I Introduction
One of the fundamental challenges of today’s networks is precise estimation of indoor users’ locations. The location of a user is a source of information that can be leveraged to unlock huge technological, social, and business potentials. This is in particular the case for indoor environment, where the signal of the global navigation satellite system (GNSS) is unavailable.
Due to its pervasive deployment and costeffective nature, positioning using wireless local area networks (WLANs) signals has been at the focus of research for almost a decade. In fact, experimental works have proven that WiFi signals can be used to obtain excellent location accuracy even in harsh multipath environments [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11]. For a comprehensive survey on the success of WiFi in localizing indoor users refer to [12, 13]. This has been a significant advancement as, until recently, ultrawideband (UWB) radio was deemed as the only viable solution to get accurate location information [14].
Indoor positioning using WiFi began with powerbased ranging using received signal strength (RSS) [8, 9, 10, 11, 15, 16]. Unfortunately, accurate range estimation with RSS is impossible because: (i) timedomain OFDM signals are highly fluctuating (ii) the amplitude of a signal is directly affected by smallscale fading (iii) signal amplification at the receiver is controlled by the automatic gain controller (AGC) whose behaviour dynamically varies with channel conditions.
This paper is motivated by the availability of channelstate information (CSI) from Intel [17] and Atheros [18] WiFi chipsets that have enabled CSI to be used for positioning. CSI is a more stable and informative representation of the wireless channel (compared to RSS) between two communicating endpoints. Therefore, it can be used to perform range (timebased or powerbased) and angleofarrival estimation. When it comes down to implementation, while CSIbased localization with AoA achieved promising outcomes [2, 3, 4, 19], using CSI to estimate timeofflight (ToF) measurement has either not been pursued or led to inconsistent results [2]. To our knowledge, the studies that do consider phasebased ranging all use softwaredefined radio (SDR), an opensource and finetuned platform that is expensive to acquire and so is unscalable. On the other hand, our work is based on using commercial offtheshelf MIMOOFDM network interface cards (NIC), which are used in laptops and computers, to estimate the range from phase of the CSI. As ToF measurement is crucial to ranging, and subsequently positioning, this raises the question, “What makes ToF estimation using CSI a challenging task?” This paper aims to find an answer to this question. Our goal is multifaceted: First, we aim to discuss some of the often neglected practical issues about CSI and ToF estimation using the CSI. In that vein, we dissect CSI that is obtainable from WiFi chipsets to understand its constituent building blocks, different forms it takes, and the sources of error that contaminate it. We proceed with introducing preprocessing methods to clean CSI from those errors and make it usable for ToF estimation. We then apply the classic superresolution spectral MUSIC algorithm to the postprocessed CSI to obtain accurate and stable range estimates. To our knowledge, this is an achievement that has never been accomplished before.
The inherent appeal of MUSIC algorithm is due to the fact that estimator’s resolvability power is not only determined by the signal bandwidth but also the total signaltonoise ratio (SNR). More importantly, MUSIC is an efficient and consistent estimator when certain criteria are met.
In doing so, different ideas are examined, including covariance hardening methods, such as spectral smoothing and forwardbackward smoothing, and decision fusion algorithms. We demonstrate that decimetre ranging with only MHz of spectrum is possible if CSI is properly postprocessed and range estimates are intuitively combined.
Problem Statement: A holistic view of the problem addressed in this paper is presented in Fig. (a)a where the link between a transmitter and receiver is shown: Whereas coherent decoding of data symbols in communications systems requires the knowledge of endtoend degradation imposed between a transmitter’s baseband (BB) and receiver’s BB (named transmission channel), location estimation hinges on the knowledge of the channel immediately between the two antennas (named propagation channel). Not only these two channels are not the same, but quantifying one from the other is a nontrivial task. The difference between transmission channel MX and propagation channel arises because of (i) lack of synchronization between transmitter/receiver in passband (PB) and (ii) deterministic signal processing operations in transmitter’s BB. In the latter case, cyclic delay diversity (CDD), spatial mapping matrix (SMM), and timewindowing, whose effects are generally incorporated into the CSI matrix, make the receiver believe that the transmitter is several tens of meters away and that the channel is more reflective than it really is.
Contribution: In tackling the aforementioned problem, this paper’s contributions are as follows:

To dissect different deterministic and random phenomena happening in the transmitter and receiver hardware causing and to be different.

To establish the right model for CSI and its relation with the channel matrix.

To develop preprocessing techniques to eliminate random phases introduced by the insufficiency of synchronization between the transmitter and the receiver.

To obtain accurate range estimates by applying superresolution algorithm to the calibrated CSI.
Organization: This paper is organized as follows: In Section II, we go over the basics of multipleinput multipleoutput orthogonal frequency division multiplexing (MIMOOFDM) WLAN systems, including their transceiver architecture, channelsounding, etc. In Section III we show why ToF estimation with CSI is a challenging task, and explain different random and deterministic sources of error contributing to this problem. With the knowledge gained, we tackle the problem of cleaning and calibrating CSI in Section IV. Finally, in Section V, we introduce ideas to obtain more accurate range estimates from the postprocessed CSI.
Notation: The following notation is adopted throughout this paper: (lowercase/regular) a scalar, (lowercase/boldface)
a vector,
(uppercase/boldface) a matrix. For matrix , is its th element, is its transpose, is its conjugate, and is its Hermitian.Ii Background
Iia Channel State Information (CSI)
Without properly compensating for the propagation and asynchronization effects, the receiver has no way of detecting what was transmitted. To that end, and through a mechanism named channel sounding, the receiver obtains an estimate of wireless channel. This is accomplished by sending a training sequence that is known to both transmitter and receiver. For a wideband MIMOOFDM system, the estimate of the channel is a collection of complex matrices one for each OFDM subcarrier. It is such information that is universally known as channel state information (CSI). Once CSI is known, it is used by the equalizer in order to cancel out any deterioration (e.g. phase shift, attenuation, etc.) that was imposed on the transmitted data. For packetbased MIMOOFDM IEEE802.11(n) systems, training sequences, namely high throughput long training fields (HTLTF), are sent in the preamble, which is instantly used by the receiver to derive CSI.
IiB WLAN Transceiver Architecture
Fig. (b)b shows the general structure of the MIMOOFDM WLAN transmitter. An encoded highrate bit stream is fed to the stream parser to create spatial streams. These spatial streams are modulated using constellation mappers (e.g. QAM) to create stream of symbols. As explained before, the transmitter may only send parallel streams, where is the true channel matrix, and violating this rule would result in loss of data. Note that (with the equality holding when the channel is rich scattering), where , are the number of transmit and receive antennas, respectively.
Next, spatial streams are cyclically shifted through a mechanism named cyclic delay diversity (CDD) to create extra frequency diversity and make sure no unintended beamforming takes place when sending common information (e.g. headers) from all transmit antennas.
The spatial mapping maps fewer number of spatial streams to larger number of transmit antennas [20]
. This is especially crucial in situations where lower number of streams is to be carried by larger number of transmit chains. The existence of CDD and spatial mapping matrix are among the main reasons to render oneway measurements of timeofflight (ToF) for ranging difficult. Moving forward, a second CDD layer is applied to each transmit chain and frequency domain samples are fed to inverse fast Fourier transform (IFFT) to create timedomain samples. These samples are then simultaneously sent from all transmit chains.
Referring to Fig. 1, the receiver output at point “B”, is related to transmitter input at point “A” through the following matrix equation:
(1) 
where , , and are, respectively, the channel matrix, the spatial mapping matrix, and the first, and the second CDD matrices at the th subcarriers, , where is the number of (nonzero) subcarriers within the band of interest out of the total of subcarriers (e.g. and for MHz in IEEE 802.11n systems). More details on the composition of ,, and are provided in the next subsection.
IiB1 Cyclic Delay Diversity (CDD)
Despite that the payload part of a packet is destined only to a given destination, the packet preamble is meant to be heard/decoded by everyone. To ensure that the header is received by all, and to avoid inadvertent beamforming across the antennas, CDD is used [21]. This is achieved by sending the same header OFDM symbols over different antennas while cyclically shifting them so that (i) all RF chains are utilized, thus, longer communication range is obtained (ii) no unintended beamforming is experienced. The effect of CDD on transmitting common header information changes the multipath nature of the channel as seen by the receiver. To simplify the transceiver architecture, CDD is always applied no matter which portion of packet is being sent, header or payload. The choice of CDD is implementation dependent. We observe that at times, even the same access point (AP) will use different CDD values for the same number of streams. Nonetheless, the standard [22] puts forth some recommendations. Ranging with the raw CSI obtained from the NIC (without accounting for CDDs) may give rise to an accuracy that is off by several tens of meters.^{1}^{1}1For example, for a 4x4 MIMO system, CDD values ns are suggested. For WLAN systems operating on sampling rate ns, where MHz, these CDDs are equivalent to delays equivalent to samples.
IiB2 Spatial Mapping Matrix (SMM)
The spatial mapping operation is the most crucial component of MIMOOFDM systems assuming tasks such as transmit beamforming, spatial multiplexing, spatial diversity, and so on. This is often implemented through linear matrix operation as shown in (1) and is an implementationdependent matter. If , often direct mapping takes place, i.e. , where
is the identity matrix. However, when
, indirect mapping may be adopted [20]. In the latter case, the effect of SMM is similar to having more echoes than those added by the propagation environment. For this reason, imposition of SMM has similar effect as having virtual echoes.IiC Channel Sounding
Channel sounding is the mechanism of obtaining CSI at the receiver. This is done by transmitting known HTLTF sequences. HTLTF sent over th stream is a unique sequence where . To probe a single dimension of the multidimensional (MIMO) channel, one is sent on each spatial stream, for the total of stream. That means that vector is fed to all the streams simultaneously to be transmitted over the th subcarrier in order to estimate MIMO channel matrix on the th subcarrier frequency. Let’s denote . To probe all the dimensions of the MIMO channel, not one but several are transmitted in the preamble (in sequence) where, . In other words, twostate training symbols will have to be sent to learn complex coefficients of the MIMO channel [20]. Subsequently, a matrix is received for the th HTLTF symbol on received antennas.
Iii Challenges of Ranging with CSI
In general, ToF estimation based on CSI suffers from several deeprooted issues some of which have not been discussed in the literature. These issues are pointed out next and dealt with in detail later on.
Bandwidth Limitation
Range estimation has been traditionally done through derivation of the channel impulse response (CIR) for each tx/rx pair and hunting CIR’s first and strongest peak. This simple approach has been effective in ranging with UWB radio and been lately pursued in the WiFibased indoor localization literature [18, 23, 13]. Without delving into derivation details, CIR is obtained by taking the IFFT of the samples of the channelfrequency response (CFR), i.e. CSI metric, while accounting for the fact that no CSI is collected on (i.e. zero subcarrier)^{2}^{2}2Transmitting data on OFDM’s center frequency would result in loss of information due to strong DC current at BB. and is given by
(2) 
where is the time (delay) domain index and
where , , , , are the number of multipath arrivals, delay and attenuation on th path, subcarrierspacing, and central frequency, respectively. This powerdelayprofile (PDP) peaks at discrete samples only if (i) th arrival has enough strength (ii) closeby arrivals are not within each other’s Rayleigh resolution limit, i.e. . For WiFi systems with sampling rate Mega sample/s (Msps) (for a MHz channel), the electromagnetic wave travels extra m between two consecutive samples. Such low sampling rate makes resolving closelyspaced multipath reflections (as needed for indoor positioning) based on CIR theoretically impossible.
CSI Phase Contamination
The phase in the CSI matrix is contaminated with terms triggered by the imperfect synchronization between the transmitter and receiver in analog/digital domains. Dubbed by the names symbol timing offset (STO), sampling frequency offset (SFO), carrier frequency offset (CFO), and carrier phase offset (CPO), these frequency and time synchronization errors are extremely volatile in nature [24].
CSI Amplitude Contamination
The amplitude of the CSI is highly distorted by three phenomena: (a) unpredictable changes in AGC gain, (b) I/Q imbalance, and (c) the mixed effect of cyclicprefix removal/guardband insertion/windowing operation on timedomain CSI samples.
CDD Phase Shift
Artificial Multipath
Iiia Impact of OFDM Baseband Operations
IiiA1 SMM and CDD
Accounting for the SMM and CDD operations at the transmitter, the entire sounding mechanism can be described by (3), at the top of the page, where (the rightmost matrix) is called the orthogonal mapping matrix.
(3)  
The CSI matrix is calculated as , for each subcarrier. In (3), and are the cyclic shift (diagonal) matrices before and after spatial mapping, which is denoted by , a linear matrix, as shown in the transceiver architecture of Fig. 1 and is the noise matrix. Because , , are implementationdependent quantities, estimating matrix at the receiver from observations is challenging. However, the receiver does not require to extract the channel matrix to decode data points; so long as are applied to both training sequences and payload (which is indeed the case), the receiver can view as an endtoend channel. Elaborating on (3), and given that the receiver removes the orthogonal mapping matrix , the element of the CSI matrix is given by
(4) 
where , , represent receive antenna, transmit antennas, and spatial stream indices, respectively. From (4), the information on the ToF of the lineofsight (LoS) path is concealed in which is given by
(5) 
where and are the attenuation and time delay of the th path between th receive and th transmit antennas, respectively. Also, is the number of multipath components and is the th subcarrier’s frequency with and being the subcarrier spacing and the center frequency, respectively.
To better understand the effect of CDD and SMM on range measurement, we performed experiments in an anechoic chamber (Fig. (c)c) wherein (no multipath). In cases when the CSI matrix is not full rank, i.e. , we expect . In this situation, the PDP yields more than one peak , , where , are the cyclic shifts before and after spatial mapping on the th transmit chain and the spatial stream. This is indeed the case as shown in Fig. 2. Fig. (a)a uses data collected from a setup where transmitter and receiver arrays directly face each other whereas, in Fig. (b)b, the receiver is rotated by 90 degrees. The latter experiment was performed to understand whether we can achieve a full channel matrix () in nonscattering anechoic chamber.
In Fig. (a)a, PDP is plotted for those packets that encounter a channel with . As expected, peaks of equal strength is observed (for all transmitreceive subchannels) which cannot be justified by the echofree nature of the propagation environment. This is not observed in Fig. (b)b where and the SMM is often nonexistent (explained later on). Nevertheless, in both figures, peaks are shifted to the right by 2 samples which could be caused by STO, preadvancement, or CDD. ^{3}^{3}3Note that transmitterreceiver are 5.18m apart in anechoic chamber experiment which should produce a peak at sample index ”0”.
The conclusion here is that raw CSI is unusable. One has to derive channelrelated terms from CSI metrics in order to do positioning, a fact that is often underappreciated in the field of CSIbased positioning.
IiiA2 Time Domain Windowing
In examining the CSI obtained in a controlled conducted test (Fig. (d)d), and in the anechoic chamber, nonlinearities of regular shape were observed in both phase and amplitude of CSI as shown in Fig. (a)a and Fig. (b)b. The symmetric phase and amplitude nonlinearity on CSI (after FFT operation at the receiver) advocates a realtime operation (after IFFT operation at the transmitter). Importantly, this phase distortion can degrade the ranging accuracy. We claim that this effect arises due to the combination of timedomain windowing, cyclicprefix (CP) removal, and guardband insertion at the transmitter as shown in Fig. 3 and the logic is as follows: Wireless communications systems follow a blockwise design methodology where hierarchies of subsystems^{4}^{4}4e.g. scrambling FEC encoding stream parsing interleaving mapper channel equalization demapper deinterleaving deparser FEC decoder descrambler are used at the transmitter and receiver. This approach works because of the linearity of the operation performed in each block, hence, an inner block (say channelequalization) remains transparent to the outer block (say encodingdecoding). This reversibility is true for most operations along a wireless chain except a few, where CP insertionremoval is the most important one. When CP of the training sequence (from which CSI is calculated) is removed at the receiver, what passes through is a sequence that is windowed (in time domain) from tail but intact from head. That is because the rising head of the timedomain windows are often not long enough to get passed CP and split into the OFDM symbol, but the falling tail of that timedomain window will impact the tail of OFDM symbol. This effect causes the observed distortion.
To further investigate this hypothesis, we worked on measurements collected in the conducted test setup. In this setting, and based on the model in (4), and , hence CSI with linear phase (vs ) was expected, like where , the latter two terms are the cyclic shifts after and before spatial mapping, is the OFDM subcarrier spacing, and is a complex coefficient. Since the nonlinearity is completely constant regardless of the choice of attenuators, cable length, etc., it implies a systematic operation happening in hardware. In fact, taking FFT of CSI yields where and are the fractional and integer part of . This timedomain signal is plotted in Fig. (c)c. This is a Tukey window as recommended in IEEE 802.11 standard [22].^{5}^{5}5One should note that the Tukey window is a flat function with smooth edge falloff. However, the window we observe through CSI has an FFT whose upper (and lower) values are zeroed as a result of guard subcarrier exertion, which gives rise to Fig. (c)c. Whereas the results for Atheros 93xx chipset are presented here, the same observation were made for Intel 53xx chipset. In the general case, the CSI model in (4) is revised as
(6) 
where
and is a timedomain rectangle function of length to represent the CP removal operation on OFDM symbol, is a frequencydomain rectangle of length to represent guard band insertion operation in OFDM systems, and is the timedomain windowing function. , , and are the length of OFDM cyclic prefix (CP), the number of guard subcarriers, and the total number of subcarriers in OFDM system, respectively. Also and are the FFT and circular convolution operators. Since this is a deterministic effect that stems from a systematic design choice, a onetime nonlinear fitting to the phase curve in Fig. (a)a and derotating CSI phase accordingly would be sufficient without any concern with respect to overfitting.^{6}^{6}6Our fit is a 3rddegree polynomial which resulted in .
Discussion: The existence of phase nonlinearity in Fig. 4 has led some researchers to associate this with the I/Q imbalance phenomenon [25]. In several different works, e.g. [13, 26, 23], the trigonometriclike shape of the CSI phase (as depicted in Fig. 4) has led to incorrect representation of CSI as . The unrecognised, deleterious effects of these baseband operations have led to the belief that CSI is not usable for ToF estimation and made rangebased indoor positioning a less fruitful area of investigation. Chronos [5] is able to measure ToF by only using the zero subcarriers (at different frequency bands), a workaround that dodges all the deteriorations explained earlier. However, this is not the case if one needs to use CSI on arbitrary set of subcarriers for ToF estimation. On the other hand, estimating AoA using CSI circumvents these problems, as differencing the phases of the CSI at receive antennas eliminates the effect of the aforementioned additive phases imposed at the baseband of the transmitter [2, 3, 4].
IiiB Impact of Imperfect Signal Processing
The matrix equation in (3) assumes perfect synchronization between the transmitter and receiver. Such assumption is not realistic as communication always suffers from lack of perfect time/frequency synchronization. To account for this, the CSI model in (3) is revised as
(7) 
where is given by (3), is an by matrix of complex and timedependent elements to account for phenomena such as symbol timing offset (STO), carrier frequency offset (CFO), sampling frequency offset (SFO), and carrier phase offset (CPO). Since the chains (transmit and receive) in today’s MIMO systems are driven by one oscillator in an MIMO system, every pair of transmitreceive ports observe similar synchronization error in (7). Please note the difference between the time index in (7) (to distinguish CSI for different packets) and delay index in (2) (to distinguish discrete multipath components of the channel).
In general, can be an arbitrary matrix with nonzero elements. However, when there is no coupling between receiver chains, this matrix will be diagonal. Also given that all RF chains in MIMO WLAN systems use a common oscillator/synthesizer, the complex diagonal elements of are the same. Our extensive experiments in the anechoic chamber (Fig. (c)c) verifies the following two hypotheses regarding the phase of : (i) linear in subcarrier index (ii) highly variable even in purely static environment. These additive phase terms highly degrade the accuracy of the CSIbased ranging as reported in several localization studies [2, 3, 5] and are discussed next.
IiiB1 Frequency Errors
In downconverting analog passband (PB) signal to baseband (BB), the following errors are introduced into the CSI:

CFO/CPO: The generated carrier at the receiver can be represented by a complex exponential. CFO exists when the receiver’s carrier frequency drifts from the transmitted carrier frequency by due to residual errors in receiver’s phase locked loop (PLL).^{7}^{7}7The CFO can also be due to Doppler effect. Nonetheless, contribution of the latter to is considerably less compared to oscillator frequency mismatch.
On the other hand, CPO is imposed because receiver’s voltage controlled oscillator (VCO) starts from a random phase every time the synthesizer restarts and the phase locked loop (PLL) cannot completely compensate for the phase difference between generated carrier and received signal. Both of these effects are shown to affect CSI in the following manner
(8) where is the CFO normalized with OFDM subcarrier spacing . Equation (8) signifies an additive phase that is cumulative in time as denoted by . Due to its accumulative nature, CFO is regularly tracked by the receiver and compensated for. However, the residual leftover can be detrimental in precise ranging.
IiiB2 Timing Errors
These errors happen when receiver (transmitter) samples (synthesizes) signals at mismatching rates. There is also the significant issue of symbol boundary detection as discussed next:

SFO: In modern homodyne architectures, the same oscillator triggering the mixer drives the analogtodigital converter (ADC). If the ADC samples the received signal with rate different from transmitter’s synthesization rate , SFO is experienced. This is manifested as an additive phase shift proportional to the subcarrier index and cumulative in time [27, 24]. Mathematically,
(9) where is the SFO normalized with the sampling time and denotes the SFO calibration interval.

STO: STO is the most degrading effect arising due to the lack of knowledge about the beginning of the received OFDM symbol [24]. This uncertainty emerges as it is not apriori known when to expect a packet. Since OFDM systems function on blocks of (time domain) samples, named symbols, it is crucial that the right block is fed to the FFT demodulator. To find out about the symbol boundary, header starts with known, periodic sequences (named shorttraining fieldsSTF) and autocorrelator/crosscorrelator is utilized at the receiver to capture and detect the presence of WiFi signals. However, because of the length limitations of these sequences, error in determining symbol boundary cannot be fully eliminated leading to irreversible errors such as intercarrier interference (ICI), intersymbol interference (ISI), and phase rotation, as seen in Fig. 5.^{8}^{8}8ISI is experienced in case I of Fig. 5 because there is multipath leakage from th symbol into the FFT window of the th symbol. This is different from Case IV where not only leakage from the next symbol (i.e. j+2 which is not plotted) causes ISI, but there is ICI as well since the FFT window is missing the beginning of OFDM frame. To summarize, FFT window should neither advance too much into CP (to avoid ISI with the previous symbol) nor should it progress into main part of OFDM symbol (to avoid ICI and ISI with the next symbol). This phase rotation can be shown to impact CSI in the following manner:
(10) 
OFDM Preadvancement: Accounting for STO uncertainty, and to avoid irrevocable ICI/ISI, almost all NIC chipsets intentionally (upon estimating symbol boundary) borrow samples from current OFDM symbol’s CP. This operation, named preadvancement, guarantees that FFR input samples are ISI/ICI free, and only (clockwise) cyclically shifted (Case II in Fig. 5) which creates phase rotation after FFT given by:^{9}^{9}9preadvancement won’t impact decoding quality as both payload and channel estimation (HTLTF) symbols undergo the same shift, hence equalization removes it.
(11) Discussion: Positioning based on the unprocessed CSI will be severely impacted as will cause m ranging inaccuracy at best. This is evident from our experimental measurements in Fig. 2: Whereas in the chamber the transmitter and receiver were m apart, calling for a PDPs that climax at the very first sample (), the true peak actually happens at the third sample, an anomalous behaviour that is a testimony to the deliberate clockwise (left) cyclic shifting of OFDM symbol.
Accounting for nonidealities due to AGC, CFO, CPO, SFO, STO, and preadvancement, the CSI model is revised as follows
(12)  
where, according to Eq. (4), is given by
The additive term entails noise , ISI, and ICI. Despite its sophisticated look, the multiplicative error terms in (12) can be compactly represented by as initially claimed in (7).
Iv CSI Calibration
We have discussed so far that ranging based solely on CSI is a futile effort unless (i) the effect of deterministic SMM, CDD, and mixed windowing operations are cancelled out (ii) random phase errors due to the lack of synchronization are compensated for.
In the following, we investigate the statistical behaviour of the CSI random phase errors and introduce techniques to remove them. Our goal is to estimate synchronization errors in (12) in the aforementioned onerous problem where errors are changing from packet to packets, thus, rendering classic estimation (ML, MMSE, etc.) approaches that rely on availability of many samples unusable.
Iva Statistical Error Characterization
Due to the highly volatile nature of phase errors, differencing across time keeps the volatility while eliminating stagnant channel terms.^{10}^{10}10As a rough figure, the parameters of the indoor wireless channel change in the order of tens of ms. Doing so for consecutive CSI samples and performing phase unwrapping (w.r.t the subcarrier index ) yields^{11}^{11}11One has to be wary of the fact that we do not get to observe but its modulus.
(13)  
where is phase unwrapping w.r.t to and and are arbitrary time indices with the constraint that with being the coherence time of the channel. Also, is the modulo operation, which is denoted by , hereinafter. To gain insights into the statistical nature of , we use the measurements collected in an anechoic chamber. Fig. (b)b shows CSI phase difference vs. subcarrier index for two cases: (i) (ii) CSI measurements. Fig. (c)c displays the empirical PDF of , , for . The following conclusions are drawn:
is a zero mean random variable whose mean is shown by the red horizontal line. (c) experiment: histogram of
, corroborates the validity of Gaussian assumption.
Even for as low as , the randomness introduced by is so large that it drives the average phase difference (horizontal red line) to zero. This observation substantiates that both and are zero mean random processes.

The drastic changes of is because of two effects: (a) The high dynamicity of receiver’s synchronization algorithms (b) the operation which delivers not the true angle but the wrappedaround version of it.

The Gaussianity of , is proved as follows: Since is a Gaussian process (per our observation), is Gaussian random variable. Noting that , then , where
is the characteristic function of random variable
. Subsequently, the PDF of is attained using the Fourier transform, that is, which can be shown to be a Gaussian. This is shown in Fig. (c)c. 
Finally, the knowledge of implies , . This is true since the process has the same distribution for different . Yet, so long as the cyclicprefix (CP) preadvancement is performed at the receiver, deeming as a zeromean random variable [18] yields completely biased range estimates.
IvB Estimating STO and SFO
The unpredictability of phase errors in (12) stems from the following reasons:

Randomness in due to the opportunistic nature of WLAN access protocol.

Randomness in due to receiver’s ability to initiate calibration using any packet header on the air regardless of whether it was destined to it or not.

Errors in estimating the amount of drift which depends on how badly the calibrating header is influenced by small scale fading.

Errors in estimating the symbol boundary and which, again, depends on the fading nature of the channel.

OFDM preadvancement [20].
For these reasons, is decorrelated for different . Therefore, only CSI across frequency and space can be used to estimate . With this knowledge and given the linearity of the additive phase (in ) in (12), several previous works [2, 30, 31] adopted a simple CSI phase detrending to eliminate . This estimator can more generally be expressed as
(14) 
where is the th element of the CSI matrix, is the number of nonzero subcarriers and is the number of guard subcarriers at both ends of spectrum that are not used to modulate any symbol. This is an exact estimator, i.e. , only when (i) the channel does not change variably between two adjacent subcarriers, that is and (ii) .
None of these two conditions is satisfied in reality: As shown in Fig. (a)a, the true channel phase normally has a firstorder linearity, hence, (14) estimates plus the linear phase term in , which is denoted by hereinafter. In this situation, (14) becomes (often negatively) a biased estimator and compensating CSI using it (as in (16)) gravely impacts ranging accuracy possibly worse than keeping STO and ranging with the original CSI. The performance of (14) is studied for thousands of channel realizations and for two different STO+SFO drift. The bias of the estimator, caused by eliminating the firstorder channel linearity was observed.
IvB1 Alternative Estimators
In obtaining , the following estimator was proven more effective in reducing the estimation error in lieu of (14).
Spatial/spectral Averaging
Given that all transmit/receive subchannels experience the same hardware error, averaging can be performed in those dimensions as follows:
(15)  
Having obtained , compensation is performed with simple post multiplication with the CSI matrix as follows,
(16) 
IvB2 Recovering Channel Phase Linearity
The goal is to subtract the firstorder channel linearity that is removed (along with phase errors) in (14)(15). However, unless the true attenuations , path delays , and are precisely known in advance (which is actually the ultimate goal of positioning), no deterministic approach can find . Yet, with the knowledge that the channelrelated term remains constant over the course of several packets, and leveraging the randomness in , Algorithm 1 is used to remove the volatility contributed by SFO and find . This is corroborated when observing that is closely independent of and (which is expected as per (12)) whereas varies across antennas.
IvB3 STO Removal
The previous procedure designed to recover the channel linearity is incapable of eliminating the STO phase. This is because varies in much longer timescale, hence, is somewhat fused into the channel phase . STO manifests itself as jumps at the end of PDP due to cyclicshifting of CIR. This is because any phase shift due to STO in frequency domain () causes circular rotation by the same amount in time domain (). Since, in indoor environments, transmitterreceiver are only several meters away and that bandwidth is limited (20MHz in IEEE802.11n), the first expected peak of true channel CIR (due to LoS arrival) often happens at =0 or 1 which means that any causes that peak to appear at the end of the PDP (due to circular shift property).
This observation forms the basis to estimate through the following logic: The discrete CIR in (2) is a linear combination of shifted discrete Dirichlet functions. This is a periodic function with fundamental period that varies smoothly from one sample to the next. Therefore, jumps that are observed at the farend of the PDP due to STO, can be detected and compensated for using Algorithm 2.
IvC Removing CFO and CPO
Removing the linear phase terms produced by STO/SFO leaves CFO/CPO errors in (12) intact. As explained earlier, and similar to SFO, CFO is an accumulative error that has to be tracked by the receiver and compensated for. However, this compensation is crude and leaves behind some residual phase on CSI. Estimating the latter is not an easy task. That is because:

Similar to , not much is known about the calibration intervals