1

From Concept to Reality: 5G Positioning with

Open-Source Implementation of UL-TDoA in
OpenAirInterface
Adeel Malik∗ , Mohsen Ahadi† , Florian Kaltenberger†∥ , Klaus Warnke‡ , Nguyen Tien Thinh† ,
Nada Bouknana† , Cedric Thienot∗ , Godswill Onche† , Sagar Arora¶
∗ Firecell, Nice, France † EURECOM, Sophia Antipolis, France ‡ TU Dresden, Dresden, Germany
¶ OpenAirInterface Software Alliance, Sophia-Antipolis, France ∥ Northeastern University, Boston (MA), USA
arXiv:2409.05217v2 [cs.IT] 11 Sep 2024

Abstract—This paper presents, for the first time, an open- struggles with accuracy and performance in indoor and densely
source implementation of the 3GPP Uplink Time Difference urban environments, along with high power consumption. Wi-
of Arrival (UL-TDoA) positioning method using the OpenAir- Fi and BLE perform better indoors, but their accuracy can be
Interface (OAI) framework. UL-TDoA is a critical positioning
technique in 5G networks, leveraging the time differences of affected by network density and environmental factors. In con-
signal arrival at multiple base stations to determine the precise trast, 5G positioning technologies offer superior accuracy, low
location of User Equipment (UE). This implementation aims latency, and consistent performance in both indoor and outdoor
to democratize access to advanced positioning technology by scenarios. 5G NR positioning leverages advanced signal char-
integrating UL-TDoA capabilities into both the Radio Access acteristics and infrastructure improvements introduced by the
Network (RAN) and Core Network (CN) components of OAI,
providing a comprehensive and 3GPP-compliant solution. new standard. Techniques such as Time Difference of Arrival
The development includes the incorporation of essential proto- (TDoA), Angle of Arrival (AoA), and multi-cell Round Trip
col procedures, message flows, and interfaces as defined by 3GPP Time (RTT) are enhanced by 5G’s higher frequency bands,
standards. Validation is conducted using two distinct methods: massive multiple-input multiple-output (MIMO) technology,
an OAI-RF simulator-based setup for controlled testing and an and beamforming capabilities. These advancements enable
O-RAN-based Localization Testbed at EURECOM in real-world
conditions. The results demonstrate the viability of this open- highly accurate and reliable positioning, even in challenging
source UL-TDoA implementation, enabling precise positioning in environments like urban canyons and indoor spaces.
various environments. By making this implementation publicly Among the various positioning techniques standardized by
available, the study paves the way for widespread research, devel- the 3rd Generation Partnership Project (3GPP) [1], this paper
opment, and innovation in the field of 5G positioning technologies, focuses on the Uplink Time Difference of Arrival (UL-TDoA)
fostering collaboration and accelerating the advancement of
cellular network positioning. method. UL-TDoA determines the location of a User Equip-
ment (UE) by analyzing the time differences in the arrival of
Index Terms—5G Positioning, TDoA, OpenAirInterface, uplink signals at multiple base stations. However, the practi-
NRPPA, LMF.
cal implementation of UL-TDoA positioning presents several
challenges, including the need for precise synchronization
I. I NTRODUCTION between base stations, advanced signal processing, and robust
algorithms to manage multipath propagation and non-line-of-
The introduction of 5G New Radio (NR) technology rep-
sight conditions. Moreover, proprietary solutions can be costly
resents a significant evolution in wireless communications,
and rigid, potentially hindering innovation and customization
bringing unparalleled advancements in speed, connectivity,
for specific needs.
and latency. Beyond merely enhancing existing mobile broad-
In this context, open-source software emerges as a vital tool
band services, 5G NR is expected to transform numerous in-
in democratizing access to advanced technologies, promoting
dustries by enabling ultra-reliable low-latency communication
innovation, and supporting collaborative development. Ope-
(URLLC), massive machine-type communications (mMTC),
nAirInterface (OAI) is a notable open-source project that offers
and enhanced mobile broadband (eMBB). A key innovation
a comprehensive, 3GPP-compliant implementation of LTE and
within the 5G framework is precise positioning and localiza-
5G Radio Access Network (RAN) and Core Network (CN)
tion, which is anticipated to create new opportunities across
components. OAI provides a flexible and effective platform for
sectors such as automotive, healthcare, logistics, and smart city
researchers, developers, and network operators to experiment
development.
with and deploy advanced communication technologies [2].
Traditional positioning methods like GPS, Wi-Fi, and Blue-
Related work: There are several examples where OAI
tooth Low Energy (BLE) beacons, while commonly used, suf-
is used as a basis for positioning. In [3], OAI is combined
fer from limitations regarding accuracy, latency, and reliability.
with a multi-channel SDR and a custom 2x2 patch antenna
GPS, for instance, provides reliable outdoor coverage but often
array for enhanced cell-ID (E-CID) positioning in indoor
The work included in this paper has been supported by the ”France 2030” scenarios, by using RTT and AoA estimates based on the
investment program through the projects 5G-OPERA and GEO-5G. demodulation reference signal (DM-RS). The HOP-5G project
2

[4], [5] sponsored the development of the PRS in OAI for

DL-TDoA positioning for FR1 and FR2 and demonstrated the
feasibility of this techniques. Based on this work, [6] built a
testbed with three OAI base stations or gNBs and a OAI user
equipment exploiting the PRS transmissions for DL-TDoA
positioning. More recently, a novel framework is presented
in [7] to estimate the RTT between a UE and a base station
(gNB) with existing 5G NR transmissions.
This paper presents a comprehensive open-source imple- Fig. 1. UE Positioning Architecture applicable to NG-RAN [1, Section 5.1]
mentation of the 3GPP Uplink Time Difference of Arrival
(UL-TDoA) positioning method using the OpenAirInterface
(OAI) framework. The primary goal of this work is to integrate II. 3GPP’ S FRAMEWORK FOR UL-TDOA BASED
POSITIONING
UL-TDoA capabilities into both the RAN and CN components
of OAI, thereby enabling precise UE positioning within 5G The 3GPP framework for positioning in 5G networks
networks. Our implementation enables end-to-end testing of involves a combination of network components, interfaces, and
UL-TDoA positioning by incorporating the necessary 3GPP- positioning methods to provide accurate and reliable location
defined protocol procedures and message exchanges. Key information for User Equipment (UE). The 3GPP standards
Contributions of this Paper: supporting UL-TDOA positioning are detailed in technical
specification TS 38.305 [1], which outline the technical re-
• Integration of UL-TDoA Support in OAI: We have inte- quirements for all location services, including UL-TDOA. The
grated the UL-TDoA positioning procedure into the OAI framework defined by 3GPP for UL-TDOA-based positioning
framework, enhancing its RAN and CN components to of a target UE, as well as the delivery of location assistance
support accurate positioning by implementing the neces- data to a UE with NG-RAN access in 5G systems, is illustrated
sary protocol procedures, message flows, and interfaces. in Figure 1. The key network components include the UE, Next
• Design and Architecture Insights: We offer detailed in- Generation Radio Access Network (NG-RAN), the Access
sights into integrating UL-TDoA procedures into the OAI and Mobility Management Function (AMF), the Location
architecture, including protocol choices and strategies for Management Function (LMF), and the Location service LCS
3GPP standards compatibility. entity. These network components are defined as:
• Validation of Implementation: We validate our UL-TDoA • UE: The UE is the mobile device enabled with 5G
implementation using two distinct setups: the OAI-RF services (5GS) whose location is being determined.
simulator-based setup and the O-RAN-based Localization • NG-RAN: The NG-RAN is comprised of at least one
Testbed at EURECOM. These validation methods allow Next Generation Node B (gNB). The gNB serves as
us to demonstrate the functionality and reliability of our the base station in 5G networks, facilitating the radio
implementation under both controlled, simulated condi- connection between user equipment (UE) and the 5G core
tions and realistic operational scenarios. network. Each gNB is linked to one or more Transmission
• Documentation and Tutorial for Implementation: We pro- Reception Points (TRPs), which are individual antennas
vide comprehensive documentation and tutorials on how or groups of antennas responsible for transmitting and
to set up and use the UL-TDoA implementation within receiving wireless signals.
the OAI framework. This includes detailed steps for • AMF: The Access and Mobility Management Function
deploying the 5G core and RAN components, configuring (AMF) is an essential part of the 5G core network, tasked
the RF simulator, and initiating the positioning proce- with managing access and mobility functions. It oversees
dures. UE registration, session management, and ensures seam-
less mobility across various cells and networks.
By making this implementation openly available, we aim • LMF: The Location Management Function (LMF) is a
to provide a valuable resource for the research community central entity within the 5G core network that oversees
and network operators. Our work encourages further explo- location services. It coordinates the collection of TDOA
ration and development of UL-TDoA positioning, fostering measurements and is responsible for calculating the final
innovation and collaboration in the field of cellular network position of the UE.
positioning technologies. • LCS entity: The Location Services (LCS) entity manages

The following sections will review the technical background the delivery of location-based services by processing
of the UL-TDoA positioning framework, highlighting key positioning requests from LCS clients. It coordinates with
network entities and protocols. We will then discuss the various network elements to ascertain the user equip-
capabilities of the OpenAirInterface platform and detail the ment’s (UE) location. LCS clients can include applica-
implementation of UL-TDoA positioning within the OAI tions installed on the UE or external systems that require
framework. Next, we will present the validation of our im- the UE’s location data.
plementation. Finally, we will conclude with a discussion of The interface defined by the 3GPP that can be used among
the implications of our work and future research directions. different network components in Figure 1 is defined as
 3

Fig. 3. Protocol Layering for LMF to NG-RAN Signalling [1, Section 6.5]

Fig. 2. UL-TDoA Positioning Procedure (3GPP) [1, 8.13.3.4]. about the characteristics of the SRS signal transmitted by the
UE for the required measurement period. These characteristics
must remain consistent across the periodic SRS transmissions.
• NR-Uu: The NR-Uu interface is the radio interface in
The LMF directs the serving gNB to instruct the UE to
5G networks, connecting the User Equipment (UE) to
transmit SRS signals for positioning. The serving gNB then
the gNodeB (gNB). It is responsible for the transmission
decides on the necessary resources and communicates the
of data, control signals, and user information between the
SRS configuration to the LMF, which in turn relays this
UE and the 5G network. The NR-Uu interface supports
information to the neighboring gNBs/TRPs participating in the
various functionalities, including signaling, data transfer,
UE positioning procedure.
and radio resource management, ensuring efficient com-
Figure 2 defines the UL-TDoA positioning procedure as per
munication between the UE and the network.
3GPP [1, Section 8.13]. As illustrated in Figure 2, the NRPPa
• NG-C: The NG-C interface in 5G networks connects
protocol is integral to the UL-TDoA positioning procedure,
the gNodeB (gNB) to the Access and Mobility Man-
facilitating communication between the LMF and gNB. The
agement Function (AMF). It handles control plane tasks
NRPPa protocol data units (PDUs) enable the exchange of
like session and mobility management, ensuring efficient
positioning-related information, including configuration set-
communication between the radio access network and the
tings, measurement requests, and results. This communication
core network. The NG-C interface is transparent to all UE
allows the gNBs to precisely measure the TDoA of uplink
positioning-related procedures, serving only as a transport
signals from the UE at various TRPs. The measurements
link for the NR positioning protocols involved in these
obtained are then utilized by the localization algorithm within
processes. In positioning procedures involving the gNB,
the LMF to determine the UE’s exact position.
the NG-C interface transparently transfers positioning re-
It is important to note that there is no direct connection
quests from the LMF to the gNB and delivers positioning
between the gNB and the LMF; all NRPPa-related messages
results from the gNB to the LMF.
must pass through the AMF. Figure 3 demonstrates the
• NLs: The NLs interface connects the Location Man-
protocol layering required for transferring NRPPa messages
agement Function (LMF) and the Access and Mobility
between the LMF and gNB. In the next section, we present
Management Function (AMF) and is transparent to all UE
in detail the messages exchanged by each network element
and gNB positioning procedures. It serves as a transport
during the NRPPa PDU Transfer process between gNB and
link for the LTE Positioning Protocol (LPP) and NR
LMF.
Positioning Protocol (NRPPa).

III. C ONTRIBUTION TO THE OAI AND I MPLEMENTATION

A. Protocol Required for UL-TDoA Positioning Method in OAI
S TATUS OF UL-TD OA
The 3GPP specifies various positioning methods in its
technical report [1, Section 8], this paper focuses specifically In this section, we outline the essential components needed
on the UL-TDoA positioning method and its open-source within OAI’s 5G RAN and 5G Core to facilitate the imple-
implementation within the OpenAirInterface framework. mentation of the UL-TDoA positioning procedure. A summary
In the UL-TDoA positioning method, the UE location of our contributions to OAI’s open-source platform is detailed
is estimated based on UL-RToA measurements gathered at below:
various gNBs/TRPs for uplink signals from the UE, along • Contributions to OAI 5G RAN:

with other configuration details. To perform these uplink – Implementation of ToA estimation from SRS
measurements, participating gNBs/TRPs need to be informed – Integration of NRPPa functionalities [8]
4

Fig. 4. End-to-End Implementation of UL-TDoA Positioning Procedure in OAI.

– Development of NRPPa PDU Transfer protocol be- A. UL-TDoA Positioning Procedure in OAI
tween AMF and gNB [9]
Figure 4 provides an overview of our end-to-end imple-
• Contributions to OAI 5G Core (LMF):
mentation of the UL-TDoA positioning procedure in OAI. We
– Implementation of LMF-specific procedures [10] will now examine each message exchange in this procedure,
– Integration of NRPPa functionalities [8] highlighting the specific developments we contributed to the
– Development of NRPPa PDU transfer protocol be- OAI framework.
tween AMF and LMF [11]
Message 1 Initiation of Location Request:
Contributions to OAI 5G Core (AMF):
The UL-TDoA positioning procedure begins with an exter-
– Implementation of NRPPa PDU Transfer protocol be- nal API generating a location information request for a target
tween AMF and LMF [11] UE for the LMF. As shown in Figure 5 to initiate the location
– Development of NRPPa PDU Transfer protocol be- procedure, the external API (which can be an advanced API
tween AMF and gNB [9] or a simple one-line command) sends the HTTP post request
These contributions significantly enhance the OAI open- to determine-location API of LMF, where the request contains
source 5G platform’s ability to support precise positioning a data structure of type InputData [10, Section 6.1.6.2.2]. To
and location-based services. The following subsection details enable the exchange of this message, we first developed the
the specific developments implemented in the OAI codebase 3gpp-compliant LMF framework and integrated it into OAI’s
to enable the UL-TDoA positioning procedure, which are core network framework. Then within that LMF framework,
essential for integrating UL-TDoA functionality within the we develop the determine-location API [10, Section 6] to
OAI framework. handle the positioning request following the 3gpp standard.
The 3GPP outlines multiple identification methods [10,
Section 6.1.6.2.2] for initiating the positioning of a target
UE. In our implementation, we utilized the Subscription
 5

Request1 message to the gNB-RRC.

Message 2.e. The gNB-RRC thread processes the request
and forwards the F1AP: TRP Information Request to the
gNB-MAC.
Message 3 TRP Information Response:
All gNBs participating in the positioning procedure prepare
Fig. 5. Determine Location Request [10, Figure 5.2.2.2.2-1] a TRP information response and send it to the LMF, providing
essential data such as configuration and location, which are
crucial for accurate UE positioning. The key information ele-
Permanent Identifier (SUPI) to identify the target UE. The ments included in our implementation of the TRP information
SUPI functions as a permanent identifier for subscribers within response, based on the list provided by 3GPP [8, Section
the network, supporting various authentication, authorization, 9.1.1.15], are as follows:
and identification tasks in 5G networks. Specifically, in our
• Message Type
implementation, the SUPI is represented by the International
• NRPPa Transection ID
Mobile Subscriber Identity (IMSI), a commonly used identifier
• TRP Information
in mobile networks. The key information elements included in
the InputData to initiate the location request for our implemen- – TRP ID
tation are as follows: – NG-RAN CGI
• SUPI ∗ PLMN Identity
• NR Cell Global Identifier (NCGI) – Geographical Coordinates
• Periodic Event Info ∗ Relative Cartesian Location
Once the LMF receives the determine-location request for a ∗ Location Uncertainty
specific UE it initiates the procedure to retrieve all the required The TRP Information Response message terminates at the
information from gNBs for the UL-TDOA positioning method. LMF, and we have implemented processing for this message
The procedure consists of several NRPPA messages (Messages in the LMF, AMF, gNB-NGAP, gNB-NRPPA, gNB-RRC, and
2-9 of Figure 4) exchanged between LMF and gNB(s). gNB-MAC components of OAI’s open-source 5G framework.
Message 2 TRP Information Request: Message 3.a. The gNB-MAC handler processes the TRP
The LMF initiates the UL-TDOA positioning method by Information Request, creates an F1AP: TRP Information
sending a TRP information request [8, Section 9.1.1.14] to Response containing the relevant TRP information, and
obtain the necessary TRP information for UE positioning. The forwards it to the gNB-RRC for further processing.
key information elements included in our implementation of Message 3.b. The gNB-RRC handler processes the F1AP:
the TRP information request, based on the list provided by TRP Information Response received from the gNB-MAC
3GPP [8, Section 9.1.1.14], are as follows: and forwards it to the gNB-NRPPa handler.
• Message Type Message 3.c. The gNB-NRPPa handler processes the
• NRPPa Transection ID F1AP: TRP Information Response, extracts key infor-
The TRP information request is part of the non-UE- mation, creates an NRPPa PDU, and sends it to the
associated NRPPa procedures. In our implementation, the gNB-NGAP handler by initiating the Uplink Non-UE
AMF forwards this non-UE-associated message to all the Associated NRPPa Transport procedure.
gNBs connected to it. The TRP information request message Message 3.d. The gNB-NGAP then initiates the NGAP
terminates in the MAC handler of the gNB. We have added Uplink Non-UE Associated NRPPa Transport procedure
processing for this message in the LMF, AMF, gNB-NGAP, and forwards the NRPPa PDU to the AMF.
gNB-NRPPA, gNB-RRC, and gNB-MAC of OAI’s open- Message 3.e. The AMF forwards the NRPPa PDU to the
source 5G framework. LMF by initiating the Namf Communication Non-UE N2
Message 2.a. The LMF creates an NRPPa PDU for the Info Notify procedure.
TRP Information Request and forwards it to the AMF by Message 4 Positioning Information Request: After receiving
initiating the Namf Communication Non-UE N2 Message the TRP Information Responses from all gNBs involved in the
Transfer procedure, carrying the NRPPa PDU. positioning process, the LMF initiates the retrieval of UL-SRS
Message 2.b. The AMF then initiates the NGAP Down- configuration details for the target UE. It then sends a Posi-
link Non-UE Associated NRPPa Transport procedure, tioning Information Request message to the serving gNB. In
carrying the NRPPa PDU, and sends it to all the gNBs response, the serving gNB allocates the necessary resources for
connected to the AMF.
1 The F1 Application Protocol (F1AP) is used to manage and control the
Message 2.c. Upon receiving the message from the AMF,
interaction between the gNB Central Unit (gNB-CU) and the gNB Distributed
each gNB processes the NGAP message and forwards the Unit (gNB-DU) in 5G NR architecture when the gNB is operating in split
NRPPa PDU to the Downlink Non-UE Associated NRPPa mode. We have added the basic framework for all positioning messages 2-9
Transport handler in the gNB-NRPPa thread. of Figure 4 in OAI’s framework to support split mode; however, the complete
processing of these messages has only been implemented for monolithic mode.
Message 2.d. The gNB-NRPPa thread decodes the Our goal is to extend our work to support the positioning procedure in split
NRPPa PDU and forwards an F1AP: TRP Information mode.
6

UL-SRS and configures the target device with the appropriate Message 5.b. The gNB-RRC handler processes the F1AP:
UL-SRS resource sets. The key information elements included Positioning Information Response received from the
in our implementation of the Positioning Information Request, gNB-MAC and forwards it to the gNB-NRPPa handler.
as outlined by 3GPP [8, Section 9.1.1.10], are as follows: Message 5.c. The gNB-NRPPa handler processes the
• Message Type F1AP: Positioning Information Response, extracts key
• NRPPa Transaction ID information, creates an NRPPa PDU, and sends it to
• Requested SRS Transmission Characteristics the gNB-NGAP handler by initiating the Uplink UE
The Positioning Information Request is part of the UE- Associated NRPPa Transport procedure.
associated NRPPa procedures. Therefore, the AMF will for- Message 5.d. The gNB-NGAP then initiates the NGAP
ward this message only to the gNB that is serving the UE. Uplink UE Associated NRPPa Transport procedure and
The Positioning information request message terminates in the forwards the NRPPa PDU to the AMF.
MAC handler of the gNB. We have added processing for this Message 5.e. The AMF forwards the NRPPa PDU to the
message in the LMF, AMF, gNB-NGAP, gNB-NRPPA, gNB- LMF by initiating the Namf Communication N2 Info
RRC, and gNB-MAC of OAI’s open-source 5G framework. Notify procedure.
Message 4.a. The LMF creates an NRPPa PDU for the Message 6 Positioning Activation Request:
Positioning Information Request and forwards it to the Once the LMF is informed of the SRS configuration for the
AMF by initiating the Namf Communication N1N2 Mes- target UE, it initiates the activation of UE SRS transmission
sage Transfer procedure, carrying the NRPPa PDU. by sending an NRPPa Positioning Activation Request message
Message 4.b. The AMF then initiates the NGAP Down- to the serving gNB. The key information elements included in
link UE Associated NRPPa Transport procedure, carrying our implementation of the Positioning Activation Request, as
the NRPPa PDU, and sends it to the serving gNB. outlined by 3GPP [8, Section 9.1.1.12], are as follows:
Message 4.c. Upon receiving the message from the AMF, • Message Type
the gNB processes the NGAP message and forwards the • NRPPa Transection ID
NRPPa PDU to the Downlink UE Associated NRPPa • SRS Resource Set ID
Transport handler in the gNB-NRPPa thread. • SRS Resource Trigger
Message 4.d. The gNB-NRPPa thread decodes the The Positioning Activation Request is part of the UE-
NRPPa PDU and forwards a F1AP: Positioning associated NRPPa procedures. Therefore, the AMF will for-
Information Request message to the gNB-RRC. ward this message only to the gNB that is currently serving the
Message 4.e. The gNB-RRC thread processes the request UE. The Positioning Activation request message terminates in
and forwards the F1AP: Positioning Information Request the MAC handler of the gNB. We have added processing for
to the gNB-MAC. this message in the LMF, AMF, gNB-NGAP, gNB-NRPPA,
Message 5 Positioning Information Response: After pro- gNB-RRC, and gNB-MAC of OAI’s open-source 5G frame-
cessing the Positioning Information Request, the serving gNB work.
prepares a Positioning Information Response that includes the Message 6.a. The LMF creates an NRPPa PDU for the
UL SRS configuration for the target UE. In the current OAI Positioning Activation Request and forwards it to the
RAN framework, the SRS configuration is predefined in the AMF by initiating the Namf Communication N1N2 Mes-
gNB settings and does not allow for dynamic adjustments for sage Transfer procedure, carrying the NRPPa PDU.
individual UEs. Consequently, when the serving gNB receives Message 6.b. The AMF then initiates the NGAP: Down-
the Positioning Information Request, it disregards the specific link UE-associated NRPPa Transport procedure, carrying
configuration requested by the LMF and instead returns the the NRPPa PDU, and sends it to the serving gNB.
existing UL SRS configuration that has already been applied Message 6.c. Upon receiving the message from the AMF,
to the target UE. The key information elements included in the gNB processes the NGAP message and forwards
our implementation of the Positioning Information response, the NRPPa PDU to the Downlink UE-associated NRPPa
as outlined by 3GPP [8, Section 9.1.1.11], are as follows: Transport handler in the gNB-NRPPa thread.
• Message Type Message 6.d. The gNB-NRPPa thread decodes the
• NRPPa Transaction ID NRPPa PDU and forwards a F1AP: Positioning
• SRS Configuration Activation Request message to the gNB-RRC.
The Positioning Information Response message terminates Message 6.e. The gNB-RRC thread processes the request
at the LMF, and we have implemented processing for this and forwards the F1AP: Positioning Activation Request
message in the LMF, AMF, gNB-NGAP, gNB-NRPPA, gNB- to the gNB-MAC.
RRC, and gNB-MAC components of OAI’s open-source 5G Message 7 Positioning Activation Response: In the current
framework. OAI RAN framework, UE SRS transmission is preactivated,
Message 5.a. The gNB-MAC handler processes the Po- and real-time modifications to a UE’s SRS transmission are not
sitioning Information Request, creates an F1AP: Posi- supported. As a result, when the gNB receives the request, it
tioning Information Response containing the SRS con- generates a Positioning Activation Response and sends it back
figuration, and forwards it to the gNB-RRC for further to the LMF, indicating that the target device is transmitting the
processing. SRS. The key information elements included in our implemen-
 7

tation of the Positioning Activation Response, as outlined by to it2 . The measurement request message terminates in the
3GPP [8, Section 9.1.1.18], are as follows: PHY handler of the gNB. We have added processing for this
message in the LMF, AMF, gNB-NGAP, gNB-NRPPA, gNB-
• Message Type
RRC, gNB-MAC, and gNB-PHY of OAI’s open-source 5G
• NRPPa Transaction ID
framework.
• Criticality Diagnostics
• System Frame Number Message 8.a. The LMF creates an NRPPa PDU for the
• Slot Number Measurement Request and forwards it to the AMF by
initiating the Namf Communication Non-UE N2 Message
The Positioning Activation Response message terminates
Transfer procedure, which carries the NRPPa PDU.
at the LMF, and we have implemented processing for this
Message 8.b. The AMF then initiates the NGAP Down-
message in the LMF, AMF, gNB-NGAP, gNB-NRPPA, gNB-
link Non-UE Associated NRPPa Transport procedure,
RRC, and gNB-MAC components of OAI’s open-source 5G
carrying the NRPPa PDU, and sends it to all the gNBs
framework. Although UE SRS transmission is preactivated,
connected to the AMF.
allowing the Positioning Activation Request to be handled en-
Message 8.c. Upon receiving the message from the AMF,
tirely at the gNB-NRPPa with a response generated there, we
each gNB processes the NGAP message and forwards the
have included the processing of this message in both the gNB-
NRPPa PDU to the Downlink Non-UE Associated NRPPa
RRC and gNB-MAC for completeness. This approach ensures
Transport handler in the gNB-NRPPa thread.
future compatibility with potential OAI code developments
Message 8.d. The gNB-NRPPa thread decodes the
that may support on-the-fly SRS activation.
NRPPa PDU and forwards an F1AP: Measurement
Message 7.a. The gNB-MAC handler processes the Posi- Request message to the gNB-RRC.
tioning Activation Request, creates an F1AP: Positioning Message 8.e. The gNB-RRC thread processes the request
Activation Response, and forwards it to the gNB-RRC for and forwards the F1AP: Measurement Request to the
further processing. gNB-MAC.
Message 7.b. The gNB-RRC handler processes the F1AP: Message 8.f. The gNB-MAC thread processes the request
Positioning Activation Response received from the gNB- and forwards the FAPI: Measurement Request to the
MAC and forwards it to the gNB-NRPPa handler. gNB-PHY.
Message 7.c. The gNB-NRPPa handler processes the Message 9 Measurement Response:
F1AP: Positioning Activation Response, extracts key
All gNBs that have received the Measurement Request and
information, creates an NRPPa PDU, and sends it to
are involved in the positioning procedure generate a Measure-
the gNB-NGAP handler by initiating the Uplink UE-
ment Response and send it to the LMF, providing crucial
associated NRPPa Transport procedure.
ToA measurements necessary for accurate UE positioning.
Message 7.d. The gNB-NGAP initiates the NGAP: Up-
The precision and resolution of these ToA measurements are
link UE-associated NRPPa Transport procedure and for-
essential for achieving high positioning accuracy, as any errors
wards the NRPPa PDU to the AMF.
in the ToA measurements can significantly affect the overall
Message 7.e. The AMF forwards the NRPPa PDU to the
accuracy. To enhance measurement precision, we have inte-
LMF by initiating the Namf Communication N2 Informa-
grated a state-of-the-art channel estimation and ToA estimation
tion Notify procedure.
procedure into the gNB. A detailed overview of this integration
Message 8 Measurement Request: is provided in Section III-B. The key information elements
Once the Positioning Activation Response is received by included in our implementation of the measurement response,
the LMF, it initiates the retrieval of ToA measurements from based on the list provided by 3GPP [8, Section 9.1.4.2], are
all the gNBs/TRPs involved in the positioning of the target as follows:
UE. The LMF sends a Measurement Request to each partici- • Message Type
pating gNB, which includes the SRS configuration previously • NRPPa Transection ID
received from the serving gNB in the Positioning Information • TRP ID
Response for the target UE. The participating gNBs then use • Measurement Result
this configuration to perform the ToA measurements and send
– UL RTOA Measurement
the results back to the LMF. The key information elements
– gNB Rx-Tx Time Difference
included in our implementation of the measurement Request,
as outlined by 3GPP [8, Section 9.1.4.1], are as follows: The measurement Response message terminates at the LMF,
and we have implemented processing for this message in
• Message Type the LMF, AMF, gNB-NGAP, gNB-NRPPA, gNB-RRC, gNB-
• NRPPa Transection ID MAC, and gNB-PHY components of OAI’s open-source 5G
• ITRP ID framework.
• SRS Configuration
2 In future work, we plan to enable the LMF and AMF to send Measurement
The measurement request is part of the non-UE-associated
Requests to specific gNBs. This approach allows for the selection of a
NRPPa procedures. In our implementation, the AMF forwards targeted subset of gNBs to participate in the positioning process and provide
this non-UE-associated message to all the gNBs connected measurements, optimizing resource usage and potentially improving accuracy.
8

Message 9.a. The gNB-PHY handler processes the Re- integrated into OAI’s gNB.
quest, creates an FAPI: Measurement Response con-
taining the ToA measuement and corresponding TRP B. Enabling ToA estimation in OAI’s gNB
information, and forwards it to the gNB-MAC for further
1) gNB-PHY: The PHY layer involves two primary pro-
processing.
cesses: channel estimation and subsequent Time of Arrival
Message 9.b. The gNB-MAC handler processes the Re-
(ToA) estimation based on the pilot symbols of the Sounding
sponse, creates an F1AP: Measurement Response con-
Reference Signal (SRS). The SRS is a wide-band reference
taining the relevant TRP information, and forwards it to
signal transmitted by the UE in the uplink. The SRS for
the gNB-RRC for further processing.
positioning is generated using the Zadoff-Chu sequence [12],
Message 9.c. The gNB-RRC handler processes the F1AP:
similar to the SRS for communication, although they can be
Measurement Response received from the gNB-MAC and
configured differently. During the SRS channel estimation,
forwards it to the gNB-NRPPa handler.
essential parameters such as the OFDM symbol size NOFDM ,
Message 9.d. The gNB-NRPPa handler processes the
subcarrier offset k, number of antennas NRX , and antenna
F1AP: Measurement Response, extracts key information,
port configurations PRX are extracted from the gNB structure.
creates an NRPPa PDU, and sends it to the gNB-NGAP
For each receive antenna n ∈ {1, . . . , NRX } and antenna port
handler by initiating the Uplink Non-UE Associated
p ∈ {1, . . . , PRX }, Least Squares (LS) estimation is performed
NRPPa Transport procedure.
by correlating the received SRS signal YSRSn,p with the
Message 9.e. The gNB-NGAP then initiates the NGAP
generated signal XSRSn,p to estimate the channel Ĥn,p,l :
Uplink Non-UE Associated NRPPa Transport procedure
and forwards the NRPPa PDU to the AMF. YSRSn,p,l [k]
Message 9.f. The AMF forwards the NRPPa PDU to the Ĥn,p,l [k] = (1)
XSRSn,p,l [k]
LMF by initiating the Namf Communication Non-UE N2
Info Notify procedure. Since the SRS can be mapped to multiple consecutive OFDM
SRS
symbols l ∈ {1, . . . , Nsymb }, during the channel estimation
Message 10 Location Response: process, the SRS channel is estimated over all the symbols.
The Location Management Function (LMF) receives Time The channel estimate is then interpolated to refine the esti-
of Arrival (ToA) measurements (uLRTOAmeas) from each mates obtained from the LS estimation process using filter
gNB and TRP, along with the TRP information response vectors Fstart , Fmiddle , or Fend , depending on the position within
containing the relative Cartesian coordinates (x, y, z) of each the OFDM symbol, as follows:
TRP, which are essential for computing the user’s position. 
Before using these ToA measurements, the LMF must map Fstart · Ĥn,p,l [k] if k = 0 or k < KTC

the reported uLRTOAmeas from the gNB to actual measured Ĥinterp
n,p,l (k)= Fmiddle · Ĥn,p,l [k] if k ̸= 0 and (k + KTC ) < Nsc
values using predefined tables from ETSI TS 138 133. For

Fend · Ĥn,p,l [k] if (k + KTC ) ≥ Nsc or k = Msc −1

each location determination request, the LMF converts the (2)
array of ToA values into Time Difference of Arrival (TDoA) where KTC is the comb size parameter, Msc is the number of
values, referencing the TRP with the strongest Received Signal subcarriers in an SRS sequence, and Nsc is the total number
Received Power (RSRP). Using the known TRP locations, of subcarriers in an OFDM symbol.
a localization algorithm within the LMF—currently utilizing Next, frequency domain channel oversampling and conversion
linear and nonlinear least squares solutions—calculates the of the estimated channel from the frequency domain to the
user’s location and returns it to the determine-location API. time domain are performed using an Inverse Fast Fourier
This localization function is designed to accept TDoA values Transform (IFFT):
and TRP positions as input, producing an estimated user posi-  
tion as output, allowing for the integration of any localization Ĥinterp
n,p,l (1 : Nfft /2),
Ĥoversamp [k] = zeros(1, L × Nfft − Nfft ), (3)
 
algorithm that follows this input-output format into the LMF. n,p,l
Once the LMF has calculated the position of the target UE, Ĥinterp
n,p,l (N fft /2 + 1 : end)
it initiates the process to provide a response to the External where L is the oversampling factor, and Nfft is the IFFT length.
API that initiated the positioning request, as illustrated in The IFFT operation is defined as:
Figure 5. This response includes a data structure of type
L×(Nfft −1)
LocationData [10, Section 6.1.6.2.3]. The key information 1 X
elements included in our implementation of the positioning ĥoversamp
n,p,l (t) = Ĥoversamp
n,p,l [k]ei2πkt/L×Nfft
L × Nfft
response (i.e., LocationData), based on the list provided by k=0
(4)
3GPP [10, Section 6.1.6.2.3], are as follows: where t denotes the time-domain index. The ToA is estimated
• Geographical coordinates by identifying the index τnpeak corresponding to the maximum
• Relative Cartesian Location of the magnitude squared of the channel impulse response
This concludes our explanation of the end-to-end imple- averaged over all the SRS OFDM symbols:
mentation of the UL-TDoA positioning procedure in OAI, as SRS
Nsymb
1 X PX RX
2
illustrated in Figure 4. In the following section, we introduce τnpeak = arg max{ ĥn,p,l (t) } (5)
SRS
our state-of-the-art ToA estimation procedure, which has been t Nsymb l=1 p=1
 9

The ToA in seconds can be calculated as: further validate the functionality and reliability of our UL-
! TDoA implementation. These setups ensure the robustness of
τnpeak our implementation and confirm its capability to support UL-
ToAn = · Ts (6) TDoA positioning.
L

Where Ts is the sampling period. A. OAI-rfsimulator based setup

a) FAPI interface: The FAPI interface is a standardized
Our first validation approach uses a setup based on the OAI-
interface between the PHY and the MAC specified by the small
RF simulator, a tool within the OpenAirInterface (OAI) frame-
cell forum [13]. The SRS measurements are sent from PHY
work designed to emulate RF environments. This virtualized
to the MAC via the SRS.indication message. This message
environment allows for the testing of various network scenar-
includes a field called “Timing advance offset in nanoseconds,”
ios without physical hardware, enabling end-to-end protocol
which is meant to be used for UL TDoA positioning measure-
and message exchange validation. By replicating real-world
ments. However, the standard does not foresee that there can
RF conditions, the OAI-RF simulator supports the validation
be multiple such measurements from multiple TRPs connected
of 5G functionalities, such as UL-TDoA positioning, in a
to the same DU. We solved this issue by adding a new value
controlled and repeatable manner, making it a valuable asset
for SRS type (5) and a new report type (“Localization”) to
for testing and refining implementations efficiently.
the SRS indication message. These additions are allowed in
the current specification and do not break the compatibility
with implementations that do not support this report type. The
actual values of the Timing advance offsets in ns from the
multiple TRPs are sent in the Report tagged list value (TLV)
directly as an array in the value field, where each value uses
16bit.
2) gNB-MAC: The MAC is responsible for scheduling the
SRS and for handling the SRS indication messages from the
PHY.
The scheduling is different depending if the UE is connected
to the same MAC (serving cell measurements) or to a different Fig. 6. OAI-RF simulator-based setup
MAC (neighbor cell measurements).
The serving cell measurements are straightforward as the A detailed tutorial on building an OAI-RF simulator-based
SRS scheduling is already activated at the PDU session es- setup can be found here [15]. The working branch for our
tablishment during the connection procedure. Upon reception implementation is named NRPPA Procedures [16]. In the
of an F1 positioning measurement request, the MAC simply following, we discuss the key aspects of our setup and provide
takes the latest ToA measurement it received from the PHY relevant log details.
and generates the F1 positioning measurement response. 1) Preparing the Setup: The first step is to deploy the 5G
In the case of a neighbor cell measurement, the MAC core. In our setup, we utilized a Docker-based deployment of
first has to activate the SRS measurements. For this kind of the OAI 5G core. The Docker images for the 5G core network
measurement we have also had to slightly modify the usage functions (NFs) are open source, publicly available, and can
of the FAPI interface as the current interface does not support be pulled to the local server using the following commands.
this usage. We have introduced a special RNTI reserved for #Pull OAI Core Network Functions
docker pull oaisoftwarealliance/ims:latest
this usage. The RNTI is used in the SRS PDU of the UL TTI docker pull oaisoftwarealliance/oai-amf:develop
request sent from the MAC to the PHY and also in the SRS docker pull oaisoftwarealliance/oai-nrf:develop
docker pull oaisoftwarealliance/oai-smf:develop
indication sent back from the PHY to the MAC. This way we docker pull oaisoftwarealliance/oai-udr:develop
can associate the measurement with the measurement request docker pull oaisoftwarealliance/oai-upf:develop
docker pull oaisoftwarealliance/oai-udm:develop
message. docker pull oaisoftwarealliance/oai-ausf:develop
docker pull oaisoftwarealliance/oai-lmf:develop
docker pull oaisoftwarealliance/trf-gen-cn5g:latest
IV. VALIDATION OF OUR O PEN -S OURCE UL-TD OA The next step is to clone the OAI 5G RAN repository [16]
POSITIONING and build the RFsimulator-based gNB and UE. Our work is
In this section, we validate our open-source UL-TDoA part of the NRPPA Procedures branch3 .
git clone
positioning implementation within the OpenAirInterface (OAI) ,→ https://gitlab.eurecom.fr/oai/openairinterface5g.git
framework. We conducted end-to-end protocol testing and cd openairinterface5g/cmake_targets
git checkout NRPPA_Procedures
message exchange validation using two different setups: the # install dependencies
OAI-RF simulator-based [14] setup and the O-RAN-based
Localization Testbed at EURECOM. The OAI-RF simulator 3 The main branch of the OAI 5G RAN repository is develop, and all new

allowed us to test the complete message flow and protocol features are eventually merged into this branch. If the NRPPA Procedures
branch no longer exists, it indicates that the features have been merged into
interactions in a controlled environment, while the O-RAN- the develop branch of the OAI 5G RAN repository, and you should use the
based Localization Testbed provided a real-world scenario to develop branch instead.
10

./build_oai -I
# compile gNB and nrUE
./build_oai --gNB --nrUE -w SIMU
Once the NF images have been pulled and the RFsimulator-
based gNB and UE have been successfully built, we are
ready to deploy our RFsimulator-based setup using these
components. Use the following commands to deploy the 5G
core.
cd openairinterface5g/doc/tutorial_resources/oai-cn5g
docker compose -f docker-compose.yaml up -d
# verify the deployment
docker ps -a
Figure 7 shows the logs from a successful 5G core deploy-
ment. The logs of the AMF can be checked using the following

Fig. 7. 5G core deployment logs Fig. 10. Example logs of UE in the connected state.

command.
docker logs oai-amf -f

Figure 8 shows the AMF logs prior to starting the gNB and
UE.

Fig. 11. Example logs of AMF in the UE connected state.

API of the LMF. The request contains a data structure of type

InputData [10, Section 6.1.6.2.2], which includes the IMSI
Fig. 8. AMF logs before running gNB and UE value of the UE. We can initiate the positioning request using
the following command, where the IP address of the LMF is
Next, we start the gNB and UE using the following com- 192.168.70.141.
mands curl --http2-prior-knowledge -H "Content-Type:
#open a terminal to run the gNB ,→ application/json" -d "@InputData.json" -X POST
cd openairinterface5g/cmake_targets/ran_build/build ,→ \protect\vrule width0pt\protect\href{http://192.168.7 ⌋
sudo RFSIMULATOR=server ./nr-softmodem -O ,→ 0.141:8080/nlmf-loc/v1/determine-location}{http://192 ⌋
,→ ../../../targets/PROJECTS/GENERIC-NR-5GC/CONF/ ,→ .168.70.141:8080/nlmf-loc/v1/determine-location}
,→ gnb.sa.band78.fr1.106PRB.usrpb210.conf
,→ --gNBs.[0].min_rxtxtime 6 --rfsim --sa Figures 12–14 show example logs of the gNB and LMF
#open another terminal to run the UE after initiating the positioning request. The LMF logs can be
cd openairinterface5g/cmake_targets/ran_build/build
sudo RFSIMULATOR=127.0.0.1 ./nr-uesoftmodem -r 106 checked using the following command.
,→ --numerology 1 --band 78 -C 3619200000 --sa docker logs oai-lmf -f
,→ --uicc0.imsi 001010000000001 --rfsim
Figures 9–11 show example logs of the gNB, UE, and AMF
when the UE is in the connected state.
Now we are ready to start the positioning procedure for
the UE. To initiate the positioning process for a specific UE,
we send an HTTP POST request to the determine-location

Fig. 12. Example logs when gNB received TRP information request
Fig. 9. Example logs of gNB in the UE connected state.
 11

TABLE I
PARAMETERS OF THE F IRECELL O-RU

NR Radio Specification
Fig. 13. Example logs when LMF received TRP information response Band n77
Occupied Bandwidth(max) 100MHz
Duplex Mode TDD
Sub Carrier Spacing 30KHz
MIMO 4T4R
RF Output Power per port 250mWatt/ 24dBm
Antennas Internal/External
Connectivity Specification
10G Base-T over SFP
Physical
1G Base-T over Ethernet
Interface Protocol ORAN Split 7-2 CAT-A
Time and Synchronization IEEE 1588v2, ITU T G.8275.1
Fig. 14. Example logs when LMF received ToA information Environmental Specification
Powering PoE ++ Type 3 IEEE802.3bt
Dimension (mm) 250mm x 213.5mm x 92.1
Weight <4Kg
B. O-RAN based Localization Testbed at EURECOM Operating Temperature -5 to 40C / -40 to 55C
The localization testbed is part of the larger Open5G testbed Environmental IP31/ IP65
Mounting Style Wall/ Pole / Ceiling
deployed at EURECOM. The overall testbed consists of Anten
next s
computing and switching infrastructure interconnected through
high-speed fiber links with various radios (either software
Radio
defined radios like the USRP or commercial O-RAN radio moun
existi
units) allowing for virtualized deployment of 5G networks. O-RU 2

A critical component of the EURECOM 5G testbed is its

Coax
integration with OpenAirInterface, which provides all the Experimentation area
virtualized network functions to run the 5G network. O-RU 1

1) Deployment: In order to evaluate the localization fea-

tures described above, we have deployed 3 additional O-RUs O-RU 3

from Firecell outdoors (see Table I for details). An aerial

photo of the EURECOM building is shown in Figure 15. The
building has two symmetric wings and two different levels
following the slope of the hill it is built on. The top level roof
features two antenna sites, one on each wing, which are part Fig. 15. Deployment of the localization testbed at EURECOM.
of the greater EURECOM 5G testbed. Each site has multiple
fibre connections that run directly into EURECOM’s server
room which hosts the computing and switching infrastructure. cores each. For the fronthaul network it uses an Intel X710
We have deployed a Firecell RU on each of these sites and 4x10Gbps NIC. Two of the four ports are used to connect to
each RU drives 2 external antennas, which have been mounted the backhaul network (via a CISCO C9364C-GX switch) and
on the railings of the roof and are connected to the RU through the two other ports are connected to the fronthaul network.
a 10m low loss cable (the cable introduces an attenuation of The core network runs on the server ”alambix” in a docker
7 dB, which has been included in the link budget). These environment.
antennas overlook the lower roof of the Eurecom building, 3) Ground truth measurements: In this work, 16 ground
which is three floors below. The northeast wing of the lower truth positions (A-P) on the Eurecom experimentation area
roof is accessible to people and is used as an experimentation were selected in a relative Cartesian coordinate system. The
area. The southwest wing of the lower roof is off-limits for distances from each point to all antennas of the testbed were
people and features a third RU whose antennas are deployed measured using a BOSCH GLM-150-C laser distance meter,
on small tripods spaced 10m apart and at a height of 2m. Our
deployment can be seen in Figures 15 and 17.
2) Logical Architecture: The logical architecture of the
localization testbed is depicted in Figure 16. It follows a
basic O-RAN architecture with sync option LLS-C3, i.e., the
synchronization is managed by a Primary Reference Time
Clock (PRTC) and a Telecom Grandmaster (T-GM) that are
situated within the fronthaul network. The timing signals are
distributed from the PRTC/T-GM to the O-RU and the O-DU
via the fronthaul network (in our case a Cisco 93180-YC-
FX3).
The CU and DU run on a server ”colibri” with a In- Fig. 16. Logical architecture of the localization testbed.
tel(R) Xeon(R) Gold 6354 CPU @ 3.00GHz CPUs with 18
12

estimation that will be then used in a Non Linear Least Squares

estimation method akin to [17] for a more fined grained
positioning. The evaluation of this process is reflected in the
oai-lmf logs as follows:
...
[lmf_app] [info] handle measurement response
...
gnbId:3,trpId:1,trpRelCartLoc(x:0,y:0,z:2),k1:563
gnbId:3,trpId:2,trpRelCartLoc(x:-9,y:0,z:2),k1:563
gnbId:3,trpId:3,trpRelCartLoc(x:-27,y:0,z:2),k1:563
gnbId:3,trpId:4,trpRelCartLoc(x:-36,y:0,z:2),k1:563
...
ToA Values:5.72717e-07
Fig. 17. TRPs and ground truth positions ToA Values:5.72717e-07
ToA Values:5.72717e-07
ToA Values:5.72717e-07
...
suited for outdoor applications and long-distance measure- Estimated Position: x = 25.4048, y = 11.8080

ments with a range of 0.08 to 150.00 meters. The laser was And finally the estimated position is returned to the
mounted on a tripod at a height of 1.3 meters, approximating determine-location API.
the typical height when a person holds a UE. The first antenna,
located on RU3 at the corner of the building, served as Point Error (m) Point Error (m)
A 4.7766 I 3.0248
the reference point with coordinates (x=0, y=0, z=2.2). The B 4.6982 J 2.3258
positions of the other antennas were measured relative to this C 0.8191 K 3.3805
reference. The recorded distances were then used in nonlinear D 1.3082 L 3.2353
E 2.3743 M 0.3461
Euclidean distance equations to calculate the relative Cartesian
F 2.0003 N 4.8525
coordinates for each ground truth point. For all the points Pi G 2.2792 O 5.4106
with unknown position and antennas Aj with known and fixed H 3.3180 P 4.1295
position the following distance di,j system of equations has TABLE II
MAE E RROR ASSOCIATED WITH P OINTS A-P
to be solved to find Pi = {xi , yi }
q
dij = (xi − xj )2 + (yi − yj )2 + (zi − zj )2 (7)
q V. C ONCLUSIONS
fi (xi , yi ) = (xi − xj )2 + (yi − yj )2 + (zi − zj )2 −di,j = 0
(8) This paper provided the first open-source implementation
In MATLAB fsolve is a numerical solver used to find of the 3GPP Uplink Time Difference of Arrival (UL-TDoA)
the roots of systems of nonlinear equations fi (xi , yi ). When positioning method within the OpenAirInterface (OAI) frame-
solving for the coordinates of un unknown point based on work, successfully integrating UL-TDoA into both the RAN
known distances to a set of antennas, fsolve adjusts the val- and CN components. By adhering to 3GPP standards, this
ues of (xj , yj ) iteratively. It minimizes the difference between implementation enabled precise and real-time positioning of
the calculated distances (from the guessed coordinates to the user equipment (UE) in 5G networks, offering a flexible al-
known antenna positions) and the given distances. By doing ternative to proprietary solutions. The approach was validated
this, fsolve finds the point (xj , yj ) that satisfies the system through both simulation and real-world testing, demonstrating
of equations, effectively solving for the unknown coordinates. its reliability and accuracy. This work not only enhanced the
capabilities of OAI for 5G positioning but also contributed to
the broader research community by providing a valuable tool
C. Results for further innovation and collaboration in the field of cellular
This section describes the process of validating the overall network positioning technologies.
performance of a deployed 5G network by testing its end-to-
end functionality. The validation involves running the OAI 5G R EFERENCES
CN components, including the oai-lmf, alongside a gNB that
[1] 3GPP, “NG Radio Access Network (NG-RAN); Stage 2 functional
integrates CU-DU functions, and a Firecell’s ORAN RU. A 5G specification of User Equipment (UE) positioning in NG-RAN,” 3GPP,
phone, acting as a UE, is then registered with this network, Technical Specification 3GPP TS 38.305, 2020.
and the success of this registration is verified by analyzing the [2] F. Kaltenberger, A. P. Silva, A. Gosain, L. Wang, and T.-T. Nguyen,
“OpenAirInterface: Democratizing innovation in the 5G Era,” Computer
logs generated by the oai-amf as shown in Figure 10. Once we Networks, vol. 176, p. 107284, 2020.
ensure the UE and gNB are connected we trigger the determine [3] D. Li, X. Chu, L. Wang, Z. Lu, S. Zhou, and X. Wen, “Perfor-
location API to start the positioning request. mance evaluation of e-cid based positioning on oai 5g-nr testbed,” in
2022 IEEE/CIC International Conference on Communications in China
We anticipate receiving the relative Cartesian location from (ICCC). IEEE, 2022, pp. 832–837.
the gNB configuration file and the uL-RTOA values from the [4] J. A. del Peral-Rosado, A. Y. Yildirim, A. Soderini, R. Mundlamuri,
corresponding reported TRPs at the LMF. These inputs will F. Kaltenberger, E. Rastorgueva-Foi, J. Talvitie, I. Lapin, and D. Flachs,
“Initial experimentation of a real-time 5g mmwave downlink positioning
be utilized in the position estimation function. The LMF is testbed,” in European Navigation Conference (ENC 2024), Noordwijk,
running a Least Squares estimation algorithm for a coarse The Netherlands, May 2024, to be published in Engineering Proceedings.
 13

[5] J. A. del Peral-Rosado, S. Schlötzer, E. Ince, P. Nolle, F. Kaltenberger,

N. Sirola, S. Garlaschi, L. Canzian, I. Lapin, and D. Flachs, “Sub-
meter hybrid positioning with flying 5gnetworks and synchronization
corrections,” in ION GNSS+, Technical meeting and showcase of GNSS
technology, products and services, Baltimore, MD, Sep. 2024.
[6] I. Palamà, S. Bartoletti, G. Bianchi, and N. Blefari Melazzi, “Experimen-
tal assessment of sdr-based 5g positioning: methodologies and insights,”
Annals of Telecommunications, pp. 1–13, 2023.
[7] R. Mundlamuri, R. Gangula, F. Kaltenberger, and R. Knopp, “Novel
round trip time estimation in 5G NR,” in 2024 IEEE Global Com-
munications Conference: Wireless Communications (Globecom 2024
WC), Cape Town, South Africa, Dec. 2024, available as arXiv preprint
arXiv:2404.19618.
[8] 3GPP, “NG-RAN; NR Positioning Protocol A (NRPPa),” 3GPP, Tech-
nical Specification 3GPP TS 38.455, 2020.
[9] ——, “3rd Generation Partnership Project; Technical Specification
Group Radio Access Network;NG-RAN;NG Application Protocol
(NGAP),” 3GPP, Technical Specification 3GPP TS 38.413, 2024.
[10] ——, “5G System; Location Management Services; Stage 3,” 3GPP,
Technical Specification 3GPP TS 29.572, 2021.
[11] ——, “3rd Generation Partnership Project; Technical Specification
Group Core Network and Terminals; 5G System; Access and Mobility
Management Services; Stage 3,” 3GPP, Technical Specification 3GPP
TS 29.518, 2023.
[12] ——, “5G; NR; Physical channels and modulation (3GPP TS 38.211
version 16.2.0 Release 16),” 3rd Generation Partnership Project (3GPP),
Tech. Rep. TS 138 211, 2020.
[13] Small Cell Forum, “5G FAPI: PHY API Specification,” SCF, techreport
222.10.04, November 2021.
[14] OpenAirInterface, “Openairinterface rf simulator.” [Online]. Avail-
able: https://gitlab.eurecom.fr/oai/openairinterface5g/-/blob/develop/
radio/rfsimulator/README.md
[15] ——, “Openairinterface rf simulator based 5g ran deployment,” 2024.
[Online]. Available: TODOaddurl
[16] ——, “Openairinterface 5g ran repository,” 2024. [Online]. Available:
https://gitlab.eurecom.fr/oai/openairinterface5g.git
[17] M. Ahadi and F. Kaltenberger, “5GNR Indoor Positioning By Joint
DL-TDoA and DL-AoD,” in 2023 IEEE Wireless Communications and
Networking Conference (WCNC), 2023.