Automatic BTS localization for 2G and 3G mobile radio networks

Mobile telecommunications plays a vital role in today's modern society, which relies on a functioning communications infrastructure to ensure economic growth and stability. Mobile network operators constantly face the challenge of adapting their networks to the customer's behavior. This means network operators must have information about their own and their competitors' BTS locations in order to reduce operations costs through joint location usage.

Government regulators monitor license adherence as well as the expansion of GSM and UMTS networks. As a result, the authorities must deal with the issue of how to technically implement passive BTS localization at all relevant frequencies without using SIM cards and mobile phones and independent of the network operator.

Internal and external security organizations and military units are also searching for passive BTS localization methods, both nationally and foreign-based, to help them confront potential terror threats such as improvised explosive devices (IED). These organizations require realtime BTS localization in order to respond rapidly to such threats, particulary to out-of-area scenarios.

Although the receiver's position can be identified using GPS, for BTS localization the distance between the BTS and the receiver is acquired by determining the signal delay. Typical GSM and UMTS signal components from the frame structure are decoded and used to determine when the signals were output by the BTS. Multiple measurement values recorded at various positions allow the BTS to be localized using approximation methods.

Compact R&S®TSMx scanners are used as receivers. One or up to four parallel applications can be run depending on the type of scanner. The R&S®TSMx scanners, in conjunction with the R&S®TSMX-PPS GPS module, are capable of precisely pinpointing the receiver position. The GPS module simultaneously serves as a high-precision time reference for determining the signal delay by means of a PPS output.

The necessary radio-standards-based demodulation and decoding of the signal components, as well as the position determination, are carried out in realtime by R&S®ROMES software installed on the notebook. The components theoretically allow localization for all digital standards with time-based frame structures.

In addition to the currently available GSM and UMTS solutions, CDMA2000® and 1xEV-DO will be offered in the future as well. The BTS localization system has the flexibility to support future standards since most of the elements are software-defined.

Application

The BTS localization system from Rohde & Schwarz operates in stationary mode, in mobile environments such as vehicles and trucks or it can be carried in a backpack. After connecting the three components – R&S®TSMx scanner, R&S®TSMx-PPS GPS module and notebook – the R&S®ROMES software is started with the BTS estimator option. A mobile phone is not required. The system is ready for a test drive upon completion of the GPS synchronization.

Depending on the technology selected, i.e. GSM or UMTS, a list of detected base stations is presented in the respective windows. If the approximation algorithm acquires sufficient usable data, the calculated geographic BTS data is immediately entered in the fields displayed by the R&S®ROMES application.

In addition, the scanner's current position can be displayed on an imported map. Driving in a circle and making sure that each circle is crossed one time yields the best results. Another useful tool is the additional window that displays the current vehicle speed by means of a color scale, ensuring the vehicle is driven at an optimal speed.

The base station list created by the R&S®ROMES software during the test drive can be exported after the measurements are taken and the located BTS positions and associated GSM and UMTS cell parameters plotted on the map.

The entire Rohde & Schwarz system is in passive mode during the test drive, meaning there is no uplink activity to the mobile network.