Subscriptionless location of wireless devices

SUBSCRIPTIONLESS LOCATION OF WIRELESS DEVICES

CROSS REFERENCE

[0001] This application claims priority to U.S. Application No.l 1/616,790, filed December 27, 2006 (attorney docket TPI-0846), entitled “Subscriptionless Location of Wireless Devices,” which is a continuation-in-part of Application Serial No. 11/607,420, filed December 1, 2006, and entitled “System for Automatically Determining Cell Transmitter Parameters to Facilitate the Location of Wireless Devices,” which are hereby incorporated by reference in their entirety.

TECHNICAL FIELD

[0002] The present invention relates generally to the field of wireless communications, and more specifically to the location of devices within the coverage area of a wireless communications network.

BACKGROUND

[0003] Several techniques for locating wireless devices involve the Mobile Station (MS) making measurements of the signals transmitted by the base stations of a wireless communication network. (The term MS or Mobile Station, as used herein, refers to any type of wireless phone or other mobile device having a radio communications capability.) These techniques are known by the acronyms EOTD, AFLT, OTD and ECID.

• Enhanced Observed Time Difference (EOTD) is a location technique defined in the ETSI 3GPP Technical Specification 43.059 in which a GSM MS makes relative time difference measurements of the beacon signals transmitted by geographically distributed base stations, where these measurements are used to compute a position.

WO 2008/085439 PCT/US2007/026255 • Advanced Forward Link Trilateration (AFLT) is a technique defined in the TIAIS-95 and CDMA 2000 standards in which a CDMA MS makes relative time difference measurements of the pilot signals transmitted by geographically distributed CDMA base stations, where these measurements are used to compute a location.

• Observed Time Difference (OTD) is a location technique defined in the ETSI3GPP Technical Specification 23.271 in which the User Equipment (UE), which is essentially a mobile station in a UMTS network, makes relative time difference measurements of the signals transmitted by geographically distributed Node Bs (base stations in a UMTS system), where these measurements are used to compute a location.

• Enhanced Cell Identification (ECID) is a technique used to locate GSM MSs in which the MSs perform received power level measurements of the signals transmitted by geographically distributed GSM base stations, where these measurements are used to compute locations.

[0004] All of these location techniques involve a MS measuring signals whose characteristics vary as a function of the distance between the MS and the Base Stations transmitting the signals. In addition, all of these location techniques require knowledge of key cell site information. Such key cell site information may include cell identification information and transmit antenna location. In addition, some of these location techniques require additional information about the transmitters, such as transmitter signal timing, signal transmit power, and signal propagation or signal loss in the environment. This information can be difficult to obtain from wireless network operators because it is dynamic and distributed across multiple data bases. This information may be difficult to obtain and maintain across multiple wireless network operators, as some operators may not be willing to cooperate and provide this information. The accuracy of each of the location techniques described above will be improved if a larger number of the base station signals are used in the location solution, which is possible when the transmit signals across multiple wireless networks are available. The accuracy of each of these techniques is dependent upon the number and quality of the signals available for measurement, and so the ability for a location solution to utilize these signals across multiple wireless networks will provide better performance than could be achieved if the measurements were limited to the signals of a single wireless network.

[0005] The subject matter described herein provides an automatic way to detect the existence of one or more useful wireless transmitters, determine the cell identification information so that each transmitter can be referred to later, determine the transmitter antenna

WO 2008/085439 PCT/US2007/026255 locations, determine the transmitter timing, determine the transmitter power level, and determine the signal power loss as a function of location, so that any such wireless transmitter can be used to locate mobile stations.

Additional Background Information Relating to Subscriptionless Location

[0006] The location of the MS is done by combining the measurements made by the MS of the downlink base station transmit signals, with the cell site information. This can be done either in the MS, or within the network, but in either case this involves the transfer of the cell site information and/or the MS measurements to the node which computes the location. In the systems deployed today, this information is transferred by the wireless link provided by the same wireless network that provides the downlink transmit signals upon which the location estimate is based. This could be either a control plane connection or a user plane connection. (See Application Serial No. 11/533,310, filed September 19, 2006, “User Plane Uplink Time Difference of Arrival (U-TDOA),” for a description of a user plane approach to network-based wireless location. As described, in a user plane architecture, a location server can communicate directly with the mobile device via a data or IP (Internet Protocol) link carried by the wireless operator’s radio network but not part of the control/voice (or access/traffic) channel structures, thus requiring no modifications to the core or radio network.) These techniques, however, do not support devices which are not served by the wireless network that is providing the downlink signals on which the location estimate is based. These techniques require that the device support two-way communication with the wireless network, and therefore require hardware in the device to support transmission to the wireless network. In addition, these techniques require utilization of the wireless network resources, as well as permission from a wireless service provider to facilitate the location. A system is needed to allow devices that are not able or allowed to communicate with the wireless network to be located based on measurements of downlink transmit signals provided by the wireless network. Many devices existing today that need to be located normally have data connections to the Internet (e.g., through Ethernet, broadband service providers using cable, fiber optics, or DSL, PSTN dialup connections, or 802.11 WiFi connections). By adding a wireless receive only capability to these devices to make measurements of the existing wireless downlink signals, the data connection can be used to provide a link between the device and location server to facilitate location. The devices, for example, could include desktop or laptop computers, voice over IP (VoIP) devices, or WiFi access nodes.

[0007] A goal of the invention described herein is to provide a way to locate devices based on downlink signal measurements made by the devices, where the devices are not part of

WO 2008/085439 PCT/US2007/026255 the wireless network or are not provided wireless service by the network. (As used herein, an expression such as based on [certain measurement/mformation] is not intended to mean that only the recited information or measurements are used. This expression should be given a broad meaning such that, for example, the wireless device may be located using the recited measurements in addition to other information.) Another goal is to provide a way to locate devices based on downlink signal measurements made by the devices, where the devices do not possess the ability to transmit signals to the wireless network. Yet another goal is to provide a way to locate devices based on downlink signal measurements made by the devices, where communication resources of the wireless network are not consumed to facilitate location.

'SUMMARY

[0008] The following summary is intended to explain several aspects of the illustrative embodiments described in greater detail below. This summary is not intended to cover all inventive aspects of the disclosed subject matter, nor is it intended to limit the scope of protection of the claims set forth below.

[0009] In one illustrative embodiment, the technology described herein provides a system for locating a mobile wireless device. The system includes a location processing node, at least one wireless device, and a server. In an exemplary embodiment, the wireless device is configured to communicate with the location processing node via a communications link, and to make scanning measurements of signals from one or more geographically distributed transmitters. Moreover, the at least one wireless device is further configured to assist the location processing node in determining key transmitter information by receiving and measuring characteristics of the signals and providing information about these characteristics via the communications link to the location processing node. The server is configured to communicate with a wireless device to be located, and to cause the wireless device to make signal measurements of signals from one or more transmitters and to provide measurement information to the location processing node. The characteristics measured by ±e at least one wireless device are useful to determine the key transmitter information.

[0010] In an illustrative embodiment, the at least one wireless device is further configured to communicate the key transmitter information to the location processing node, wherein the information may be used by the location processing node to compute the location of one or more wireless devices. In addition, the system is configured to operate with the one or more transmitters, and at least one transmitter is part of a first wireless communications network and at least one transmitter is part of a second wireless communications network. The server may also be configured to communicate via a user plane data channel with the at least one wireless

WO 2008/085439 PCT/US2007/026255 device, and the wireless device may be configured to provide measurement information via the data channel to the location processing node.

[0011] The key transmitter information preferably includes cell identification information, which may include at least one member of the group consisting of Cell ID, frequency channel, base station identity code, Cel! Global Identity, and Base Station ID. The key transmitter information may also include cell transmitter location information, which may include latitude and longitude, and possibly altitude. In addition, the key transmitter information may include cell transmitter signal timing information, and the signal measurements may include relative signal timing and/or absolute signal timing.

[0012] The technology described below also provides methods and systems for locating a wireless device as well as a wireless device of the type that is especially configured for use in the inventive methods and systems.

[0013] The described technology also provides, and may be embodied in, methods, wireless devices, and computer readable media comprising software for carrying out the functions and activities described herein.

[0014] An example of a method in accordance with the invention comprises the steps of providing, to a first node capable of computing location, key information for one or more base station transmitters of one or more wireless communications networks; and, at a wireless device to be located, measuring signals transmitted by the base station transmitter. The method may also include providing to the first node (which in this example is configured to compute location), via a communication link between the wireless device and the first node, data representative of the signal measurements; and, at the first node, computing the location of the wireless device to be located.

[0015] An exemplary system in accordance with the invention comprises a first node capable of computing location; means for providing, to the first node, key information for a base station transmitter of one or more wireless communications networks; a wireless device to be located, including means for measuring signals transmitted by the base station transmitter; and means for providing to the first node, via a communication link between the wireless device and the first node, data representative of the signal measurements.

[0016] An example of a wireless device in accordance with the invention comprises a receiver and a processor configured to measure signals transmitted by a base station transmitter of a wireless communications network; and means for communicating with a first node, via a communication link between the wireless device and the first node, and for transmitting data representative of the signal measurements to the first node.

WO 2008/085439

[0017] Other aspects and embodiments of the present invention are described below.

PCT7US2007/026255

BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The foregoing summary as well as the following detailed description are better understood when read in conjunction with the appended drawings. For the purpose of illustrating the invention, there is shown in the drawings exemplary constructions of the invention; however, the invention is not limited to the specific methods and instrumentalities disclosed. In the drawings:

[0019] Figure 1 is a block diagram depicting an environment, including two wireless communications networks, in which the inventive subject matter described herein may be deployed.

[0020] Figure 1A schematically illustrates how a mobile wireless device (which could be an LDP device or any other kind of MS), may be configured to communicate via a data channel with a server (which could be a Location Enabling Server or other type of server). The server may be configured to communicate via the data channel with wireless devices to be located, and to cause the devices to make measurements of signals from one or more transmitters and to provide measurement information to a location processing node (which could be the same node as the LES, or a different node).

[0021] Figure 2 is a flowchart of a process in accordance with an illustrative embodiment.

[0022] Figure 3 is a block diagram referenced below in explaining how the location of a mobile station (MS) may be computed using the measurements and base station parameters.

[0023] Figure 4 is a block diagram depicting an environment, including two wireless communications networks, in which the inventive subject matter may be deployed. In this environment, a device whose location is to be determined is able to communicate with a location server using a communication link not provided by the wireless communication networks.

[0024] Figure 5 schematically illustrates how a wireless device may be configured to communicate via a data channel with a server or location processing node. As shown in Figure 4, in this example the data channel provides a conununication link that is not provided by the wireless communications network.

[0025] Figure 6 is a flowchart of a process in accordance with the present invention.

DETAILED DESCRIPTION OF ILLUSTRATIVE EMBODIMENTS

[0026] We will now describe illustrative or presently preferred embodiments of the present invention. First, we provide an overview and then a more detailed description.

WO 2008/085439

PCT/US2007/0262S5

Overview

[0027] The technology described herein provides a system for locating devices within the coverage area of a wireless network. The invention may be embodied in a system that employs much of the existing infrastructure in a wireless network. For example, the system may utilize the wireless network to facilitate communication between theMSs and a location server. The system may employ a user-plane, or Secure User-plane (SUPL), connection between the MS and the location server. An example of such a user plane is defined by an Open Mobile Alliance technical standard (see www.openmobilealliance.org).

[0028] Co-pending Patent Application No. 11/533,310, filed September 19, 2006, entitled “USER PLANE UPLINK TIME DIFFERENCE OF ARRIVAL (U-TDOA),” describes a user plane approach to network-based wireless location. Typical U-TDOA solutions are often based on the control plane architecture, which can require extensive modifications of the mobile network infrastructure in line with the ANSI/3GPP location services standards (for example, ANSI/ETSIJ-STD-036 and ANSI ESTI GSM 03.17). The control plane approach involves the use of information conveyed in the control or voice channels (also known respectively as the access channel and traffic channels, among other names) to locate the mobile device. In contrast, in a user plane architecture, the location server can communicate directly with the mobile device via a data or IP (Internet Protocol) link carried by the wireless operator’s radio network but not part of the control/voice (or access/traffic) channel structures, thus requiring no modifications to the core or radio network. The ‘310 application describes a system that may be used to instruct the wireless location system (WLS) how to locate a mobile device (such as an LDP Device, where LDP stands for location device platform). In the control plane approach, the WLS waits for information from the wireless communications network before calculating a position, whether via U-TDOA, Cell-ID, Cell-ID+Timing Advance, or Cell-ID with Power Difference of Arrival. In the user plane approach, the mobile device provides to an LES (also called the Location Enabling Server, or LES) sufficient information over the data channel to perform the location calculation. The information provided to the LES is known to the mobile device (i.e., T DP Device) and this knowledge is leveraged to facilitate the location calculation. In addition, the mobile information can also be used for tasking, for example, to task the U-TDOA/AoA WLS since the information sent over the data connection can include serving cell, neighboring cells, frequency, and hopping pattern information. In the prior control plane approach, this information is obtained from the network via the E5, Lb or lupc interface (for example) and not from the mobile over a data channel.

WO 2008/085439 PCT/US2007/026255

[0029] Figure 1 shows an illustrative environment in which the technology described herein may be used. In this figure, a first wireless network includes a central office 41 and Base Transceiver Stations (BTSs) 10, 11, 12. Mobile devices, 0rMSs31,32, and 33, can communicate voice and data using this first wireless network. The MSs (31, 32, 33) and the location server 51 are connected by an IP connection provided by the first wireless network. In a user-plane solution, an application runs on the MS, which would perform the signal measurements when commanded by the server 51 through the IP connection and report the results of these measurements through the IP connection. The advantage of a user-plane implementation is that it does not require a wireless network operator to place additional features and infrastructure into the wireless network to support location related messaging between the MS and the location server 51. The MSs make measurements of the signals transmitted by BTSs 10, 11, 12 of the first wireless network, as well as the signals transmitted by the BTSs 21, 22, 23 of a second wireless network, which includes a second central office 42. These measurements, along with the derived cell site information, are used to determine the mobile device positions. Figure 1 also depicts wireless links 61, 62 and 63.

[0030] Figure 1A illustrates how a server and location processing node, which may be part of the server or a different node, may be configured or programmed to communicate with one or more wireless devices over a user plane data link 300. To perform an enhanced networkbased location, a MS 31 may be configured to receive broadcast acquisition data, register on the wireless communications system (if required) and then request data service from the wireless network to establish a data link or channel 300 as shown. In contrast to the control channels and signaling of the wireless communications system (the control plane), the data channel 300 (the user plane) supports a modulation to support data transmissions (data signaling is not re-encoded and compressed by the wireless communications system as with voice signaling, but rather passes though the wireless system as shown in Figure 1A). The payload contents of the data channel 300 do not require examination or modification by the functional elements of the wireless communications system. The data channel payload does not inform, control, or modify the operations of the elements of the wireless communications system as does control channel data. The data channel 300 may be carried as payload in an assigned data channel either as raw binary data or in a voice channel as a series of voice frequency tones. The data connection may be routed by the data network (reference numeral 300 in Figure 1A) to a server 51 and/or location processing node 52. Upon connection with the server or location processing node, the MS 31 then transmits its data. Similarly, the data channel may be used to transmit commands from a server to the MS.

WO 2008/085439 PCT/US2007/026255

[0031] Exemplary aspects of the inventive system include the following:

1. The key information for each base station transmitter is determined across one or more wireless networks. This key information may include:

• Cell Identification information;

• Transmitter location, including latitude, longitude and altitude;

• Signal timing;

• Signal transmit power; and • Signal propagation.

2. This key information is provided to a node capable of computing a location. This node could be the MS, the location server, or some other node.

3. The MS to be located makes measurements of transmitted signals. Signal measurements may include timing, power level measurements, or signal to noise ratio measurements.

4. Signal measurements performed by the MS are provided to a node capable of computing a location.

[0032] The step of providing information for each base station may include the following steps:

1. Fixed or wireless devices scan for wireless base station signals;

2. Devices determine cell or base station identification information;

3. Devices make measurements of the received base station signals. Such measurements may include signal timing/phase and power level.

4. The key transmitter parameters are determined based on these signal measurements.

[0033] This concept is distinct from several location concepts defined in the prior art, which generally require that the transmitter location and timing, and transmit power are known. See, e.g., U.S. Patent Nos. 5,293,645 (Sood); 6,529,165 (Duffet-Smith); 5,646,632 (Khan); 5,045, 861 (Duffet-Smith); and 6,094,168 (Duffet-Smith). For example, U.S. Patent No. 6,529,165 identifies a method to determine the position of a MS, as well as the base station signal timing, through a complex matrix solution. This solution requires the cell IDs and cell positions to be known a priori. The technology described herein provides for automatic determination of relevant cell site information, which may include identification for the cell sites, positions for the cell transmit antenna, transmit power and signal propagation.

WO 2008/085439 PCT/US2007/026255

[0034] We also describe herein methods and systems for locating a wireless device using a communication link not provided or supporter by a wireless communications system whose base stations are used to obtain information used to locate the wireless device. For example, an implementation of a method in accordance with the invention comprises (a) providing, to a first node, key information for one or more base station transmitters of one or more wireless communications networks; (b) at a wireless device to be located, measuring signals transmitted by the one or more base station transmitters; (c) communicating information representative of one of the key information and the signal measurements, wherein the information may be communicated via a communication link to one of the first node and the wireless device to be located, wherein the communication link may be not provided by the one or more wireless communications networks; and (d) at one of the first node and the wireless device to be located, computing the location of the wireless device to be located. The first node may be configured for computing location, and the communication link may comprise an Ethernet link, the Internet, a dial-up telephone link, a WiFi link, or the like. The first node may include the wireless device to be located, or may be a server. Moreover, the signal measurements may include timing measurements, such as time of arrival (TOA) measurements or time difference of arrival (TDOA) measurements, power level measurements, and/or signal to noise ratio measurements. The key information may include cell identification information, transmitter location information, including latitude and longitude information, signal timing information, signal transmit power information, and/or signal propagation information. In addition, the key information may be automatically determined by one or more wireless devices, or may be known a priori. The method may also include, at the wireless device to be located, measuring signals transmitted by a plurality of base station transmitters, wherein the plurality of base station transmitters include transmitters from at least two wireless networks. The method may be employed to locate wireless devices that lack a wireless transmitter, and the wireless device to be located may comprise a computer, a WiFi access node, a Voice over Internet Protocol (VoIP) access node, and/or a Video over Internet Protocol access node. The method may be carried out to provide location for emergency services, such as, for example, location services for emergency VoIP calls.

Detailed Description of System for Automatically Determining Cell Transmitter

Parameters

[0035] As discussed above, Figure 1 is a high level diagram of one presently preferred embodiment. Elements 10, 11, and 12 are BTSs, which are part of a first wireless network. Elements 21,22, and 23 are BTSs that are part of a second wireless network. Elements 31, 32,

PCT/US2007/026255 and 33 are devices existing within the first wireless network, and these devices are capable of making signal measurements, including time difference and/or power level measurements. The devices could be fixed devices with known position, or mobile devices with known or unknown positions. Elements 41 and 42 are the central office equipment of the first and second wireless networks, and element 51 is a location server, which is connected to the MSs 31, 32, and 33 via wireless links 61, 62, and 63, through the first wireless network.

[0036] Location server 51 tasks MSs 31, 32, and 33 via commands through the wireless network to scan all available wireless bands for base station broadcast signals. In North America, this could include the cellular (800 MHz) band and PCS (1900 MHz) band. In Europe, this could include the GSM (900 MHz) band and the PCN (1800 MHz) band, or the UMTS (2100 MHz) band. In other regions, these bands may be different, and over time the set of bands may change as licenses for wireless service evolve. During this scanning process, the MS will store information for each of the base stations it can detect. The MS may be commanded to scan and report cell information for cells outside of its home network, as these cells are just as useful as the cells of the home network in supporting location related measurements. This cell information may include: cell identification information, broadcast channel number or frequency, received signal power, and relative time difference of received signals. This information may then be provided to the location server 51. If the MS has any other relevant position information, such as a position determined from a built-in GPS receiver, or if the MS’s position is fixed and is known, or if the timing of the device can be mapped to timing derived in the device by GPS, this information can be provided to the server as well. This information from many MSs can be collected by the location server 51 and used to determine information that can be used to locate these MSs, and other MSs in the area, in the future.

[0037] Figure 2 is a flowchart of a high level process embodying this location technique. The process may be described as follows:

[0038] Step 1: The key information for the base station transmitter is determined across one or more wireless networks. This key information includes:

• Cell Identification information • Transmitter location, including latitude, longitude and altitude • Signal timing • Signal transmit power • Signal propagation

[0039] Step 2: This key information is provided to a node capable of computing a location. This node could be the MS, the location server, or some other node.

־ 11 WO 2008/085439 PCT/US2007/026255

[0040] Step 3: MS makes measurements of transmitted signals. Signal measurements may include timing, power level measurements, or signal to noise ratio measurements.

[0041] Step 4: Signal measurements made by the MS are provided to node capable of computing a location.

[0042] Step 5: MS location is computed.

[0043] Step 1, providing key site information, preferably includes the following: Fixed or wireless devices scan for wireless base station signals. The devices determine cell or base station identification information, and make measurements of the received base station signals, including signal timing/phase and power level. The signal measurements made by these devices are provided to a Location Node, along with the determined cell or base station identification information are provided to a node, where this information is used to determine the cell site transmitter location, cell transmitter signal timing, signal transmit power, and signal transmit power loss as a function of location.

GSM Scanning

[0044] For a GSM system as defined in the ETSI 3GPP specifications, the scanning processing could include many of the methods already used by GSM MSs to acquire downlink beacon signals, and cells within a GSM network. For example: The MS will scan each 200 kHz channel in each band it supports. At each channel, the MS tries to detect the Frequency Correction Channel (FCH) to identify downlink beacon signals and to make frequency adjustment to aid further acquisition of the downlink signals. The FCH contains a single tone signal, which appears on the downlink beacon channel at a regular interval. The channel could be detected, e.g., through a matched filter or a correlation process. The Absolute Radio Frequency Channel Number (ARFCN) for each detected FCH is useful information for future measurements. If a FCH is found, or possibly even if it is not found, the MS will attempt to ־ detect the Synchronization Channel (SCH), which contains a frame with a known data pattern that repeats on the beacon channel at a regular interval. This signal could be detected with a matched filter or correlation techniques. The SCH contains a SCH information message that contains the Base Station Identify Code (BSIC) and the parameters ΤΙ, T2, and T3, which describe the GSM frame number. At this time, a timing measurement could be made, relative to an internal MS clock or to another measured signal. The signal power could be measured as well. This channel can be used by the MS to determine the frame timing of the beacon signal to allow further analysis of the downlink beacon signal.

WO 2008/085439 PCT/US2007/026255

[0045] Next, the MS could demodulate the Broadcast Control Channel (BCCH) to gather additional information about the cell. The BCCH contains System information messages that could be used for cell identification, as well as aid further scanning. For example, the System information Type 2, or Type 2bis message, contains the BCCH Frequency List, which contains the ARFCNs of the beacon channels of the neighbor cells. This could be used to guide the MS to the next set of channels to scan. System information Type 3 contains the Cell Identification, which can be used to identify this cell, to correlate this measurement with other measurements made by the same or different MSs, made simultaneously or at different times. System information Type 6 also contains the Cell Identification, which can be used to identify this cell, to correlate this measurement with other measurements made by the same or different MSs, made simultaneously or at different times.

[0046] Therefore, by scanning the channels, the MS is able to determine the ARFCN, the BSIC, the Cell ID, list of neighbor cell frequencies, cell timing, and received signal power.

IS-95/CDMA-2OOQ Scanning

[0047] A similar scanning process could be used by ain IS-95 or CDMA-2000 system. For example: First the MS scans the forward link Pilot Channel. Each cell transmits the Pilot Channel, but at different time offsets relative to an absolute time. The Pilot Channel is detected by the MS through correlation or matched filter techniques. At this time, a timing measurement could be made, relative to an internal MS clock or relative to another measured signal. The signal power could be measured as well.

[0048] Once the Pilot Channel is acquired, the MS can decode the Synch Channel. The Synch Channel provides the current time of day, as well as the Long Code State and the offset applied to the Pilot Channel.

[0049] Once the MS has decoded the Synch Channel, it can decode the Paging Channel. The Paging Channel contains the System Parameters Message, which contains the Base Station ID. The Paging Channel also contains the Neighbor List message, which defines the set of channels and Pilot Channel offsets the MS can use to search for neighbor cells.

UMTS Scanning

[0050] A similar scanning process can be used in a UMTS system, as is used in an IS95/CDMA 2000 system. For example: First the UE acquires the Primary Synchronization Channel. The Primary synchronization channel is common to all cells and transmits the Primary Synchronization Code (PSC). The channel can be acquired through matched filter or correlation techniques.

WO 2008/085439 PCT/US2007/026255

[0051] Once the UE has acquired the PSC, it is able to able to acquire the Secondary Synchronization Channel (S-SCH). The S-SCH allows the UE to determine frame synchronization, and to identify the scrambling code used for the BCCH for that cell. At this time, a timing measurement could be made, relative to an internal MS clock or to another measured signal. The signal power could be measured as well.

[0052] Once the scrambling code is determined for the cell, the UE is able to de-spread the Broadcast Physical Channel, and obtain system information form the BCCH. The BCCH contains cell identification information as well as neighbor cell information.

[0053] The scanning process may repeat, or particular mobiles may be asked to re-scan all channels, or particular channels to improve the reliability and accuracy of the measurements.

[0054] The scanning technique in general is common to all air interfaces, and is not limited to the air interfaces specifically discussed herein, but apply to WiFi, WiMAX, WiBro, and other air interfaces, whether currently used or defined in the future. The scanning may be performed by mobile devices (MSs) where the location of the device is unknown, or by fixed devices, such as Mobile Stations or Location Measurement Units (LMUs) deployed in known locations.

[0055] The measurements and information determined from the MS scanning are provided to a node, which uses this to determine the remaining key cell site information, including cell transmitter locations, cell transmitter timing, cell transmit power, and signal propagation.

Determination of Key Cell Site Information

[0056] For a location system based on downlink timing measurements, the additional key information includes transmitter position and transmitter timing. This key information can be derived as explained below.

[0057] Figure 3 shows a simple two-transmitter, one-receiver scenario, with cell transmitters ^c and ^b along with a single mobile station ⁰.

[0058] In this scenario, ^0TDmeas“^ represents the measured time difference of arrival 55 M of signals from transmitter sites ^c and ^b to the mobile station ״.

Toff_b is the time offset of cell site transmitter*^, relative to some absolute time.

Toffc is the time offset of cell site transmitter *^, relative to some absolute time.

potential coordinates for a mobile station measurement^״.

(Eot_Sb,Lon_Sb) p_Otentia] _c00rdinates of cell site transmitter .

WO 2008/085439 (Latj^Lon^) _afe ρ_01επ1^ coordinates of cell site transmitter ^c.

c is the velocity of propagation of an electromagnetic wave in air (or a vacuum).

cr_afre is the expected standard deviation of the OTD measurement.

[0059] An error is computed for each OTD measurement, by computing the difference between the measured time difference (OTDmeas) and the theoretical time difference (OTDtheory assuming a given position for each cell site transmitter י and (Lat_5c, Lon^), _a p_OSj_tj_on f_{rom w}hich the mobile station measurement is made ), and a time offset ^T0-^^b and ^T0$^c for each site.

Error״ _te = OTDtheor_abeTDmeas_{a be}

Where

OTDtheor_abc =—*[dist(S_c,M _a)-dist(S_b,M_g)] + Toff_b-Toff_c' ’ c

Where dist(S_I,M _y)

S M is the distance between cell site antenna ¹ and MS ^γ.

[0060] Many such measurements are made by many MSs for many sites. A combined error function is created from the set of errors for all the measurements. This could be a sum of square errors, weighted square errors or some other function. The weighted square error function would be:

Error(Lat^Lon.,Lat_u,Lon_utTpff)= £ % (OTHtheor_gbc-OTDmeas_gJ>^²

AHMtasuremcnls ' ^{0 ,c}

Where

Lat' ,Lon, ,OTDoff are vectors which describe the coordinates and time offsets for the full set of cell site transmitters, and are vectors which describe the coordinates of the MSs for the full set of measurements.

[0061] It may be possible that some of the devices making measurements have a clock which is synchronized to some known time base, such as GPS time. For those devices, and absolute Time of Arrival (TOA) can be made for individual signals, rather than observed time differences. In this case the error function is explained:

WO 2008/085439 PCT/US2007/026255

TOAmeas^ _b is the measured time of a signal from transmitter S_b arriving d at mobile station M <7_{a b} is the expected standard deviation of the OTD measurement.

Then, an error is computed for each measurement, by computing the difference between the measured time of arrival (TOAmeas ) and the theoretical time of arrival (TOAtheor), assuming a given position for the cell site transmitter (Lat_Sb, Lon_sb) and a position from which the mobile station measurement is made (Lal_Ma,Lon_Ma), and a time offset Toff_k for the site.

Error_{a b} -TOAtheor_{a b} -TOAmeas _ab

Where

TOAtheor_ab = ~*[dist(S_b,M _g)}-Toff_b c

The combined error function for a system using absolute time of arrival measurements would be:

Error(]M_s,Lon_s,LaL_utLpn_u,T^)= Σ ½. (TOAtheor_ab -TOAmeas^)²AffTOAMtaiuremenis / ^a׳^

[0062] Or, if there are a combination of mobile stations with some making time of arrival measurements, and others making time difference of arrival measurements, the error function would be:

[0063] In this example, the appropriate error function is then minimized over the possible set of coordinates for each cell site transmitter, the possible set of coordinates of the MS for each measurement, and the possible values for transmitter time offsets. This set produces the least squared error. The invention is not limited to a least squares error function. Other error functions could be used.

[0064] Each of the time difference, or time of arrival measurements is information that can be used to solve for all of the unknown variables. If the total number of measurements is greater than the total number of unknown variables, then the measurements can provide for a unique solution for each variable. In addition, if there are many more measurements than unknown variables, the system is over determined, and a solution is also possible, with the advantage that the effects of individual measurement errors will be reduced.

[0065] For example, each MS could make 10 OTD measurements per measurement attempt on average. This error function could become quite complex, as there may be more than 1000 cells in a large network, and more than 100,000 MS measurement attempts required to obtain a highly over determined measurement of the system. In this example, there would be on

WO 2008/085439 PCT/US2007/026255 the order of one million OTD measurement errors (-10 per measurement attempt), which would be optimized over about 203,000 unknown variables, which include the latitude and longitude for each ofthe 100,000 measurement attempts, and the latitude and longitude and time offset value for each of 1000 cell site transmitters. This would be a very large non-linear function to minimize, but is not an intractable problem, and can be solved with today’s computers. Setting the error function to a value of zero produces a very large non-linear equation to solve. Many available articles and books provide methods for solving non-linear equations.

[0066] For the above error functions to provide valid values of the unknowns, the time offset of the cell site transmitters must have a small variation during the time the measurements are made and used. Often this is the case as the base station transmitter timing is based on communication links back to a central office, which are ultimately all connected to a very stable time base. The stability of the time base will limit the amount of time a given set of time offsets are valid. In addition, the variation of the time offsets may be modeled as a function of time; for example, as a linear function of time modeled as an offset plus a drift rate multiplied by a time difference. This model, which is more complex than a single offset, would create an additional variable to solve, such as a time drift rate, but could provide time offset measurements, which are valid, for a longer period of time, improving accuracy.

[0067] This process can be greatly simplified as some of this information may already be known. For example, many of the MSs may have an accurate position determined with a GPS or other location capability when making measurements, or the devices may be fixed at known locations and act as Location Measurement Units, such as those defined in the 3GPP Technical Specifications. In the above example, the same error function could be used, but the number of unknown variables would be reduced by 200,000, because the cell site transmitter variables were ftp.terminert using only measurements from MSs or LMUs that have an accurate GPS or otherwise have a known position.

[0068] Another example of simplification is that some of the cell site coordinates are known. This might be the case if the system is deployed with cooperation of one or more wireless operators that provide the cell position information, while sites from one or more additional operators which do not provide the cell coordinates are used. In this case, the example above could be reduced by 1000 variables if half (½) of the original 1000 cells have known coordinates.

[0069] A further simplification that dramatically helps the real time performance is that the positions of the cell site antennas do not vary with time. Once a set of cell transmitter positions is established, it can be assumed to be correct in the future, and need not be solved for

WO 2008/085439 PCT/US2007/026255 in real time on a frequent basis. Logic can be put in place which periodically checks for new cell site IDs, or identifies particular cell site transmitters where measurements of the signal from that site are particularly inaccurate, possibly indicating the coordinates are wrong. The coordinates for this new cell or cells with incorrect coordinates can be determined within the method described above, with MS measurements with known or unknown coordinates, and with the coordinates of nearby sites also known.

[0070] For some systems, such as GSM and UMTS WCDMA systems, the cell site transmitters are typically not synchronized. However, in IS-95 and CDMA 2000 systems, the cell site transmitters are synchronized, or in some cases the cell transmitters in a GSM or UMTS system could be synchronized. In the synchronized case, the time offset can be assumed constant, or measured infrequently, and then assumed to be stable over long periods of time, similar to the assumptions which could be made about the cell site positions in the above example.

[0071] The problem can also be reduced to smaller sets of mobile measurements, and cell site transmitters in a particular area. This smaller set of unknowns and measurements would be used to solve for subsets of the variables, which are later combined to create a full solution. For example, this method could be used to solve for the key information for just one cell transmitter at a time. In this case, only a first set of MS measurements involving the particular cell site transmitter of interest, as well as any cell site transmitters reported by the set of MSs which are reported, would be included in the solution. Optionally, any additional MS measurement that includes any of the cell site transmitters found in the first set of measurements could be included. In this case, the solution would be limited to a smaller geographic area, perhaps including only 10-20 cell transmitters, and 100-200 MS measurements, a much smaller set when compared to the first example. Then, the key information for the single transmitter is determined and tagged as known. Thereafter, the same process repeats on a second cell in this original set, but using the known information of the first cell, in the solution of the information of the second cell, as well as all MS measurements which include this second cell. This entire process would then be repeated on a 3^rd and 4^th cell, each time using the known information for the previous cells, until the key information for all cells is determined. This process could be generalized to select subsets of MS measurements and cell transmitters included in these measurements to solve for subsets of the unknown information that are then marked as known, and can be used in the solution of subsequent subsets of unknown information.

[0072] 3GPP Technical Specification 44.031 defines the parameters needed by the MS to make time difference measurements, as well as the set of cell transmitter information required

WO 2008/085439 PCT/US2007/026255 to perform an EOTD location. This includes the cell transmitter ARFCN, the Cell ID, the BSIC, the frame timing information, and the transmitter location. The above procedures automatically determine all of the information. Along with the timing measurements made by the MS to be located, all information is available to perform an EOTD location.

(0073] The IS-95 and CDMA 2000 technical specifications define the parameters needed to perform an AFLT location. This includes the Pilot PN offsets, the transmitter locations, and the radio channel numbers. The above procedures automatically determine all of the information. Along with the timing measurements made by the MS to be located, all information is available to perform an AFLT location.

[0074] 3GPP Technical Specification 25.331 defines the parameters needed by the UE to make time difference measurements, as well as the set cell transmitter information required to perform and OTD location in a UMTS network. This includes the cell transmitter, frequency channel, the cell identification information, the frame timing information, and the transmitter location. The above procedures automatically determine all of the information. Along with the Liming measurements made by the UE to be located, all information is available to perform an OTD location.

[0075] This system may be implemented with a user plane or Secure User Plane (SUPL) connection between the MS and the location server as defined by OMA. The MS and the location server are connected by an IP connection, which is provided by a cellular wireless operator, through an 802.11 WiFi network, or even through a wired connection. In a user plane solution, an application running on the MS could perform the signal measurements when commanded by the server through the IP connection, and report the results of these measurements through the IP connection. The advantage of a user plane implementation is that it does not require a wireless operator to place additional features and infrastructure into the wireless network to support location related messaging between the MS and the location server.

Subscriptioniess Location

[0076] An extension of the above approach utilizes a communication link between the device to be located and the location server. This link is not provided by the wireless network providing the downlink transmit signals upon which the location estimate is based. Figure 4 is a high level diagram of one presently preferred embodiment. Elements 10, 11, and 12 are BTSs that are part of a first wireless network, and elements 21, 22, and 23 are BTSs that are part of a second wireless network. Element 30 is a device capable of making downlink signal measurements, which may include absolute time, time difference and/or power level

WO 2008/085439 measurements. The devices could be fixed or mobile, with known or unknown positions. Elements 41 and 42 are the central office equipment of the first and second wireless networks, and element 51 is a location server, which is connected to the device 30 via a data links 61 that is not provided by either wireless network providing the signals used for location. All messaging between the device 30 and location server 51 occur over link 61, and this link 61 is not provided by the first or second wireless networks.

[0077] Figure 5 illustrates how a server 51 and location processing node 52, which may be part of the server or a different node, may be configured or programmed to communicate with one or more devices 31 over a data link 300. For example, a device 31 may be configured to receive broadcast acquisition data, and then employ data link 300 to communicate base station transmit signal measurements to the location processing node 52, as shown. Similarly, the data channel may be used to transmit commands from a server to the device 31.

[0078] Figure 6 is a flowchart of a high level process embodying this location teehnigne. The process may be described as follows:

Step 1: The key information for the base station transmitter is determined or known across one or more wireless networks, and is provided to a node capable of computing a location. This node could be the device to be located, the location server, or some other node. This key information may include:

• Cell Identification information • Transmitter location, including latitude, longitude and altitude • Signal timing • Signal transmit power • Signal propagation

Step 2: The device makes measurements of transmitted signals. Signal measurements may include timing, power level measurements, or signal to noise ratio measurements.

Step 3: Signal measurements made by the device are provided to the node capable of computing a location.

Steps 4 and 5 : Device location is computed.

[0079] In this illustrative example, all information exchange between the device and the location server, or location node, is facilitated by a data link that is not provided by the wireless network providing signals used in the location estimation process. Accordingly, the following goals may be accomplished: (1) Devices may be located based on downlink signal measurements made by the devices, where the devices are not part of the wireless network or are not provided wireless service by the network. (2) Devices may be located based on downlink signal

WO 2008/085439 PCT/US2007/026255 measurements made by the devices, where the devices do not possess the ability to transmit signals to the wireless network. (3) Devices may be located based on downlink signal measurements made by the devices, where communication resources of the wireless network are not consumed to facilitate location.

Conclusion

[0080] The true scope the present invention is not limited to the illustrative embodiments disclosed herein. For example, the foregoing disclosure of a Wireless Location System (WLS) uses explanatory terms, such as wireless device, mobile station, location processing node client, network station, and the like, which should not be construed so as to limit the scope of protection of this application, or to otherwise imply that the inventive aspects of the WLS are limited to the particular methods and apparatus disclosed. For example, the terms LDP Device and LES are not intended to imply that the specific exemplary structures depicted in Figures 1 and 2 must be used in practicing the present invention. A specific embodiment of the present invention may utilize any type of mobile wireless device as well as any type of server computer that may be programmed to carry out the invention as described herein. Moreover, in many cases the place of implementation (i.e., the functional element) described herein is merely a designer’s preference and not a requirement. Accordingly, except as they may be expressly so limited, the scope of protection is not intended to be limited to the specific embodiments described above.