This paper is included in the Proceedings of the
13th USENIX Symposium on Networked Systems
Design and Implementation (NSDI ’16).
March 16–18, 2016 • Santa Clara, CA, USA
ISBN 978 -1-931971-29 - 4
Open access to the Proceedings of the
13th USENIX Symposium on
Networked Systems Design and
Implementation (NSDI ’16)
is sponsored by USENIX.
Decimeter-Level Localization with a
Single WiFi Access Point
Deepak Vasisht, MIT CSAIL; Swarun Kumar, Carnegie Mellon University;
Dina Katabi, MIT CSAIL
https://www.usenix.org/conference/nsdi16/technical-sessions/presentation/vasisht
USENIX Association 13th USENIX Symposium on Networked Systems Design and Implementation (NSDI ’16) 165
Decimeter-Level Localization with a Single WiFi Access Point
Deepak Vasisht
†
, Swarun Kumar
‡
, Dina Katabi
†
†
MIT CSAIL,
‡
CMU
deepakv@mit.edu, swarun@cmu.edu, dk@mit.edu
Abstract – We present Chronos, a system that enables
a single WiFi access point to localize clients to within tens
of centimeters. Such a system can bring indoor position-
ing to homes and small businesses which typically have a
single access point.
The key enabler underlying Chronos is a novel algo-
rithm that can compute sub-nanosecond time-of-flight us-
ing commodity WiFi cards. By multiplying the time-of-
flight with the speed of light, a MIMO access point com-
putes the distance between each of its antennas and the
client, hence localizing it. Our implementation on com-
modity WiFi cards demonstrates that Chronos’s accu-
racy is comparable to state-of-the-art localization systems,
which use four or five access points.
1. INTRODUCTION
Recent years have seen significant advances in indoor
positioning using wireless signals [48, 28]. State-of-the-
art systems have achieved an accuracy of tens of centime-
ters, even using commodity WiFi chipsets [30, 32, 18]. Ex-
isting proposals however target enterprise networks, where
multiple WiFi access points can combine their informa-
tion and cooperate together to locate a user. However, the
vast majority of homes and small businesses today have
a single WiFi access point. Consequently, this large con-
stituency of wireless networks has been left out of the ben-
efits of accurate indoor positioning.
Developing a technology that can locate users and ob-
jects using a single WiFi access point would enable a range
of important applications:
(i) Smart Home Occupancy: In particular, indoor posi-
tioning can play a crucial role in the smart home vi-
sion, where WiFi enabled home automation systems
like NEST are gaining increasing popularity [37]. Accu-
rate localization addresses a long-standing problem in
home automation: reliable occupancy detection [36, 6].
With WiFi-based localization, one can track the num-
ber of users per room using their phones or wearables,
and accordingly adapt heating and lighting. Knowing
the identity of these occupants can then help personalize
heating and lighting levels based on user preferences.
(ii) WiFi Geo-fencing: Beyond the home, indoor position-
ing can benefit small businesses that use a single access
point to offer free WiFi to attract customers. But with
increasingly congested networks, business owners seek
to restrict WiFi connectivity to their own customers,
given that 32% of users in the US admit to have ac-
cessed open WiFi networks outside the premises they
serve [47]. Yet securing these networks with passwords
is inconvenient, both to customers that connect to these
networks and the business owners who must frequently
change the passwords. Indoor positioning with a sin-
gle access point provides a natural solution to this prob-
lem because it can automatically authenticate customers
based on their location.
(iii) Device-to-device Location: More generally, enabling
two WiFi nodes to localize each other without addi-
tional infrastructure support has implications in areas
where WiFi networks may not exist altogether. Imagine
traveling with friends or family in countries where WiFi
is not as prevalent as in the US, yet still be able to find
each other in a mall, museum, or train station, without
the need to connect to a WiFi infrastructure.
Our goal is to design a system that enables a single
WiFi node (e.g., an access point) to localize another, with-
out support from additional infrastructure. Further, we
would like a design that works on commodity WiFi NICs
and does not require any additional sensors (cameras, ac-
celerometers, etc.).
As we design for the above goal, it helps to first ex-
amine why past systems need multiple access points. The
most direct approach to RF-based positioning estimates
the time-of-flight (i.e., propagation time) and multiplies it
by the speed of light to obtain the distance [23, 16]. How-
ever, past proposals for WiFi-based positioning cannot
measure the absolute time-of-flight. They measure only
differences in the time-of-flight across the receiver’s anten-
nas. Such time differences allow those systems to infer the
direction of the source with respect to the receiver, known
as the angle of arrival (AoA) [48]. But they don’t provide
the distance between the source and the receiver. Thus,
past work has to intersect the direction of the source from
multiple access points to localize it. In fact, past propos-
als typically use four or five access points to achieve tens
of centimeters accuracy [30, 32, 48, 50]. Even the few re-
cent proposals to localize using one WiFi access point [35,
53] require users to walk to multiple locations to emulate
the presence of multiple access points. They then intersect
signal measurements across these locations coupled with
accelerometer readings to infer the user’s trajectory.
There are however non-WiFi systems that can accu-
rately measure the absolute time-of-flight, and hence lo-
calize using a single receiver. Such systems use special-
166 13th USENIX Symposium on Networked Systems Design and Implementation (NSDI ’16) USENIX Association
ized ultra wideband radios that span multiple GHz [5,
41]. Since time resolution is inversely related to the ra-
dio bandwidth, such devices can measure time-of-flight at
sub-nanosecond accuracy, and hence localize an object to
within tens of centimeters. In contrast, directly measuring
time with a 20MHz or 40MHz WiFi radio results in errors
of 7 to 15 meters [30].
Motivated by the above analysis, we investigated
whether a WiFi radio can emulate a wideband multi-GHz
radio, for the purpose of localization. Our investigation
led to Chronos, an indoor positioning system that enables
a pair of WiFi devices to localize each other. It runs on
commodity WiFi cards, and does not require any external
sensor (e.g., accelerometer, or camera). Chronos works by
making a WiFi card emulate a very wideband radio. In
particular, while each WiFi frequency band is only tens of
Megahertz wide, there are many such bands that together
span a very wide bandwidth. Chronos therefore transmits
packets on multiple WiFi bands and stitches their informa-
tion together to give the illusion of a wideband radio.
Yet, emulating a wideband radio using packets trans-
mitted on different frequency bands is not easy. Stitch-
ing measurements across such packets requires Chronos
to overcome three challenges:
Resolving Phase Offsets: First, to emulate a wideband
radio, Chronos needs to stitch channel state information
(CSI) captured by multiple packets, transmitted in dif-
ferent WiFi frequency bands, at different points in time.
However, the very act of hopping between WiFi frequency
bands introduces a random initial phase offset as the hard-
ware resets to each new frequency (i.e., PLL locking).
Chronos must therefore recover time-of-flight to perform
positioning despite these random phase offsets.
Eliminating Packet Detection Delay: Second, any mea-
surement of time-of-flight of a packet necessarily includes
the delay in detecting its presence. Different packets how-
ever experience different random detection delays. To
make matters worse, this packet detection delay is typi-
cally orders-of-magnitude higher than time-of-flight. For
indoor WiFi environments, time-of-flight is just a few
nanoseconds, while packet detection delay spans hundreds
of nanoseconds [38]. Chronos must tease apart the time-
of-flight from this detection delay.
Combating Multipath: Finally, in indoor environments,
signals do not experience a single time-of-flight, but a
time-of-flight spread. This is because RF signals in indoor
environments bounce off walls and furniture, and reach
the receiver along multiple paths. As a result, the receiver
obtains several copies of the signal, each having experi-
enced a different time-of-flight. To perform accurate lo-
calization, Chronos therefore must disentangle the time-
of-flight of the direct path from all the remaining paths.
The body of this paper explains how Chronos over-
comes these challenges, computes the absolute time-of-
flight, and enables localization using a single access point.
Summary of Results: We have implemented Chronos
and evaluated its performance on devices equipped with
Intel 5300 WiFi cards. Our results reveal the following:
• Chronos computes the time-of-flight with a median er-
ror of 0.47 ns in line-of-sight and 0.69 ns in non-line-
of-sight settings. This corresponds to a median distance
error of 14.1 cm and 20.7 cm respectively.
• Chronos enables a WiFi device (e.g., an AP) to localize
another with a median error of 65 cm in line-of-sight
and 98 cm in non-line-of-sight settings.
To demonstrate Chronos’s capabilities, we use it for three
applications:
• Smart Home Occupancy: Chronos can be used to track
the number of occupants in different rooms of a home
using a single access point–akeyprimitive for smart
homes that adapt heating and lighting. Experiments
conducted in a 2-bedroom apartment with 4 occupants
show that Chronos maps residents in a home to the cor-
rect room they are in with an accuracy of 94.3%.
• WiFi Geo-fencing: Chronos can be used by small busi-
nesses with a single access point to restrict WiFi con-
nectivity to customers within their facility. Experiments
in a coffee house reveal that Chronos achieves this to an
accuracy of 97%.
• Personal Drone: Chronos’s ability to locate a pair of
user devices can directly benefit the navigation systems
of personal robots such as recreational drones. Chronos
enables personal drones that can maintain a safe dis-
tance from their user by tracking their owner’s handheld
device. Our experiments using an AscTec Quadrotor re-
veal that it maintains the required distance relative to a
user’s device with a root mean-squared error of 4.2 cm.
Contributions: To our knowledge, Chronos is the first
system that enables a node with a commercial WiFi card to
locate another at tens of centimeters accuracy without any
third party support, be it other WiFi nodes or external sen-
sors (e.g., accelerometers). Chronos also contributes the
first algorithm for measuring the absolute time-of-flight on
commercial WiFi cards at sub-nanosecond accuracy.
2. OVERVIEW
We briefly outline the organization of the rest of this
paper. Chronos localizes a pair of WiFi devices without
third party support by computing time of flight of sig-
nals between them. Sec. §3 describes our approach to
compute time-of-flight by stitching together information
across multiple WiFi frequency bands. It is followed by a
description of the challenges faced by Chronos and how it
addresses them. Specifically:
• Eliminating Packet Detection Delay: First, Chronos
disentangles the time-of-flight from packet detection
USENIX Association 13th USENIX Symposium on Networked Systems Design and Implementation (NSDI ’16) 167
Figure 1: WiFi Bands: Depicts WiFi bands at 2.4 GHz and
5 GHz. Note that some of these frequencies (e.g. 5.5-5.7 GHz)
are DFS bands in the U.S. that many 802.11h compatible
802.11n radios like Intel 5300 support.
delay, since the latter has no connection to the distance
between transmitter and receiver (See Sec. §4).
• Combating Multipath: Second, Chronos separates the
time-of-flight of the direct path of the wireless signal
from that of all the remaining paths (See Sec. §5).
• Resolving Phase Offsets: Finally, Chronos removes
arbitrary phase offsets that are introduced as the WiFi
receiver hops between frequency bands (See Sec. §6).
3. MEASURING TIME OF FLIGHT
In this section, we describe how Chronos measures ac-
curate time-of-flight of signals between a pair of WiFi
devices without third party support. For clarity, the rest
of this section assumes signals propagate from the trans-
mitter to a receiver along a single path with no detection
delay or phase offsets. We address challenges stemming
from packet detection delay, multipath and phase offsets
in §4, §5 and §6 respectively.
Chronos’s approach is based on the following observa-
tion: Conceptually, if our receiver had a very wide band-
width, it could readily measure time-of-flight from a single
receiving device at a fine-grained resolution (since time
and bandwidth are inversely related). Unfortunately, to-
day’s WiFi devices do not have such wide bandwidth. But
there is another opportunity: WiFi devices are known to
span multiple frequency bands scattered around 2.4 GHz
and 5 GHz. Combined, these bands span almost one GHz
of bandwidth. By making a transmitter and receiver hop
between these different frequency bands, we can gather
many different measurements of the wireless channel. We
can then “stitch together” these measurements to compute
the time-of-flight, as if we had a very wideband radio.
However, our method for stitching time measurements
across WiFi frequency bands must account for the fact that
many WiFi bands are non-contiguous, unequally spaced,
and even multiple GHz apart (Fig. 1). Chronos overcomes
these issues by exploiting the relation between the time-of-
flight and the phase of wireless channels. Specifically, we
know from basic electromagnetics that as a signal prop-
agates in time, it accumulates a corresponding phase de-
pending on its frequency. The higher the frequency of the
signal, the faster the phase accumulates. To illustrate, let
us consider a transmitter sending a signal to its receiver.
Then we can write the wireless channel h as [42]:
h = ae
−j2πf τ
, (1)
where a is the signal magnitude, f is the frequency and τ
is the time-of-flight. The phase of this channel depends on
time-of-flight as:
∠h = −2πf τ mod 2π (2)
Notice that the above equation depends directly on the sig-
nal’s time-of-flight and hence, we can use it to measure the
time-of-flight τ as:
τ = −
∠h
2πf
mod
1
f
(3)
The above equation gives us the time-of-flight modulo
1/f . Hence, for a WiFi frequency of 2.4 GHz, we can only
obtain the time-of-flight modulo 0.4 nanoseconds. Said
differently, transmitters with times-of-flight 0.1 ns, 0.5 ns,
0.9 ns, 1.3 ns, etc. all produce identical phase in the wire-
less channel. In terms of physical distances, this means
transmitters at distances separated by multiples of 12 cm
(e.g., 3 cm, 15 cm, 27 cm, 39 cm, etc.) all result in the
same channel phase. Consequently, there is no way to dis-
tinguish between these transmitters using their phase on a
single frequency band.
Indeed, this is precisely why Chronos needs to hop be-
tween multiple frequency bands {f
1
, ..., f
n
} and measure
the corresponding wireless channels {h
1
, ..., h
n
}. The re-
sult is a system of equations, one per frequency, that mea-
sure the time-of-flight modulo different values:
∀i ∈{1, 2, ..., n} τ = −
∠h
i
2πf
i
mod
1
f
i
(4)
Notice that the above set of equations has the form of
the well-known Chinese remainder theorem [45]. Such
equations can be readily solved using standard modular
arithmetic algorithms, even amidst noise [14] and have
been used in prior work, in the context of range estima-
tion ([44, 43]).
1
The theorem states that solutions to these
equations are unique modulo a much larger quantity – the
Least Common Multiple (LCM) of {1/f
1
, ...,1/f
n
}.
To illustrate how the above system of equations works,
consider a source at 0.6 m whose time-of-flight is 2 ns.
Say the receiver measures the channel phases from this
source on five candidate WiFi frequency bands as shown
in Fig. 2. We note that a measurement on each of these
channels produces a unique equation for τ, like in Eqn. 4.
Each equation has multiple solutions, depicted as colored
vertical lines in Fig. 2. However, only the correct solution
of τ will satisfy all equations. Hence, by picking the so-
lution satisfying the most number of equations (i.e., the τ
with most number of aligned lines in Fig. 2), we can re-
cover the true time-of-flight of 2 ns.
Note that our solution based on the Chinese remain-
der theorem makes no assumptions on whether the set
1
Algorithm 1 in §5 provides a more general version of Chronos’s
algorithm to do this while accounting for noise and multipath
168 13th USENIX Symposium on Networked Systems Design and Implementation (NSDI ’16) USENIX Association
τ
Figure 2: Measuring Time-of-Flight: Consider a wireless
transmitter at a distance of 0.6 m, i.e. a time-of-flight of 2 ns.
The phase of each WiFi channel results in multiple solutions,
depicted as colored lines, including 2 ns. However, the solution
that satisfies most equations, i.e. has the most number of aligned
colored lines is the true time-of-flight (2 ns).
of frequencies {f
1
, ..., f
n
} are equally separated or oth-
erwise. In fact, having unequally separated frequencies
makes them less likely to share common factors, boost-
ing the LCM. Thus, counter-intuitively, the scattered and
unequally-separated bands of WiFi (Fig. 1) are not a chal-
lenge, but an opportunity to resolve larger values of τ .
While the above provides a mathematical formulation
of our algorithm, we describe below important systems
considerations when dealing with commercial WiFi cards:
• Chronos must ensure both the WiFi transmitter and re-
ceiver hop synchronously between multiple WiFi fre-
quency bands. Chronos achieves this using a frequency
band hopping protocol driven by the transmitter. Be-
fore switching frequency bands (every 2-3 ms in our
implementation), the transmitter issues a control packet
that advertises the frequency of the next band to hop
to. The receiver responds with an acknowledgment and
switches to the advertised frequency. Once the acknowl-
edgment is received, the transmitter switches frequency
bands as well. As a fail-safe, transmitters and receivers
revert to a default frequency band if they do not re-
ceive packets or acknowledgments from each other for
a given time-out duration on any band.
• Our implementation of Chronos sweeps all WiFi bands
in 84 ms (12 times per second). This is within the chan-
nel coherence time of indoor environments [39] and can
empirically localize users at walking speeds ( §10.3).
• Finally, we discuss and evaluate the implications of
Chronos’s protocol on data traffic in §9.3.
4. ELIMINATING PACKET DETECTION DELAY
So far, we computed time-of-flight based on the chan-
nels h
i
, that signals experience when transmitted over the
air on different frequencies f
i
. In practice however, there
is a difference between the channel over the air, h
i
, and
the channel as measured by the receiver,
˜
h
i
. Specifically,
the measured channel at the receiver,
˜
h
i
, experiences a de-
lay in addition to time-of-flight: the delay in detecting the
presence of a packet. This delay occurs because WiFi re-
ceivers detect the presence of a packet based on the energy
of its first few time samples. The number of samples that
the receiver needs to cross its energy detection threshold
varies based on the power of the received signal, as well
as noise. While this variation may seem small, packet de-
tection delays are often an order-of-magnitude larger than
time-of-flight, particularly in indoor environments, where
time-of-flight is just a few tens of nanoseconds (See §9.1).
Hence, accounting for packet detection delay is crucial for
accurate time-of-flight and distance measurements.
Thus, our goal is to derive the true channel h
i
(which
incorporates the time-of-flight alone) from the measured
channel
˜
h
i
(which incorporates both time-of-flight and
packet detection delay). To do this, we exploit the fact that
WiFi uses OFDM. Specifically, the bits of WiFi packets
are transmitted in the frequency domain on several small
frequency bins called OFDM subcarriers. This means that
the wireless channels
˜
h
i
can be measured on each subcar-
rier. We then make the following claim:
C
LAIM 4.1. The measured channel at subcarrier-0
does not experience packet detection delay, i.e., it is iden-
tical in phase to the true channel at subcarrier 0.
To see why this claim holds, note that while time-of-
flight and packet detection delay appear very similar, they
occur at different stages of a signal’s lifetime. Specifically,
time-of-flight occurs while the signal is transmitted over
the air (i.e., in passband). In contrast, packet detection de-
lay stems from energy detection that occurs in digital pro-
cessing once the carrier frequency has been removed (in
baseband). Thus, time-of-flight and packet detection delay
affect the wireless OFDM channels in different ways.
To understand this difference, consider the WiFi fre-
quency band, i. Let
˜
h
i,k
be the measured channel of OFDM
subcarrier k, at frequency f
i,k
.
˜
h
i,k
experiences two phase
rotations in different stages of the signal’s lifetime:
• A phase rotation in the air proportional to the over-the-
air frequency f
i,k
. From Eqn. 2 in §3, this phase value
for a frequency f
i,k
is:
∠h
i,k
= −2πf
i,k
τ mod 2π,
where τ is the time-of-flight.
• An additional phase rotation due to packet detection af-
ter the removal of the carrier frequency. This additional
phase rotation can be expressed as:
∆
i,k
= −2π(f
i,k
− f
i,0
)δ
i
,
where δ
i
is the packet detection delay.
Thus, the total measured channel phase at subcarrier k is:
∠
˜
h
i,k
=(∠h
i,k
+∆
i,k
) mod 2π (5)
=(−2πf
i,k
τ − 2π(f
i,k
− f
i,0
)δ
i
) mod 2π (6)
Notice from the above equation that the second term
∆
i,k
=
−
2π(f
i,k
−
f
i,0
)δ
i
= 0 at k = 0. In other words, at