Embedding the Localization and Imaging Functions in Mobile Systems: An Airport Surveillance Use Case

Driven by the extended applications and scarce spectrum resources, integrating the radio sensing functions into the future mobile system has been a consensus between the stakeholders. This paper demonstrates the feasibility of joint localization and imaging functions by exploiting the reference signal in the radio frame defined in the mobile system. Essentially, the subspace-based algorithms are adopted to jointly estimate the angle and distance and to enable the localization function for uplink and downlink signals and the derivation of theoretical performance boundaries. The vector antenna and virtual array concepts are introduced in the downlink scenario to enhance the angle estimation resolution. The uplink sounding reference signal is exploited to enable the imaging function as analog to synthetic-aperture radar (SAR). The joint localization and imaging performances are verified with a realistic ray-tracing channel based on the 3D ground and buildings model of Muret airport in France. The simulation results show that the reference signal can provide acceptable localization accuracy and target-distinguishing capability by adopting a virtual array and joint time-spatial smoothing in downlink and uplink, respectively. The joint localization and imaging results prove that the future mobile network is potentially a viable infrastructure to provide economic surveillance solutions for airports, particularly for secondary airports that are not well equipped with dedicated surveillance systems.

the sensing (or imaging) as an intrinsic function is an obvious demand in the 6G network design [1], [2]. As described in [3], [4] The embodiment of the sensing function may include but is not limited to accurate localization, motion status capturing, and mapping of the surrounding environments for network-and user-terminal ends. Particularly, these sensing functions are expected to be achieved and carried out by the same radio bursts which are usually designed for communications, without the auxiliary external global navigation satellite system (GNSS) or inertial sensor signals.
This paper exploits the reference signal (RS) defined in the 5G radio frames to achieve the joint localization and imaging functions for future-proofing the integrated sensing and communications (ISAC) in 6G era [5]. In general, the radio-signal-based localization relies on the measuring and estimating the parameters that indicate the relative position between the signal source (i.e., transmitter) and the observation point (i.e., receiver). Such parameters include the receive signal strength (RSS), the direction (or angle) of arrival or departure, and/or the source-observation point distance (obtained from delay measurements). The RSS is the easiest accessible parameter for the localization purpose, however, it suffers the limitation of the path-loss models inaccuracies [6] if trilateration or hyperbolic approaches are used. The radio tomography [7] and fingerprinting approaches [8] provide accurate RSS-based positioning, however, they require high dense multiple-radio anchors deployed in the area of interest, that are not suitable for the airport scenarios, as well as regular collection of training databases in a manual or crowdsensing manner, which are typically too complex to implement. Thus, in this paper we focus on the estimation of angle and delay parameters which lead to more robust and accurate target localization than RSS-based estimates. To estimate the direction (angle) of radio signal departure or arrival, the system requires the spatial sampling of the incident signal, which is often done by various antenna arrays, such as uniform linear arrays (ULA), uniform circular arrays (UCA), or uniform rectangular arrays (URA). Subspace algorithms such a MUSIC [9] are often applied on the spatial samples for angle estimation; in such cases, the angle resolution is determined by the physical aperture of the array [10]. The extraction of the distance (delay) can be categorised into three genres: i). modulated-timing sequence (e.g., GPS system); ii). cross-correlation of the radio pulse/burst (e.g., fast time processing in radar ranging [11]); iii). subspace processing over frequency-domain samples of the wideband radio signal [12]. The subspace processing is adopted in this work, as it provides the opportunity for the joint angle-anddelay estimation for the single-cell localization. Besides the localization, we also explore the imaging function (analog to SAR imaging) by using the mobile radio resources, which is potential the enabler of wider applications (e.g., the security surveillance, infrastructure monitoring etc.), however, not well-discussed so far in the ISAC context according to [13], [14], [15]. To prove the practicality of the mobile signal-based localization and imaging, the airport (particularly the secondary airport) surveillance is used as the main scenario, which is shown in Fig. 1. Secondary airports are gaining increasing importance in the context of growth of global air traffic and low-cost carriers (LCCs) [16], however, are under-equipped for the diverted air traffic. The major airports often employ advance-surface dedicated Advanced-Surface Movement Guidance and Control Systems (A-SMGCS) [17] along with the deployment of multilateration (MLAT) [18], surface movements radar (SMR) [19], Automatic Dependent Surveillance-Broadcast (ADS-B) [20], camera or light detection and ranging (LiDAR) for the monitoring and surveillance of ground and aerial objects. However, these solutions pose several challenges when applied in the secondary airports, such as high cost (e.g., SMR), low equipage (e.g., ADS-B), or environmental constraints (e.g., Video camera and LiDAR). One potential solution is to exploit the radio resources of the private 5G or 6G networks for surveillance purpose. Pilot 5G private networks have already been deployed in the major passenger and freight hubs, such as Paris-Charles de Gaulle airport [21] and Port of Antwerp [22]. Predictably, private networks will be deployed in more smart facilities (e.g., airport, port, stadium etc.) in the near future for security, reliability, and low-latency [23] mobile services, as well as the sensing functions to support these services.
The main task of the airport surveillance is to localize the 5G or 6G-equipped aircraft and other vehicles present in the airport area, by using the reference cellular signals [24]. This task include two scenarios: i) the first one is the user equipment (UE) localization at the base station (BS) side (called 5G NodeB in 5G terminology), by using the uplink sounding reference signal (SRS) transmitted from the UE; ii) the second one is the self-localization of the terminal equipment (called UE in 5G terminology) by using the downlink positioning reference signal (PRS) transmitted from the BS. For both scenarios, we assume that the BS and UE (usually an aircraft) are equipped with an URA and with a single 3D vector antenna (VA) [25], respectively. The considered scenarios are depicted in Fig. 1 which is also used in [26]. The VA is equipped at the UE side, because of its identical angle-estimation performance over all directions, wideband capability, and the compact size [25] that are more suitable for the space-constrained UE. The direction and distance information used for positioning are estimated via the subspace-based joint angle and delay estimation (JADE) algorithm [27] which has been widely used in radio-based positioning and sensing [28], [29]. In this paper, the localization function relies on the angle and delay estimation based on the directly receiving SRS on the BS and PRS on the UE. In our previous work [30], JADE has been proved to work well with the uplink 5G SRS signal for angle-anddelay estimation purpose, but it has not been studied with downlink PRS signals. Our work in [31] demonstrated that the subspace-based algorithm is also applicable on a single VA for an approximate angle-of-arrival (AoA) identification with limited resolution. Moreover, [31] revealed that a strong coherent path will crash down the angle identification. Despite the promising vision studied in [30], [31], in order to pave the path for 5G or 6G-signal-based airport surveillance, we still need to tackle a series of unresolved challenges, including the coarse angle resolution of a single receiving VA, the impact of the coherent multipath components on the subspace algorithms, the capacity to resolve multiple targets, etc. To tackle these challenges, we applied a series of of novel approaches which are summarized in many folds: • Virtual Array: The virtual array is introduced in the UE self-localization with downlink PRS signals. The use of the virtual-array at UE side essentially improves the angle resolution by an extended virtual aperture. The virtual array also provide the opportunity to apply the spatial smoothing to mitigate the impact of the coherent multipath reflections. In addition, the combination of the virtual linear array (VLA) and VA enables the 2D direction estimation and shows robustness to the mirror image vagueness effect in comparison with the isotropic element based VLA. The related results are shown in Section IV-B; • 3D Smoothing: The 3D spatial-frequency smoothing strategy is applied on both the URA (uplink SRS receiving) and VA antennas (downlink PRS receiving) in order to mitigate the impact from the coherent multipaths. The smoothing is essential when the UE is close to the ground (e.g., during the landing and taking off of an aircraft) as the ground-surface reflection is put on par with the direct transmission. The smoothing strategy and effect are shown in Sections III-C and IV-B; • Multiple Targets: In this work, we also take advantage of the frequency-time orthogonality of the SRS signals from different UEs to break the limitations of angle and time resolution in the detection of multiple targets. The SRS resource allocation patterns defined in [24] are used to differentiate the UEs. Section IV-A shows the results by extracting orthogonal allocated reference signals among two UEs; • Imaging with Mobile Signal: Beyond the angle and delay estimation, we also explored and proved the imaging functionality with 5G uplink SRS signal, by mimicking the SAR imaging processing [32]. The SRS based imaging results shown in this paper opens a new field to exploit the 5G signals for surveillance purpose. Unlike the localization function, the imaging function replies to the reflected SRS signals from the objects in the area of interest. In Section IV-D, the imaging output taking from the scatterd SRS signal is demonstrated. • Verification with ray tracing channel: The localization and imaging performances are verified with using ray tracing channels, which are generated based on realistic 3D geometry model and dielectric properties of the ground and buildings in Muret Airport. In terms of system design, our proposed solution suggests the use VA-VLA configuration to improve the angle estimation accuracy, and therefore the overall positioning accuracy, and it exploits the imagining capabilities of 5G signals in a SAR-like processing, which can be employed for sensing the environment in situations where traditional air traffic management structures are insufficient, such as low visibility due to weather conditions or heavy signal obstructions. The rest of the paper is organised as the follows: Section II describes the definition of reference signals in 5G protocol, system model, and antenna properties for sensing. Section III introduces the signal processing methods used for angle and delay estimation, including virtual array, spatial smoothing, subspace algorithms and performance boundary derivation. The simulated localization and imaging results are conducted and compared in Section IV. Finally, the conclusions of the current work as well as a discussion about future works are given in Section V.

II. SYSTEM AND SIGNAL MODELS
In this work, two localization scenarios are investigated for the airport surveillance: the first scenario aims to localize UE location at the base station by analysing the uplink reference signal (SRS used as an example) from UEs; the second scenario is the UE self-localization by downlink reference signal (PRS as the example) from the base station. In the formal scenario, The base station is equipped with an M URA ×M URA URA for joint angle-delay estimation. In the later scenario, UE receives PRS with a signle VA wich is also able to perform the joint angle-delay estimation that can be further improved by applying the virtual array concept. This section derives signal models and problem formulation for time and delay estimation in both the downlink and uplink scenarios. To have a clear view of signal models and estimation process, Table 1 explains the meaning of the symbols used in the mathematical modelling. It is also worth noting that other reference signals defined in 5G NR can also be used for localization purposes. For example, downlink channel state information reference signals (CSI-RS) in [33] and demodulation reference signals (DMRS, in both downlink and uplink) in [34]. Even the payload signal can be exploited for sensing purposes for detection or imaging.

A. TRANSMITTED SIGNAL MODEL 1) UPLINK SOUNDING REFERENCE SIGNAL (SRS)
SRS signal is the 5G uplink reference signal used for estimating channel quality between UE and BS. In 3GPP standards TS 38.211 [24], the SRS is derived from the low peak-to-average power ratio (PAPR) Zadoff-Chu sequence whose entries are allocated to the specific time and frequency units (physical resource unit, PRU) by following a set of the configuration rules (as shown in Appendix A). The pattern is defined by a parameter set [l 0 , k 0 , K tc , nrofSymbols, M SRS , C SRS , B SRS ] 1 whose elements are delivered in the signaling messages radio resource control (RRC) Connection Setup message and RRC Connection Reconfiguration message. Once a Zadoff-Chu sequence is selected, each entry in the sequence will be allocated to PRU in a resource block (RB) according to the parameters set. For the clearance, one RB contains to 12 subcarriers and 14 OFDM symbols. The duration of 14 OFDM symbols is defined one slot in time domain as shown in Fig. 2. 3GPP standards reserved 8-th to 13-th OFDM symbols in one slot for SRS signals. l 0 and nrofSymbols are parameters to control the time domain start location and symbols duration of the 1. To avoid the misunderstanding, the symbols l 0 , k 0 , K tc , nrofSymbols, M SRS , B SRS , C SRS are the same as 3GPP TS 38.211 [24]. SRS signal and each SRS lasts for 1, 2 or 4 symbols. The frequency domain allocation pattern is defined by k 0 and K tc which indicate the start subcarrier index of SRS signal and the subcarrier span between two adjacent Zadoff-Chu sequence entries of the same UE, respectively. K tc is also called comb structure indicator and its value can be chosen from 1, 2, and 4. After mapping each Zadoff-Chu entry to the right PRU, a frequency domain SRS OFDM symbol can be assembled and denoted by X SRS . According to the configuration rule, the SRS signals from different UEs will be allocated with orthogonal time and frequency patterns. Figure 2 shows a visualization of resource allocation pattern of two UEs' SRS signals which are orthogonal to each other. It can be seen that both UE1 and UE2 start from the 8-th OFDM symbol with the duration equal to 4 and 2, respectively. Both UE1 and UE2 have comb 2 structure and the span between two adjacent Zadoff-Chu entries of the same user is two subcarriers. It should be noticed that RRC message contains bandwidth configuration indicator C SRS and transmission bandwidth configuration parameter B SRS . The values of the two parameters are jointly affecting the selection of total frequency domain resource block number m SRS from the Table 6

2) DOWNLINK POSITIONING REFERENCE SIGNAL (PRS)
Similarly, downlink PRS signal, X i,ψ PRS ∈ C 1×N is transmitted from the BS to UEs with a specific length-31 Gold sequence. The allocation pattern is illustrated in Fig. 3   defined by L PRS , which equals to 12 for both UEs. The PRS subcarrier starting index is k 0 = 0, and the orthogonality between PRS for different UEs is achieved by switching the offset parameter k PRS offset . The PRS subcarrier starting index on each OFDM symbol is varying with an order defined in the Table 7.4.1.7.3-1 in 3GPP TS 38.211 [24]. As the standard does not contain the description of PRS bandwidth configuration, we use the same bandwidth as SRS signal in this work.
The UE localization in this work relies on the angle (direction) and time (distance) estimation of the receiving SRS and PRS signals. As the signal is extracted according to the PRU allocation pattern in the frequency domain, we use frequency domain X SRS and X PRS to represent the reference signal for uplink and downlink respectively. The angle and delay estimations require the spatial and frequency sampling of the receiving reference signals. In the rest of this section, we describe the assembly of angle, time and joint manifold.

B. ANGLE MANIFOLD 1) ANGLE MANIFOLD OF URA IN UPLINK SCENARIO
The uplink angle estimation is achieved using the URA antenna installed on the BS, which brings the capability to identify the AoAs for both azimuth and elevation dimensions. For a URA, the array elements are evenly placed with half-wavelength spacing on horizontal and vertical directions as shown in Fig. 1. We use φ and θ to denote the azimuth and elevation angles, respectively, and use array element at the right bottom corner as the reference point. For an incident signal from the direction (φ, θ ), The array manifold a URA (φ, θ ) ∈ C M×M can be written as: where the operator T is transpose operation. a ULA (θ ) and a ULA (φ|θ) [35] are azimuth and elevation manifolds, respectively and defined as:

2) ANGLE MANIFOLD OF VIRTUAL LINEAR ARRAY IN DOWNLINK SCENARIO
In the downlink scenario, only a single VA is equipped on the UE and a VLA is formed to observing the received signal at different locations as shown in Fig. 5. In contrast to the actual ULA, which takes the spatial samples by using evenly placed antennas (usually with half-wavelength spacing), the VLA takes the spatial samples of the signal by taking advantage of the moving platform where the antenna is installed for angle estimation. VLA extends the virtual aperture to improve the potential angle estimation resolution. Fig. 1 also illustrates the Cartesian coordinate system of one BS and UEs equipped with VA. The downlink PRS signal is transmitted from the BS to a UE with arrival angles θ and φ. When using the VA-VLA for direction finding, angle manifold is synthesized by both VLA manifold Eq. (3) and VA manifold Eq. (4) following (6). The theoretical structure of VA can be represented by three electric dipoles and three magnetic dipoles as the Fig. 4 shows. It can detect incoming signal angle from all directions identically and measure the incoming signal polarization state as well. Assumption 1: The antenna size is significantly less than the distance between BS and UEs. Thus, the VA is treated as a point-like structure and the receiving electromagnetic wave is a planar wave. The corresponding angle manifold of VA used for angle estimation can be written in the form of (3).
The γ and ζ describe the auxiliary polarization state (vertical or horizontal polarised) and signal polarization state (linear, circular, or elliptical), respectively. Assumption 2: The receiving signal on UE from the BS is vertical polarized as there always exists a vertical component for a dual polarised antenna. The signal is also set as linear polarised. Thus, ζ and γ are set as 0 • and 90 • in this work. It has been shown in [30] that the VA has limited angle resolution and high sensitivity to the coherence between signals. To further enhance the angle estimation accuracy in the presence of strong coherent reflection, which is generally present in multipath propagation scenarios, we adopt the virtual array by taking advantage of the UE mobility. The virtual array concept takes samples from multiple different locations, which is similar as SAR [32]. This idea has also been explored in [36] for human target tracking with a VLA whose elements are equally spaced. In this work, we construct a diagonally placed VLA with VA as array element for identification of both azimuth and elevation angles. We show the VLA structure together with the orientation in Fig. 5. The blue marks follow the UE's moving track, and the distance between the UE and the BS is assumed much larger than the VLA element distance to form a far-field scenario. The M VLA elements virtual array manifold and elements' values about the k th path can be described with the following equation (4): where It is worth to note that the element spacing d Hori VLA and d Verti VLA might be different in the practice, such as, targets are only moving in a horizontal plane (d Verti VLA = 0); VLA constructed under this situation is only helpful to enhance azimuth angle estimation accuracy. Further details about virtual array element spacing and capabilities will be described in Section IV.
At last, the joint angle manifold of the VA-VLA a VA-VLA (φ k , θ k ) ∈ C 6×M VLA of downlink PRS is expressed as fellow:

C. TIME MANIFOLD AND ICI REPRESENTATION
Supposing the propagation delay of a reference signal (either uplink or downlink) is τ and the first subcarrier of the signal is the reference subcarrier with phase shift e −j2π f 0 τ . The phase shift on the n-th subcarrier is e −j2π f n τ , where f n is determined by comb parameter and OFDM subcarrier spacing f . The f n of SRS is f SRS n = nK tc f and the delay manifold for SRS g SRS (τ ) ∈ C 1×N can be expressed as Similarly, f PRS n = nK PRS comb f is the f n of PRS and the corresponding delay manifold for PRS can be written as Target's mobility introduces Doppler shift in the receiving signals, which can be described with signal phase rotation vector C(v) ∈ C 1× and D(v) ∈ C 1×N , similar as [37]. The estimation step requires multiple SRS symbols for expectation calculation in Eq. (21) and we define as the total number of the observed SRS signal. D(v) represents the inter-carrier interference and C(v) contains the phase rotation information among OFDM symbols. As the SRS and PRS are not using all OFDM symbols within one slot, we use S SRS and S PRS in Eq. (9) and (10) to show the ψ-th symbol's index, and those indexes are used to calculate the group phase rotation in Eq. (11) and (12) where · and mod(·) denotes floor function and modulo operator.

D. RECEIVING SIGNAL MODELLING 1) SRS RECEIVING SIGNAL
Due to the multipath propagation in the practical environment, the SRS signal propagates through K multipaths and each path has it's own delay and angle. Thus, we use the Y (14) to indicate the ψ-th observed SRS from one UE by the BS. We assume that a UE sends totally OFDM symbols and each symbol is treated as one snapshot in the subspace estimation.
From communication point of view, the antenna and propagation environment cause attenuation and phase shift and these affects can be described by a 3D channel state information matrix H i,ψ SRS ∈ C M URA ×M URA ×N . Assuming Z i SRS ∈ C M URA ×M URA ×N as the additive noise matrix with Z i SRS ∼ CN (0, σ 2 I), the received signal corresponding to SRS is given as: where represents the elementwise matrix multiplication andX i,ψ SRS,k is given aŝ Here,X 2) PRS RECEIVING SIGNAL Similarly, the receiving downlink PRS signal after multipath propagation on the UE can be defined as equations (17), (18), and (19) given below: As the Eq. (17)

III. ALGORITHMS FOR ANGLE, TIME ESTIMATION AND IMAGING
In this section, we elaborate the premier algorithms applied on the received SRS and PRS signals for joint angle and delay estimation in Section III-A. To evaluate the location estimation bound, Section III-B derives CRLB expression. Also, the spatial-time smoothing algorithm is introduced in Section III-C to enhance the estimation performance with the presence of the strong coherent multipaths. Furthermore, the SRS signal based imaging algorithm is depicted as enhancement for angle and time based UE localization for the airport surveillance with 5G networks.

A. JOINT ANGLE AND DELAY ESTIMATION
The subspace algorithm was first introduced in [9] as multiple signal classification (MUSIC). It makes use of the orthogonality between the noise and signal subspaces to identify the signal sources directions. Then, the method was extended to two dimensional time and delay estimation in [27]. In this work, the estimation is further extended to three dimensions which include azimuth, elevation angles and time delay. In this section, estimation in uplink scenario is elaborated in detail. The downlink estimation works in similar fashion, with some differences on the manifold as virtual array is used in the downlink. By taking advantage of the prior knowledge of the Zadoff-Chu and its allocation pattern on both the BS and UE, the uplink channel can be estimated via Eq. (20). Symbol ∅ is called as element wise division or Hadamard division.
To perform the 3D estimation, we firstly reshape the estimated 3D channel information matrixĤ i SRS ∈ C M URA ×M URA ×N into a vector form vec(Ĥ i SRS ) ∈ C 1×M URA * M URA * N , and then we calculate the covariance matrix of the reshaped vec(Ĥ i SRS ), which is: where E[ · ] denotes expectation, [ · ] * is conjugate transpose operation, and vec(·) means vectorization operation. After where ι is the number of paths under estimation. As we are focusing on the LoS path and the processed SRS signal of different UEs are orthogonal to others in the time-frequency domains, the position estimation of multiple UEs is equivalent to multiple single-target positioning. Thus, ι is set to 1 in the simulation. The searching space of this work includes three parameters: azimuth angle φ, elevation angel θ and time delay τ . Thus, the joint manifold Then, with the noise subspace and searching manifold, the 3D spectrum of UE i is achieved as: After brute-force search in θ , φ, and τ dimensions, the peak value of P i SRS (φ i , θ i , τ i ) indicates the estimated signal source position.
The estimation method follows the same steps in the downlink scenario; the difference appear on joint manifold A i PRS (φ i , θ i , τ i ) in Eq. (25) because of the using of the virtual VA array: Moreover, the noise subspace used for the downlink scanrio is E PRS n = [e 1 , e 2 , . . . , e (6 * M VLA * N −L+1) ]. In practice, the performance of the subspace based method is limited array imperfections, particularly the mutual coupling between the array element, which disturbing the covariance matrix in Eq. (21) in the MUSIC algorithm. Usually, the technique link method of moments (MoM) [38] and its variants are often used to compensate the performance deterioration. In addition, the subspace based method also suffers from fundamental problems such as limited capability with the presence of coherence interference, requirement of independence between the signal and noise, correlation between the resolution and number of elements, capability of handling the multiple targets. In this paper, some of the problems are addressed by the virtual array and smoothing strategies. (14), we develop the general form of CRLB regarding multi parameter α = [θ, φ, τ ] in this section. Firstly, we assume one antenna element receives the l-th sample x(lT s − τ ) with delay τ . x(lT s − τ ) is a sample of N total subcarriers OFDM signal. The total number of samples is 2L + 1 and T s is the sampling time. Then, x(lT s − τ ) can be mathematically written as

Continuing from the received signal
where X n is the frequency domain OFDM signal value on the n-th subcarrier with corresponding magnitude given as: Thus, we expressed the received raw sample y raw q,m,l (α) in eq. (28) and noise involved sample y q,m,l (α) in eq. (29). m indicates the index of VLA element and we totally have M VLA elements. Also, a q VA shows the qth element of the VA's steering vector in eq. (3).
Secondly, we calculate the likelyhood function p(y|α) regarding the multivariate vector α and Fisher Information Matrix (FIM) J(α) 3 in equation (31) and (32) [25], [39] where ∇ α means gradient along parameter vector α. Thirdly, the multivariate CRLB is derived as follow [25]: 3. Elements of FIM are given in Appendix A. where z q,m,l is complex additive Gaussian noise with variance equals to σ 2 /2. The FIM and CRLB of URA case follows equation (32) and (33) also and detailed result of FIM is provided in Appendix A.

C. MULTI-DIMENSIONAL SMOOTHING
The orthogonality between reference signals of different UEs avoids the mutual interference. But the impact of coherence from the strong reflections still exist. The presence of coherent multipath component breaks the orthogonality between the noise and signal subspaces. As a post processing scheme [40], spatial smoothing preserves the full rank property of the sub-covariance matrices, thus, maintains the subspace estimation performance even with the presence of the coherent sources. To enhance the estimation accuracy, the space smoothing methods in [29] is adjusted and extended to 3D dimension: azimuth, elevation and subcarrier.
The conventional one dimension spatial smoothing methods divides, for example, a M element ULA antenna array into overlapping P sub arrays. The total array number is M − P + 1; the two adjacent sub array has a constant phase difference. By using the similar strategy, the 3D spatial-frequency smoothing method is illustrated in Fig. 6 and Fig. 7 for URA and virtual VA array, respectively. Each square in Fig. 6 and Fig. 7 indicates the channel state information (CSI m1,m2,n ), which means the element of channel information matrix H i,ψ SRS corresponding to antenna element m1, m2 and subcarrier index n. In Fig. 6, each block is a CSI on specific array elements and subcarrier. Three slices from the subcarrier domain are presented in the smoothing example. We use the receiving signal of 7 × 7 URA and 500 subcarrier as example. Thus, the size of H i,ψ SRS in the example is 7×7×500. The smoothing method divides the channel information matrix into three groups along URA vertical, horizontal dimensions, and subcarriers dimension.  Different from the URA structure, the VA has six unique elements, and spatial smoothing along the VA ports is not applicable. Thus, the 3D spatial smoothing is implemented along VLA and subcarrier dimensions. We use the example of 7-element VA-VLA and 500 subcarriers for downlink. With the increasing of group index from 1 to 3, the subgroup shifts both virtual array and subcarrier dimensions. The size of estimated channel matrixĤ

D. 5G SIGNAL BASED IMAGING
Inspired by the multiple location observation (or sampling) mechanism in the SAR system, we proposed the timespace VLA structure in Section II-B for downlink UE self-localization in the 5G network. In the SAR concept, the multiple location samples of reflected illuminating pulses are used for constructing images. In this work, we can also treat the uplink SRS signal as known pulses and utilize the echos of SRS signal from the area of interest to perform imaging function. The similar idea can be found in the recent published work on the simultaneous imaging and uplink communications [41]. As the Fig. 8 demonstrates, if the aircraft flies over the airport following a straight route in the horizontal plain with a steady speed v (zero speed on the vertical direction). The SRS signal is emitted from the aircraft at different locations, and echoes reflected from the ground targets in the area of interest. With the sampled scattered SRS signals, the imaging function is achieved by estimating delay g(τ ) SRS and slow time signal phase shift C(v) in Eq. (7) and (36). Here, we need to clarify an important prerequisite when using the continuous 5G radio bursts for imaging purpose. In the continuous transmitting system, the echo signals will be very likely to be submerged in new signals in the RF port, while the pulse based SAR system is free from the self-interference. Thus, strong selfinterference cancellation on the UE need to be assumed in order to perform the SAR imaging on 5G UE. 4 C(v) = 1, e −2jπ ψ 2 T sym 2v/λ , . . . , e −2jπ ψ ψ T sym 2v/λ * Instead of using matched filtering, we use channel estimation on the receiving SRS echos to the channel data vectorĤ ψ SRS ∈ C 1×N , it is used as fast time sample in the imaging processing. As the AoA information is not needed for imaging function, angle manifold is left out in Eq. (37) and (38). Assume the aircraft sends in total SRS symbols to illuminate an area. The total channel information cubes H SRS ∈ C ×N of all the symbols during this period can be written as the Eq. (38) [44]. The dimension of H SRS along the symbol index is usually called slow time samples. Here, we consider a long range (far field) imaging situation where the distance between aircraft and ground targets is much longer than the flight route (r >> u). The output of Eq. (40) contains the down range r and Doppler frequency f , which are calculated by Fourier transform on fast time and slow time domains. F S ∈ C × and F N denote the slow time and fast time processing, respectively.
According the recent works of the in-band self-cancellation [42], [43], 105 ∼ 110 dB is an achievable self-interference suppression level which indicates that in-band residue is very close to the receiver sensitivity (noise floor) if 0 dBm power emission is set on the transmitting path. Thus, the current technique will be able to support the sampling the reflected SRS for SAR imaging.
The Doppler shift f is further used in Eq. (41) to calculate the cross range r c , where F and F H N denotes the points discrete Fourier transform (DFT) operation and N points inverse DFT (iDFT) operation. It is worth to clarify that any uplink signal sending from the UE to the BS has the potential to be exploited for imaging propose by following the processing from Eq. (37) to (40). However, the performance of reference signal based result may benefiting the higher auto-correlation property.

IV. PERFORMANCE ANALYSIS
In this section, we first show the comparison of ToA estimations with/without extracting the reference signal according to the allocation patterns. Then, the AoA estimation performance is evaluated with affect from coherent interference and corresponding mitigation strategies: spatial smoothing (for downlink) and VLA (for upink). After combining the smoothing, VLA and orthogonality, the target position estimation results by using 5G SRS and PRS signals are provided in Section III-A together with the CRLB. At last, the ground imaging capability by using uplink SRS is demonstrated.

A. MULTIPLE UES DIFFERENTIATING
After solving the downlink AoA estimation problem with VA-VLA, we are still facing the ToA resolution limitations with the presence of multiple sources in the uplink scenario. As the SRS signal has a swift arrangement and the allocated bandwidth to reference signal is less than the total 5G channel bandwidth, there is a demand to achieve high accurate ToA estimation function with a relatively narrower bandwidth [24]. The orthogonality of SRS signals' allocation pattern enable us to extract SRS from every UE and estimate UE's TOA. As shown in Fig. 9 and 10, two UEs are sending SRS signals to the BS with range equal to 3 m and 6 m respectively. The total bandwidth allocated to SRS signal is 15 MHz. Firstly, source ToA without extracting SRS is estimated, the "joint detected results" shows one peak in between of two red marks (ground truth). Then, estimation method is applied separately on the extracted SRS signals. The peaks of two curves exactly locate at the ground truth. We also show the ToA estimation performance of signal bandwidth up to 120 MHz in Fig. 10. Clearly, ToA estimation peaks of two targets are distinguishable by using extracted SRS signals with 15 MHz bandwidth. This further ease the bandwidth requirement for ToA estimation.

B. VIRTUAL LINEAR VA ARRAY FOR ENHANCED DOWNLINK AOA ESTIMATION
In the donwlink angle estimation with PRS signal and VA antenna, the AoA estimation of VA degrades with the presence of coherent paths [31]. The simulation results in this section shows the angle resolution improvement brought by spatial samples of virtual array when the UE is moving. The virtual array element orientation follows target's moving direction. We set one LoS path and one NLoS path (reflection) with the power equal to 0 dBW and −3 dBW in this simulation. The azimuth and elevations angles [φ, θ ] of two LoS and NLoS are [40 • , 50 • ] and [80 • , 120 • ], respectively. If the VA or VLA are applied individually, 2D MUSIC spectrum are shown as a) and b) in Fig. 11. In the VA only case, neither the LoS path nor NLoS path can be detected. In stead, a wide highlighted spot appears. This indicates the receiving signal is interfered by the coherent source. As the spatial smoothing is capable for separating the coherent sources, we apply the virtual array strategy to VA. However, the conventional VLA is only for one dimension angle estimation. Taking advantage of the 2D direction identification capability of VA, the VA-VLA is able to estimate both azimuth and elevation angle. As can be seen from b) of Fig. 11, when the isotropic antenna is used in the VLA, only round curves are shown up. The spectrum is symmetric about the line with azimuth angle equals to π , since the linear array factor is symmetric with its element orientation. After replacing the isotropic antenna with VA in the VLA, the MUSIC spectrum of Fig. 11 c) shows two narrow ripples with highlight spots in the middle; The highlight spots fall in the correct azimuth and elevation angles of LoS and NLoS paths. The results prove the AoA estimation enhancement with VA based VLA structure.
Another benefit of using VA for angle estimation can be seen in Fig. 12. In the case a) and b) of Fig. 12, the isotropic elements are used in the VLA. From the azimuth-elevation angle estimation plot, we can see that this configuration is not able the resolve the angles. After applying the VA in the VLA, clear highlighted estimation can be observed on the correct angles. In addition, with the increasing of the element spacing (> λ 2 ), the mirror image vagueness effects [45] of VA-VLA is much less than the normal isotropic-VLA.

C. UPLINK AND DOWNLINK LOCALIZATION ACCURACY
In this section, the 3D UE positioning function is achieved by jointly estimate time and delay estimation of uplink and downlink scenarios. As we defined in Table 2, the BS estimates one UE's location via SRS, and UE is estimate AoA and ToA of incoming PRS for calculating its position relative to the BS. One aircraft equipped a single VA is treated as UE and it is landing on the runway with the speed v. The subspace method is used to estimate the ToA and AoA on both uplink (SRS) and downlink (PRS) cases. The Fig. 13 shows the simulated localization accuracy (solid lines) in term of root mean squire error (RMSE) together with the CRLB (dash lines) of the uplink (blue) and downlink (red) scenarios. As the estimation performance of MUSIC algorithm is bounded by the minimum anlge and time searching step size in Eq. (24). We plot the localization limit with the black line in Fig. 13 by using τ = 5 ns as delay searching step sizes and θ = 0.1 • as angle searching step size. The MUSIC estimation limit is calculated by the euclidean metric (as Eq. (42) shown) of two MUSIC adjacent searching points p1(x 1 , y 1 , z 1 ) and p2(x 2 , y 2 , z 2 ), which follows the steps shown from Eq. (43) to Eq. (47).
p1(x 1 , y 1 , z 1 ) = r 1 [cos(φ 1 ) sin(θ 1 ), sin(φ 1 ) sin(θ 1 ), cos(θ 1 )], (43) p2(x 2 , y 2 , z 2 ) = r 2 [cos(φ 2 ) sin(θ 2 ), sin(φ 2 ) sin(θ 2 ), cos(θ 2 )], where c is the speed light. In the Fig. 13, the SRS and PRS based localization RMSEs converges to 1.79 m and 1.1 m  respectively. The gap between the localization RMSE curves and MUSIC performance bound is caused by the airplane mobility. The time used for collecting 20 sanpshots causes the discrepancy between estimated and the actual locations. Moreover, the longer observation time for forming the virtual array results performance drop of SRS base estimation comparing with the PSR based estimation. The two dash lines in the Fig. 13 show the CRLBs of SRS and PRS based localization accuracy without considering the mobility. We can observe the a constant gap between the uplink and downlink RMSE performances, which indicates the dimension reduction caused by the spatial smoothing has less impact on the VA virtual array.

D. IMAGING WITH UPLINK SRS IN 5G NETWORKS
The SRS signal sent from UEs can be scattered by the objects on the ground. The scattered SRS signals create opportunity of a 5G signal based imaging function. As the reference signal allocation pattern is known by the UE, we assume a flight is flying horizontally close to the airport and transmitting the SRS with a fixed repetition time. The bandwidth of SRS is 15 MHz and 200 slots, (one SRS symbol per slot), are observed. The speed of flight is set as 60 m/s and the SRS symbol is sending one time per slot. Then, the flight collects reflected echos from the ground to generate an image of local area. The received SRS echos are extracted according to its allocation pattern and channel estimation is implemented to form the information cube [44]. Then we implement the Inverse Fourier transform of fast time samples and Fourier transform along slow time dimension to calculate the delays and Doppler shifts of echoes. The example is provided in Fig. 14. Three buildings with the down ranges r equal to [1000, 1025, 1050] m and cross ranges r c equal to [0, 6.9, 34] m. The example shows the imaging potential by using 5G SRS signal, which can a complementary information for airport surveillance for the locations achieved from the time and delay estimations.

V. CONCLUSION
In this work, we prove that the applying of the joint spatialtime subspace estimation algorithm on uplink SRS and downlink PRS signals enables the UE localization function in the 5G/6G network. For both scenarios, the smoothing mechanism helps to counteract the impact of coherent multipaths. The novel design of virtual linear VA array overcomes the impact of coherent reflections on VA and extend the linear antenna array capability to azimuth and elevation dimensions, and further enables high angle estimation resolution in a 3D space. We also address the multiple UEs localizing problem by taking advantage of the orthogonality between SRS signals of UEs, reduce the required bandwidth for time delay estimation. Moreover, the uplink SRS signal is further utilised for the imaging purpose and the simulation result demonstrates the imaging of the point targets of interest from an aircraft UE. In terms of system design recommendation, a downlink configuration with virtual linear VA arrays is recommended for an increased positioning accuracy and a VA-VLA uplink configuration is recommended for sensing the environment. Such solutions can complement the existing air traffic management solutions by offering additional robustness and fall-back mechanisms when current solutions are lagging, such as under low-visibility conditions or heavy obstacles in airport areas. We have following future works in pipeline: i) the ray-tracing method in the 3D Muret airport model will be used to simulate to realistic channel propagation for validating the performance of the localization and imaging algorithms; ii) Comparing the SRS (OFDM modulated) based imaging performance with the traditional linear frequency modulation (LFM) signal based results, particularly for the target with higher Doppler; iii) Investigate the localization and imaging performance with more diverse simulation settings which include high mobility targets, different allocation patterns of reference signals, multiple targets with different level of coherence.

APPENDIX A SRS AND PRS MAPPING STRATEGY
In the main context, we defined the frequency domain reference signal sequences X SRS and X PRS . The sequence entries of SRS and PRS are allocated into the PRU predefined by the standards. The detailed time and frequency domain indices for on specific sequence entry are expended as eq. (48) and (49). To avoid the misunderstanding, the parameters in eq. (48) and (49) are strictly follow the 3GPP standards [24]. k and l represent the subcarrier (frequency) index and symbol (time) index of SRS entries. Where β SRS is used for controlling signal power and N ap is the logic antenna port number defined in the standard. N ap = 1 in this paper. The value of k starts from 0 to M rs sc,b . M rs sc,b (refer to N in Table 1) is the maximum subcarrier number of SRS signal and valued at m SRS * 12/K TC . The symbol index l is ranging from the first SRS symbol to the (N SRS symb − 1) th symbols. Total N SRS symb symbols are allocated with the reference of start location l 0 . The k, l and β also stand for the subcarrier, time indices and power controlling in PRS case. Symbol location and length are determined by l PRS start and L PRS . The subcarrier index k of PRS is selected from the [24, Table 7.4.1.7.3-1 ] according to the symbol index l. That is the reason why the PRS subcarrier index is varying with symbol number but SRS is the same. In a PRS k,l = β PRS X SRS k , l , k = k K PRS comb + k offset comb + k mod K PRS comb , l = l PRS start , l PRS start + 1, . . . , l PRS start + L PRS − 1. (49) In this appendix, we only show the principle of SRS and PRS generation. The detailed step-by-step calculation can be found in page 85 for SRS and pages 114 ∼ 115 for PRS in [24]. BO TAN (Member, IEEE) received the B.Sc. and M.Sc. degrees in communications engineering from the Beijing University of Posts and Telecommunications in 2004 and 2008, respectively, and the Ph.D. degree from the Institute for Digital Communications, The University of Edinburgh, U.K., in November 2013. From 2012 to 2016, he was Postdoctoral Fellow with University College London and the University of Bristol, contributed to passive radar, pervasive sensing, and phased array radar for indoor robotic. He was a Lecturer of Electronics Engineering with Coventry University from 2017 and 2018. Since 2019, he has been a Tenure Track Assistant Professor with Tampere University, Finland. His current research includes radio signal processing for wireless communications and radar system, integration of radio connectivity and sensing for intelligent machines. He is the Coordinator and the PI of the H2020, Academy of Finland, Business Finland projects on deep-learning-enhanced optic and radio networks, mmWaveenabled drone swarm, data security and privacy preserving in the distributed machine learning system, system-on-chip solution for positioning, sensing, and security in 5G system, and 5G-based airport surveillance. He is an active reviewer of multiple IEEE and IET journals in radar, communications, wireless networks, and machine learning.