Patent Description:
It is often desirable to know the location of a user equipment (UE), e.g., a cellular phone, with the terms "location" and "position" being synonymous and used interchangeably herein. A location services (LCS) client may desire to know the location of the UE and may communicate with a location center in order to request the location of the UE. The location center and the UE may exchange messages, as appropriate, to obtain a location estimate for the UE. The location center may return the location estimate to the LCS client, e.g., for use in one or more applications.

Obtaining the location of a mobile device that is accessing a wireless network may be useful for many applications including, for example, emergency calls, personal navigation, asset tracking, locating a friend or family member, etc. Existing positioning methods include methods based on measuring radio signals transmitted from a variety of devices including satellite vehicles and terrestrial radio sources in a wireless network such as base stations and access points. Various techniques for positioning are described in <NPL>.

The invention as defined in the independent claims to which reference is directed with preferred feature set out in the dependent claims.

Techniques are discussed herein for passive positioning of user equipment (UE) in <NUM> NR. <NUM> NR includes several positioning methods such as downlink (DL) and uplink (UL) Time Difference of Arrival (TDOA), DL Angle of Departure (AoD), UL Angle of Arrival (AoA), DL initiated Round Trip Time (RTT), and combinations of these methods. In general, some TDOA methods may require network synchronization. In contrast, RTT based methods are not dependent on network synchronization. Simultaneously positioning user equipment in high density areas (e.g., stadiums, convention centers, Internet of Things (IoT) installations, and Industrial IoT (IIoT), etc.) may present challenges associated with messaging and bandwidth limitations. For example, RTT methods require transmissions from each UE and thus may not be scalable in UE dense environments. DL TDOA based methods, however, with time synchronized NR networks may be scaled to a large number of devices without exceeding bandwidth limitations. For example, fixed overhead positioning reference signal (PRS) transmissions from base stations may be used. The PRS transmissions are independent from the number of UEs and the UEs are not required to transmit responses to the PRS transmissions.

The techniques provided herein utilize passive positioning techniques with a plurality of stations. For example, a first base station may provide a first DL PRS to a second base station and a UE may overhear the first DL PRS. In response to receiving the first DL PRS from the first base station, the second base station may transmit a second DL PRS to the first base station, and the UE may overhear the second DL PRS. One of the stations, or another network resource, may provide turnaround time information associated with the reception and transmission times of the first and second DL PRSs, and location/distance information associated with the first and second stations. The UE may be configured to utilize the time difference of arrival of the first and second DL PRS and the corresponding transmission times, turnaround time information, and location information to compute a TDOA position. These techniques and configurations are examples, and other techniques and configurations may be used.

Referring to <FIG>, an example of a communication system <NUM> includes a UE <NUM>, a Radio Access Network (RAN) <NUM>, here a Fifth Generation (<NUM>) Next Generation (NG) RAN (NG-RAN), and a <NUM> Core Network (5GC) <NUM>. The UE <NUM> may be, e.g., an IoT device, a location tracker device, a cellular telephone, or other device. A <NUM> network may also be referred to as a New Radio (NR) network; NG-RAN <NUM> may be referred to as a <NUM> RAN or as an NR RAN; and 5GC <NUM> may be referred to as an NG Core network (NGC). Standardization of an NG-RAN and 5GC is ongoing in the <NUM>rd Generation Partnership Project (3GPP). Accordingly, the NG-RAN <NUM> and the 5GC <NUM> may conform to current or future standards for <NUM> support from 3GPP. The RAN <NUM> may be another type of RAN, e.g., a <NUM> RAN, a <NUM> Long Term Evolution (LTE) RAN, etc. The communication system <NUM> may utilize information from a constellation <NUM> of satellite vehicles (SVs) <NUM>, <NUM>, <NUM>, <NUM> for a Satellite Positioning System (SPS) (e.g., a Global Navigation Satellite System (GNSS)) like the Global Positioning System (GPS), the Global Navigation Satellite System (GLONASS), Galileo, or Beidou or some other local or regional SPS such as the Indian Regional Navigational Satellite System (IRNSS), the European Geostationary Navigation Overlay Service (EGNOS), or the Wide Area Augmentation System (WAAS). Additional components of the communication system <NUM> are described below. The communication system <NUM> may include additional or alternative components.

As shown in <FIG>, the NG-RAN <NUM> includes NR nodeBs (gNBs) 110a, 110b, and a next generation eNodeB (ng-eNB) <NUM>, and the 5GC <NUM> includes an Access and Mobility Management Function (AMF) <NUM>, a Session Management Function (SMF) <NUM>, a Location Management Function (LMF) <NUM>, and a Gateway Mobile Location Center (GMLC) <NUM>. The gNBs 110a, 110b and the ng-eNB <NUM> are communicatively coupled to each other, are each configured to bi-directionally wirelessly communicate with the UE <NUM>, and are each communicatively coupled to, and configured to bi-directionally communicate with, the AMF <NUM>. The AMF <NUM>, the SMF <NUM>, the LMF <NUM>, and the GMLC <NUM> are communicatively coupled to each other, and the GMLC is communicatively coupled to an external client <NUM>. The SMF <NUM> may serve as an initial contact point of a Service Control Function (SCF) (not shown) to create, control, and delete media sessions.

<FIG> provides a generalized illustration of various components, any or all of which may be utilized as appropriate, and each of which may be duplicated or omitted as necessary. Specifically, although one UE <NUM> is illustrated, many UEs (e.g., hundreds, thousands, millions, etc.) may be utilized in the communication system <NUM>. Similarly, the communication system <NUM> may include a larger (or smaller) number of SVs (i.e., more or fewer than the four SVs <NUM>-<NUM> shown), gNBs 110a, 110b, ng-eNBs <NUM>, AMFs <NUM>, external clients <NUM>, and/or other components. The illustrated connections that connect the various components in the communication system <NUM> include data and signaling connections which may include additional (intermediary) components, direct or indirect physical and/or wireless connections, and/or additional networks. Furthermore, components may be rearranged, combined, separated, substituted, and/or omitted, depending on desired functionality.

While <FIG> illustrates a <NUM>-based network, similar network implementations and configurations may be used for other communication technologies, such as <NUM>, Long Term Evolution (LTE), etc. Implementations described herein (be they for <NUM> technology and/or for one or more other communication technologies and/or protocols) may be used to transmit (or broadcast) directional synchronization signals, receive and measure directional signals at UEs (e.g., the UE <NUM>) and/or provide location assistance to the UE <NUM> (via the GMLC <NUM> or other location server) and/or compute a location for the UE <NUM> at a location-capable device such as the UE <NUM>, the gNB 110a, 110b, or the LMF <NUM> based on measurement quantities received at the UE <NUM> for such directionally-transmitted signals. The gateway mobile location center (GMLC) <NUM>, the location management function (LMF) <NUM>, the access and mobility management function (AMF) <NUM>, the SMF <NUM>, the ng-eNB (eNodeB) <NUM> and the gNBs (gNodeBs) 110a, 110b are examples and may, in various embodiments, be replaced by or include various other location server functionality and/or base station functionality respectively.

The UE <NUM> may comprise and/or may be referred to as a device, a mobile device, a wireless device, a mobile terminal, a terminal, a mobile station (MS), a Secure User Plane Location (SUPL) Enabled Terminal (SET), or by some other name. Moreover, the UE <NUM> may correspond to a cellphone, smartphone, laptop, tablet, PDA, tracking device, navigation device, Internet of Things (IoT) device, asset tracker, health monitors, security systems, smart city sensors, smart meters, wearable trackers, or some other portable or moveable device. Typically, though not necessarily, the UE <NUM> may support wireless communication using one or more Radio Access Technologies (RATs) such as Global System for Mobile communication (GSM), Code Division Multiple Access (CDMA), Wideband CDMA (WCDMA), LTE, High Rate Packet Data (HRPD), IEEE <NUM> WiFi (also referred to as Wi-Fi), Bluetooth® (BT), Worldwide Interoperability for Microwave Access (WiMAX), <NUM> new radio (NR) (e.g., using the NG-RAN <NUM> and the 5GC <NUM>), etc. The UE <NUM> may support wireless communication using a Wireless Local Area Network (WLAN) which may connect to other networks (e.g., the Internet) using a Digital Subscriber Line (DSL) or packet cable, for example. The use of one or more of these RATs may allow the UE <NUM> to communicate with the external client <NUM> (e.g., via elements of the 5GC <NUM> not shown in <FIG>, or possibly via the GMLC <NUM>) and/or allow the external client <NUM> to receive location information regarding the UE <NUM> (e.g., via the GMLC <NUM>).

The UE <NUM> may include a single entity or may include multiple entities such as in a personal area network where a user may employ audio, video and/or data I/O (input/output) devices and/or body sensors and a separate wireline or wireless modem. An estimate of a location of the UE <NUM> may be referred to as a location, location estimate, location fix, fix, position, position estimate, or position fix, and may be geographic, thus providing location coordinates for the UE <NUM> (e.g., latitude and longitude) which may or may not include an altitude component (e.g., height above sea level, height above or depth below ground level, floor level, or basement level). Alternatively, a location of the UE <NUM> may be expressed as a civic location (e.g., as a postal address or the designation of some point or small area in a building such as a particular room or floor). A location of the UE <NUM> may be expressed as an area or volume (defined either geographically or in civic form) within which the UE <NUM> is expected to be located with some probability or confidence level (e.g., <NUM>%, <NUM>%, etc.). A location of the UE <NUM> may be expressed as a relative location comprising, for example, a distance and direction from a known location. The relative location may be expressed as relative coordinates (e.g., X, Y (and Z) coordinates) defined relative to some origin at a known location which may be defined, e.g., geographically, in civic terms, or by reference to a point, area, or volume, e.g., indicated on a map, floor plan, or building plan. In the description contained herein, the use of the term location may comprise any of these variants unless indicated otherwise. When computing the location of a UE, it is common to solve for local x, y, and possibly z coordinates and then, if desired, convert the local coordinates into absolute coordinates (e.g., for latitude, longitude, and altitude above or below mean sea level).

The UE <NUM> may be configured to communicate with other entities using one or more of a variety of technologies. The UE <NUM> may be configured to connect indirectly to one or more communication networks via one or more device-to-device (D2D) peer-to-peer (P2P) links. The D2D P2P links may be supported with any appropriate D2D radio access technology (RAT), such as LTE Direct (LTE-D), WiFi Direct (WiFi-D), Bluetooth®, and so on. One or more of a group of UEs utilizing D2D communications may be within a geographic coverage area of a Transmission/Reception Point (TRP) such as one or more of the gNBs 110a, 110b, and/or the ng-eNB <NUM>. Other UEs in such a group may be outside such geographic coverage areas, or may be otherwise unable to receive transmissions from a base station. Groups of UEs communicating via D2D communications may utilize a one-to-many (<NUM>:M) system in which each UE may transmit to other UEs in the group. A TRP may facilitate scheduling of resources for D2D communications. In other cases, D2D communications may be carried out between UEs without the involvement of a TRP.

Base stations (BSs) in the NG-RAN <NUM> shown in <FIG> include NR Node Bs, referred to as the gNBs 110a and 110b. Pairs of the gNBs 110a, 110b in the NG-RAN <NUM> may be connected to one another via one or more other gNBs. Access to the <NUM> network is provided to the UE <NUM> via wireless communication between the UE <NUM> and one or more of the gNBs 110a, 110b, which may provide wireless communications access to the 5GC <NUM> on behalf of the UE <NUM> using <NUM>. In <FIG>, the serving gNB for the UE <NUM> is assumed to be the gNB 110a, although another gNB (e.g. the gNB 110b) may act as a serving gNB if the UE <NUM> moves to another location or may act as a secondary gNB to provide additional throughput and bandwidth to the UE <NUM>.

Base stations (BSs) in the NG-RAN <NUM> shown in <FIG> may include the ng-eNB <NUM>, also referred to as a next generation evolved Node B. The ng-eNB <NUM> may be connected to one or more of the gNBs 110a, 110b in the NG-RAN <NUM>, possibly via one or more other gNBs and/or one or more other ng-eNBs. The ng-eNB <NUM> may provide LTE wireless access and/or evolved LTE (eLTE) wireless access to the UE <NUM>. One or more of the gNBs 110a, 110b and/or the ng-eNB <NUM> may be configured to function as positioning-only beacons which may transmit signals to assist with determining the position of the UE <NUM> but may not receive signals from the UE <NUM> or from other UEs.

The BSs 110a, 110b, <NUM> may each comprise one or more TRPs. For example, each sector within a cell of a BS may comprise a TRP, although multiple TRPs may share one or more components (e.g., share a processor but have separate antennas). The system <NUM> may include macro TRPs or the system <NUM> may have TRPs of different types, e.g., macro, pico,
and/or femto TRPs , etc. A macro TRP may cover a relatively large geographic area (e.g., several kilometers in radius) and may allow unrestricted access by terminals with service subscription. A pico TRP may cover a relatively small geographic area (e.g., a pico cell) and may allow unrestricted access by terminals with service subscription. A femto or home TRP may cover a relatively small geographic area (e.g., a femto cell) and may allow restricted access by terminals having association with the femto cell (e.g., terminals for users in a home).

As noted, while <FIG> depicts nodes configured to communicate according to <NUM> communication protocols, nodes configured to communicate according to other communication protocols, such as, for example, an LTE protocol or IEEE <NUM>. 11x protocol, may be used. For example, in an Evolved Packet System (EPS) providing LTE wireless access to the UE <NUM>, a RAN may comprise an Evolved Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access Network (E-UTRAN) which may comprise base stations comprising evolved Node Bs (eNBs). A core network for EPS may comprise an Evolved Packet Core (EPC). An EPS may comprise an E-UTRAN plus EPC, where the E-UTRAN corresponds to the NG-RAN <NUM> and the EPC corresponds to the 5GC <NUM> in <FIG>.

The gNBs 110a, 110b and the ng-eNB <NUM> may communicate with the AMF <NUM>, which, for positioning functionality, communicates with the LMF <NUM>. The AMF <NUM> may support mobility of the UE <NUM>, including cell change and handover and may participate in supporting a signaling connection to the UE <NUM> and possibly data and voice bearers for the UE <NUM>. The LMF <NUM> may communicate directly with the UE <NUM>, e.g., through wireless communications. The LMF <NUM> may support positioning of the UE <NUM> when the UE <NUM> accesses the NG-RAN <NUM> and may support position procedures / methods such as Assisted GNSS (A-GNSS), Observed Time Difference of Arrival (OTDOA), Real Time Kinematics (RTK), Precise Point Positioning (PPP), Differential GNSS (DGNSS), Enhanced Cell ID (E-CID), angle of arrival (AOA), angle of departure (AOD), and/or other position methods. The LMF <NUM> may process location services requests for the UE <NUM>, e.g., received from the AMF <NUM> or from the GMLC <NUM>. The LMF <NUM> may be connected to the AMF <NUM> and/or to the GMLC <NUM>. The LMF <NUM> may be referred to by other names such as a Location Manager (LM), Location Function (LF), commercial LMF (CLMF), or value added LMF (VLMF). A node / system that implements the LMF <NUM> may additionally or alternatively implement other types of location-support modules, such as an Enhanced Serving Mobile Location Center (E-SMLC) or a Secure User Plane Location (SUPL) Location Platform (SLP). At least part of the positioning functionality (including derivation of the location of the UE <NUM>) may be performed at the UE <NUM> (e.g., using signal measurements obtained by the UE <NUM> for signals transmitted by wireless nodes such as the gNBs 110a, 110b and/or the ng-eNB <NUM>, and/or assistance data provided to the UE <NUM>, e.g. by the LMF <NUM>).

The GMLC <NUM> may support a location request for the UE <NUM> received from the external client <NUM> and may forward such a location request to the AMF <NUM> for forwarding by the AMF <NUM> to the LMF <NUM> or may forward the location request directly to the LMF <NUM>. A location response from the LMF <NUM> (e.g., containing a location estimate for the UE <NUM>) may be returned to the GMLC <NUM> either directly or via the AMF <NUM> and the GMLC <NUM> may then return the location response (e.g., containing the location estimate) to the external client <NUM>. The GMLC <NUM> is shown connected to both the AMF <NUM> and LMF <NUM>, though one of these connections may be supported by the 5GC <NUM> in some implementations.

As further illustrated in <FIG>, the LMF <NUM> may communicate with the gNBs 110a, 110b and/or the ng-eNB <NUM> using a New Radio Position Protocol A (which may be referred to as NPPa or NRPPa), which may be defined in 3GPP Technical Specification (TS) <NUM>. NRPPa may be the same as, similar to, or an extension of the LTE Positioning Protocol A (LPPa) defined in 3GPP TS <NUM>, with NRPPa messages being transferred between the gNB 110a (or the gNB 110b) and the LMF <NUM>, and/or between the ng-eNB <NUM> and the LMF <NUM>, via the AMF <NUM>. As further illustrated in <FIG>, the LMF <NUM> and the UE <NUM> may communicate using an LTE Positioning Protocol (LPP), which may be defined in 3GPP TS <NUM>. The LMF <NUM> and the UE <NUM> may also or instead communicate using a New Radio Positioning Protocol (which may be referred to as NPP or NRPP), which may be the same as, similar to, or an extension of LPP. Here, LPP and/or NPP messages may be transferred between the UE <NUM> and the LMF <NUM> via the AMF <NUM> and the serving gNB 110a, 110b or the serving ng-eNB <NUM> for the UE <NUM>. For example, LPP and/or NPP messages may be transferred between the LMF <NUM> and the AMF <NUM> using a <NUM> Location Services Application Protocol (LCS AP) and may be transferred between the AMF <NUM> and the UE <NUM> using a <NUM> Non-Access Stratum (NAS) protocol. The LPP and/or NPP protocol may be used to support positioning of the UE <NUM> using UE-assisted and/or UE-based position methods such as A-GNSS, RTK, OTDOA and/or E-CID. The NRPPa protocol may be used to support positioning of the UE <NUM> using network-based position methods such as E-CID (e.g., when used with measurements obtained by the gNB 110a, 110b or the ng-eNB <NUM>) and/or may be used by the LMF <NUM> to obtain location related information from the gNBs 110a, 110b and/or the ng-eNB <NUM>, such as parameters defining directional SS transmissions from the gNBs 110a, 110b, and/or the ng-eNB <NUM>.

With a UE-assisted position method, the UE <NUM> may obtain location measurements and send the measurements to a location server (e.g., the LMF <NUM>) for computation of a location estimate for the UE <NUM>. For example, the location measurements may include one or more of a Received Signal Strength Indication (RSSI), Round Trip signal propagation Time (RTT), Reference Signal Time Difference (RSTD), Reference Signal Received Power (RSRP) and/or Reference Signal Received Quality (RSRQ) for the gNBs 110a, 110b, the ng-eNB <NUM>, and/or a WLAN AP. The location measurements may also or instead include measurements of GNSS pseudorange, code phase, and/or carrier phase for the SVs <NUM>-<NUM>.

With a UE-based position method, the UE <NUM> may obtain location measurements (e.g., which may be the same as or similar to location measurements for a UE-assisted position method) and may compute a location of the UE <NUM> (e.g., with the help of assistance data received from a location server such as the LMF <NUM> or broadcast by the gNBs 110a, 110b, the ng-eNB <NUM>, or other base stations or APs).

With a network-based position method, one or more base stations (e.g., the gNBs 110a, 110b, and/or the ng-eNB <NUM>) or APs may obtain location measurements (e.g., measurements of RSSI, RTT, RSRP, RSRQ or Time Of Arrival (TOA) for signals transmitted by the UE <NUM>) and/or may receive measurements obtained by the UE <NUM>. The one or more base stations or APs may send the measurements to a location server (e.g., the LMF <NUM>) for computation of a location estimate for the UE <NUM>.

Information provided by the gNBs 110a, 110b, and/or the ng-eNB <NUM> to the LMF <NUM> using NRPPa may include timing and configuration information for directional SS transmissions and location coordinates. The LMF <NUM> may provide some or all of this information to the UE <NUM> as assistance data in an LPP and/or NPP message via the NG-RAN <NUM> and the 5GC <NUM>.

An LPP or NPP message sent from the LMF <NUM> to the UE <NUM> may instruct the UE <NUM> to do any of a variety of things depending on desired functionality. For example, the LPP or NPP message could contain an instruction for the UE <NUM> to obtain measurements for GNSS (or A-GNSS), WLAN, E-CID, and/or OTDOA (or some other position method). In the case of E-CID, the LPP or NPP message may instruct the UE <NUM> to obtain one or more measurement quantities (e.g., beam ID, beam width, mean angle, RSRP, RSRQ measurements) of directional signals transmitted within particular cells supported by one or more of the gNBs 110a, 110b, and/or the ng-eNB <NUM> (or supported by some other type of base station such as an eNB or WiFi AP). The UE <NUM> may send the measurement quantities back to the LMF <NUM> in an LPP or NPP message (e.g., inside a <NUM> NAS message) via the serving gNB 110a (or the serving ng-eNB <NUM>) and the AMF <NUM>.

As noted, while the communication system <NUM> is described in relation to <NUM> technology, the communication system <NUM> may be implemented to support other communication technologies, such as GSM, WCDMA, LTE, etc., that are used for supporting and interacting with mobile devices such as the UE <NUM> (e.g., to implement voice, data, positioning, and other functionalities). In some such embodiments, the 5GC <NUM> may be configured to control different air interfaces. For example, the 5GC <NUM> may be connected to a WLAN using a Non-3GPP InterWorking Function (N3IWF, not shown <FIG>) in the 5GC <NUM>. For example, the WLAN may support IEEE <NUM> WiFi access for the UE <NUM> and may comprise one or more WiFi APs. Here, the N3IWF may connect to the WLAN and to other elements in the 5GC <NUM> such as the AMF <NUM>. In some embodiments, both the NG-RAN <NUM> and the 5GC <NUM> may be replaced by one or more other RANs and one or more other core networks. For example, in an EPS, the NG-RAN <NUM> may be replaced by an E-UTRAN containing eNBs and the 5GC <NUM> may be replaced by an EPC containing a Mobility Management Entity (MME) in place of the AMF <NUM>, an E-SMLC in place of the LMF <NUM>, and a GMLC that may be similar to the GMLC <NUM>. In such an EPS, the E-SMLC may use LPPa in place of NRPPa to send and receive location information to and from the eNBs in the E-UTRAN and may use LPP to support positioning of the UE <NUM>. In these other embodiments, positioning of the UE <NUM> using directional PRSs may be supported in an analogous manner to that described herein for a <NUM> network with the difference that functions and procedures described herein for the gNBs 110a, 110b, the ng-eNB <NUM>, the AMF <NUM>, and the LMF <NUM> may, in some cases, apply instead to other network elements such eNBs, WiFi APs, an MME, and an E-SMLC.

As noted, in some embodiments, positioning functionality may be implemented, at least in part, using the directional SS beams, sent by base stations (such as the gNBs 110a, 110b, and/or the ng-eNB <NUM>) that are within range of the UE whose position is to be determined (e.g., the UE <NUM> of <FIG>). The UE may, in some instances, use the directional SS beams from a plurality of base stations (such as the gNBs 110a, 110b, the ng-eNB <NUM>, etc.) to compute the UE's position.

Referring also to <FIG>, a UE <NUM> is an example of the UE <NUM> and comprises a computing platform including a processor <NUM>, memory <NUM> including software (SW) <NUM>, one or more sensors <NUM>, a transceiver interface <NUM> for a transceiver <NUM> (that includes a wireless transceiver <NUM> and/or wired transceiver <NUM>), a user interface <NUM>, a Satellite Positioning System (SPS) receiver <NUM>, a camera <NUM>, and a position (motion) device <NUM>. The processor <NUM>, the memory <NUM>, the sensor(s) <NUM>, the transceiver interface <NUM>, the user interface <NUM>, the SPS receiver <NUM>, the camera <NUM>, and the position (motion) device <NUM> may be communicatively coupled to each other by a bus <NUM> (which may be configured, e.g., for optical and/or electrical communication). One or more of the shown apparatus (e.g., the camera <NUM>, the position (motion) device <NUM>, and/or one or more of the sensor(s) <NUM>, etc.) may be omitted from the UE <NUM>. The processor <NUM> may include one or more intelligent hardware devices, e.g., a central processing unit (CPU), a microcontroller, an application specific integrated circuit (ASIC), etc. The processor <NUM> may comprise multiple processors including a general-purpose/ application processor <NUM>, a Digital Signal Processor (DSP) <NUM>, a modem processor <NUM>, a video processor <NUM>, and/or a sensor processor <NUM>. One or more of the processors <NUM>-<NUM> may comprise multiple devices (e.g., multiple processors). For example, the sensor processor <NUM> may comprise, e.g., processors for radar, ultrasound, and/or lidar, etc. The modem processor <NUM> may support dual SIM/dual connectivity (or even more SIMs). For example, a SIM (Subscriber Identity Module or Subscriber Identification Module) may be used by an Original Equipment Manufacturer (OEM), and another SIM may be used by an end user of the UE <NUM> for connectivity. The memory <NUM> is a non-transitory storage medium that may include random access memory (RAM), flash memory, disc memory, and/or read-only memory (ROM), etc. The memory <NUM> stores the software <NUM> which may be processor-readable, processor-executable software code containing instructions that are configured to, when executed, cause the processor <NUM> to perform various functions described herein. Alternatively, the software <NUM> may not be directly executable by the processor <NUM> but may be configured to cause the processor <NUM>, e.g., when compiled and executed, to perform the functions. The description may refer to the processor <NUM> performing a function, but this includes other implementations such as where the processor <NUM> executes software and/or firmware. The description may refer to the processor <NUM> performing a function as shorthand for one or more of the processors <NUM>-<NUM> performing the function. The description may refer to the UE <NUM> performing a function as shorthand for one or more appropriate components of the UE <NUM> performing the function. The processor <NUM> may include a memory with stored instructions in addition to and/or instead of the memory <NUM>. Functionality of the processor <NUM> is discussed more fully below.

The configuration of the UE <NUM> shown in <FIG> is an example and not limiting of the disclosure, including the claims, and other configurations may be used. For example, an example configuration of the UE includes one or more of the processors <NUM>-<NUM> of the processor <NUM>, the memory <NUM>, and the wireless transceiver <NUM>. Other example configurations include one or more of the processors <NUM>-<NUM> of the processor <NUM>, the memory <NUM>, the wireless transceiver <NUM>, and one or more of the sensor(s) <NUM>, the user interface <NUM>, the SPS receiver <NUM>, the camera <NUM>, the PMD <NUM>, and/or the wired transceiver <NUM>.

The UE <NUM> may comprise the modem processor <NUM> that may be capable of performing baseband processing of signals received and down-converted by the transceiver <NUM> and/or the SPS receiver <NUM>. The modem processor <NUM> may perform baseband processing of signals to be upconverted for transmission by the transceiver <NUM>. Also or alternatively, baseband processing may be performed by the processor <NUM> and/or the DSP <NUM>. Other configurations, however, may be used to perform baseband processing.

The UE <NUM> may include the sensor(s) <NUM> that may include, for example, an Inertial Measurement Unit (IMU) <NUM>, one or more magnetometers <NUM>, and/or one or more environment sensors <NUM>. The IMU <NUM> may comprise one or more inertial sensors, for example, one or more accelerometers <NUM> (e.g., collectively responding to acceleration of the UE <NUM> in three dimensions) and/or one or more gyroscopes <NUM>. The magnetometer(s) may provide measurements to determine orientation (e.g., relative to magnetic north and/or true north) that may be used for any of a variety of purposes, e.g., to support one or more compass applications. The environment sensor(s) <NUM> may comprise, for example, one or more temperature sensors, one or more barometric pressure sensors, one or more ambient light sensors, one or more camera imagers, and/or one or more microphones, etc. The sensor(s) <NUM> may generate analog and/or digital signals indications of which may be stored in the memory <NUM> and processed by the DSP <NUM> and/or the processor <NUM> in support of one or more applications such as, for example, applications directed to positioning and/or navigation operations.

The sensor(s) <NUM> may be used in relative location measurements, relative location determination, motion determination, etc. Information detected by the sensor(s) <NUM> may be used for motion detection, relative displacement, dead reckoning, sensor-based location determination, and/or sensor-assisted location determination. The sensor(s) <NUM> may be useful to determine whether the UE <NUM> is fixed (stationary) or mobile and/or whether to report certain useful information to the LMF <NUM> regarding the mobility of the UE <NUM>. For example, based on the information obtained/measured by the sensor(s) <NUM>, the UE <NUM> may notify/report to the LMF <NUM> that the UE <NUM> has detected movements or that the UE <NUM> has moved, and report the relative displacement/distance (e.g., via dead reckoning, or sensor-based location determination, or sensor-assisted location determination enabled by the sensor(s) <NUM>). In another example, for relative positioning information, the sensors/IMU can be used to determine the angle and/or orientation of the other device with respect to the UE <NUM>, etc..

The IMU <NUM> may be configured to provide measurements about a direction of motion and/or a speed of motion of the UE <NUM>, which may be used in relative location determination. For example, the one or more accelerometers <NUM> and/or the one or more gyroscopes <NUM> of the IMU <NUM> may detect, respectively, a linear acceleration and a speed of rotation of the UE <NUM>. The linear acceleration and speed of rotation measurements of the UE <NUM> may be integrated over time to determine an instantaneous direction of motion as well as a displacement of the UE <NUM>. The instantaneous direction of motion and the displacement may be integrated to track a location of the UE <NUM>. For example, a reference location of the UE <NUM> may be determined, e.g., using the SPS receiver <NUM> (and/or by some other means) for a moment in time and measurements from the accelerometer(s) <NUM> and gyroscope(s) <NUM> taken after this moment in time may be used in dead reckoning to determine present location of the UE <NUM> based on movement (direction and distance) of the UE <NUM> relative to the reference location.

The magnetometer(s) <NUM> may determine magnetic field strengths in different directions which may be used to determine orientation of the UE <NUM>. For example, the orientation may be used to provide a digital compass for the UE <NUM>. The magnetometer(s) <NUM> may include a two-dimensional magnetometer configured to detect and provide indications of magnetic field strength in two orthogonal dimensions. Also or alternatively, the magnetometer(s) <NUM> may include a three-dimensional magnetometer configured to detect and provide indications of magnetic field strength in three orthogonal dimensions. The magnetometer(s) <NUM> may provide means for sensing a magnetic field and providing indications of the magnetic field, e.g., to the processor <NUM>.

The transceiver <NUM> may include a wireless transceiver <NUM> and a wired transceiver <NUM> configured to communicate with other devices through wireless connections and wired connections, respectively. For example, the wireless transceiver <NUM> may include a transmitter <NUM> and receiver <NUM> coupled to one or more antennas <NUM> for transmitting (e.g., on one or more uplink channels and/or one or more sidelink channels) and/or receiving (e.g., on one or more downlink channels and/or one or more sidelink channels) wireless signals <NUM> and transducing signals from the wireless signals <NUM> to wired (e.g., electrical and/or optical) signals and from wired (e.g., electrical and/or optical) signals to the wireless signals <NUM>. Thus, the transmitter <NUM> may include multiple transmitters that may be discrete components or combined/integrated components, and/or the receiver <NUM> may include multiple receivers that may be discrete components or combined/integrated components. The wireless transceiver <NUM> may be configured to communicate signals (e.g., with TRPs and/or one or more other devices) according to a variety of radio access technologies (RATs) such as <NUM> New Radio (NR), GSM (Global System for Mobiles), UMTS (Universal Mobile Telecommunications System), AMPS (Advanced Mobile Phone System), CDMA (Code Division Multiple Access), WCDMA (Wideband CDMA), LTE (Long-Term Evolution), LTE Direct (LTE-D), 3GPP LTE-V2X (Vehicle-to-Everything) (PC5), V2C (Uu), IEEE <NUM> (including IEEE <NUM>. 11p), WiFi, WiFi Direct (WiFi-D), Bluetooth®, Zigbee etc. New Radio may use mm-wave frequencies and/or sub-<NUM> frequencies. The wired transceiver <NUM> may include a transmitter <NUM> and a receiver <NUM> configured for wired communication, e.g., with the network <NUM> to send communications to, and receive communications from, the gNB 110a, for example. The transmitter <NUM> may include multiple transmitters that may be discrete components or combined/integrated components, and/or the receiver <NUM> may include multiple receivers that may be discrete components or combined/integrated components. The wired transceiver <NUM> may be configured, e.g., for optical communication and/or electrical communication. The transceiver <NUM> may be communicatively coupled to the transceiver interface <NUM>, e.g., by optical and/or electrical connection. The transceiver interface <NUM> may be at least partially integrated with the transceiver <NUM>.

The user interface <NUM> may comprise one or more of several devices such as, for example, a speaker, microphone, display device, vibration device, keyboard, touch screen, etc. The user interface <NUM> may include more than one of any of these devices. The user interface <NUM> may be configured to enable a user to interact with one or more applications hosted by the UE <NUM>. For example, the user interface <NUM> may store indications of analog and/or digital signals in the memory <NUM> to be processed by DSP <NUM> and/or the general-purpose processor <NUM> in response to action from a user. Similarly, applications hosted on the UE <NUM> may store indications of analog and/or digital signals in the memory <NUM> to present an output signal to a user. The user interface <NUM> may include an audio input/output (I/O) device comprising, for example, a speaker, a microphone, digital-to-analog circuitry, analog-to-digital circuitry, an amplifier and/or gain control circuitry (including more than one of any of these devices). Other configurations of an audio I/O device may be used. Also or alternatively, the user interface <NUM> may comprise one or more touch sensors responsive to touching and/or pressure, e.g., on a keyboard and/or touch screen of the user interface <NUM>.

The SPS receiver <NUM> (e.g., a Global Positioning System (GPS) receiver) may be capable of receiving and acquiring SPS signals <NUM> via an SPS antenna <NUM>. The antenna <NUM> is configured to transduce the wireless SPS signals <NUM> to wired signals, e.g., electrical or optical signals, and may be integrated with the antenna <NUM>. The SPS receiver <NUM> may be configured to process, in whole or in part, the acquired SPS signals <NUM> for estimating a location of the UE <NUM>. For example, the SPS receiver <NUM> may be configured to determine location of the UE <NUM> by trilateration using the SPS signals <NUM>. The general-purpose processor <NUM>, the memory <NUM>, the DSP <NUM> and/or one or more specialized processors (not shown) may be utilized to process acquired SPS signals, in whole or in part, and/or to calculate an estimated location of the UE <NUM>, in conjunction with the SPS receiver <NUM>. The memory <NUM> may store indications (e.g., measurements) of the SPS signals <NUM> and/or other signals (e.g., signals acquired from the wireless transceiver <NUM>) for use in performing positioning operations. The general-purpose processor <NUM>, the DSP <NUM>, and/or one or more specialized processors, and/or the memory <NUM> may provide or support a location engine for use in processing measurements to estimate a location of the UE <NUM>.

The UE <NUM> may include the camera <NUM> for capturing still or moving imagery. The camera <NUM> may comprise, for example, an imaging sensor (e.g., a charge coupled device or a CMOS imager), a lens, analog-to-digital circuitry, frame buffers, etc. Additional processing, conditioning, encoding, and/or compression of signals representing captured images may be performed by the general-purpose processor <NUM> and/or the DSP <NUM>. Also or alternatively, the video processor <NUM> may perform conditioning, encoding, compression, and/or manipulation of signals representing captured images. The video processor <NUM> may decode/decompress stored image data for presentation on a display device (not shown), e.g., of the user interface <NUM>.

The position (motion) device (PMD) <NUM> may be configured to determine a position and possibly motion of the UE <NUM>. For example, the PMD <NUM> may communicate with, and/or include some or all of, the SPS receiver <NUM>. The PMD <NUM> may also or alternatively be configured to determine location of the UE <NUM> using terrestrial-based signals (e.g., at least some of the signals <NUM>) for trilateration, for assistance with obtaining and using the SPS signals <NUM>, or both. The PMD <NUM> may be configured to use one or more other techniques (e.g., relying on the UE's self-reported location (e.g., part of the UE's position beacon)) for determining the location of the UE <NUM>, and may use a combination of techniques (e.g., SPS and terrestrial positioning signals) to determine the location of the UE <NUM>. The PMD <NUM> may include one or more of the sensors <NUM> (e.g., gyroscope(s), accelerometer(s), magnetometer(s), etc.) that may sense orientation and/or motion of the UE <NUM> and provide indications thereof that the processor <NUM> (e.g., the processor <NUM> and/or the DSP <NUM>) may be configured to use to determine motion (e.g., a velocity vector and/or an acceleration vector) of the UE <NUM>. The PMD <NUM> may be configured to provide indications of uncertainty and/or error in the determined position and/or motion.

Referring also to <FIG>, an example of a TRP <NUM> of the BSs 110a, 110b, <NUM> comprises a computing platform including a processor <NUM>, memory <NUM> including software (SW) <NUM>, a transceiver <NUM>, and (optionally) an SPS receiver <NUM>. The processor <NUM>, the memory <NUM>, the transceiver <NUM>, and the SPS receiver <NUM> may be communicatively coupled to each other by a bus <NUM> (which may be configured, e.g., for optical and/or electrical communication). One or more of the shown apparatus (e.g., a wireless interface and/or the SPS receiver <NUM>) may be omitted from the TRP <NUM>. The SPS receiver <NUM> may be configured similarly to the SPS receiver <NUM> to be capable of receiving and acquiring SPS signals <NUM> via an SPS antenna <NUM>. The processor <NUM> may include one or more intelligent hardware devices, e.g., a central processing unit (CPU), a microcontroller, an application specific integrated circuit (ASIC), etc. The processor <NUM> may comprise multiple processors (e.g., including a general-purpose/ application processor, a DSP, a modem processor, a video processor, and/or a sensor processor as shown in <FIG>). The memory <NUM> is a non-transitory storage medium that may include random access memory (RAM)), flash memory, disc memory, and/or read-only memory (ROM), etc. The memory <NUM> stores the software <NUM> which may be processor-readable, processor-executable software code containing instructions that are configured to, when executed, cause the processor <NUM> to perform various functions described herein. Alternatively, the software <NUM> may not be directly executable by the processor <NUM> but may be configured to cause the processor <NUM>, e.g., when compiled and executed, to perform the functions. The description may refer to the processor <NUM> performing a function, but this includes other implementations such as where the processor <NUM> executes software and/or firmware. The description may refer to the processor <NUM> performing a function as shorthand for one or more of the processors contained in the processor <NUM> performing the function. The description may refer to the TRP <NUM> performing a function as shorthand for one or more appropriate components of the TRP <NUM> (and thus of one of the BSs 110a, 110b, <NUM>) performing the function. The processor <NUM> may include a memory with stored instructions in addition to and/or instead of the memory <NUM>. Functionality of the processor <NUM> is discussed more fully below.

The transceiver <NUM> may include a wireless transceiver <NUM> and a wired transceiver <NUM> configured to communicate with other devices through wireless connections and wired connections, respectively. For example, the wireless transceiver <NUM> may include a transmitter <NUM> and receiver <NUM> coupled to one or more antennas <NUM> for transmitting (e.g., on one or more uplink channels, one or more downlink channels, and/or one or more sidelink channels) and/or receiving (e.g., on one or more downlink channels, one or more uplink channels, and/or one or more sidelink channels) wireless signals <NUM> and transducing signals from the wireless signals <NUM> to wired (e.g., electrical and/or optical) signals and from wired (e.g., electrical and/or optical) signals to the wireless signals <NUM>. Thus, the transmitter <NUM> may include multiple transmitters that may be discrete components or combined/integrated components, and/or the receiver <NUM> may include multiple receivers that may be discrete components or combined/integrated components. The wireless transceiver <NUM> may be configured to communicate signals (e.g., with the UE <NUM>, one or more other UEs, and/or one or more other devices) according to a variety of radio access technologies (RATs) such as <NUM> New Radio (NR), GSM (Global System for Mobiles), UMTS (Universal Mobile Telecommunications System), AMPS (Advanced Mobile Phone System), CDMA (Code Division Multiple Access), WCDMA (Wideband CDMA), LTE (Long-Term Evolution), LTE Direct (LTE-D), 3GPP LTE-V2X (PC5), IEEE <NUM> (including IEEE <NUM>. 11p), WiFi, WiFi Direct (WiFi-D), Bluetooth®, Zigbee etc. The wired transceiver <NUM> may include a transmitter <NUM> and a receiver <NUM> configured for wired communication, e.g., with the network <NUM> to send communications to, and receive communications from, the LMF <NUM> or other network server, for example. The transmitter <NUM> may include multiple transmitters that may be discrete components or combined/integrated components, and/or the receiver <NUM> may include multiple receivers that may be discrete components or combined/integrated components. The wired transceiver <NUM> may be configured, e.g., for optical communication and/or electrical communication.

The configuration of the TRP <NUM> shown in <FIG> is an example and not limiting of the disclosure, including the claims, and other configurations may be used. For example, the description herein discusses that the TRP <NUM> is configured to perform or performs several functions, but one or more of these functions may be performed by the LMF <NUM> and/or the UE <NUM> (i.e., the LMF <NUM> and/or the UE <NUM> may be configured to perform one or more of these functions).

Referring also to <FIG>, an example server, such as the LMF <NUM>, comprises a computing platform including a processor <NUM>, memory <NUM> including software (SW) <NUM>, and a transceiver <NUM>. The processor <NUM>, the memory <NUM>, and the transceiver <NUM> may be communicatively coupled to each other by a bus <NUM> (which may be configured, e.g., for optical and/or electrical communication). One or more of the shown apparatus (e.g., a wireless interface) may be omitted from the server <NUM>. The processor <NUM> may include one or more intelligent hardware devices, e.g., a central processing unit (CPU), a microcontroller, an application specific integrated circuit (ASIC), etc. The processor <NUM> may comprise multiple processors (e.g., including a general-purpose/ application processor, a DSP, a modem processor, a video processor, and/or a sensor processor as shown in <FIG>). The memory <NUM> is a non-transitory storage medium that may include random access memory (RAM)), flash memory, disc memory, and/or read-only memory (ROM), etc. The memory <NUM> stores the software <NUM> which may be processor-readable, processor-executable software code containing instructions that are configured to, when executed, cause the processor <NUM> to perform various functions described herein. Alternatively, the software <NUM> may not be directly executable by the processor <NUM> but may be configured to cause the processor <NUM>, e.g., when compiled and executed, to perform the functions. The description may refer to the processor <NUM> performing a function, but this includes other implementations such as where the processor <NUM> executes software and/or firmware. The description may refer to the processor <NUM> performing a function as shorthand for one or more of the processors contained in the processor <NUM> performing the function. The description may refer to the server <NUM> (or the LMF <NUM>) performing a function as shorthand for one or more appropriate components of the server <NUM> performing the function. The processor <NUM> may include a memory with stored instructions in addition to and/or instead of the memory <NUM>. Functionality of the processor <NUM> is discussed more fully below.

The transceiver <NUM> may include a wireless transceiver <NUM> and a wired transceiver <NUM> configured to communicate with other devices through wireless connections and wired connections, respectively. For example, the wireless transceiver <NUM> may include a transmitter <NUM> and receiver <NUM> coupled to one or more antennas <NUM> for transmitting (e.g., on one or more downlink channels) and/or receiving (e.g., on one or more uplink channels) wireless signals <NUM> and transducing signals from the wireless signals <NUM> to wired (e.g., electrical and/or optical) signals and from wired (e.g., electrical and/or optical) signals to the wireless signals <NUM>. Thus, the transmitter <NUM> may include multiple transmitters that may be discrete components or combined/integrated components, and/or the receiver <NUM> may include multiple receivers that may be discrete components or combined/integrated components. The wireless transceiver <NUM> may be configured to communicate signals (e.g., with the UE <NUM>, one or more other UEs, and/or one or more other devices) according to a variety of radio access technologies (RATs) such as <NUM> New Radio (NR), GSM (Global System for Mobiles), UMTS (Universal Mobile Telecommunications System), AMPS (Advanced Mobile Phone System), CDMA (Code Division Multiple Access), WCDMA (Wideband CDMA), LTE (Long-Term Evolution), LTE Direct (LTE-D), 3GPP LTE-V2X (PC5), IEEE <NUM> (including IEEE <NUM>. 11p), WiFi, WiFi Direct (WiFi-D), Bluetooth®, Zigbee etc. The wired transceiver <NUM> may include a transmitter <NUM> and a receiver <NUM> configured for wired communication, e.g., with the network <NUM> to send communications to, and receive communications from, the TRP <NUM>, for example. The transmitter <NUM> may include multiple transmitters that may be discrete components or combined/integrated components, and/or the receiver <NUM> may include multiple receivers that may be discrete components or combined/integrated components. The wired transceiver <NUM> may be configured, e.g., for optical communication and/or electrical communication.

The configuration of the server <NUM> shown in <FIG> is an example and not limiting of the disclosure, including the claims, and other configurations may be used. For example, the wireless transceiver <NUM> may be omitted. Also or alternatively, the description herein discusses that the server <NUM> is configured to perform or performs several functions, but one or more of these functions may be performed by the TRP <NUM> and/or the UE <NUM> (i.e., the TRP <NUM> and/or the UE <NUM> may be configured to perform one or more of these functions).

Referring to <FIG>, example downlink PRS resource sets are shown. In general, a PRS resource set is a collection of PRS resources across one base station (e.g., TRP <NUM>) which have the same periodicity, a common muting pattern configuration and the same repetition factor across slots. A first PRS resource set <NUM> includes <NUM> resources and a repetition factor of <NUM>, with a time-gap equal to <NUM> slot. A second PRS resource set <NUM> includes <NUM> resources and a repetition factor of <NUM> with a time-gap equal to <NUM> slots. The repetition factor indicates the number of times each PRS resource is repeated in each single instance of the PRS resource set (e.g., values of <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>). The time-gap represents the offset in units of slots between two repeated instances of a PRS resource corresponding to the same PRS resource ID within a single instance of the PRS resource set (e.g., values of <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>). The time duration spanned by one PRS resource set containing repeated PRS resources does not exceed PRS-periodicity. The repetition of a PRS resource enables receiver beam sweeping across repetitions and combining RF gains to increase coverage. The repetition may also enable intra-instance muting.

Referring to <FIG>, example subframe and slot formats for positioning reference signal transmissions are shown. The example subframe and slot formats are included in the PRS resource sets depicted in <FIG>. The subframes and slot formats in <FIG> are examples and not limitations and include a comb-<NUM> with <NUM> symbols format <NUM>, a comb-<NUM> with <NUM> symbols format <NUM>, a comb-<NUM> with <NUM> symbols format <NUM>, a comb-<NUM> with <NUM> symbols format <NUM>, a comb-<NUM> with <NUM> symbols format <NUM>, a comb-<NUM> with <NUM> symbols format <NUM>, a comb-<NUM> with <NUM> symbols format <NUM>, and a comb-<NUM> with <NUM> symbols format <NUM>. In general, a subframe may include <NUM> symbol periods with indices <NUM> to <NUM>. The subframe and slot formats may be used for a Physical Broadcast Channel (PBCH). Typically, a base station may transmit the PRS from antenna port <NUM> on one or more slots in each subframe configured for PRS transmission. The base station may avoid transmitting the PRS on resource elements allocated to the PBCH, a primary synchronization signal (PSS), or a secondary synchronization signal (SSS) regardless of their antenna ports. The cell may generate reference symbols for the PRS based on a cell ID, a symbol period index, and a slot index. Generally, a UE may be able to distinguish the PRS from different cells.

A base station may transmit the PRS over a particular PRS bandwidth, which may be configured by higher layers. The base station may transmit the PRS on subcarriers spaced apart across the PRS bandwidth. The base station may also transmit the PRS based on the parameters such as PRS periodicity TPRS, subframe offset PRS, and PRS duration NPRS. PRS periodicity is the periodicity at which the PRS is transmitted. The PRS periodicity may be, for example, <NUM>, <NUM>, <NUM> or <NUM>. Subframe offset indicates specific subframes in which the PRS is transmitted. And PRS duration indicates the number of consecutive subframes in which the PRS is transmitted in each period of PRS transmission (PRS occasion). The PRS duration may be, for example, <NUM>, <NUM>, <NUM> or <NUM>.

The PRS periodicity TPRS and the subframe offset PRS may be conveyed via a PRS configuration index IPRS. The PRS configuration index and the PRS duration may be configured independently by higher layers. A set of NPRS consecutive subframes in which the PRS is transmitted may be referred to as a PRS occasion. Each PRS occasion may be enabled or muted, for example, the UE may apply a muting bit to each cell. A PRS resource set is a collection of PRS resources across a base station which have the same periodicity, a common muting pattern configuration, and the same repetition factor across slots (e.g., <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM> slots).

In general, the PRS resources depicted in <FIG> may be a collection of resource elements that are used for transmission of PRS. The collection of resource elements can span multiple physical resource blocks (PRBs) in the frequency domain and N (e.g., <NUM> or more) consecutive symbol(s) within a slot in the time domain. In a given OFDM symbol, a PRS resource occupies consecutive PRBs. A PRS resource is described by at least the following parameters: PRS resource identifier (ID), sequence ID, comb size-N, resource element offset in the frequency domain, starting slot and starting symbol, number of symbols per PRS resource (i.e., the duration of the PRS resource), and QCL information (e.g., QCL with other DL reference signals). Currently, one antenna port is supported. The comb size indicates the number of subcarriers in each symbol carrying PRS. For example, a comb-size of comb-<NUM> means that every fourth subcarrier of a given symbol carries PRS.

A PRS resource set is a set of PRS resources used for the transmission of PRS signals, where each PRS resource has a PRS resource ID. In addition, the PRS resources in a PRS resource set are associated with the same transmission-reception point (e.g., a TRP <NUM>). A PRS resource set is identified by a PRS resource set ID and may be associated with a particular TRP (identified by a cell ID) transmitted by an antenna panel of a base station. A PRS resource ID in a PRS resource set may be associated with an omnidirectional signal, and/or with a single beam (and/or beam ID) transmitted from a single base station (where a base station may transmit one or more beams). Each PRS resource of a PRS resource set may be transmitted on a different beam and as such, a PRS resource, or simply resource can also be referred to as a beam. Note that this does not have any implications on whether the base stations and the beams on which PRS are transmitted are known to the UE.

In an example, a positioning frequency layer may be a collection of PRS resource sets across one or more base stations. The positioning frequency layer may have the same subcarrier spacing (SCS) and cyclic prefix (CP) type, the same point-A, the same value of DL PRS Bandwidth, the same start PRB, and the same value of comb-size. The numerologies supported for PDSCH may be supported for PRS.

A PRS occasion is one instance of a periodically repeated time window (e.g., a group of one or more consecutive slots) where PRS are expected to be transmitted. A PRS occasion may also be referred to as a PRS positioning occasion, a positioning occasion, or simply an occasion.

Note that the terms positioning reference signal and PRS are reference signals that can be used for positioning, such as but not limited to, PRS signals in LTE, navigation reference signals (NRS) in <NUM>, downlink position reference signals (DL-PRS), uplink position reference signals (UL-PRS), tracking reference signals (TRS), cell-specific reference signals (CRS), channel state information reference signals (CSI-RS), primary synchronization signals (PSS), secondary synchronization signals (SSS), sounding reference signals (SRS), etc..

Referring to <FIG>, an example round trip message flow <NUM> between a user equipment <NUM> and a base station <NUM> is shown. The UE <NUM> is an example of the UE <NUM>, <NUM> and the base station <NUM> may be a gNB 110a-b or ng-eNB <NUM>. In general, RTT positioning methods utilize a time for a signal to travel from one entity to another and back to determine a range between the two entities. The range, plus a known location of a first one of the entities and an angle between the two entities (e.g., an azimuth angle) can be used to determine a location of the second of the entities. In multi-RTT (also called multi-cell RTT), multiple ranges from one entity (e.g., a UE) to other entities (e.g., TRPs) and known locations of the other entities may be used to determine the location of the one entity. The example message flow <NUM> may be initiated by the base station <NUM> with a RTT session configured message <NUM>. The base station may utilize the LPP / NRPPa messaging to configure the RTT session. At time T1, the base station <NUM> may transmit a DL PRS <NUM>, which is received by the UE <NUM> at time T2. In response, the UE <NUM> may transmit a Sounding Reference Signal (SRS) for positioning message <NUM> at time T3 which is received by the base station <NUM> at time T4. The distance between the UE <NUM> and the base station <NUM> may be computed as: <MAT> where c = speed of light.

In dense operating environments, where there are many UEs exchanging RTT messages with base stations, the bandwidth required for the UL Sounding Reference Signals (SRS) for positioning messages may increase the messaging overhead and utilize excess network bandwidth. Passive positioning techniques may reduce the bandwidth required for positioning by eliminating transmissions from the UE.

Referring to <FIG>, an example message flow <NUM> for passive positioning of a user equipment <NUM> is shown. The message flow includes the UE <NUM>, a first base station <NUM> and a second base station <NUM>. The UE <NUM> is an example of the UEs <NUM>, <NUM>, and the base stations <NUM>, <NUM> are examples of the gNBs 110a-b or ng-eNB <NUM>. In general, TDOA positioning techniques utilize the difference in travel times between one entity and other entities to determine relative ranges from the other entities and those, combined with known locations of the other entities may be used to determine the location of the one entity. Angles of arrival and/or departure may be used to help determine a location of an entity. For example, an angle of arrival or an angle of departure of a signal combined with a range between devices (determined using signal, e.g., a travel time of the signal, a received power of the signal, etc.) and a known location of one of the devices may be used to determine a location of the other device. The angle of arrival or departure may be an azimuth angle relative to a reference direction such as true north. The angle of arrival or departure may be a zenith angle relative to directly upward from an entity (i.e., relative to radially outward from a center of Earth). In operation, the first base station <NUM> may provide a passive positioning start message <NUM> to the UE <NUM>. The passive positioning start message <NUM> may be a broadcast message, or other signaling such as RRC, to inform the UE of a PRS transmission schedule and may include transmission information (e.g., channel information, muting patterns, PRS bandwidth, PRS identification information, etc.). At time T1, the first station may transmit a first DL PRS <NUM> which may be received by the second base station <NUM> at time T2 (for example), and by the UE <NUM> at time T3. The second base station <NUM> may be configured to transmit a second DL PRS <NUM> at time T4, which is received by the first base station <NUM> at time T5 and by the UE <NUM> at time T6. The time between T2 and T4 may be a configured turnaround time on the second base station <NUM> and thus a known period of time. The time between T1 and T2 (i.e., time of flight) may also be known because the first and second base stations <NUM>, <NUM> are in fixed locations. The turnaround time (i.e., T4-T2) is provided to the UE for use in positioning calculations. The time of flight (i.e., T2-T1) may be broadcast or otherwise provided to the UE <NUM> for use in positioning calculations. For example, when the UE <NUM> is in an RRC connected state, the turnaround time and time of flight information may be provided via broadcast PDSCH, PDCCH, MAC-CE, RRC messages, or other signaling methods. In an embodiment, the value of the turnaround time (i.e., T4-T2) may be dominated by the periodicity of the PRS and thus may be relaxed to a known upper bound of the propagation delay. When the UE <NUM> is in an RRC idle or inactive mode, the turnaround time and time of flight information may be provided via System Information Blocks (e.g., SIBs, pos-SIBs) or Other System Information (OSI) messaging. The UE <NUM> may observe the difference between T6 and T3, and the distances may be computed as: <MAT> <MAT> <MAT>.

The distance values and the locations of the stations may be used to determine a location of the UE <NUM>. In an example, the UE <NUM> may provide the distance information to a network resource (e.g., the LMF <NUM>) and the network may be configured to determine the location of the UE <NUM>. In another example, the UE <NUM> may receive assistance data and be configured to determine a location and report the location to the network. The base stations <NUM>, <NUM> may be configured to operate with different radio access technologies (e.g., LTE, sub <NUM>, <NUM>, mmW) and with different frequency layers. In an example, in dynamic spectrum sharing, the base stations and/or UEs may be configured to operate with different technologies simultaneously.

In an example, the first base station <NUM> and the second base station <NUM> may be in communication with one another, but may not be in line of site (NLOS). In an NLOS use case, the first and second base stations <NUM>, <NUM> may be configured to perform an RTT exchange. For example, the distance between the first base station <NUM> and the second base station <NUM> may be computed as: <MAT>.

The resulting value from equation (<NUM>) is signaled to the UE <NUM> as a proxy for the distance/time of flight between the first base station <NUM> and the second base station <NUM>.

The message flow <NUM> is generally adequate when the first base station <NUM> and the second base station <NUM> can hear one another, and the UE <NUM> can overhear the first DL PRS <NUM> transmitted from the first base station <NUM> to the second base station <NUM>, and the second DL PRS <NUM> transmitted from the second base station <NUM> to the first base station <NUM>. Typically, lower frequency wireless networks (e.g., sub <NUM>) may use omnidirectional DL PRS transmissions which may be heard by several stations. In some higher frequency <NUM> NR networks, however, millimeter wave (mmW) and beamforming technologies are used to generate directional transmissions. Such directional beams may limit the ability of the first and second base stations <NUM>, <NUM> to exchange DL PRS messages, as well as limit the ability of an UE to overhear the DL PRS transmissions between base stations.

Referring to <FIG>, with further reference to <FIG>, an example message flow <NUM> for passive positioning of a base station <NUM> is shown. In operation, the message flow <NUM> is similar to the message flow <NUM> with the roles of the UE <NUM> and the second base station <NUM> reversed. For example, the UE <NUM> may be configured to provide an UL SRS for positioning <NUM> upon receiving the first DL PRS <NUM>. The UE <NUM> may be configured to provide the turnaround time (i.e., T4-T3) to the first base station <NUM>, or other station on the network, and the second base station may be configured compute a positioning constraint based on the respective times of arrivals (i.e., T2, T6).

In an embodiment, the LMF <NUM> (not shown in <FIG> and <FIG>) may be communicatively coupled to the base stations <NUM>, <NUM> and the UE <NUM>. The LMF <NUM> may configure the PRS transmissions and signal the PRS configurations to the base stations in a network. In an example, the LMF <NUM> may divide sets of stations (e.g., gNBs, UEs) into several groups. The grouping may be based on PRS resources, station configurations, and station locations. For example, the grouping may be based on which measurements are feasible or likely to be successful (e.g., based on LOS). Each station may be part of more than one group. A first group may be configured to transmit PRS in a time period while the remaining groups are configured to listen for the PRS. The different groups of station may then alternate transmitting PRS. Each base station may be configured to record when PRS signals are received and the time the base station's PRS are transmitted (e.g., the turnaround time). The LMF <NUM> may be configured to inform network stations of the PRS timing information (e.g., inter-gNB propagation, gNB turn times, etc.). The UEs in the network may measure the PRS transmitted from the base stations and utilize the PRS timing information to determine time differences between the PRS signals. The time differences may be used in the position computations and previously described. In an embodiment, the PRS timing information may include timing offset values for base station pairs, or other time reference such as a GNSS time. The timing information may also include periodicity information and resources for PRS of the base stations, and propagation times among base stations. In an example, the propagation times may be defined as upper bounds instead of accurate values. The timing information may enable a UE to receive a PRS from a master base station and then determine T4 - T2 values for other base stations, which may variable based on when the master PRS is transmitted. The timing information may be propagated via inter-gNB message exchanges (e.g., direct data connection and message transfer between the gNBs), and/or via connections through the LMF <NUM> (e.g., the LMF <NUM> may be configured to distribute the timing information to other gNBs). Other signaling techniques may also be used to propagate the timing information.

Referring to <FIG>, an example industrial internet of things (IIOT) environment <NUM>, with a plurality of base stations is shown. The environment <NUM> includes a first base station <NUM> and a second base station <NUM>. The base stations <NUM>, <NUM> may be mounted in an overhead configuration (e.g., ceiling mounted) with respective coverage areas directed down toward an area with a plurality of UEs such as a first UE <NUM>, a second UE <NUM>, and a third UE <NUM>. The coverage areas of the base stations <NUM>, <NUM> may prohibit reliable communications between the base stations <NUM>, <NUM>. Thus, the base stations <NUM>, <NUM>, may not be able to exchange PRS messages as depicted in the message flow <NUM>. In this example, one or more of the UEs <NUM>, <NUM>, <NUM> may be configured to perform some or all of the functions of the base stations described herein. For example, the second UE <NUM> may be configured to determine a location (e.g., using inertial, satellite and/or terrestrial techniques) and transmit positioning reference signals to neighboring base stations and/or UEs. The second UE <NUM> may be promoted to the status of a reference station, and the network (e.g., LMF <NUM> or other server) may be configured to provide assistance data based on the location and capabilities of the UE <NUM>. The second UE <NUM> may be configured to transmit omnidirectional sounding reference signals (SRS) for positioning and/or beamformed SRS for positioning based on the capabilities of the network and/or the UE. For example, UEs configured for <NUM> sub <NUM> operations may utilize omnidirectional signaling, and UEs configured for higher frequencies may utilize analog beam forming. The second UE <NUM> may transmit SRS for positioning with existing uplink and sidelink communication interfaces such as Uu and PC5, for example. Since the second UE <NUM> is in the coverage areas of both the first base station <NUM> and the second base station <NUM>, the second UE <NUM> may be configured to exchange PRS messages with either base station <NUM>, <NUM>. The second UE <NUM> is also proximate to the first UE <NUM> and the third UE <NUM> and may communicate with proximate UEs via one or more interfaces (e.g., Uu, PC5/sidelink). While the second UE <NUM> is being used as a reference station in this example because of the hypothetical coverage areas of the first and second base stations, other UEs may be designated as reference stations without regard to overlapping coverage areas. For example, the first UE <NUM> may be a reference station and may be used for passive positioning for other UEs that are positioned such that they may overhear the exchange of PRS messages between the first UE <NUM> and the first base station <NUM>. Further, the base stations <NUM>, <NUM> and the UEs <NUM>, <NUM>, <NUM> may be configured to operate with different technologies (e.g., LTE, sub <NUM>, <NUM>, mmW) and different frequency layers.

Referring to <FIG>, with further reference to <FIG>, an example message flow <NUM> for passive positioning with a plurality of UEs is shown. The message flow <NUM> includes the first base station <NUM>, the first UE <NUM>, and the second UE <NUM>. The base station <NUM>, may be a gNB 110a-b or ng-eNB <NUM> and the UEs <NUM>, <NUM> are examples of the UEs <NUM>, <NUM>. In an example, the message flow <NUM> includes transmitting a DL PRS <NUM> at time T1 with the first base station <NUM>, which is received by the second UE <NUM> at time T2. The first UE <NUM> is in a position to receive the DL PRS <NUM> at time T3. The second UE <NUM> is configured to transmit an UL PRS or UL SRS <NUM> at time T4, which is received by the first base station <NUM> at time T5. The first UE <NUM> is in a position to receive the UL SRS <NUM> at time T6. The first base station <NUM> and/or the second UE <NUM> may be configured to indicate (e.g., via broadcasting or other signaling) the turnaround time (i.e., T4-T2), the time of flight (i.e., T2-T1), and other assistance data (e.g., locations of the first base station <NUM> and the second UE <NUM>). In an example, the first base station <NUM> may indicate the time of flight, and the second UE <NUM> may indicate the turnaround time. The first UE <NUM> is configured to perform RSTD measurements based on the time of arrivals T3 and T6 and compute distances between the stations based on the equations (<NUM>)-(<NUM>) above. In an example, the second UE <NUM> may initiate the PRS exchange with the first base station <NUM> such that an UL SRS is transmitted at time T1 and receive by the first base station <NUM> at time T2. While <FIG> depicts two UEs and one base station, the methods for passive positioning with NR described herein are not so limited. Various combinations of base stations and UEs may be used. Further, the base stations may be one or more of a variety of TRPs such as macro, pico and/or femto TRPs, and combinations of omnidirectional and beamformed transmissions may be used. Different frequency layers may also be used. For example, the first base station <NUM> may be configured to transmit PRS based on LTE and/or <NUM> standards in a dynamic spectrum sharing model, and the UEs may be configured to transmit PRS based on either LTE and/or <NUM> based on the individual capabilities of the UEs.

In an example, a designated reference UE (e.g., the second UE <NUM>) may not have a line of sight (NLOS) with the first base station <NUM> and may be configured to perform an RTT exchange with the first base station <NUM>. The resulting RTT distance (e.g., the results of equation (<NUM>)), may be provided to the first UE <NUM> and used as a proxy for the distance/time of flight between the first base station <NUM> and the reference UE (e.g., the second UE <NUM>).

Referring to <FIG>, an example message flow <NUM> for passive positioning with a plurality of base stations is shown. The message flow includes a UE <NUM>, a first base station <NUM>, a second base station <NUM>, and third base station <NUM>. The UE <NUM> is an example of the UEs <NUM>, <NUM>, and the base stations <NUM>, <NUM>, <NUM> are examples of the gNBs 110a-b or ng-eNB <NUM>. The number of UEs and base stations in <FIG> is an example and not a limitation and various numbers of UEs and base stations may be used. The first base station <NUM> may optionally provide a passive positioning start message <NUM>. The passive positioning start message <NUM> may be a broadcast message, or other signaling such as RRC, to inform the UE <NUM>, or other proximate UEs (not shown in <FIG>) of PRS transmission schedules for each of the base stations <NUM>, <NUM>, <NUM>, which may include respective transmission information for each of the base stations (e.g., resource sets, resources, times, frequencies, resource elements per resource, repetition factor, periodicity, offset, etc.). At time T1, the first station may transmit a first DL PRS <NUM> which may be received by the second base station <NUM> at time T2 (for example), and by the third base station <NUM> at time T2'. The first DL PRS <NUM> may also be received by the UE <NUM> at time T3. The second base station <NUM> may be configured to transmit a second DL PRS <NUM> at time T4, which is received by the first base station <NUM> at time T5 and by the UE <NUM> at time T6. The time between T2 and T4 may be a configured turnaround time on the second base station <NUM> and thus a known period of time. The time between T1 and T2 (i.e., time of flight) may also be known because the first and second base stations <NUM>, <NUM> are in fixed locations. The first turnaround time (i.e., T4-T2) and the first time of flight (i.e., T2-T1) may be broadcast or otherwise provided to the UE <NUM> for use in positioning calculations. The third base station <NUM> is configured to transmit a third DL PRS <NUM> at time T4', which is received by the first base station <NUM> at time T5' and by the UE <NUM> at time T6'. The time between T2' and T4' may be a configured time on the third base station <NUM> and thus a known time. The time between T1 and T2' may also be known because the first and third base stations <NUM>, <NUM> are in fixed locations. The second turnaround time (i.e., T4'-T2') and the second time of flight (i.e., T2'-T1) may be provided to the UE <NUM> (e.g., PDSCH, PDCCH, MAC-CE, RRC messages, SIBs, pos-SIBs, OSI, or other signaling methods). The time of flight value may be a distance expressed in linear units (e.g., meters, kilometers, etc.) or in time units (e.g., nanoseconds). The UE <NUM> may observe the difference between T6 and T3, T6' and T3, and T6' and T6. In an example, the UE <NUM> may be configured to compute the respective distances based on equations (<NUM>)-(<NUM>) above and provide the distance values to the network (e.g., the LMF <NUM>). The network may utilize the distance values to compute a location of the UE <NUM>. In an example, the UE <NUM> may utilize the distance values and assistance data to compute a location. The base stations <NUM>, <NUM>, <NUM> may be configured to operate with different technologies (e.g., LTE, sub <NUM> GH, <NUM>, mmW) and with different frequency layers. In an example, in dynamic spectrum sharing, the base stations and/or UEs may be configured to operate with different technologies simultaneously. The turnaround times (e.g., T4-T2, T4'-T2') may be configured by a network resource (e.g., the LMF <NUM>) and provided to the respective base stations to enable the DL PRS signals <NUM>, <NUM>, <NUM> to be transmitted in a preestablished sequence. The base stations <NUM>, <NUM>, <NUM> may also be configured with periods of null resources (e.g., muted) to avoid interference with proximate stations. In an example, the DL PRS signals <NUM>, <NUM>, <NUM> may be transmitted on different frequency layers and with different technologies (e.g., LTE, <NUM>). One or more of the base stations <NUM>, <NUM>, <NUM>, may be a UE (e.g., a reference UE) configured to transmit UL SRS via an UL interface (e.g., Uu) or a sidelink interface (e.g., PC5).

Referring to <FIG>, with further reference to <FIG>, a method <NUM> for providing passive positioning information includes the stages shown. The method <NUM> is, however, an example and not limiting. The method <NUM> may be altered, e.g., by having stages added, removed, rearranged, combined, performed concurrently, and/or having single stages split into multiple stages.

At stage <NUM>, the method <NUM> optionally includes receiving, at a first station, a positioning reference signal transmission schedule indicating times to transmit positioning reference signals and times to receive positioning reference signals. A TRP <NUM> and a UE <NUM> are example means for receiving the positioning reference signal transmission schedule. In an embodiment, a network server such as the LMF <NUM> may be configured to provide a PRS transmission schedule to the base stations and/or UEs in a network. In an example, the LMF <NUM> may divide the gNB and/or UEs into several groups based on PRS resource configuration, station configurations, and station locations. Each gNB and/or UE may be part of more than one group. A first group may be configured to transmit PRS in a time period while the remaining groups are configured to listen for the PRS. The different groups of station may then alternate transmitting PRS. Each base station may be configured to record when PRS signals are received and the time the base station's PRS are transmitted (e.g., the turnaround time). The LMF <NUM> may be configured to inform network stations (i.e., the first station) of the PRS transmission schedule via messaging protocols such as NRPPa, LPP, etc..

At stage <NUM>, the method <NUM> includes receiving, at the first station and at a first time, a first positioning reference signal from a second station. A TRP <NUM> and a UE <NUM> are example means for receiving a first positioning reference signal. Referring to <FIG>, the second base station <NUM> may receive the first DL PRS <NUM> at time T2. Referring to <FIG>, the second UE <NUM> may receive the DL PRS <NUM> at time T2. The PRS signals being transmitted by a first station at time T1. The first PRS may be an omnidirectional or beamformed transmission capable of being received by a plurality of stations and/or UEs. In an example, the first PRS may be an on-demand PRS.

At stage <NUM>, the method includes transmitting a second positioning reference signal to the second station at a second time, wherein the second time is after the first time. The TRP <NUM> and the UE <NUM> are means for transmitting the second PRS. Referring to <FIG>, the second base station <NUM> may transmit the second DL PRS <NUM> at time T4. Referring to <FIG>, the second UE <NUM> may transmit a UL SRS <NUM> at time T4. In an example, the UE <NUM> may utilize an uplink interface (e.g., Uu) or a sidelink interface (e.g., PC5) to transmit the second PRS. In an example, the first PRS transmitted at stage <NUM> and the second PRS transmitted at stage <NUM> may utilize different frequency layers.

At stage <NUM>, the method includes providing a turnaround time value based on the first time and the second time, and a distance value based on a location of the first station and a location of the second station to a user equipment. The TRP <NUM> and the UE <NUM> are a means for transmitting the turnaround time and distance values. Referring to <FIG>, an example of the turnaround time value is based on the time between receiving the first DL PRS <NUM> and the time the second DL PRS <NUM> is transmitted (e.g., the value of T4-T2). Referring to <FIG>, the turnaround time is based on the time the DL PRS <NUM> is received and the UL SRS <NUM> is transmitted (e.g., the value T4-T2). In another example, referring to <FIG>, the turnaround time value may be based on the time the first DL PRS <NUM> is received by the third base station <NUM>, and the time the third PRS <NUM> is transmitted (e.g., T4'-T2'). The distance values are based on the physical locations between the first and second station. The distance value may be used to compute a time of flight (e.g., the time T2-T1). In an example, the distance value may be based on an RTT exchange between the two stations. The turnaround and distance values associated with the base station and reference UEs may be broadcast or provided in network signaling or higher layer protocols (e.g., RRC, LPP, NRPP, MAC-CE, SIBs, etc.). In an example, the turnaround time value may be included in the second PRS received by the UE. The turnaround time value and locations of the stations may be associated with a PRS identification, station ID, or other signal characteristic of a received PRS based on a codebook stored locally on the UE.

Referring to <FIG>, with further reference to <FIG>, a method <NUM> for passive positioning of a user equipment includes the stages shown. The method <NUM> is, however, an example and not limiting. The method <NUM> may be altered, e.g., by having stages added, removed, rearranged, combined, performed concurrently, and/or having single stages split into multiple stages.

At stage <NUM>, the method includes receiving a first positioning reference signal from a first base station at a first time. The UE <NUM> is a means for receiving the first PRS. In an example, a TRP <NUM> may be configured to transmit a DL PRS, such as the first DL PRS <NUM>. The TRP <NUM> may optionally be configured to provide a passive positioning start message <NUM> to alert proximate UEs that passive positioning exchanges are being initiated. In an example, the UE <NUM> may be configured to select a DL PRS based on established PRS scheduling information. The UE <NUM> receives the first PRS at time T3 as depicted in <FIG>, <FIG> and <FIG>. In an example, the first PRS may be a user or group specific on-demand PRS.

In an embodiment, a network server such as the LMF <NUM> may be configured to provide a PRS transmission schedule to the UE <NUM>. In an example, the LMF <NUM> may divide the base stations into several groups based on PRS resource configuration, station configurations, and station locations. Each base station may be part of more than one group. For example, the first base station may be included in a first group may be configured to transmit PRS that the first time, while the remaining groups are configured to listen for the PRS. The different groups of base station may then alternate transmitting PRS. The LMF <NUM> may be configured to inform the UE <NUM> of the PRS transmission schedule via messaging protocols such as LPP or via a gNB via RRC, MAC-CE, DCI, etc..

At stage <NUM>, the method includes receiving a second positioning reference signal from a second base station at a second time. The UE <NUM> is a means for receiving the second PRS. In an example, a second TRP <NUM>, such as the second base station <NUM> or the UE <NUM> is configured to send a DL PRS <NUM> or a UL SRS <NUM> at time T4. The UE <NUM> receives the second PRS at time T6 as depicted in <FIG>, <FIG> and <FIG>. The UE may be configured to select a DL PRS based on established PRS scheduling information. In an example, the second PRS may be a user or group specific broadcast on-demand PRS. The first and second PRS may be on the same frequency layer or on different frequency layers. In an example, the first and/or second PRS may be transmitted via a sidelink interface (e.g., PC5). Other interfaces and signaling methods may be used to receive PRS transmissions.

At stage <NUM>, the method includes receiving a turnaround time value associated with the first positioning reference signal and the second positioning reference signal, and a distance value based on a location of the first station and a location of the second station. The UE <NUM> are a means for receiving the turnaround time and distance values. Referring to <FIG>, an example of the turnaround time value is based on the time between receiving the first DL PRS <NUM> and the time the second DL PRS <NUM> is transmitted (e.g., the value of T4-T2). Referring to <FIG>, the turnaround time value is based on the time the DL PRS <NUM> is received and the UL SRS <NUM> is transmitted (e.g., the value T4-T2). In another example, referring to <FIG>, the turnaround time value may be based on the time the first DL PRS <NUM> is received by the third base station <NUM>, and the time the third PRS <NUM> is transmitted (e.g., T4'-T2'). The distance values are based on the physical locations between the first and second station. The distance value may be used to compute a time of flight (e.g., the time T2-T1). In an example, the distance value may be based on an RTT exchange between the two stations. The turnaround time and distance values associated with the base station and reference UEs may be broadcast or provided in network signaling (e.g., RRC, LPP, NRPP, MAC-CE, SIBs, pos-SIBs etc.). In an example, the turnaround time value and locations of the stations may be associated with a PRS identification, station ID, or other signal characteristics of a received PRS based on a codebook stored locally on the UE.

At stage <NUM>, the method includes determining a time difference of arrival based at least in part on the turnaround time value, the distance value, the first time, and the second time. The UE <NUM> is a means for determining the time difference of arrival. The UE may utilize the first time (i.e., T3), the second time (i.e., T6), and turnaround time and distance values to perform the distance calculations provide at equations (<NUM>)-(<NUM>). The distance value may be expressed as a time of flight (e.g., in units of time), or in units of length (e.g., meters) and the UE may be configured to compute a time of flight based on the distance. The UE <NUM> may be configured to send the time difference of arrival information (e.g., T6-T3) to the first and/or second stations, or a serving station. In an example, the UE <NUM> may be configured to determine a location based on the time difference of arrival information, and assistance data, and provide the location to the first and/or second station, or a serving station.

In an embodiment, the functions of the base stations in the method <NUM> may be performed by reference UEs. For example, UL PRS and device-to-device sidelinks (e.g., PC5) may be used to provide PRS or other reference signals such as SRS for positioning. Other interfaces, such as the Uu interface, may be used to transmit one or more PRSs.

For example, due to the nature of software and computers, functions described above can be implemented using software executed by a processor, hardware, firmware, hardwiring, or a combination of any of these. For example, one or more functions, or one or more portions thereof, discussed above as occurring in the LMF <NUM> may be performed outside of the LMF <NUM> such as by the TRP <NUM>.

Components, functional or otherwise, shown in the figures and/or discussed herein as being connected or communicating with each other are communicatively coupled unless otherwise noted. That is, they may be directly or indirectly connected to enable communication between them.

As used herein, unless otherwise stated, a statement that a function or operation is "based on" an item or condition means that the function or operation is based on the stated item or condition and may be based on one or more items and/or conditions in addition to the stated item or condition.

As used herein, the singular forms "a," "an," and "the" include the plural forms as well, unless the context clearly indicates otherwise. For example, "a processor" may include one processor or multiple processors. The terms "comprises," "comprising," "includes," and/or "including," as used herein, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.

Also, as used herein, "or" as used in a list of items (possibly prefaced by "at least one of" or prefaced by "one or more of") indicates a disjunctive list such that, for example, a list of "at least one of A, B, or C," or a list of "one or more of A, B, or C" or a list of "A or B or C" means A, or B, or C, or AB (A and B), or AC (A and C), or BC (B and C), or ABC (i.e., A and B and C), or combinations with more than one feature (e.g., AA, AAB, ABBC, etc.). Thus, a recitation that an item, e.g., a processor, is configured to perform a function regarding at least one of A or B, or a recitation that an item is configured to perform a function A or a function B, means that the item may be configured to perform the function regarding A, or may be configured to perform the function regarding B, or may be configured to perform the function regarding A and B. For example, a phrase of "a processor configured to measure at least one of A or B" or "a processor configured to measure A or measure B" means that the processor may be configured to measure A (and may or may not be configured to measure B), or may be configured to measure B (and may or may not be configured to measure A), or may be configured to measure A and measure B (and may be configured to select which, or both, of A and B to measure). Similarly, a recitation of a means for measuring at least one of A or B includes means for measuring A (which may or may not be able to measure B), or means for measuring B (and may or may not be configured to measure A), or means for measuring A and B (which may be able to select which, or both, of A and B to measure). As another example, a recitation that an item, e.g., a processor, is configured to at least one of perform function X or perform function Y means that the item may be configured to perform the function X, or may be configured to perform the function Y, or may be configured to perform the function X and to perform the function Y. For example, a phrase of "a processor configured to at least one of measure X or measure Y" means that the processor may be configured to measure X (and may or may not be configured to measure Y), or may be configured to measure Y (and may or may not be configured to measure X), or may be configured to measure X and to measure Y (and may be configured to select which, or both, of X and Y to measure). Substantial variations may be made in accordance with specific requirements. For example, customized hardware might also be used, and/or particular elements might be implemented in hardware, software (including portable software, such as applets, etc.) executed by a processor, or both.

The systems and devices discussed above are examples. For instance, features described with respect to certain configurations may be combined in various other configurations.

A wireless communication system is one in which communications are conveyed wirelessly, i.e., by electromagnetic and/or acoustic waves propagating through atmospheric space rather than through a wire or other physical connection. A wireless communication network may not have all communications transmitted wirelessly, but is configured to have at least some communications transmitted wirelessly. Further, the term "wireless communication device," or similar term, does not require that the functionality of the device is exclusively, or evenly primarily, for communication, or that the device be a mobile device, but indicates that the device includes wireless communication capability (one-way or two-way), e.g., includes at least one radio (each radio being part of a transmitter, receiver, or transceiver) for wireless communication.

The terms "processor-readable medium," "machine-readable medium," and "computer-readable medium," as used herein, refer to any medium that participates in providing data that causes a machine to operate in a specific fashion. Using a computing platform, various processor-readable media might be involved in providing instructions/code to processor(s) for execution and/or might be used to store and/or carry such instructions/code (e.g., as signals). In many implementations, a processor-readable medium is a physical and/or tangible storage medium. Such a medium may take many forms, including but not limited to, non-volatile media and volatile media. Non-volatile media include, for example, optical and/or magnetic disks. Volatile media include, without limitation, dynamic memory.

Claim 1:
A method for providing passive positioning information to a first user equipment, UE, (<NUM>), comprising:
receiving (<NUM>), at a first station (<NUM>) and at a first time (T2), a first positioning reference signal from a second station (<NUM>) wherein the first and second stations are base stations, UEs, other than the first UE, or a combination;
transmitting by the first station (<NUM>) a second positioning reference signal to the second station (<NUM>) at a second time (T4), wherein the second time is after the first time; and
providing to the first user equipment (<NUM>) a turnaround time value as the difference between the first time and the second time, and a distance value indicating a distance between the first station (<NUM>) and the second station (<NUM>);
wherein the turnaround time value is provided to the first user equipment by one of the following: broadcast from one of the first station, the second station or a serving station, or network signalling from the serving station, or higher layer protocols from a location server;
wherein the distance value is determined by the first station, or the second station, or the location server, based at least in part on a first transmission time, the first time, the second time, and a second receive time (T5) indicating a time the first station received the second positioning reference signal, wherein the first transmission time (T1) indicates a time the second station transmitted the first positioning reference signal.