and PeopleTrust.