PaperlayerView exact revision on arXiv

Source-linked AI summary

Evolution Toward Sensing-Enabled RAN: Practical Bistatic Sensing via Uplink

Kenan Turbic, Khanh-Toan Pham, Slawomir Stanczak

arXiv:2610.20923v2eess.SP

TL;DR

Uplink CSI-based sensing offers a way to add sensing to cellular networks with minimal infrastructure changes, but CSI alone cannot determine absolute target position. The paper combines 5G UE positioning with gNB multi-antenna processing and demonstrates localization of a walking person in simulation and an SDR-based experiment.

Abstract

from arXiv · show

This paper considers uplink channel state information (CSI)-based sensing as an opportunistic approach to enabling sensing in cellular networks, with minimum required modifications to the infrastructure. A practical sensing signal processing procedure is presented, combining 5G positioning function with multi-antenna array processing for passive target localization. The approach is validated through simulation and practical experiments with a software-defined radio-based setup, utilizing open-source software frameworks and commercially available hardware components. Results demonstrate feasibility of the uplink CSI-based sensing for detection, localization and tracking of moving targets over local areas.

I. INTRODUCTION

The paper argues for an evolutionary route to sensing-enabled cellular networks by reusing uplink CSI, requiring minimal RAN changes. It presents and validates a practical procedure for target localization using uplink CSI in evolved 5G systems.

I. INTRODUCTION

  • The paper motivates ISAC by the substantial scale of cellular infrastructure and its potential use for sensing alongside communication.The paper cites for this motivation.Source: §I · p. 1
  • An evolutionary route with minimum RAN modifications is presented as a more realistic near-term deployment path than developing new waveforms and frequency bands.New waveforms and bands are described as important to the long-term ISAC vision.Source: §I · p. 1
  • Reusing pilot-derived CSI for sensing avoids discarding channel estimates and requires practically no changes to the RAN standard.The estimates are already obtained for communication functions such as data equalization and user scheduling.Source: §I · p. 1
  • Reported experimental studies have often used non-standard waveforms or pilots, while real-time standard-compliant CSI-based ISAC demonstrations remain scarce.The cited examples include generic OFDM, WiFi, and non-standard pilots; recent NVIDIA Aerial demonstrations used DMRS-based uplink CSI and a trained neural network for moving-person localization.Source: §I · p. 1
  • The work presents an uplink CSI-based bistatic sensing procedure that combines 5G UE positioning with multi-antenna array processing for target localization.It is validated through simulation and preliminary measurements from a real-time SDR testbed using an NVIDIA Aerial-based, 3GPP-compliant Open RAN gNB.Source: §I · p. 1

A. Channel Model

The channel model treats uplink CSI as a sum of propagation paths whose delays, Doppler shifts, and gains encode aspects of the environment. Frequency- and time-domain transforms expose delay and Doppler structure, but CSI alone provides limited absolute spatial interpretation.

A. Channel Model

  • Uplink pilots DMRS and SRS support CSI estimation, which can be further processed for information about the propagation environment.DMRS accompanies uplink data and supports equalization; SRS is sent independently of user data for scheduling.Source: A. Channel Model · p. 1
  • The channel comprises LoS and multipath components, with path delays tied to propagation lengths and Doppler shifts arising from scatterer or UE motion.The model assumes a stationary UE during observation, so Doppler shifts are attributed solely to scatterer motion.Source: A. Channel Model · p. 2
  • Frequency-domain IDFT and time-domain DFT of the CTF yield CIR snapshots and a delay-Doppler map, but CSI alone offers limited absolute spatial interpretation.The channel model describes a target echo as lying on an ellipse with the UE and gNB at its foci; Doppler corresponds to change in total path length.Source: A. Channel Model · p. 2

B. Sensing Limitations and Opportunities

CSI timing and unknown UE position prevent direct absolute bistatic-range recovery and target positioning without additional information. The paper uses an absolute LoS delay, obtainable from known UE position or candidate 5G mechanisms, to recover physical path delays.

B. Sensing Limitations and Opportunities

  • Because gNB synchronization references the first arriving signal, observed CIR delays are relative; with UE position generally unknown, CSI alone cannot establish absolute target range or position.The paper states target-position estimation is not possible without additional information.Source: B. Sensing Limitations and Opportunities · p. 2
  • CIR variations from moving objects can support moving-target presence detection without absolute distances or UE position, with minimal additional cost and no RAN-standard or hardware changes.The paper identifies intrusion detection in private or campus networks as a practical use case.Source: B. Sensing Limitations and Opportunities · p. 2

A. Total Bistatic Range Recovery

  • Knowing the absolute LoS delay allows recovery of physical path delays from the gNB's synchronization-relative CSI delays.The physical LoS delay can follow from known UE position, such as a reference UE or fixed-position CPE, or be estimated using timing advance or 5G UE positioning.Source: A. Total Bistatic Range Recovery · p. 2
  • Timing advance is unsuitable for target localization because its coarse quantization and narrow PRACH bandwidth yield distance errors on the order of tens of meters; SRS-based UE positioning offers finer time resolution.SRS can span the entire uplink bandwidth.Source: A. Total Bistatic Range Recovery · p. 3

B. Angle-of-Arrival Estimation

Bistatic path length alone leaves target position ambiguous along a propagation ellipse. Multi-antenna AoA estimates orient the ellipse and locate the scatterer on it, enabling localization when combined with LoS range.

B. Angle-of-Arrival Estimation

  • Bistatic target path length alone cannot localize a target because its propagation ellipse may have arbitrary orientation and the target's position on that ellipse remains unknown.The paper identifies AoA estimation at the gNB using multiple receive antennas as the additional localization requirement.Source: B. Angle-of-Arrival Estimation · p. 3
  • LoS AoA sets the propagation ellipse's orientation relative to the gNB array broadside, while target-echo AoA identifies the scatterer's position on the ellipse.Together with LoS range, the AoA estimates enable target localization.Source: B. Angle-of-Arrival Estimation · p. 3
  • An IDFT across antenna elements can estimate AoA from the spatial harmonic component, while Capon or MUSIC can offer superior estimates at higher computational complexity.The model assumes target speed is low enough for fast-time Doppler to be negligible.Source: B. Angle-of-Arrival Estimation · p. 3

C. Target Position Mapping

Target position is mapped by intersecting the gNB’s AoA ray with the propagation ellipse established from target and LoS delays and angles. The resulting geometry also gives the direction of the target velocity component estimated from bistatic Doppler.

C. Target Position Mapping

  • The target position is obtained where the gNB AoA ray intersects the propagation ellipse defined by the absolute target and LoS delays and angles.The target distance from the gNB follows from this geometry.Source: C. Target Position Mapping · p. 3
  • Equation (6) gives target distance using the ellipse geometry, target AoA relative to LoS, and the estimated target and LoS angles.The distance and target echo AoA yield Cartesian position, assuming known gNB position and array orientation.Source: C. Target Position Mapping · p. 3
  • The bistatic-Doppler-estimated target velocity component points along the propagation ellipse normal at the target location.The passage introduces a unit vector for this direction.Source: C. Target Position Mapping · p. 3

D. Sensing Procedure Outline

The gNB procedure uses two processing branches: one estimates LoS parameters, while the other suppresses LoS and clutter and forms a range-Doppler-angle map. These operations support target detection, tracking, and localization.

D. Sensing Procedure Outline

  • The gNB processes uplink CSI in two branches: LoS-parameter estimation supports synchronization, impairment compensation, LoS suppression, and localization, while the other produces a range-Doppler-angle map.The second branch uses the first branch’s inputs and UE positioning mechanisms.Source: D. Sensing Procedure Outline · p. 3, Figure 2 · p. 4
  • The LoS pipeline identifies the least-delay CIR peak, then estimates LoS AoA from antenna-element signals in that delay bin.The AoA estimate can support null-subspace suppression of the strong LoS contribution; the identity matrix is Na × Na and the transpose is Hermitian.Source: D. Sensing Procedure Outline · p. 3
  • Subtracting the CTF time-average across CPI pilot symbols removes the zero-Doppler component to facilitate moving-target detection.The same suppression approach can be applied to external-source interference when their AoAs are properly estimated.Source: D. Sensing Procedure Outline · p. 4
  • After LoS and clutter suppression, successive Fourier transforms process the CTF across delay, Doppler, and spatial dimensions.The spatial dimension is distance along the array aperture relative to a reference point.Source: D. Sensing Procedure Outline · p. 4
  • Detection and parameter estimation on the delay-Doppler-angle map can be followed by tracking and data association across CPIs to estimate target trajectories.Zero-padding or second-order polynomial interpolation can reduce straddle loss; the absolute LoS delay from 5G UE positioning translates relative echo delays into target distances.Source: D. Sensing Procedure Outline · p. 4

IV. PRACTICAL CHALLENGES

The section briefly discusses practical challenges and indicates possible mitigation approaches.

IV. PRACTICAL CHALLENGES

  • The section identifies practical challenges and points to possible mitigation approaches.Source: §IV · p. 4

1) Limited Tx power:

The practical challenges include limited sensing range, position-estimation error, and UE mobility. The passage describes the factors constraining range and accuracy and the static-UE assumption used by the method.

1) Limited Tx power:

  • Low UE transmit power and the strong direct path masking weak echoes limit sensing range, making the approach better suited to short-range indoor or industrial scenarios.Higher-power-class, higher-gain CPE devices can extend the range.Source: 1) Limited Tx power · p. 4

2) Positioning error:

  • Target-position accuracy depends jointly on all estimates in equation (6), with LoS delay constrained by positioning conditions and AoA errors by array and estimation factors.LoS delay accuracy depends on bandwidth, SNR, channel conditions, and gNB count; AoA accuracy depends on array aperture, SNR, and estimation method.Source: 2) Positioning error · p. 4

3) UE mobility:

  • The method assumes a nomadic UE that remains static over the CPI, so LoS and clutter are time-invariant.For UE motion, the LoS Doppler shift must generally be estimated and compensated using methods typically used in automotive radar.Source: 3) UE mobility · p. 4

4) CSI availability and signaling overhead:

The section identifies traffic-dependent CSI availability and hardware drift over long sensing intervals as practical constraints, then demonstrates simulated target localization after LoS suppression.

4) CSI availability and signaling overhead:

  • DMRS-based CSI can be sparse or irregular under low uplink traffic, whereas independently scheduled SRS offers flexible timing at the cost of additional uplink resources.The paper suggests combining DMRS in high-traffic periods with scheduled SRS during low data activity.Source: 4) CSI availability and signaling… · p. 4

5) Sensing with communication hardware:

  • Timing, carrier-frequency, and sampling-frequency offsets limit Rx coherence over time and accumulate across multi-frame CPIs for slow targets, though a known strong path can track and compensate for drift.These impairments have negligible impact over the short symbol blocks used for communication data detection.Source: 5) Sensing with communication hardware · pp. 4–5

V. SIMULATION RESULTS

  • The simulation uses a static UE 10 m from a four-element gNB ULA and a static target at 15 m and −30°; the target echo is 12 dB weaker than the 20 dB LoS path.The array has half-wavelength element spacing, and the LoS SNR is specified at the Rx antenna output before signal-processing gain.Source: §V · p. 5
  • The LoS component is strongest at 10 m, while the weaker target echo lies near 23 m; suppression removes the LoS component.The range axis is adjusted using the absolute LoS distance to show total bistatic propagation path length.Source: Figure 3 · p. 5, §V · p. 5
  • After LoS suppression and bistatic-to-monostatic range conversion, the simulated map retains the target at its exact input position.The range conversion of the observed space is for visualization; detected targets are transformed individually, and the displayed peak is slightly distorted.Source: Figure 4 · p. 5, §V · p. 6

VI. EXPERIMENTAL RESULTS

The SDR-based experiment tracked a person walking toward the radio unit, with detected positions generally close to the walking path. The setup used a 5G modem and assumed known absolute line-of-sight delay for localization.

VI. EXPERIMENTAL RESULTS

  • The real-time testbed used an NVIDIA Aerial SDR gNB and a four-antenna horizontal ULA at 3.75 GHz with 100 MHz bandwidth.The setup used 3,276 active subcarriers spaced 30 kHz apart.Source: §VI · p. 6
  • A subject walked from 6 m to 3 m toward the RU at −32° azimuth, while localization assumed known absolute LoS delay from the UE location.The CTF used 32 DMRS-based estimates collected every 2.5 ms; the testbed did not yet implement the 5G positioning function.Source: §VI · p. 6
  • 0.5–1 m typically separated detected positions from the subject’s actual position as the subject walked toward the RU.The larger deviations, including in the monostatic range curve, could be suppressed with tracking algorithms not considered in this work.Source: Figure 6 · p. 6, §VI · p. 6

VII. CONCLUSIONS

The paper uses uplink CSI in evolved 5G FR1 networks for bistatic sensing and combines UE positioning with gNB antenna-array processing for target localization. Simulation and SDR measurements demonstrate feasibility in an indoor walking scenario with minimal required modifications.

VII. CONCLUSIONS

  • Uplink CSI estimates from pilot signals provide an opportunistic basis for bistatic sensing in evolved 5G FR1 networks.Source: §VII · p. 6
  • The 5G UE positioning function and gNB antenna array support LoS absolute-range and AoA estimation for target localization.Source: §VII · p. 6
  • Simulation and real-time SDR measurements demonstrate feasible localization of a walking person in an indoor 5G FR1 scenario with minimal required modifications.The setup used an open-source NVIDIA Aerial gNB implementation and commercially available RU and UE.Source: §VII · p. 6
Loading 2610.20923v2…