A Multichannel Approach and Testbed for Centimeter-Level WiFi Ranging

Latest advancements in WiFi ranging enable the use of both timestamps and channel frequency response (CFR) measurements supporting the recently released IEEE 802.11az Next Generation Positioning standard. However, resolution limitations are imposed by the single-channel bandwidth of operation, and WiFi devices that can only operate using 20 MHz channels on a given time instance suffer from limited ranging capabilities. While devices can frequency hop to multiple channels to obtain CFR measurements across larger bandwidths, changes in local oscillator phase offsets and time offsets per channel prevent direct stitching of the CFR. To overcome these challenges and achieve phase-coherent multichannel (PCMC) CFR measurements, we propose a two-way CFR approach that embeds timestamp information in the phase. We develop a software-defined radio testbed to evaluate our proposed multichannel ranging technique and answer hardware implementation challenges. For range estimation, we employ multiple signal classification and a complexity reduction strategy to accommodate large bandwidths with many subcarriers. Utilizing our proposed PCMC technique with 16 channels, we demonstrate a median error of 2.7 cm and a 90th percentile error of 9.5 cm in indoor line-of-sight conditions.


I. INTRODUCTION
D EMAND for localization solutions has increased in recent years for emerging Internet of Things (IoTs) applications, including security, surveillance, asset tracking, and locationbased services [1], [2].These applications seek high-accuracy localization with low-cost implementations.To meet these requirements, many solutions have been proposed based on common wireless infrastructure, including ultrawideband (UWB), Bluetooth low energy (BLE), and WiFi.WiFi's ubiquity and existing anchors deployed in the form of access points (APs) offer a cost-effective and attractive solution, and proposed indoor and IoT localization schemes have been primarily based on WiFi [3].This work focuses on the specific problem of direct ranging between two devices which is suitable for proximity detection or scenarios with only a single AP available.Moreover, range estimates between devices can serve as building blocks for localization by trilateration using three or more APs.Among the fundamental localization techniques based on received signal strength indicator (RSSI), channel state information (CSI) patterns, time of flight (ToF), direction of arrival (DoA), or time difference of arrival (TDoA), only those based on RSSI or ToF are capable of direct ranging between devices.Due to the low accuracy of ranging with RSSI measurements, interest has primarily been on ToF-based techniques for direct WiFi ranging [4], [5], [6].
To accurately estimate ToF, precise subnanosecond time synchronization is necessary, and two-way timestamp measurements are commonly used supporting standardized WiFi fine time measurement (FTM) [5].However, the fundamental limitation of this technique is the bandwidth utilized as sample spacing in time directly determines timestamp resolution.For example, a 20-MHz bandwidth results in a c 2W = 7.5 m expected ranging resolution where c is the speed of light and W is the bandwidth.To increase accuracy beyond sample-level timestamp limitations, channel frequency response (CFR) measurements consisting of magnitude and phase information can be used [7], and the most recent extension of standardized WiFi ranging, referred to as Next Generation Positioning (NGP), has included the ability to obtain two-way CFR measurements through null data packet (NDP) exchanges [8].While incorporating CFR measurements extends ranging capabilities to subsample resolution, challenges remain to be addressed.Specifically, ToF-based ranging is a bandwidth-limited problem, and devices may be unable to operate on a high single-channel bandwidth.In these cases, obtaining ranging performance associated with high bandwidths, such as 40, 80, or 160 MHz, may only be possible by channel hopping across multiple 20 MHz channels.However, these multichannel measurements suffer from local oscillator (LO) phase offsets and time offsets per channel that impede phase-coherent stitching, and noncoherent combining of these multichannel CFR measurements does not provide a significant accuracy improvement [9].Thus, there is a desire for methods that enable coherent stitching of multichannel CFR measurements.Moreover, CFR measurements suffer from hardware impairments, including symbol time offset (STO), self-time-offset (SFTO), hardware delays, and nonlinear filtering effects, which require mitigation techniques to fully leverage multichannel CFR information for ranging [10].
As new methods for ranging are emerging in WiFi standards [5], [8], it is essential to evaluate their performance capabilities in real-world environments [11].However, compatibility with emerging WiFi ranging methods is not immediately available in most off-the-shelf devices, and customization is limited among devices that are available.For these reasons, we adopt software-defined radios (SDRs), which offer timing and waveform customization on an IQ sample level.
The contributions of this article can be outlined as follows.
1) We propose a phase-coherent multichannel (PCMC) stitching method to improve ranging performance for devices with low single-channel bandwidth capabilities.This PCMC method simplifies the multichannel range estimation problem to enable the use of well-studied phase parameter estimators, including super-resolution algorithms to be applied for high-resolution range estimation [9], [12], [13], [14], [15], [16], [17].2) We develop an SDR-based WiFi ranging testbed that enables NGP prototyping, and we answer implementation challenges of our proposed PCMC approach in hardware.Time synchronization impairments, time offsets, hardware delays, LO phase offsets, and nonlinear filter effects are investigated with proposed solutions based on one-time calibration measurements.3) We collect a large dataset of real-world indoor measurements to evaluate the accuracy and complexity of our proposed PCMC ranging technique.Evaluations are made using the multiple signal classification (MUSIC) algorithm [9], [14] with a proposed complexity reduction approach.Accuracy comparisons are made to existing state-of-the-art WiFi-based ranging methods.Using single snapshots from the collected measurements, we demonstrate centimeter-level accuracy in line-of-sight (LOS) conditions and decimeter-level accuracy in nonline-of-sight (NLOS) conditions.The rest of this article is organized as follows.In Section II, we discuss related works with an emphasis on ranging techniques.Section III outlines the system model to obtain a two-way PCMC CFR from timestamps and one-way CFR measurements.In Section IV, we cover system model assumptions, hardware implementation challenges, and our proposed solutions.Section V describes our reduced-complexity MUSIC-based algorithm for ToF estimation.Section VI details our developed WiFi ranging testbed.In Section VII, we define our methods and setup for our collected real-world measurements.In Section VIII, we evaluate the computational complexity and accuracy of our proposed PCMC techniques.Finally, Section IX concludes this article II.RELATED WORKS Localization using WiFi and other common wireless infrastructure has been a high-interest research problem in recent years with comprehensive surveys available in [1], [2], [3], [18], [19], [20], and [21].Approaches can be subdivided among data-driven and model-based methods with the former utilizing RSSI or CSI patterns in space and the latter relying on measurements of RSSI, ToF, DoA, or TDoA.Data-driven techniques use a pattern matching approach to localize with fingerprinting or machine learning [19], [20].On the other hand, model-based approaches are developed from the physics of the problem and statistical assumptions without prior data.

A. Data-Driven Methods
Localization with WiFi fingerprinting was first proposed in [22] in which the K-nearest-neighbors algorithm is used with prior RSSI measurements taken in a grid pattern.Kalman filters are applied for enhanced RSSI-based location estimation in [23].Later, in [24], a probabilistic RSSI-based method is proposed using a Bayesian approach with notable decimeter-level accuracy.In [25], both CSI magnitude and phase information are used to create fingerprints.A sanitization algorithm is employed for the CSI phase along with clustering to estimate the location.Recent fingerprinting approaches have proposed a time-reversal method based on two-way channel impulse response (CIR) measurements, or equivalently, the squared CFR magnitude [26], [27], [28].These time-reversal fingerprinting methods have demonstrated centimeter-level accuracy in the areas where they have been deployed.Machine learning approaches include those based on support vector machines [29], [30], feedforward neural networks [31], multilayer perceptrons [32], multilayer neural networks [33], convolutional neural networks [34], and recurrent neural networks [35].Due to their pattern matching foundation, data-driven methods do well in NLOS conditions where model-based approaches struggle.However, they require many measurements over time at inference to reduce ambiguities, rely on time-consuming data collection, and are susceptible to changes in the environment in which they are deployed [36].

B. Model-Based Methods
Model-based methods do not require many measurements for estimation and do not rely on prior data taken in the environment in which they are deployed.These low data acquisition costs and ease of setup make model-based approaches appealing solutions to IoT localization demands despite their challenges in NLOS conditions [4].DoA-based methods enable device localization using multiple anchors and triangulation [37], [38], [39].Similarly, TDoA-based solutions use multiple time-synchronized anchors to localize a target through time of arrival (ToA) measurements and geometric relations [40], [41], [42], [43].While these techniques are capable of decimeter-level localization accuracy, they are not suitable for direct ranging due to the necessity of multiple anchors to localize.In terms of methods that enable direct ranging between devices, RSSI-based solutions may seem appealing due to the ubiquity of RSSI and consequent ease of Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.
implementation.However, they perform with meter-level accuracy at best in multipath environments due to small-scale fading, which introduces discrepancies between RSSI measurements and the expected propagation model [4], [44].
ToF-based methods utilize the physical relationship between signal ToF, τ , propagation speed c, and distance r as r = τ × c, where c is the speed of light in free space.To employ ToF estimation techniques, methods typically take two-way measurements to eliminate the need for precise time synchronization between devices [21].These two-way measurements can come in the form of timestamps of ToA and time of departure (ToD) or CFR, which contains ToF information in the phase.
Among the first to localize using ToF estimation is the proposed method in [45] in which two-way timestamps are used to measure the round trip ToF for range estimation.Multiple channels and CFR measurements are used to enable enhanced ToF estimation in [46].Their method takes only the center subcarrier of the two-way CFR across 35 WiFi channels in the 2.4 and 5 GHz bands.ToF is estimated with an inverse nonuniform discrete Fourier transform (INDFT) and demonstrated accuracy is decimeter level.Moreover, they show a low impact on network traffic using a multichannel approach and the ability of the two-way CFR to mitigate carrier frequency offset impairments.In [10], the proposed system uses all CFR subcarriers of a single 20 MHz channel to estimate ToF.After mitigating sources of error through their CFR calibrations, they use the MUSIC algorithm and demonstrate decimeter-level accuracy.The work in [47] evaluates the performance capabilities of multichannel CFR-based ranging across a 320-MHz bandwidth and shows the possibility of centimeter-level accuracy through measurements using a vector network analyzer, which self-calibrates and selfsynchronizes in time and frequency.None of these prior works propose solutions to SFTO and changing STO impairments in the context of multichannel ranging.Our work assumes no external time or frequency synchronization between devices and offers solutions to hardware implementation challenges while achieving centimeter-level ranging accuracy in real-world environments.
Several works have investigated standardized FTM-based ranging, which uses two-way timestamps to estimate ToF [5].In [6], [11], and [48], FTM performance is evaluated through measurements.In [49], one-way CFR information and MUSIC are used to correct FTM measurements.In [50], DoA information is used with FTM measurements for localization.Works that investigate NGP are limited thus far [51], [52], [53] with the only accuracy evaluations being in simulation.We are not aware of any work that investigates the performance capabilities of NGP in real-world measurement scenarios along with associated hardware implementation challenges.

III. SYSTEM MODEL
This section outlines the mathematical model for two-way timestamp and CFR measurements and our proposed PCMC stitching method.Between two transceiver devices, labeled initiator and reflector, two-way timestamp and CFR measurements are taken to measure integer delay and fractional delay, respectively.Integer delay can be described as where τ ID is the equivalent ToF measured by the timestamps.
The timestamps are all measured sequentially in seconds with t 1 and t 3 measuring ToD using each device's local clock and t 2 and t 4 measuring ToA using measured CIR obtained by crosscorrelation between the received packet and a known part of the packet preamble.CFR measurements are obtained by taking the fast Fourier transform (FFT) of a packet preamble's long training field (LTF) based on the timestamps t s 2 and t s 4 , respectively, where the superscript s denotes that these are the equivalent integer sample indices of t 2 and t 4 .Due to Fourier transform properties and the physical total ToF delay being a continuous value, delay not observed in the integer delay appears in the phase of the CFR as fractional delay, enabling subsample resolution for ToF estimation.The one-way CFR phase from initiator to reflector for a single path channel can be expressed as where k = −K/2, . . ., K/2 − 1 is the CFR subcarrier index across K subcarriers on a single WiFi channel, f k is the kth subcarrier frequency, τ is the observed fractional delay, Δ t is the time offset between devices, and φ is the phase offset between initiator and reflector LOs [54], [55].Similarly, the CFR phase measured from reflector to initiator can be expressed as Summing the phases of the one-way CFR measurements across frequency indices k, time offset and LO phase offset impairments cancel, and the resulting two-way CFR phase can be expressed as where τ F = (τ )/2.Using both integer delay from timestamps and fractional delay from CFR, the total ToF is expressed as The timeline of timestamp and CFR measurements is displayed in Fig. 1 across channels denoted by index b.We note that reflector delays T r and channel hopping delays T hop are also present in the timeline of measurements, and it can be shown that if these delays are too long, they can cause noticeable additional time offsets [55].
In practice, integer delay measurements may not be consistent across multiple channels due to frequency-dependence of CIR measurements, finite channel coherence time, and noise, resulting in changing STO and integer delay ambiguities.Fig. 2 demonstrates different possibilities for integer delays and the corresponding fractional delay observed in the CFR due to Fourier transform properties.Using two-way timestamp measurements, this integer delay ambiguity can be eliminated by  embedding the integer delay in the two-way CFR phase as where Δ f is the constant subcarrier frequency spacing.This embedding shifts the integer delay to zero and always results in case 3, as shown in Fig. 2, where the total delay equals the observed fractional delay.Extending this model to include challenges posed by wireless propagation, i.e., multipath conditions and noise, the observed one-way CFR from initiator to reflector can be described as and from reflector to initiator, the one-way CFR can be expressed as where M is the number of one-way multipath components (MPCs), a m is the complex amplitude of the mth MPC, τ are additive white Gaussian noise terms for the kth subcarrier measurement.Aside from hardware impairments, the CFR is identical in either direction between initiator and reflector due to channel reciprocity [56].The two-way CFR with the integer delay embedding described by ( 6) is then expressed as where M 2W is the number of two-way MPCs, ãm is the complex amplitude of the mth two-way MPC, τm is the two-way ToF of the mth MPC, and ñk is the two-way noise term of the kth frequency channel, which includes the squared and cross terms of the one-way noise [30].The number of two-way MPCs is a function of the number of one-way MPCs as M 2W = 2M − 1 due to squaring of the one-way CFR, and the one-way LOS ToF is related to the two-way LOS ToF as τ 1 = τ1 /2, where the subscript 1 indicates the LOS MPC with lowest delay.From the LOS one-way ToF, distance between devices can be obtained as r = τ 1 × c, where c is the propagation speed, i.e., the speed of light in free space.Thus far, the system model has described single-channel CFR measurements.After mitigating integer delay ambiguities, LO phase offsets, and time offsets, the two-way CFR measurements per channel described by ( 9) can be stitched together coherently in phase.The stitching process involves the following three steps.
1) Average any overlapping CFR measurements from different channels taken on the same subcarrier frequencies.2) Concatenate CFR measurements of adjacent channels to form a vector.3) Interpolate to fill small null subcarrier gaps within the measured CFR, between adjacent channels, and across the dc subcarriers.We use linear interpolation on the CFR magnitude and phase separately for these small gaps.To concretely describe the signal model after stitching, we express the PCMC CFR in a compact matrix form as where and i = 1, . . ., K B describes the uniformly spaced unique subcarrier frequencies after stitching across B channels.Following this signal model, a derivation for the Cramér-Rao lower bound in the case of two MPCs is provided in [57], which demonstrates the relationship of the bound to the ToF spacing between MPCs, signal-to-noise ratio (SNR), bandwidth, and CFR measurement spacing.
The complete method to obtain the PCMC CFR is outlined as Algorithm 1.The two-way CFR with integer delay embedded in the phase is constructed in Lines 1-6.Lines 7-19 show average two-way multichannel CFR measurements on Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.overlapping subcarrier frequencies.Line 20 forms the twoway multichannel CFR vector with null subcarrier gaps, and Line 23 interpolates across null subcarriers.The function interp(x, v, x q ) denotes linear interpolation across the phase and magnitude, where x contains the measurement points, v contains the measurements at the points of x, and x q contains the interpolation query points.

IV. MITIGATION OF HARDWARE IMPAIRMENTS
While the two-way approach described in Section III mitigates changing time offsets and LO phase offsets that impede coherent stitching of the CFR, there are assumptions made that are not expected to hold in practical WiFi hardware.These assumptions are as follows.
1) Zero time offset between each device's own transmitter and receiver, i.e., zero SFTO.
2) Zero time delays in device hardware, i.e., only the signal traveling in free space contributes to observed ToF delay.3) No hardware filtering effects in the magnitude and phase of the CFRs.4) Fixed transmitter and receiver gains across channels.In this section, we relax each of these assumptions and propose mitigation techniques to enable device implementation.

A. Nonzero Self-Time-Offset
In the presence of time offsets and LO phase offsets, the CFR phase at subcarrier k for a single WiFi channel with a single path can be expressed as (12) measured from initiator to reflector and reflector to initiator, respectively [55].Previously used variables in ( 2) and (3) for time offsets Δ t and LO phase offsets φ have been expanded to explicitly denote the transmit T X and receive RX times, T RX , and LO phases, φ RX , for the initiator I and reflector R devices.Since the transmitter and receiver on a device are expected to share a common LO, we assume that (13) and (14) are the LO phase offsets for the reflector and initiator, respectively.While making this assumption, we acknowledge that a device may not use a common LO to enable its transmitter and receiver to lock onto different frequency channels simultaneously, and we provide an alternative mitigation technique in Appendix A for this situation.Taking the two-way CFR phase with (11) and (12), we obtain where T X ) is the remaining SFTO.Assuming the transmitter and receiver on each device share the same internal clock, i.e., the devices are selfsynchronized to meet FTM and NGP prerequisites [8], then T Δ is constant and can be mitigated for each channel by observing and aligning CFR phase measurements with different center frequencies, as demonstrated in Fig. 3(a).

B. Hardware Delays
In addition to the delay due to a signal traveling over the air between antennas, there are delays due to the signal traveling through hardware components, e.g., wires, filters, and amplifiers, in an RF signal chain.These delays can be expressed in the two-way CFR phase as where τ (R) h and τ (I) h are the delays for the reflector and initiator hardware, respectively.Unlike the SFTO that appears at baseband, these hardware delays appear at passband.Measurements of hardware delays need to be taken only once for a specific hardware chain to calibrate.Alternatively, a measurement at a known distance can be taken to estimate the total hardware delay between two devices to calibrate, as demonstrated in Fig. 3(b).

C. Filtering Effects
Two filtering effects appear in each CFR measurement.The first is a low-pass filtering (LPF) effect that appears at baseband and causes nonlinear effects in the magnitude and phase of the measured CFR.The second effect appears in the passband magnitude and is due to the frequency selectivity of RF hardware components.These effects are measurable and constant for a given device.Thus, the measured filter effects in the CFR can be divided out across frequency.Specifically, we can express the calibration as where i = 1, . . ., K B is used to denote subcarrier indices across multichannel measurements, H is used to denote the measured filter response.The effect of the LPF mitigation is demonstrated in Fig. 3(c) for magnitude and Fig. 3(d) for phase using 20 MHz and 160 MHz single-channel CFR measurement bandwidths, respectively.We note that the LPF effect on phase only appears at the highest operation bandwidth of our devices, 160 MHz.Both LPF and hardware frequency selectivity magnitude calibrations are shown in Fig. 3(e) for 20 MHz multichannel CFR measurements.We plot across all measured 20 MHz channels in the 5 GHz band to show the severity of hardware frequency selectivity as bandwidth increases.

D. Changing Transmitter and Receiver Gains
To improve the SNR of received signals, transmitter and receiver gains may adapt and change per channel measurement, causing misalignments of CFR magnitude measurements of different channels.This effect is demonstrated by the uncalibrated case in Fig. 3(f).To realign the magnitude measurements while still benefitting from different gains per channel to improve SNR, we calibrate each one-way CFR as where H The effect of this gain calibration is demonstrated in Fig. 3(f).
While we assume known gains for the SDRs utilized in our testbed, in practice, these gains may not be known, and an estimate may be necessary for the gain shifts across channels.For cases with unknown G T X,b and G RX,b , alternative methods for aligning CFR magnitude measurements of adjacent channels can be based on overlapping CFR measurements from channels available in the 2.4-GHz band or CFR extrapolation using Burg's algorithm for forward and backward autoregressive modeling of the CFR [57], [58].The alignment factor can then be estimated from the least squares solution of G b in where H

V. REDUCED-COMPLEXITY RANGING WITH MUSIC
We employ the MUSIC algorithm for ToF estimation due to its properties as an asymptotically efficient and unbiased estimator and popularity as a super-resolution estimator for signal processing problems of the form in (10) [9], [10], [37], [57], [59], [60], [61].For the subspace decomposition necessary for MUSIC, a sample covariance matrix must be computed.With a low number of snapshots and in the presence of multipath, there will be several highly correlated sources or MPCs that degrade estimation of the covariance matrix.To improve decorrelation of these sources, we employ multiple techniques.Namely, we utilize the covariance smoothing technique [62], [63], spatial combining [9], and our proposed frequency-shift combining.
The low subcarrier spacing of WiFi CFR measurements results in a large sample covariance matrix and high complexity eigendecomposition for MUSIC.To reduce the complexity while maintaining a similar total bandwidth, we combine covariance matrices from shifted and resampled CFR measurements.This proposed frequency shifting, resampling, and combining reduces the total covariance size while using frequency-shifted CFRs to enhance the covariance estimate [9].Specifically, following the matrix model of (10), we first sample the CFR using shifts d = 1, . . ., D s , where D s is the number of shifts.We represent the dth shifted CFR as where Smoothed sample covariance matrices are then obtained as where T is the lth smoothing subarray for the pth antenna pair and dth shifted CFR, the superscript H denotes conjugate transpose, and the superscript T denotes transpose [62], [63].Applying diversity techniques to further improve the decorrelation of sources [9], we combine sample covariances across space using antenna pairs and across shifted frequencies as where P is the number of antenna pairs.Finally, this forward covariance matrix estimate can be enhanced by applying a forward-backward approach expressed as where the superscript * denotes complex conjugate, and J is the N × N reversal matrix [12], [64].The effect of this forwardbackward method is enforcement of the persymmetric property of the true covariance matrix, which is lost when computing the forward covariance matrix estimate in ( 21) and ( 22) [12].This enhanced covariance matrix estimate is subsequently utilized for subspace decomposition as where Q = [q 1 . . .q N ] is the matrix of eigenvectors and Λ = diag(λ 1 , . . ., λ N ) is the diagonal matrix of eigenvalues in descending order.The signal subspace eigenvectors and eigenvalues are denoted as Q s and Λ s , respectively, and the noise subspace eigenvectors and eigenvalues are denoted as Q n and Λ n , respectively.The signal subspace size corresponds to the number of MPCs M 2W , and thus, the noise subspace size is N − M 2W .
Steering vectors for the MUSIC search are constructed as where the set of delays τ m ∈ [τ 1 , τ 2 , . . ., τ J M ] define the delay search window of the computed MUSIC pseudospectrum, and the number of points J M depends on the largest delay expected and resolution of the MUSIC search.The multipath propagation delays are estimated from the peaks of the MUSIC pseudospectrum computed as and the peak with lowest delay τ1 corresponds to the estimated LOS distance as r = τ1 × c.We note that this computation of the MUSIC pseudospectrum weights each noise eigenvector by its corresponding eigenvalue.This weighting has been shown to improve performance for practical situations with an inaccurate estimate of the signal subspace size [9], [65].
Our reduced-complexity MUSIC-based algorithm for PCMC ranging is summarized in Algorithm 2. The function EVD(X) denotes eigendecomposition of input matrix X, and the function findPeaks(Y) denotes the peak finding algorithm which outputs the ToF peak locations [τ 1 , τ2 , . . ., τN pks ] in ascending order for input vector Y.

VI. WIFI RANGING TESTBED
We built a WiFi ranging testbed using two Ettus X310 Universal Software Radio Peripherals (USRPs), one to act as initiator and one to act as reflector, without external time or frequency synchronization.This testbed enables NGP prototyping necessary to evaluate the proposed PCMC ranging techniques and hardware calibrations.The testbed supports measurements on all commonly allocated 2.4 and 5 GHz WiFi channels at the time of writing with single-channel bandwidths of 20, 40, 80, and 160 MHz.Channels on the 6-GHz band are not covered due to hardware limitations of the testbed.A specific list of WiFi channels scanned is available in Appendix B. High efficiency (HE) NDPs are exchanged between devices to obtain CFR measurements with 78.125 KHz subcarrier spacing [8], [66].Key system parameters of our testbed are outlined in Table I, where ADC sampling rate is the analog-to-digital converter sampling rate of the USRP X310.The collection of measurements is conducted through a LabVIEW graphical interface to interact with the USRPs and quickly visualize information.MATLAB scripts are used for digital waveform generation, real-time received packet processing, and saving data for further postprocessing and analysis.

A. Hardware
The high-level hardware setup is summarized in Fig. 4 with a photo of the antenna housing and components in Fig. 5(a).A custom hardware front-end is developed to increase transmit and receive gains and enable self-measurement of the leakage path described in Appendix A. To reduce testbed costs, SP4T switches are employed to enable utilization of the same transmitter and receiver hardware across all antennas.These SP4T switches, the variable attenuators, and the SPDT switches are all controlled through each USRP's general-purpose input/output (GPIO) interface.Wires 8 m in length are utilized to place the antenna housings in different locations without moving the USRPs.The host PC, USRPs, and amplifiers' power supply are placed on a mobile cart to move the measurement setup to different locations.A representative image of the physical setup in an example measurement location is shown in Fig. 5(b).

B. Software
A flowchart of the measurement process is included in Fig. 6 to demonstrate the flow of packet exchanges and data between the USRPs and host PC.For each bandwidth, channel frequency, and antenna pair, a pair of packet transfers, signal detections, Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.and timestamp measurements are conducted.After all antenna pair measurements per channel, the SPDT switches are set to self-measure the leakage channel for purposes described in Appendix A. Data transfers to the host from the USRP FPGAs consist of timestamp measurements and IQ data samples that include the detected packet.After confirming successful packet detection on the host, these data are transferred for subsequent processing through a queue following a producer/consumer architecture, and the host becomes ready to transfer more data from the USRP FPGA with little delay.The consumer loop obtains data from the queue and does any desired processing on the received packet, such as estimating SNR, CFR, and distance for real-time visualizations on the LabVIEW GUI, as shown in Fig. 7. Timestamps and processed data are also saved to files from the processing loop.

C. Timing
Packet detection and timestamp measurements occur in the USRP FPGA processing to enable the reflector to quickly detect a packet and respond to the initiator after a programmed T r = 250 μs delay.A short reflector delay T r ensures that the corresponding added time offset is negligible [55].Transmit and receive triggers are set on an event basis using each USRP's FPGA clock.Timestamps are determined based on the transmission triggers and received packet start indices using the measured CIR.A complete timeline of packet exchanges from the perspectives of the initiator and reflector is shown in Fig. 8. Due to a lack of fine time synchronization between devices, the exact RX trigger and RX end timings on the initiator and reflector are offset and drifting over time relative to the other device.This drift becomes noticeable over milliseconds or seconds, while the packet size is microsecond level.Thus,  feedback and adjustment of the RX trigger and RX end timings are necessary to maintain coarse capture window alignment between devices as measurements are repeated over long periods of time.Measured timestamps are utilized for this feedback after the initialization of the USRPs.

VII. MEASUREMENT CAMPAIGN
Measurements for evaluation are obtained using our developed testbed in four unique indoor environments, namely, across two rooms, i.e., room-to-room, a large indoor open space, a classroom, and a lab room.Measurement maps of each environment are plotted in Fig. 9. Walls and nonmoving furniture are drawn and shaded on each map.For each environment, the initiator antenna housing is placed in a fixed location, while the reflector antenna housing is placed around the area and on different objects, such as mobile carts, chairs, or desks, to accumulate a diverse set of measurements.LOS measurements are taken in all environments without obstructions.NLOS measurements are taken in the room-to-room environment as the measurements with the wall between the rooms or other objects blocking the LOS propagation path between the antennas.
For each location, bandwidth (i.e., 20, 40, 80, and 160 MHz), channel described in Appendix B, and antenna pair in the 4 × 2 configuration, two two-way CFR measurements are taken across an exchange of HE NDPs.Our measurement dataset is comprised of 230 736 two-way CFR measurements with a Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.measurement range of 0.39 to 12.05 m.Our collected dataset with processing code is available in [67].

VIII. EVALUATION
To evaluate the performance of the proposed PCMC ranging techniques, we look at complexity and accuracy using single snapshots.Complexity is assessed in terms of the number of complex multiplications as it varies with the number of frequency shifts and the number of channels.Accuracy of our proposed PCMC approach is compared with the equivalent single-channel NGP case, the noncoherent frequency diversity (NCFD) approach [9], [68], and Chronos INDFT [46].For PCMC, NCFD, and NGP, we use the proposed reducedcomplexity MUSIC-based algorithm.The NCFD approach applies the sample covariance combining technique of [9] across multichannel measurements.For Chronos INDFT implementation and parameters, we follow the insights in [69].In addition, PCMC accuracy evaluations are made with different numbers of channels, numbers of antenna pairs, and LOS/NLOS conditions.Finally, we evaluate the effectiveness of the proposed solutions to hardware impairments.
Parameters specified for the reduced-complexity MUSICbased ranging algorithm are the number of frequency shifts for covariance matrix estimation, smoothing subarray size, estimated number of MPCs to determine signal subspace size, and the number of MUSIC search points.The number of frequency shifts is fixed per bandwidth and subcarrier spacing based on empirical evaluations in indoor environments.The smoothing subarray size for all cases is set as N ≈ K D s /2 following insights from [63], [70], and preliminary evaluations.The number of MPCs specified is scaled with bandwidth as higher resolution estimation of the MPC ToFs is possible with higher bandwidths [57].Finally, the number of search points for MUSIC is fixed at J M = 751 with a 2-cm resolution for complexity evaluations since a centimeter-level resolution is often sufficient in practice.However, for accuracy evaluations, we use J M = 75001 with a 0.2-mm resolution to obtain smoother cumulative distribution function (CDF) statistics.

A. Complexity Evaluation
To evaluate the ToF estimation complexity following the reduced-complexity MUSIC-based algorithm described in Section V, we look at the number of complex multiplications as it varies with the number of frequency shifts D s .The complexity of MUSIC in terms of the number of complex multiplications can be expressed as The first term includes the number of complex multiplications to calculate the covariance matrix by ( 21) and ( 22) using the reduced-complexity method described in [30].The second term is the approximate number of complex multiplications necessary for eigendecomposition [71].Finally, the third term is the number of complex multiplications necessary for calculating the MUSIC pseudospectrum by (26).MUSIC algorithm complexity, as it varies with the number of frequency shifts D s , is plotted in Fig. 10(a) for NGP and the proposed PCMC method.The number of 20 MHz channels measured is denoted by B, and the B = 1 case is NGP.In Fig. 10(b), the corresponding root-mean-square error (RMSE) is plotted using all measurements taken in LOS conditions.From the complexity analysis and observed RMSEs, we confirm the potential for significant complexity reduction with minimal performance loss using our frequency-shifting approach, especially as the total bandwidth is increased.However, we note that the CFR measurement resolution is decreased due to resampling in (20), and this can cause sharp changes in the CFR to be missed in multipath conditions [72].As a result, we observe limitations to increasing D s .Based on these observations in indoor environments, we set D s = {8, 12, 16, 20, 28} for B = {1, 2, 4, 8, 16} for subsequent evaluations.These settings for D s enable more than three orders of magnitude complexity reduction for the B = 16 multichannel stitch.In addition, our choices of B are to emulate the cases with 20, 40, 80, 160, and 320 MHz single-channel bandwidths subdivided across 20 MHz channels.

B. Accuracy Evaluation
For our first evaluation, we take measurements through wires to remove all multipath sources and leave only impairments due to the hardware imperfections and noise.Error CDF, mean error, absolute error CDF, and RMSE results are plotted in Fig. 11(a) and (d) for all wired measurements using various wire lengths.Comparisons are made between our proposed PCMC method with B = 4 and B = 16 20 MHz channel measurements, NCFD with B = 16, NGP with a 20 MHz channel, and Chronos, which uses an INDFT method across all available 2.4 and 5 GHz channels (B = 42) [46].From these wired measurement results, we observe that all methods can obtain centimeter-level accuracy in the absence of multipath conditions.Moreover, this demonstrates the maximum expected accuracy of our testbed after employing the hardware impairment mitigation techniques described in Section IV.
Changing the multipath conditions, we evaluate the accuracy of our proposed PCMC approach across the different indoor locations described by Fig. 9. Error CDF, mean error, absolute error CDF, and RMSE results using our proposed PCMC approach, NCFD, NGP, and Chronos INDFT are plotted in Fig. 11(b) and (e) for all measurements taken in LOS conditions.From the results, we observe that Chronos INDFT ranging has many high error cases in the indoor multipath environments evaluated, whereas the MUSIC-based methods are more robust despite their lower total bandwidths.Using our PCMC method, we obtain median errors of 2.7 and 15.0 cm for B = 16 and B = 4, respectively, while the NGP case obtains a median error of 82.8 cm using the same 20 MHz device bandwidth constraint.Furthermore, our PCMC method with B = 16 obtains a 90th percentile error of 9.5 cm and a maximum error of 24.5 cm, demonstrating a high level of robustness in indoor LOS conditions.
We next evaluate the accuracy of our proposed PCMC approach in more challenging indoor NLOS conditions.These NLOS conditions are observed in the room-to-room environment of Fig. 9(a) and consist of measurements through cabinets, desks, and the wall separating the rooms.In Fig. 11(c) and (f), we plot error CDF, mean error, absolute error CDF, and RMSE results using our proposed PCMC approach, NCFD, NGP, and Chronos INDFT.From the error CDF and mean error results, we observe higher errors and positive bias for the NLOS case as expected [73], [74], [75], [76].However, despite the challenging NLOS conditions, our proposed PCMC approach remains robust with few high outlier errors, especially for the case with B = 16.The observed median error for the PCMC approach with B = 16 is 82.7 cm, demonstrating the ability of the proposed multichannel method to perform at a decimeter level even in difficult indoor NLOS conditions.
Thus far, evaluations have assumed all eight antenna pairs to be used from the 4 × 2 configuration.Next, we evaluate the performance as it varies with the number of antenna pairs.Increasing the number of antenna pairs allows for more spatial diversity and improved covariance estimation for MUSIC [9].However, increased costs come with including more antennas on a device.Thus, evaluating the ranging performance of our PCMC method with the number of antenna pairs is of high interest.We look at cases with P = 1, P = 2, P = 4, and P = 8 antenna pairs divided up from the full 4 × 2 antenna configuration.Absolute error CDF and RMSE results are shown in Fig. 12 for the PCMC method with B = 16 channels using all LOS measurements.From the results, we observe consistent improvement in accuracy as the number of antenna pairs is increased.The accuracy improves from decimeter-level RMSE at 40.1 cm with P = 1 antenna pair to centimeter-level RMSE at 5.2 cm with P = 8 antenna pairs.The median error with P = 1 antenna pair is centimeter-level at 4.8 cm and decreases to 2.7 cm at P = 8 antenna pairs.
We next compare the proposed PCMC approach to the equivalent NGP single-channel measurements using 40, 80, and 160 MHz total bandwidths.Here, 20 MHz channels are available, and the PCMC stitches utilize the same center frequencies as their single-channel NGP counterparts.Comparisons are plotted in Fig. 13 using all measurements taken in LOS conditions and the full 4 × 2 antenna configuration.From these   comparisons, we conclude that the proposed multichannel stitching method can accurately replicate the equivalent singlechannel two-way CFR measurement on the same bandwidth.Discrepancies between the PCMC stitches and the equivalent NGP single-channel measurements can be attributed to residual hardware impairments, differences in transmit power distribution across subcarriers, and finite channel coherence time.
Evaluations are also made for the effectiveness of the proposed solutions to hardware impairments.While the timing impairments discussed, including integer delay ambiguity, SFTO, and hardware delays, often lead to errors orders of magnitude larger than the true ToF, nonlinear magnitude and phase impairments have more subtle effects and may even be ignored in some cases.Specifically, we evaluate the impact of LPF, hardware frequency selectivity, and changing per-channel gains of the transmitter and receiver.Results for the PCMC stitch with B = 16 20 MHz channels are plotted in Fig. 14 using all measurements taken in LOS conditions and the full 4 × 2 antenna configuration.For this evaluation, we individually look at the cases without LPF magnitude calibrations, without calibrations for frequency selectivity of the hardware components, and without per-channel gain calibration.The gains applied vary from 0 to 8 dB additional gain from the lowest to highest frequency channel.From the results, we observe corresponding reductions in accuracy due to the lack of these magnitude calibrations.We determine the gain calibration to be the most impactful on error, while LPF magnitude calibration is the least impactful on error.We also evaluate calibrations for NGP with a 160-MHz single-channel bandwidth.Comparisons with and without LPF calibrations for this case are plotted in Fig. 15 using all measurements taken in LOS conditions and the full 4 × 2 antenna configuration.From these results, we observe a more significant reduction in accuracy due to the lack of an LPF magnitude calibration compared with the PCMC case with B = 16.This is due to the LPF magnitude effect being more impactful for larger single-channel bandwidths in the SDRs.In addition, we find that the omitting LPF phase calibration has the most significant impact on error compared to other calibrations.

IX. CONCLUSION
To increase ranging resolution for WiFi devices with a low operation bandwidth, we propose a PCMC stitching approach based on two-way timestamp and CFR measurements obtainable with NGP.We design and build an SDR-based WiFi ranging testbed to prototype NGP and establish the ranging performance of our proposed PCMC method.Furthermore, we address hardware challenges for this approach and propose solutions based on one-time calibration measurements.The proposed PCMC technique is evaluated using single-snapshot measurements taken in real-world indoor environments with our developed WiFi ranging testbed.This testbed and collected dataset of two-way timestamp and CFR measurements supporting NGP are the first of their kind to the best of the authors' knowledge.Distance is estimated using our reduced-complexity MUSIC-based algorithm that offers orders of magnitude complexity reduction for large stitched bandwidths with many subcarriers.We compare our PCMC approach using MUSIC to prior works with demonstrated improvements in accuracy.Across all measurements in LOS conditions with 16 multichannel measurements, our PCMC method achieves a median ranging error of 2.7 cm and a 90th percentile error of 9.5 cm.Across all measurements in NLOS conditions with 16 multichannel measurements, our methods obtain a median ranging error of 82.7 cm and 90th percentile error of 177.8 cm.
Toward future WiFi implementations, our PCMC stitching approach is expected to be scalable as large-bandwidth channels Authorized licensed use limited to the terms of the applicable license agreement with IEEE.Restrictions apply.
in the 5 and 6 GHz WiFi bands are subdivided into smallbandwidth channels using a 20-MHz fundamental channel bandwidth.Moreover, while we target low-cost WiFi devices with a 20-MHz operation bandwidth, our formulated PCMC approach is not constrained to a 20-MHz single-channel bandwidth.For future work, we consider approaches to stitch nonadjacent WiFi channels and look toward ranging techniques that improve accuracy in NLOS conditions.

APPENDIX A DIFFERENT TRANSMITTER AND RECEIVER LOS
Due to the requirement of additional hardware, the situation where transmitter and receiver LOs are different is less common in low-cost devices.However, this case appears in the SDRs utilized for our testbed.Thus, we devise a calibration to enable PCMC stitching with the testbed SDRs.Following the model of ( 11) and ( 12), we define the CFR phase for the leakage paths between each device's own transmitter and receiver as where τ l = (τ l )/2 is the remaining total leakage delay.With this full LO phase offset mitigation, the CFR phase of multiple channels can be coherently stitched together.Like the passband hardware delay discussed in Section IV-B, the leakage delay can be mitigated by subtracting the remaining error in ToF estimation using a measurement with a known distance between the initiator and reflector.

APPENDIX B WIFI CHANNEL LIST AND SUBCARRIER ALLOCATIONS
The list below includes all the WiFi channels scanned by the testbed for each bandwidth.Channels are numbered at multiples of 5 MHz within a band [66]

Fig. 1 .
Fig. 1.Timeline of measurements between initiator and reflector.Measurements across different channels are completed sequentially, denoted in the figure by indices b and b + 1.

Fig. 2 .
Fig. 2. Possible integer delays and corresponding fractional delays for a given total ToF τ .The indices that determine possible integer delays are half of the sample period T s due to observing the two-way delay.

F
,m are fractional delays of the mth MPC, and n (IR) k and n (RI) k

Fig. 3 .
Fig. 3. Hardware challenges and calibrations on CFR measurements from our WiFi ranging testbed.All measurements to demonstrate hardware challenges and calibrations are taken through wires except for gain calibrations, which are demonstrated using wireless measurements in the presence of multipath to improve clarity.(a) Observed and calibrated SFTO across six consecutive 20 MHz two-way CFR phase measurements.(b) Observed and calibrated total hardware delay across two consecutive 20 MHz two-way CFR phase measurements.(c) LPF magnitude calibration on a 20-MHz channel.(d) LPF phase calibration on a 160-MHz channel.(e) Magnitude calibrations for LPF effects and hardware frequency selectivity across all measured 5 GHz channels with 20 MHz bandwidth.(f) Calibration of changing gains across CFR measurements of different channels with 20 MHz bandwidth.Overlapping channels are evaluated to emphasize CFR magnitude misalignments.
(cal) i represents the calibrated one-way CFR, H (D) i represents the one-way CFR of either initiator-to-reflector IR or reflector-to-initiator RI measurements, and H (F R) i (cal) b,k is the calibrated one-way CFR, H (D) b,k is the uncalibrated received CFR, G T X,b is the transmitter gain, G RX,b is the receiver gain, and the subscript b indicates the bth channel.
represent the vectors of overlapping CFR measurements from channels b + 1 and b, respectively.

Algorithm 2 :
Reduced-Complexity MUSIC-based Algorithm for PCMC Ranging.

Fig. 4 .Fig. 5 .
Fig. 4. WiFi ranging testbed block diagram.The initiator and reflector employ an identical high-level setup with the only modifications being the transmitter amplifier models used and the number of antennas at each device.The initiator uses four antennas, while the reflector uses two.

Fig. 6 .
Fig. 6.Data collection flowchart with interactions between the USRPs and host PC.The producer loop is completed for each measurement bandwidth, channel frequency, and antenna pair.

Fig. 7 .
Fig. 7. Testbed GUI display of real-time measurements across all antenna pairs of the 4 × 2 configuration on a single 160-MHz channel.A movement of one of the antenna housings shows up in the distance estimates tracked over time.Two groups of SNR estimates correspond to the leakage measurements (higher SNR) and the wireless two-way measurements (lower SNR).

Fig. 8 .
Fig. 8. Transmit and receive timings of the initiator and reflector.The reflector TX trigger time is set to T r = 250 μs after the detected start index of the received IR packet.

Fig. 9 .
Fig. 9. Measurement maps of indoor environments with drawn walls and nonmoving furniture.The indoor open space case is measured in a location with a high ceiling at 12.4 m and far walls at 46.3 m apart.(a) Room-to-room map with a central wall and connecting door.(b) Indoor open space map.(c) Classroom map.(d) Lab room map.

Fig. 10 .
Fig. 10.Complexity and RMSE evaluations of the reduced-complexity MUSIC-based algorithm as it varies with the number of frequency shifts D s and number of multichannel measurements B. (a) Number of complex multiplications using J M = 751 MUSIC search points.(b) RMSE using all measurements taken in LOS conditions.

Fig. 11 .Fig. 12 .
Fig. 11.Error CDF, absolute error CDF, mean error, and RMSE results for different ranging methods and multipath conditions.Comparisons are made between Chronos INDFT, NGP, NCFD, and our proposed PCMC method.(a) Error CDF and mean error results for measurements taken through wires.(b) Error CDF and mean error results for all measurements taken in LOS conditions.(c) Error CDF and mean error results for all measurements taken in NLOS conditions.(d) Absolute error CDF and RMSE results for measurements taken through wires.(e) Absolute error CDF and RMSE results for all measurements taken in LOS conditions.(f) Absolute error CDF and RMSE results for all measurements taken in NLOS conditions.

Fig. 13 .
Fig. 13.Absolute error CDF and RMSE comparisons between the NGP single-channel CFR measurements and their total-bandwidthequivalent PCMC stitch using 20 MHz multichannel measurements.

Fig. 14 .
Fig. 14.Absolute error CDF and RMSE comparisons with and without the proposed calibration techniques for LPF magnitude effects, frequency selectivity (Freq Sel) of the hardware components, and changing per-channel gains.Evaluations are conducted using PCMC stitching across B = 16 20 MHz channels.

Fig. 15 .
Fig. 15.Absolute error CDF and RMSE comparisons with and without the proposed calibration techniques for LPF effects using NGP with a 160-MHz single-channel bandwidth.
GHz band): 50, 114, 163.In TableII, the subcarrier allocation indices and their corresponding FFT sizes are listed per bandwidth.